`MemoryActorContractClauseView` is the closed typed variant matching the
schema-specific clause records above. It exposes typed enum, boolean, exact
`SyncScopeRef`, and compare-exchange ordering-pair ranges; it is not a map of
field names to values. Every external typed value persists through canonical
bytes produced and validated by its semantic owner. C++ enum values, TableGen
case numbers, and declaration order are implementation details and cannot be
used as a persistent codec. Pair arrays sort lexicographically by owner
canonical bytes.
Independent review
No independent interface audit has been supplied for this attempt.
Execution provenance
The original pilot recorded the compiler hash and checkout revision separately; its binary build revision was not verified. Coverage follow-ups use separately identified rebuilt binaries. Original simulator binary hashes were not retained.
Original standalone-test agent report
This is exploratory evidence, not an accepted production-format PBT.
Two of the passage's obligations (pair-array canonical-byte sort; canonical-byte persistence of external typed values) were tested against the real subject API on 100 seeds. The closed-typed-variant / not-a-field-name-map clause and the full 'no ordinal codec' clause are structural C++-type facts with no external falsifiable input and were not tested.
Reported numeric verdicts
not measured
Tested obligations
id
P1
predicate
for the clause returned by create(), the compare-exchange ordering-pair range is strictly increasing in framed(encodeAtomicOrdering(success)) ++ framed(encodeAtomicOrdering(failure))
result
held on 100/100 admitted seeds
text
Pair arrays sort lexicographically by owner canonical bytes.
Every external typed value persists through canonical bytes produced and validated by its semantic owner.
Untested obligations
MemoryActorContractClauseView is the closed typed variant matching the schema-specific clause records (no external interface to falsify; the C++ type is a std::variant by construction).
It exposes typed enum, boolean, exact SyncScopeRef and compare-exchange ordering-pair ranges; it is not a map of field names to values (structural type fact, no run-time input can violate it).
Sorting of the non-pair typed ranges (orderings, sync scopes, boolean, granularity) was not separately asserted; only the compare-exchange pair array was.
Named view methods MemoryActorContractDomainView::actorSchema/clauses/contains are documented but not present under those names in the pinned checkout; the underlying MemoryActorContractDomain members were used instead.
Format
chosen
standalone C++ PBT harness linked against the pinned subject libraries
progrmr spct used
false
reason
The passage is a runtime view/codec claim. MemoryActorContractClauseView and MemoryActorContractDomainView appear only in docs; the real API (fabric::MemoryActorContractDomain) has no MLIR attribute or textual surface (no matches in include/Fabric/IR/FabricAttrs.td or test/**), so a ProGRMR-generated .mlir plus a .spct checker would have tested parsing, not the codec.
Reproduction
not measured
Measured subject code coverage
measured · Measured handwritten Loom subject code only; external LLVM/MLIR and generated code excluded. Includes main executions, including rejected inputs; deliberate controls excluded. No matching native-suite baseline for this executable has been imported, so no coverage gain is claimed. Semantic fidelity remains a separate audit.
pbt/pair_sort_pbt.cpp (in-process predicates P1/P2, recomputing owner canonical bytes via dataflow::encodeAtomicOrdering rather than Fabric internals)
controlled violation
kind
synthetic checker self-test (not a subject defect)
log
evidence/run_legal_mutate.log
mechanism
--mutate swaps the first and last pair of the range returned by the subject before the P1 predicate runs
observed
91/100 seeds report P1_sorted=0 and verdict=FAIL, exit code 1; the 9 passes are single-pair ranges where the swap is a no-op
coverage
collected
false
reason
no coverage-instrumented build of the subject libraries was available; the budget was spent making the real-API PBT compile and run
expected rejections
count
92
diagnostic
compare-exchange capability admits an illegal ordering pair
note
legitimate subject admission rejection of illegal ordering pairs, not a property violation and not a syntax failure
format
chosen
standalone C++ PBT harness linked against the pinned subject libraries
progrmr spct used
false
reason
The passage is a runtime view/codec claim. MemoryActorContractClauseView and MemoryActorContractDomainView appear only in docs; the real API (fabric::MemoryActorContractDomain) has no MLIR attribute or textual surface (no matches in include/Fabric/IR/FabricAttrs.td or test/**), so a ProGRMR-generated .mlir plus a .spct checker would have tested parsing, not the codec.
generator path
pbt/pair_sort_pbt.cpp (deterministic std::mt19937 per seed; also contains the checker)
partially tested obligations
evidence
canonical bytes observed are a framed namespaced tag 'loom.dataflow.atomic-ordering' plus a wire value distinct from the C++ enumerator (C++ Monotonic=1 -> wire 2, Acquire=2 -> wire 3, SeqCst=5 -> wire 6); the pair order is that of those bytes, not of declaration order. Observation, not an independent falsifiable property.
id
P3
text
C++ enum values, TableGen case numbers, and declaration order are implementation details and cannot be used as a persistent codec.
passage
docs/spec-fabric-mem.md:921-928
pinned revision
48615bc5925ef4b9db8b4550b5d4322933cf4b7b
potential subject bugs
none recorded
sampling
conventions not source obligations
--legal restricts sampled pairs to the compare-exchange legality rule (failure ordering in {monotonic, acquire, seq_cst}, failure no stronger than success, no duplicate pairs) so admission does not mask the sort/codec properties
sync scope restricted to {system, single_thread}; vector granularity fixed to nullopt
pairs per clause
1..8 (sampling bound, not a source requirement)
seeds main
0..99 with --legal sampling mode
seeds unrestricted
0..99 without --legal
slot
breadth-15
status
partial
status reason
Two of the passage's obligations (pair-array canonical-byte sort; canonical-byte persistence of external typed values) were tested against the real subject API on 100 seeds. The closed-typed-variant / not-a-field-name-map clause and the full 'no ordinal codec' clause are structural C++-type facts with no external falsifiable input and were not tested.
for the clause returned by create(), the compare-exchange ordering-pair range is strictly increasing in framed(encodeAtomicOrdering(success)) ++ framed(encodeAtomicOrdering(failure))
result
held on 100/100 admitted seeds
text
Pair arrays sort lexicographically by owner canonical bytes.
Every external typed value persists through canonical bytes produced and validated by its semantic owner.
untested obligations
MemoryActorContractClauseView is the closed typed variant matching the schema-specific clause records (no external interface to falsify; the C++ type is a std::variant by construction).
It exposes typed enum, boolean, exact SyncScopeRef and compare-exchange ordering-pair ranges; it is not a map of field names to values (structural type fact, no run-time input can violate it).
Sorting of the non-pair typed ranges (orderings, sync scopes, boolean, granularity) was not separately asserted; only the compare-exchange pair array was.
Named view methods MemoryActorContractDomainView::actorSchema/clauses/contains are documented but not present under those names in the pinned checkout; the underlying MemoryActorContractDomain members were used instead.