ABYSS engine: where checks can disagree

pub fn checked_guest_range(ptr: u16, len: usize) -> Option<GuestRange> {
    let start = usize::from(ptr);
    let end = start.checked_add(len)?;
    (end <= GUEST_ADDRESS_SPACE).then_some(GuestRange { range: start..end })
}

fn checked_guest_range(address, length) {
    if (the requested bytes leave VM memory) {
        reject the request
    }
    return the safe range
}

impl OwnedInvocation {
    pub fn copy_from_guest(guest: &[u8], request_pointer: u16) -> Result<Self, StructuralError> {
        let frame = copy_guest_frame(guest, request_pointer)?;
        let decoded = BraidFrame::decode(&frame)?;
        let descriptor = decoded.input_descriptor();
        let range = descriptor
            .checked_range()
            .ok_or(StructuralError::InputRange)?;
        let source = guest
            .get(range.as_range())
            .ok_or(StructuralError::InputRange)?;

        let output = decoded
            .output_descriptor()
            .checked_range()
            .ok_or(StructuralError::OutputRange)?;
        if guest.get(output.as_range()).is_none() {
            return Err(StructuralError::OutputRange);
        }

        let mut input = [0u8; INPUT_MAX];
        input[..source.len()].copy_from_slice(source);
        Ok(Self {
            frame,
            input,
            input_len: descriptor.length,
        })
    }

impl OwnedInvocation {
    pub fn copy_from_guest(guest, request_pointer) {
        let frame = copy the request frame from guest memory
        let decoded = read the frame's fields
        let source = the checked input range; reject if outside guest memory
        let output = the checked output range
        if (output is outside the supplied guest memory) { reject }
        let input = a host-owned copy of source
        return OwnedInvocation { frame, input, input_len }
    }

pub(super) const BODY_LEN: usize = 64;
pub(super) const TILE_COUNT: usize = 4;
pub(super) const RECORDS_PER_TILE: usize = 4;

Entry body layout {
    64 bytes total
    four tiles
    four rows and four columns per tile
}

        let tile = self.record / RECORDS_PER_TILE;
        let row = self.record % RECORDS_PER_TILE;
        let base = tile * 16 + row * 4;
        self.record += 1;
        Some((
            tile,
            row,
            [
                self.body[base],
                self.body[base + 1],
                self.body[base + 2],
                self.body[base + 3],
            ],

        for (each tile and row) {
            read four neighboring bytes across the row
            yield a row event for the Entry checker
        }

        let tile = self.record / RECORDS_PER_TILE;
        let column = self.record % RECORDS_PER_TILE;
        let tile_base = tile * 16;
        self.record += 1;
        Some((
            tile,
            column,
            [
                self.body[tile_base + column],
                self.body[tile_base + 4 + column],
                self.body[tile_base + 8 + column],
                self.body[tile_base + 12 + column],
            ],

        for (each tile and column) {
            read four bytes down the column
            yield a separate column event
        }

    for (event_index, (tile, row, bytes)) in RowCursor::new(body).enumerate() {
        let parity = bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3] == (q[tile] as u8 & 0x0f);
        let row_ok = match bytes[0] >> 4 {
            0x1 => (bytes[1] <= 31) & (bytes[2] <= 31),
            0x2 => (bytes[1] <= bytes[2]) & (bytes[2] <= 31),
            _ => false,
        };

    for (each row of the 64-byte Entry body) {
        XOR its four bytes and compare the expected check value
        inspect the high half of its first byte
        require the matching row shape and number limits

    for (pc, (tile, column, bytes)) in ColumnCursor::new(body).enumerate() {
        let parity = bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3] == (q[tile] as u8 & 0x0f);
        let low_op = bytes[0] & 0x0f;
        let operation = RestrictedOp::from_low_nibble(low_op);
        let operation_valid = operation != RestrictedOp::Invalid;
        parity_valid &= parity;
        skeleton_valid &= operation_valid & (low_op == OP_SKELETON[pc]);
        for lineage in Lineage::ALL {
            signature_matches[lineage.index()] &=
                operands_match(pc, bytes[1] & 0x0f, bytes[2] & 0x0f, lineage);

    for (each column of the same body) {
        XOR its four bytes and compare the expected check value
        require its first byte to name the operation for this position
        for (each power track) {
            check the next two bytes against that track's pattern

    let conditioner_valid = bank_valid & unique_lineage & (q[4] == selected_seal);
    let valid = rows.parity_valid
        & rows.grammar_valid
        & columns.parity_valid
        & columns.skeleton_valid
        & unique_lineage
        & expected_lineage_valid
        & conditioner_valid;

    let conditioner_valid = bank, unique-lineage, and seal checks all pass
    let valid = every row check
        and every column check
        and the shared lineage and conditioner checks

            let mutant = evaluate_braid(&mutant_body, bank, lineage_u8);
            assert!(mutant.rows.grammar_valid);
            assert!(mutant.rows.parity_valid);
            assert!(mutant.rows.events.iter().all(|event| event.row_valid));
            assert!(mutant.rows.events.iter().all(|event| event.parity_valid));
            assert!(mutant.columns.parity_valid);
            assert!(mutant.columns.events.iter().all(|event| event.parity_valid));

            test the altered Entry body {
                row shapes still pass
                every row's XOR check still passes
                column XOR checks still pass
            }

            assert!(!mutant.columns.skeleton_valid);
            assert_eq!(mutant.columns.lineage_match_count, 0);
            assert!(mutant.derived_lineage().is_none());
            assert!(!mutant.expected_lineage_valid);
            assert!(!mutant.conditioner_valid);
            assert!(!mutant.semantic_valid());

            test the same altered Entry body {
                its column operation pattern fails
                no power track matches
                the full Entry decision fails
            }

def canonical_cell_domain(
    row: int,
    column: int,
    pc: int,
    lineage: int,
) -> list[int]:
    operands = expected_operands(lineage)
    if row == 0:
        low_values = [OPCODES[pc]]
    elif pc in operands:
        low_values = [operands[pc][row - 1]]
    else:
        low_values = list(range(16))

    high_values = (1, 2) if column == 0 else (0, 1)
    return [
        (high << 4) | low
        for high in high_values
        for low in low_values
    ]

def canonical_cell_domain(row, column, pc, lineage):
    operands = required operand digits for this track
    if row == 0:
        low_values = the required operation digit at pc
    elif pc has a required operand pair:
        low_values = the required digit for this row
    else:
        low_values = any digit from 0 through 15
    high_values = 1 or 2 in column zero; otherwise 0 or 1
    return every allowed high-and-low-digit byte

        for row in range(3):
            tile[row][3] = (
                parity
                ^ tile[row][0]
                ^ tile[row][1]
                ^ tile[row][2]
            )
        for column in range(3):
            tile[3][column] = (
                parity
                ^ tile[0][column]
                ^ tile[1][column]
                ^ tile[2][column]
            )
        tile[3][3] = (
            parity
            ^ tile[3][0]
            ^ tile[3][1]
            ^ tile[3][2]
        )

        for row in the first three rows:
            calculate its rightmost byte so the row XOR hits the target
        for column in the first three columns:
            calculate its bottom byte so the column XOR hits the target
        calculate the corner so the bottom row XOR hits the target

        if (
            tile_is_valid(tile, parity, tile_index, lineage)
            and (
                next_parity is None
                or (
                    conditioner_native(q_in, tile, tile_index)
                    & 0x0F
                )
                == next_parity
            )
        ):
            if found == solution_index:
                return tile
            found += 1

        if (the tile passes its local rules
            and the next tile will get the right XOR target):
            if (this is the requested valid candidate):
                return tile
            count this valid candidate

def construct_body(bank: int, lineage: int) -> bytes:
    q = 0
    tiles: list[list[list[int]]] = []
    for tile_index in range(4):
        assert q & 0x0F == REQUIRED_PARITIES[tile_index]
        solution_index = bank if tile_index == 0 else 0
        tile = construct_tile(
            q,
            tile_index,
            lineage,
            solution_index,
            (
                REQUIRED_PARITIES[tile_index + 1]
                if tile_index + 1 < len(REQUIRED_PARITIES)
                else None
            ),
        )
        tiles.append(tile)
        q = conditioner_native(q, tile, tile_index)
    return bytes(
        cell
        for tile in tiles
        for row in tile
        for cell in row

def construct_body(bank, lineage):
    q = 0
    tiles = []
    for tile_index in range(4):
        check q's low digit is this tile's required target
        select the bank-numbered valid tile first; later select the first
        tile = construct_tile(q, tile_index, lineage, selected choice, next target)
        add tile to the body
        q = conditioner_native(q, tile, tile_index)
    return the four tiles as 64 bytes

#[derive(Clone, Copy, PartialEq, Eq)]
struct Fibre {
    state: FibreState,
    semantic_steps_total: u16,
    entry_owner: Option<EntryFibreOwner>,
    entry_first: Option<EntryFirstCall>,
}

#[derive(Clone, Copy, PartialEq, Eq)]
struct EntryFibreOwner {
    reserved_slot: u8,
    reserved_generation: u32,
    expected_lineage: u8,
    bank: u8,
    nonce: u32,
    body_digest: [u8; 32],
}

impl Fibre {
    const fn idle() -> Self {
        Self {
            state: FibreState::Idle,
            semantic_steps_total: 0,
            entry_owner: None,
            entry_first: None,
        }
    }

struct Fibre {
    state = idle or waiting for Entry completion
    semantic_steps_total = steps already used
    entry_owner = saved reservation and owner details
    entry_first = the saved first-call details
}
struct EntryFibreOwner {
    reserved slot, generation, power track, bank, nonce, body fingerprint
}
impl Fibre {
    fn idle() {
        start idle with zero steps and no owner or first-call details
    }

pub(super) const ROOT_BYTES: usize = 12;
pub(super) const OBSERVATION_COUNT: usize = 32;
pub(super) const COST_CLASS_COUNT: u8 = 8;
pub(super) const COST_BASE: u16 = 72;
pub(super) const COST_STRIDE: u16 = 24;
pub(super) const MAX_OBSERVATION_COST: u16 =
    COST_BASE + COST_STRIDE * (COST_CLASS_COUNT as u16 - 1);

SYNC clue format {
    hidden owner number = 12 bytes
    32 observations, each in one of eight classes
    class 0 costs 72 steps
    each higher class costs 24 more steps
}

pub(super) const fn cost_for_class(class: u8) -> u16 {
    COST_BASE + COST_STRIDE * ((class & MASK) as u16)
}

pub(super) const fn class_for_cost(cost: u16) -> Option<u8> {
    if cost < COST_BASE || cost > MAX_OBSERVATION_COST {
        return None;
    }
    let delta = cost - COST_BASE;
    if delta % COST_STRIDE != 0 {
        return None;
    }
    Some((delta / COST_STRIDE) as u8)

fn cost_for_class(class) {
    turn a three-bit class into one of the eight allowed work costs
}
fn class_for_cost(cost) {
    if (cost is outside the allowed range) { return no class }
    if (cost is not on an allowed step) { return no class }
    return the corresponding three-bit class

                    let packed = host.gatecall(req_ptr, budget, &mut self.mem);
                    let status = packed & GATE_STATUS_MASK;
                    let steps = (packed >> GATE_STEPS_SHIFT).min(GATE_STEPS_MAX);
                    self.push_tagged(status, true);
                    executed = executed
                        .saturating_add(GATECALL_BUDGET_COST)
                        .saturating_add(steps);

                    let packed = host's status and work count for this request;
                    let status = keep the guest-visible low bits;
                    let steps = cap the work count in the high bits;
                    self.push_tagged(status, true);
                    executed = executed
                        + the fixed GATECALL cost
                        + steps;

    fn synchronize_session(&self, session: &mut Session) -> u16 {
        let ordinal = usize::from(session.synchronization_ordinal.min(31));
        let cost = self.observation_costs[ordinal];
        let eligible = !session.comparison_attempted
            && session.synchronization_ordinal < OBSERVATION_COUNT as u8
            && (!session.has_synchronization_tick
                || session.last_synchronization_tick != self.current_tick);
        if eligible {
            let destination = usize::from(session.synchronization_ordinal);
            session.synchronization_classes[destination] = self.observation_classes[destination];
            session.synchronization_ordinal += 1;
            session.last_synchronization_tick = self.current_tick;
            session.has_synchronization_tick = true;
        } else {
            session.synchronization_invalid = true;
        }
        cost
    }

    fn synchronize_session(session) {
        let cost = today's cost for the next clue number
        if (no comparison yet, fewer than 32 clues, and no clue this tick) {
            save this clue's class; advance to the next
            remember this game tick
        } else { mark the whole clue history invalid }
        return the cost
    }

    ingress_evidence: bool,
    entry_node: Option<NodeId>,
    synchronization_ordinal: u8,
    synchronization_classes: [u8; OBSERVATION_COUNT],
    last_synchronization_tick: u32,
    has_synchronization_tick: bool,
    synchronization_invalid: bool,
    comparison_attempted: bool,
    calibrated_node: Option<NodeId>,
    preflight_scratch: [u8; 32],

    each calibration session remembers {
        which of 32 clues comes next and those already collected
        the last SYNC tick and whether it has failed
        whether a one-shot root comparison was attempted
        any proof node earned from that comparison
    }

    short_gate = bytearray(first)
    short_gate[12] = 0x21
    runtime = bytes(short_gate) + TIMED_ROUTINE
    if GATE_ONCE + len(runtime) > RUNTIME_PATCH_END:
        raise AssertionError("runtime Gate routines exceed main's 63-slot frame")

    short_gate = copy the first stock donor's bytes
    short_gate[12] = ABYSS GATECALL opcode
    runtime = the edited caller followed by the timed routine
    if the replacement would overrun main's local frame:
        stop building the bot

  fresh_tick();
  tick = game_tick();

  while (k < 32) {
    w2 = outer;
    c1 = cmdseq;
    if (k == 0) { pad_first(); } else { pad_next(); }
    e = gate_timed();
    outer = outer + 1;
    cmdseq = cmdseq + 1;

    e = (e + (0 * (k == 0))) & 7;
    d = (5 * (e + 5)) & 7;
    acc = (d - 3*prev - k) & 7;
    i = (5*k) & 31;
    w6 = replace_digit(w6, i, acc, 0);
    w7 = replace_digit(w7, i, acc, 1);
    w8 = replace_digit(w8, i, acc, 2);
    w9 = replace_digit(w9, i, acc, 3);
    prev = d;
    tick = game_tick();
    k = k + 1;
  }

  start on a fresh Gate tick
  for (clue 0 through clue 31) {
      choose the timing pad for the first call or a later call
      make one timed SYNC call and read its delay class
      undo the part mixed with the previous delay and clue number
      store this three-bit clue in its designated position
      remember this delay for the next call
  }

    const ZERO_ROOT_COSTS: [u16; OBSERVATION_COUNT] = [
        240, 168, 120, 240, 96, 72, 72, 144, 144, 168, 216, 240, 192, 72, 168, 144, 240, 168, 120,
        240, 96, 72, 72, 144, 144, 168, 216, 240, 192, 72, 168, 144,
    ];
    const SEQUENTIAL_ROOT_COSTS: [u16; OBSERVATION_COUNT] = [
        240, 168, 144, 240, 192, 120, 240, 120, 216, 216, 96, 216, 168, 120, 96, 96, 72, 168, 72,
        72, 120, 96, 144, 192, 120, 144, 192, 240, 120, 168, 240, 120,
    ];

    #[test]
    fn independent_golden_vectors_pin_symbol_order_and_costs() {
        assert_eq!(encode_costs([0; ROOT_BYTES]), ZERO_ROOT_COSTS);
        assert_eq!(
            encode_costs(std::array::from_fn(|index| index as u8)),
            SEQUENTIAL_ROOT_COSTS
        );
        assert_eq!(decode_costs(&ZERO_ROOT_COSTS), Some([0; ROOT_BYTES]));
        assert_eq!(
            decode_costs(&SEQUENTIAL_ROOT_COSTS),
            Some(std::array::from_fn(|index| index as u8))
        );

    ZERO_ROOT_COSTS = expected 32 costs for the all-zero root
    SEQUENTIAL_ROOT_COSTS = expected 32 costs for bytes 0 through 11
    fn independent_golden_vectors_pin_symbol_order_and_costs() {
        encode each known 12-byte root and compare all 32 saved costs
        decode those costs and recover the exact original root

  i = 0;
  while (i < 32) {
    acc = packed_digit(w6,w7,w8,w9,i);
    j = 0;
    while (j < i) {
      acc = acc - (((3*i + 5*j + 1) & 7) * packed_digit(w6,w7,w8,w9,j));
      j = j + 1;
    }
    acc = acc & 7;
    w6 = replace_digit(w6, i, acc, 0);
    w7 = replace_digit(w7, i, acc, 1);
    w8 = replace_digit(w8, i, acc, 2);
    w9 = replace_digit(w9, i, acc, 3);
    i = i + 1;
  }

  i = 31;
  while (i < 32) {
    acc = packed_digit(w6,w7,w8,w9,i);
    j = i + 1;
    while (j < 32) {
      acc = acc - (((2*i + 4*j + 3) & 7) * packed_digit(w6,w7,w8,w9,j));
      j = j + 1;
    }
    acc = acc & 7;
    w6 = replace_digit(w6, i, acc, 0);
    w7 = replace_digit(w7, i, acc, 1);
    w8 = replace_digit(w8, i, acc, 2);
    w9 = replace_digit(w9, i, acc, 3);
    if (i == 0) { break; }
    i = i - 1;
  }

  i = 0
  while (i < 32) {
      read clue i
      for (each earlier clue j) { subtract j's contribution }
      keep the low three bits and replace clue i
      i = i + 1
  }
  i = 31
  while (i < 32) {
      read clue i
      for (each later clue j) { subtract j's contribution }
      keep the low three bits and replace clue i
      if (i == 0) { break }
      i = i - 1
  }

  round = 5;
  while (round < 6) {
    i = 0;
    while (i < 16) {
      acc = packed_digit(w6,w7,w8,w9,i);
      acc = acc + 2*packed_digit(w6,w7,w8,w9,(i+1)&15);
      acc = acc + 3*packed_digit(w6,w7,w8,w9,(i+5)&15);
      acc = acc + packed_digit(w6,w7,w8,w9,(i+7)&15)*packed_digit(w6,w7,w8,w9,(i+11)&15);
      acc = (acc + round + 2*i + 1) & 7;
      d = (packed_digit(w6,w7,w8,w9,16+i) - acc) & 7;
      j = (i & 7) * 4;
      if (i < 8) {
        w8 = (w8 & ~(7 << j)) | (d << j);
      } else {
        w9 = (w9 & ~(7 << j)) | (d << j);
      }
      i = i + 1;
    }
    d = w6; w6 = w8; w8 = d;
    d = w7; w7 = w9; w9 = d;
    if (round == 0) { break; }
    round = round - 1;
  }

  round = 5
  while (round < 6) {
      i = 0
      while (i < 16) {
          acc = rebuild this round's mask from the first half
          d = subtract the mask from the paired digit; keep three bits
          j = the slot where recovered digit i belongs
          if (i < 8) {
              w8 = store d in the first recovered word
          } else {
              w9 = store d in the second recovered word
          }
          i = i + 1
      }
      swap w6 with w8
      swap w7 with w9
      if (round == 0) { break }
      round = round - 1
  }

  r0 = 0; r1 = 0; r2 = 0;
  i = 0;
  while (i < 32) {
    d = packed_digit(w6,w7,w8,w9,i);
    acc = i * 3;
    j = acc >> 5;
    acc = acc & 31;
    if (j == 0) {
      r0 = r0 | (d << acc);
    } else if (j == 1) {
      r1 = r1 | (d << acc);
    } else {
      r2 = r2 | (d << acc);
    }
    if (acc > 29) {
      if (j == 0) { r1 = r1 | (d >> (32-acc)); }
      else if (j == 1) { r2 = r2 | (d >> (32-acc)); }
    }
    i = i + 1;
  }

  r0 = 0; r1 = 0; r2 = 0
  i = 0
  while (i < 32) {
      d = recovered digit i
      acc = i * 3
      j = which 32-bit word owns that starting bit
      acc = bit position inside that word
      if (j == 0) {
          r0 = put d in the first word
      } else if (j == 1) {
          r1 = put d in the second word
      } else {
          r2 = put d in the third word
      }
      if (acc > 29) {
          put the overflowing bit or bits in the next word
      }
      i = i + 1
  }

  fresh_tick();
  w2 = outer;
  c0 = 2;
  c1 = cmdseq;
  c4 = r0; c5 = r1; c6 = r2; c7 = 0;
  gate_once();
  outer = outer + 1;
  cmdseq = cmdseq + 1;

  fresh_tick();
  w2 = outer;
  c0 = 3;
  c1 = cmdseq;
  gate_once();
  outer = outer + 1;
  cmdseq = cmdseq + 1;

  after recovering the root {
      wait for a fresh tick
      send the three recovered root words for one host comparison
      advance the Gate command sequence
      on another fresh tick, start binding that result into the sessions
  }

        let candidate = root_from_words(candidate_words);
        let comparison = compare_root(&candidate, &self.roots.owner_root());
        let transcript_complete = session.synchronization_ordinal == OBSERVATION_COUNT as u8
            && !session.synchronization_invalid
            && bytes_difference(session.synchronization_classes, self.observation_classes) == 0;
        let digest = cost_digest(session.synchronization_classes);
        let run = run_witness(self.roots.owner_root(), digest);
        let lineage = normalized_session_lineage(session);
        let entry = normalized_drive_proof(provenance, session.entry_node);
        let exact_entry =
            entry.difference(NodeKind::EntryProof, Scope::Lineage(lineage), 0x03, 4) == 0;
        let create = !session.comparison_attempted
            && transcript_complete
            && comparison.matches()
            && comparison.compared_bytes() == ROOT_BYTES as u8
            && session.ingress_evidence
            && exact_entry;

        session.comparison_attempted = true;
        let retained_witness = *witness;
        let candidate_witness = Some(CalibrationWitness {
            owner_root: candidate,
            cost_digest: digest,
            run_witness: run,
        });
        let install_witness = create && retained_witness.is_none();

        let candidate = root made from the submitted words
        let comparison = compare all 12 bytes with this run's hidden root
        let transcript_complete = all 32 SYNC clues arrived in order and match this run
        let exact_entry = the Entry proof has the right owner, kind, rights, and rank
        let create = first comparison attempt
            and complete transcript and matching root
            and safe Entry work and exact Entry proof
        session.comparison_attempted = true
        let candidate_witness = a receipt for this candidate and run
        let install_witness = create and no receipt was installed before

#[derive(Clone, Copy, PartialEq, Eq)]
struct CalibrationWitness {
    owner_root: [u8; ROOT_BYTES],
    cost_digest: [u8; 16],
    run_witness: [u8; 16],
}

after successful calibration, host keeps {
    the root owned by this run
    a fingerprint of the ordered 32 costs
    a fingerprint binding the proof to this run
}

    e = gate_timed();
    outer = outer + 1;
    cmdseq = cmdseq + 1;

    e = (e + (1 * (k == 0))) & 7;
    d = (5 * (e + 5)) & 7;
    acc = (d - 3*prev - k) & 7;
    i = (5*k) & 31;

    control bot's SYNC loop {
        measure the current clue
        if (this is the chosen clue) { change its class by one }
        continue decoding a plausible but wrong root
    }

    #[test]
    fn every_one_symbol_mutant_reencodes_exactly_without_a_local_oracle() {
        let source = encode_costs(std::array::from_fn(|index| (index * 7) as u8));
        for ordinal in 0..OBSERVATION_COUNT {
            for delta in 1..COST_CLASS_COUNT {
                let mut mutant = source;
                let class = class_for_cost(mutant[ordinal]).expect("encoded class");
                mutant[ordinal] = cost_for_class(class.wrapping_add(delta));
                let plausible = decode_costs(&mutant).expect("every class vector is valid");
                assert_eq!(encode_costs(plausible), mutant);
            }

    fn every_one_symbol_mutant_reencodes_exactly_without_a_local_oracle() {
        let source = 32 costs encoded from a known root
        for (each one of the 32 positions) {
            for (each different three-bit class) {
                change only that cost
                decode the changed list into a plausible root
                confirm that root reproduces the changed list
            }

pub(super) struct QueueEntry {
    op: u8,
    slot: u8,
    reuse_low8: u8,
    lineage: u8,
    session_slot: u8,
    cached_kind: u8,
    cached_rights: u8,
    payload: [u8; 9],
}

a waiting queued write stores {
    operation and page slot
    only the low byte of the checked generation
    power track and session
    old page kind and permissions
    nine bytes of write request
}

    fn from_request(request: EnqueueRequest, slot: CapSlot, session: SessionIdentity) -> Self {
        let mut payload = [0u8; 9];
        payload[0..2].copy_from_slice(&request.byte_offset.to_le_bytes());
        payload[2] = request.length;
        payload[3..7].copy_from_slice(&request.data.to_le_bytes());
        payload[7] = request.preflight_count;
        Self {
            op: QUEUE_OPCODE,
            slot: request.handle.slot,
            reuse_low8: slot.generation as u8,
            lineage: session.lineage,
            session_slot: session.slot,
            cached_kind: slot.kind,
            cached_rights: slot.rights,
            payload,

    fn from_request(request, slot, session) {
        let payload = offset, length, data, and preflight count
        return queued record {
            page slot from request.handle
            only the low byte of slot.generation
            session's power track and slot
            old page kind and rights
            payload

    wait_until(lines, f"({maintenance_expr})-1")
    active_frame(lines, lineage)
    command(
        lines,
        command_base=0,
        opcode=5,
        lineage=lineage,
        sequence=sequence_var,
        target="r2",
        generation=f"0x{old_generation:08x}",
        args=("72", "4", f"0x435841{lineage:02x}", "62"),
    )
    gate_call(lines, sequence_var)

    build the maintenance-crossing write {
        wait until one tick before the chosen maintenance tick
        open the correct power-track session
        queue a four-byte write at page offset 72
        use the old full generation and preflight value 62
        make this the first Gate work of that tick
    }

        let mut copy_second = retained_work;
        for (index, byte) in entry_bytes[8..].iter().copied().enumerate() {
            copy_second.pending[8 + index] = byte;
        }
        copy_second.pending_copied = true;
        copy_second.copied_epoch = self.epoch;
        let mut copy_second_queue = retained_queue;
        let (popped_entry, popped_origin, popped_present) = copy_second_queue.pop_front_fixed();
        copy_second.dereference_valid = popped_present
            & (queue_entry_difference(popped_entry, retained_work.entry) == 0)
            & (queue_origin_difference(popped_origin, retained_work.origin) == 0);
        copy_second.phase = QueuePhase::DerefLive.as_u8();

        let mut deref_live = retained_work;
        let live_kind = (slot.kind == CapKind::Scratch.as_u8())
            | (slot.kind == CapKind::Dispatch.as_u8())
            | (slot.kind == CapKind::ProgramPage.as_u8());
        deref_live.dereference_valid &= slot_in_range & live_kind;
        deref_live.phase = QueuePhase::DerefLowGeneration.as_u8();

        let mut deref_low_generation = retained_work;
        deref_low_generation.dereference_valid &=
            slot.generation as u8 == retained_work.entry.reuse_low8;
        deref_low_generation.phase = QueuePhase::DerefOwner.as_u8();

        let copy_second = copy the saved waiting work
        for (each remaining byte of the queued entry) {
            put it in that copied work
        }
        mark the second half copied in the current epoch
        let popped_entry = remove the queue's front entry
        check it is the same entry and origin the work expected
        let deref_live = check the saved slot is still in range and has an allowed kind
        let deref_low_generation = compare the saved low generation byte with the live slot

                    select_rotation_tombstone_cell(ordered, tombstones[slot_index], gather_mask);
            }
            let eligible = ordered.present
                & (ordered.value.old_kind == CapKind::Scratch.as_u8())
                & !selected.present;
            let latch_mask = std::hint::black_box(RotationSelectionMask::new(eligible));
            selected = select_rotation_tombstone_cell(selected, ordered, latch_mask);
        }

                    during page rotation {
                        consider eligible old Scratch-page tombstones
                        choose the first matching slot
                        preserve its physical page for the new Dispatch role
                    }

        let mut deref_address = retained_work;
        let page_valid = slot_in_range & page_in_range & (page_owner == retained_work.entry.slot);
        let cached_authority = (retained_work.entry.cached_kind == CapKind::Scratch.as_u8())
            & (retained_work.entry.cached_rights & RIGHT_WRITE != 0)
            & retained_work.origin.full_validation
            & (retained_work.origin.old_kind == CapKind::Scratch.as_u8())
            & (retained_work.origin.old_rights & RIGHT_WRITE != 0);
        #[cfg(any(test, feature = "abyss-repaired-uaf"))]
        let repair_required = matches!(policy, QueueResumePolicy::FullGenerationAndKind);
        #[cfg(not(any(test, feature = "abyss-repaired-uaf")))]
        let repair_required = {
            let _ = policy;
            false
        };
        let repaired_fields = (slot.generation == retained_work.origin.old_generation)
            & (slot.kind == retained_work.origin.old_kind);
        let policy_valid = !repair_required | repaired_fields;
        deref_address.dereference_valid &= page_valid & cached_authority & policy_valid;

        before dereferencing a queued write {
            require the page to belong to the saved slot
            require write authority from the old Scratch page
            the optional repaired policy also requires exact old generation and kind
            the normal path does not require those full fields here
        }

        let stale_conjunction = write_valid
            & origin.full_validation
            & (origin.old_kind == CapKind::Scratch.as_u8())
            & (entry.cached_kind == CapKind::Scratch.as_u8())
            & (entry.cached_rights & RIGHT_WRITE != 0)
            & (slot.kind == CapKind::Dispatch.as_u8())
            & (origin.old_generation != slot.generation)
            & (origin.old_generation as u8 == slot.generation as u8)
            & (origin.old_physical_page == slot.physical_page)
            & (session_difference(origin.session, active_session) == 0)
            & (origin.enqueue_epoch == work.copied_epoch)
            & (work.copied_epoch < self.epoch)
            & (origin.old_generation >> 8 == origin.enqueue_epoch)
            & (slot.generation >> 8 == self.epoch);
        let candidate_cap = StaleExecCap {
            slot: entry.slot,
            full_generation: slot.generation,
            lineage: slot.lineage,
            session_slot: slot.owner_session_slot,
            physical_page: slot.physical_page,
            rights: STALE_EXEC_RIGHTS,
            issued_epoch: self.epoch,

        if the queued write crossed maintenance exactly right {
            require valid old Scratch origin and matching session
            require new Dispatch page in the same slot and physical page
            require different full generations with equal low bytes
            require the expected old and new maintenance epochs
            issue a new stale execution handle for the new page

    let base = page_base(physical_page)?;
    let mut page = [0u8; PAGE_BYTES];
    let controlled_word = u32::try_from(base.checked_add(72)?).ok()?;
    let lit_r7 = make_spec(7, 0, CellWidth::U32, 0);
    let push_r7 = make_spec(0, 7, CellWidth::U8, 0);
    let ld32_r0 = make_spec(0, 0, CellWidth::U32, 0);
    let capld_root_r1 = make_spec(1, 0, CellWidth::U32, ROOT_VIEW_SLOT);
    let xor_r0_r1 = make_spec(0, 1, CellWidth::U32, 2);
    let cmp_r0_r0 = make_spec(0, 0, CellWidth::U32, 0);
    let cells = [
        (Primitive::Lit, lit_r7, 0),
        (Primitive::CursorPush, push_r7, 0),
        (Primitive::Ld32, ld32_r0, controlled_word),
        (Primitive::CapLd, capld_root_r1, 8),
        (Primitive::Alu, xor_r0_r1, 0),
        (Primitive::Yield, 0, 0),
        (Primitive::Cmp, cmp_r0_r0, 0),
        (Primitive::Seal, 0, 0),
        (Primitive::DriveCommit, 0, 0),
    ];

    small Dispatch bootstrap {
        read the four bytes written at page offset 72
        load a host-owned root view and combine it
        pause once, then compare
        SEAL the result and request a zero-level DRIVE commit
    }

        let (verifier_kind, target_kind, rights) = match source {
            ExecutionSource::StaleDispatch if slot.kind == CapKind::Dispatch => (
                VerifierKind::StaleBootstrap,
                TargetKind::StaleExec,
                TargetRights {
                    load: false,
                    store: true,
                    execute: true,
                },
            ),
            ExecutionSource::ProgramPage if slot.kind == CapKind::ProgramPage => (
                program_verifier,
                TargetKind::ProgramPage,
                TargetRights::load_store_execute(),
            ),

        select the right verifier {
            stale Dispatch execution uses the special bootstrap checks
            ordinary ProgramPage execution uses its program verifier
            give each path only its allowed page rights

                let (offset, length, controlled_word, preflight_count) = reuse.controlled_write();
                let semantic_admitted = (offset, length, preflight_count) == (72, 4, 62)
                    && raw == [0; 3]
                    && saturated == [0; 3];
                let evidence = StaleDispatchCertificateEvidence {
                    lineage,
                    session_slot,
                    session_generation: session.generation,
                    calibrated_node_digest: parent.node_digest(),
                    queue_commit: reuse.queue_commit(),
                    bootstrap_program_digest: program_digest,
                    controlled_word,

                before saving stale Dispatch proof {
                    require the queued write: offset 72, four bytes, preflight 62
                    require the boost request to be [0, 0, 0]
                    record the parent calibration proof, queue event, and program

        let stale_node = match staged_provenance.node(stale_id) {
            Some(node)
                if node.kind() == NodeKind::StaleDispatchProof
                    && node.scope() == Scope::Lineage(lineage)
                    && node.certificate_set() == 0x1f
                    && effective_ceiling(node.kind(), node.certificate_set()) == Some(12) =>
            {
                node
            }
            _ => return false,
        };
        std::hint::black_box(stale_node.node_digest());

        let mut staged_capabilities = self.capabilities.clone();
        let capability_session =
            SessionIdentity::new(candidate.identity.session_slot, lineage.as_u8());
        let promotion = match staged_capabilities.promote_stale(handle, capability_session) {
            Some(promotion)

        before promoting the stale page {
            require a StaleDispatch proof for this power track
            require exactly five accepted proof kinds
            require a level-12 ceiling
            then try to turn the stale page into a normal program

    emitter.set(V_LINEAGE, 2)
    emitter.set(V_SESSION, 2)
    emit_call_pop(emitter, "stage_load_sequence")
    emit_prepare_command(
        emitter,
        command_offset=0,
        opcode=7,
        target_from=V_TARGET,
        generation=0x301,
    )
    emit_prepare_command(
        emitter,
        command_offset=32,
        opcode=8,
        sequence_delta=1,
        args=(0x000C_0C0C, 0, 0, 0),
    )
    emit_invoke_current(emitter, 2)
    emit_increment(emitter, V_SEQUENCE)
    emit_call_pop(emitter, "stage_store_sequence")
    emit_call_pop(emitter, "stage_tick")

    during gameplay {
        select the TRAWL session and current program
        prepare RUN, then DRIVE with levels [12, 12, 12]
        make the Gate call
        save the advanced sequence and move to the next tick
    }

    let prefix = [
        (0, Primitive::BeginChallenge, 0, 0),
        (1, Primitive::CursorPush, push_r7, 0),
        (2, Primitive::CursorDup, duplicate_top, 0),
        (3, Primitive::CursorDup, duplicate_top, 0),
        (4, Primitive::CursorDup, duplicate_top, 0),
        (5, Primitive::Lit, lit_r1, carriers[0]),
        (6, Primitive::Lit, lit_r2, carriers[1]),
        (7, Primitive::Lit, lit_r6, carriers[2]),
        (8, Primitive::CapLd, root_depth_two_r3, 12),
        (9, Primitive::Call, 0, loop_target),
    ];

    final program's opening cells {
        start a challenge
        prepare its cursor stack
        load six packed audit answers in cells 5–7
        read a host-owned root word
        call the challenge-processing loop
    }

    let body = [
        (20, Primitive::CapLd, pulse_post_r6, 0),
        (21, Primitive::Alu, add_r0_r6, 0),
        (22, Primitive::Alu, add_immediate_r0, 0x9e37_79b9),
        (23, Primitive::Alu, rol_immediate_r0, 5),
        (24, Primitive::Alu, xor_r0_r3, 0),
        (25, Primitive::Alu, rol_immediate_r3, 1),
        (26, Primitive::Alu, add_immediate_r4, 4),
        (27, Primitive::Cmp, cmp_ne_immediate_r4, 64),
        (28, Primitive::Cjmp, 0, loop_target),
        (29, Primitive::Ret, 0, 0),

    final program's loop {
        read the next challenge word
        mix it with a fixed number and rotate the result
        XOR a rotating root word
        repeat until 16 words are done
        return to the caller
    }

fn replay_visible(view: &ClosedViews, nonce: u32) -> u32 {
    let mut h = nonce;
    let mut root_roll = word(&view.root, 3);
    for index in 0..16 {
        h = h
            .wrapping_add(word(&view.pulse, index))
            .wrapping_add(0x9e37_79b9)
            .rotate_left(5);
        h ^= root_roll;
        root_roll = root_roll.rotate_left(1);
    }
    for index in 0..4 {
        h ^= word(&view.parent, index);
    }
    h

fn replay_visible(view, nonce) {
    let h = nonce; let root_roll = one saved root word
    for (16 pulse words) {
        add the next word and a fixed number to h; rotate h
        XOR h with root_roll; rotate root_roll
    }
    for (4 parent-proof words) { XOR each into h }
    return h

    let carriers = [cells[5].immediate, cells[6].immediate, cells[7].immediate];
    Some(FullPrefix {
        m: [
            carriers[0] as u16,
            (carriers[0] >> 16) as u16,
            carriers[1] as u16,
            (carriers[1] >> 16) as u16,
            carriers[2] as u16,
            (carriers[2] >> 16) as u16,
        ],
    })

    read audit answers from the program {
        take the numbers in setup cells 5, 6, and 7
        split each into a low and high 16-bit answer
        return six answers in that exact order
    }

pub(super) fn replay_audit(
    challenge: [u32; 16],
    r_init: [u16; AUDIT_LANES],
    m: [u16; AUDIT_LANES],
) -> AuditResult {
    let matrix = matrix(challenge);
    let bias = bias(challenge);
    let target = target(challenge);
    let r_final = std::array::from_fn(|row| {
        let mut value = r_init[row].wrapping_add(bias[row]);
        for (column, witness) in m.into_iter().enumerate() {
            value = value.wrapping_add(matrix[row][column].wrapping_mul(witness));
        }
        value
    });
    AuditResult {
        challenge,
        challenge_digest: challenge_digest(challenge),
        r_init,
        m,
        r_final,
        target,
        holds: fixed_u16s_equal(r_final, target),
    }

fn replay_audit(challenge, starting_values, six_answers) {
    build this challenge's matrix, bias, and target
    for (each of six rows) {
        start from that row's value and bias
        add the contribution of all six supplied answers
    }
    return the six resulting row values for comparison

pub(super) fn solve_audit_witness(
    challenge: [u32; 16],
    r_init: [u16; AUDIT_LANES],
) -> [u16; AUDIT_LANES] {
    let (lower, diagonal, upper, permutation) = audit_factors(challenge);
    let bias = bias(challenge);
    let target = target(challenge);
    let rhs: [u16; AUDIT_LANES] =
        std::array::from_fn(|i| target[i].wrapping_sub(r_init[i]).wrapping_sub(bias[i]));

    let mut after_lower = [0u16; AUDIT_LANES];
    for i in 0..AUDIT_LANES {
        let mut value = rhs[i];
        for j in 0..i {
            value = value.wrapping_sub(lower[i][j].wrapping_mul(after_lower[j]));
        }
        after_lower[i] = value;
    }
    let after_diagonal: [u16; AUDIT_LANES] =
        std::array::from_fn(|i| after_lower[i].wrapping_mul(inverse_odd(diagonal[i])));
    let mut after_upper = [0u16; AUDIT_LANES];
    for i in (0..AUDIT_LANES).rev() {
        let mut value = after_diagonal[i];
        for j in i + 1..AUDIT_LANES {
            value = value.wrapping_sub(upper[i][j].wrapping_mul(after_upper[j]));
        }
        after_upper[i] = value;
    }
    std::array::from_fn(|column| after_upper[permutation[column]])

fn solve_audit_witness(challenge, r_init) {
    let (lower, diagonal, upper, permutation) = this challenge's layers
    let rhs = target minus r_init minus bias, wrapping at 16 bits
    for (lane 0 up to lane 5) { undo the lower layer }
    let after_diagonal = undo each odd multiplier
    for (lane 5 down to lane 0) { undo the upper layer }
    return the six values rearranged by permutation

    emitter.set(S5_BLOCK, 0)
    emit_call_pop(emitter, "stage5_challenge_block")
    emitter.set(S5_BLOCK, 1)
    emit_call_pop(emitter, "stage5_challenge_block")
    emit_call_pop(emitter, "stage5_audit_initial")
    emit_call_pop(emitter, "stage5_solve")

    prepare final audit {
        compute both challenge blocks
        calculate the six starting audit values
        solve for the six answers to put in the program
    }

        emitter.set(V_ARG0, (5 + pair) * 8 + 4)
        emitter.set(S5_ROW, 2 * pair)
        emit_indexed_load(emitter, S5_M, S5_ROW)
        emitter.store(V_ARG1)
        emit_increment(emitter, S5_ROW)
        emit_indexed_load(emitter, S5_M, S5_ROW)
        emitter.push(16)
        emitter.op(OP_SHL)
        emitter.load(V_ARG1)
        emitter.op(OP_OR)
        emitter.store(V_ARG1)
        emitter.set(V_ARG2, 0)
        emitter.set(V_ARG3, 0)
        emit_call_pop(emitter, "stage_cmd_write")

        for (each of three audit carrier cells) {
            pack two solved 16-bit answers into one 32-bit number
            write that number into the cell's immediate field
        }

        let terminals_match = submission.actual_r0 == self.expected_r0[0]
            && fixed_u32s_equal(submission.counterfactual_r0, counterfactual);
        let mut absorption = true;
        for lane in 0..5 {
            absorption &= submission.actual_r0 != submission.counterfactual_r0[lane];
        }
        absorption &= (submission.actual_r0 != submission.counterfactual_r0[5]) == self.audit_holds;
        let valid = submission.verifier == VerifierKind::FullProgram
            && fixed_identity_equal(submission.identity, self.identity)
            && fixed_bytes_equal(submission.program_digest, self.program_digest)
            && submission.semantic_steps_before_pair == FULL_PRE_TERMINAL_STEPS
            && submission.audit_capture_count == 3
            && fixed_u16s_equal(submission.audit_capture, self.m)
            && submission.actual_condition == false
            && submission.counterfactual_condition == [false; COUNTERFACTUAL_LANES]
            && terminals_match
            && absorption
            && full_coverage_valid(submission.coverage)
            && full_trace_valid(
                submission.trace,
                self.views,
                self.identity.ingress_nonce,
                self.m,
            )
            && submission.has_full_terminal_sources();

        let terminals_match = live result and all comparison-lane results match
        let absorption = true
        for (the first five comparison lanes) {
            require the live result to differ from that lane's result
        }
        require the sixth lane's difference to match the saved audit outcome
        let valid = correct full-program verifier and run identity
            and correct program, step count, and three audit captures
            and matching terminal results and lane differences
            and valid coverage, trace, and terminal proof sources

        let expected_set = if audit.holds {
            MODULE_COMPLETE_CERTIFICATE_SET
        } else {
            MODULE_BASE_CERTIFICATE_SET
        };
        let module = match staged_provenance.node(module_id) {
            Some(node)
                if node.kind() == NodeKind::ModuleProof
                    && node.scope() == Scope::Lineage(lineage)
                    && node.certificate_set() == expected_set
                    && effective_ceiling(node.kind(), node.certificate_set())
                        == Some(if audit.holds { 16 } else { 12 }) =>
            {
                *node
            }
            _ => return false,

        before installing the final Module proof {
            if (audit passed) { require all six proof kinds and level 16 }
            else { require the base five kinds and level 12 }
            reject a node with any different kind, owner, or ceiling

    for _ in range(2):
        emitter.copy(V_GENERATION, V_VIEW2)
        emit_call_pop(emitter, "stage_load_sequence")
        emit_prepare_command(
            emitter,
            command_offset=0,
            opcode=7,
            target_from=V_TARGET,
            generation_from=V_GENERATION,
        )
        emit_prepare_command(
            emitter,
            command_offset=32,
            opcode=8,
            sequence_delta=1,
            args=(APEX_REQUEST_WORD, 0, 0, 0),
        )
        emit_invoke_current(emitter, 2)
        emit_increment(emitter, V_SEQUENCE)
        emit_call_pop(emitter, "stage_store_sequence")
    emit_increment(emitter, V_LINEAGE)
    emit_call_pop(emitter, "stage_tick")

    finish the full program {
        on one frozen game tick, repeat twice:
            prepare RUN and the next DRIVE request
            call Gate with a 256-step allowance
            save the advanced sequence
        then advance the power track and tick
    }