THE FALSE SHARING

Two threads, two different variables, neither reading the other's. Put them four bytes apart and the program spends all its time passing a cache line back and forth.

THE FALSE SHARING · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · SHARED MEMORY ◆ .dlw.fold THE FOLD / CO-OP / SHARED MEMORY / THE FALSE SHARING THE FALSE SHARING a bug with no wrong behaviour 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Two threads. Two different variables. Neither one ever reads the other’s. Put them four bytes apart and the program still spends all its time passing a cache line back and forth, because coherence is not tracked per variable. LIT verified live. two cores, 1,000 writes each to variables they alone own. At offsets 0 and 4 — one 64-byte line — the line changes owner on 1,999 of the 2,000 writes. Move the second variable to offset 64 and the count is 0 : two compulsory upgrades and then silence forever. Sweeping the offset from 0 to 128 in steps of 4 gives a step function that falls off a cliff at exactly 64 , the line size — nothing gradual, no locality gradient, one number. The fix costs 60 bytes of padding. 2 HOW IT WAS WEAVED · AI + HUMAN False sharing and cache-line padding are standard concurrent-programming knowledge; the MESI ownership model here is the usual simplification. AVAN (AI) ran the sweep rather than naming the effect, and the shape is the point. If false sharing were about ‘locality’ the curve would decay; it does not decay, it steps , once, at the line size. That is the signature of a quantised resource, and it is why the bug is undetectable by reasoning about the program: 1,999 and 0 are the same source code, the same semantics, the same access pattern, differing only in a layout decision no one wrote down. 3 ONE DIMENSION One step function. It falls at 64 and nowhere else. 4 TWO DIMENSIONS · INTERACTIVE Slide the second variable and watch the line stop moving. offset +4 ▶ offset -4 jump to 64 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that padding fixes false sharing. The inverse is that this is a bug with no wrong behaviour . Nothing computes an incorrect answer; no invariant breaks; every test passes. The program is correct and 1,000× slower, and the cause is invisible to every tool that reasons about meaning, because meaning is exactly what is unaffected. Read backwards, the cache line is a unit the machine takes seriously and the language does not admit exists — and a bug that lives entirely in the gap between those two views can only be seen by looking at the address arithmetic, never at the logic. pause spin LIT two cores, 1,000 writes each to variables they alone own: at offsets 0 and 4 - one 64-byte line - the line changes owner on 1,999 of the 2,000 writes, and moving the second variable to offset 64 gives 0, two compulsory upgrades and then silence forever; sweeping the offset 0 to 128 in steps of 4 gives a step function falling off a cliff at exactly 64, the line size, with nothing gradual about it, and the fix costs 60 bytes of padding FIG False sharing and cache-line padding are standard concurrent-programming knowledge; the MESI ownership model here is the usual simplification. AVAN ran the sweep rather than naming the effect, and the shape is the point: if false sharing were about locality the curve would decay, but it steps, once, at the line size. That is the signature of a quantised resource, and it is why the bug is undetectable by reasoning about the program - 1,999 and 0 are the same source code with the same semantics. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SHARED MEMORY · David Lee Wise (ROOT0), with AVAN


THE MEMORY FENCE

x=1 then read y on one core; y=1 then read x on the other. Both reading zero is impossible if the machine does what the program says. Every x86 in the world will do it anyway.

I-13 v2.0 | net = binds - k | 4 planes, 13 symbols, 12 operants, 5 cortex rules | sha 64881ebf

THE MEMORY FENCE · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · THE SYNC ◆ .dlw.fold THE FOLD / CO-OP / THE SYNC / THE MEMORY FENCE THE MEMORY FENCE a subtraction, not an instruction 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Store buffering: x=1 then read y, on one core; y=1 then read x, on the other. Both reading zero is impossible if the machine does what the program says. Every x86 in the world will do it anyway. LIT verified live. enumerating every schedule exhaustively: under sequential consistency there are 6 interleavings and 0 of them produce r0=r1=0 . Add per-core store buffers and the schedule space grows to 80 , of which 18 produce it — 22.5% of executions reach a state the source code forbids. Put a fence between each store and its load and the space collapses to 20 schedules, with 0 bad outcomes. The fence did not add anything: it deleted 60 of the 80 possible executions. 2 HOW IT WAS WEAVED · AI + HUMAN The store-buffer litmus test (SB) is the canonical TSO example, from Sewell, Sarkar and Owens’ x86-TSO work and every memory-model course since. AVAN (AI) enumerated the linear extensions rather than reasoning about them, which caught a real error: the first sequential-consistency run reported 12 schedules and 1 bad outcome, because one load had been left unconstrained relative to its own thread’s store. Correcting the precedence gives 6 and 0 — and the fact that the buggy version produced a plausible number is the reason the check has to be exhaustive rather than sampled. 3 ONE DIMENSION 6 schedules, none bad. Then 80, and 18 are. 4 TWO DIMENSIONS · INTERACTIVE Walk any schedule and watch both registers land on zero. mode: SC / TSO / fence next schedule ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that a fence synchronises. The inverse is that a fence is a subtraction — it does not order your program, it removes futures from the machine . Nothing is added: no message, no handshake, no value. The count goes 80 → 20 , and correctness arrives as the disappearance of 60 executions you never wanted. Read backwards, an unfenced program is not one that runs incorrectly; it is one that runs all of its possibilities, and every synchronisation primitive ever written is a way of saying which of them you refuse. pause spin LIT enumerating every schedule exhaustively, sequential consistency gives 6 interleavings and 0 of them produce r0=r1=0; adding per-core store buffers grows the space to 80 of which 18 produce it, 22.5% of executions reaching a state the source code forbids; putting a fence between each store and its load collapses the space to 20 schedules with 0 bad outcomes - the fence added nothing, it deleted 60 of the 80 possible executions FIG The store-buffer litmus test is the canonical TSO example, from Sewell, Sarkar and Owens' x86-TSO work. AVAN enumerated the linear extensions rather than reasoning about them, which caught a real error: the first sequential-consistency run reported 12 schedules and 1 bad outcome because one load had been left unconstrained relative to its own thread's store. Correcting the precedence gives 6 and 0 - and the buggy version producing a plausible number is exactly why the check has to be exhaustive rather than sampled. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE SYNC · David Lee Wise (ROOT0), with AVAN


THE SEQLOCK

A reader that writes nothing. No lock, no cache line to own, no cost imposed on anyone. It reads a counter, reads the data, reads the counter again - and if they disagree it starts over.

THE SEQLOCK · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · GLITCH · RACE CONDITION ◆ .dlw.fold THE FOLD / GLITCH / RACE CONDITION / THE SEQLOCK THE SEQLOCK starvation wearing the costume of latency 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A reader that writes nothing. No lock to acquire, no cache line to own, no cost imposed on anyone else. It reads a counter, reads the data, reads the counter again — and if the two disagree it throws the answer away and starts over. LIT verified live. enumerating every interleaving exhaustively: a plain unguarded reader against a two-field writer has 6 orderings, and 2 of them return a torn pair that violates the invariant. Wrapping the same reader in a sequence counter gives 70 orderings, of which 68 are detected and retried and 2 complete — and of the ones that complete, 0 are torn. The reader performs 0 writes to shared state in every case. Under a writer active 90% of the time, 89.96% of reads retry and the worst observed run needed 101 attempts. 2 HOW IT WAS WEAVED · AI + HUMAN Seqlocks are a standard Linux kernel primitive (Stephen Hemminger, from earlier reader/writer sequence schemes) used for jiffies , timekeeping and other write-rare data. AVAN (AI) proved the safety property by exhaustion rather than argument — all 70 interleavings of a 4-op writer and a 4-op reader, with 0 torn results getting through. The number worth reporting honestly is the other one: 68 of 70 retried. In this tiny space the writer is always active, so that figure is not the real-world retry rate; the rate sweep is, and it climbs to 89.96% exactly where the writer does. 3 ONE DIMENSION 70 interleavings. Zero torn reads. Sixty-eight retries. 4 TWO DIMENSIONS · INTERACTIVE Pick an interleaving and see whether the counter catches it. next interleaving ▶ next TORN case ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that readers never block writers. The inverse is that the cost was moved, not removed — and it was moved somewhere nobody measures . The writer is wait-free; the reader is only obstruction-free, and its retries do not appear as contention, as a blocked thread, or in any lock profile. They appear as a read that took longer, which every latency graph will average away. Read backwards, a lock-free reader is not a reader that cannot be starved — it is a reader whose starvation has been made to look like slowness. pause spin LIT enumerating every interleaving exhaustively, a plain unguarded reader against a two-field writer has 6 orderings of which 2 return a torn pair violating the invariant, while the same reader wrapped in a sequence counter gives 70 orderings of which 68 are detected and retried and 2 complete - and of those that complete, 0 are torn, with the reader performing 0 writes to shared state in every case; under a writer active 90% of the time 89.96% of reads retry and the worst observed run needed 101 attempts FIG Seqlocks are a standard Linux kernel primitive used for jiffies, timekeeping and other write-rare data. AVAN proved the safety property by exhaustion rather than argument - all 70 interleavings, 0 torn results getting through. The number worth reporting honestly is the other one: 68 of 70 retried, and in this tiny space the writer is always active, so that figure is not the real-world retry rate. The rate sweep is, and it climbs to 89.96% exactly where the writer does. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of RACE CONDITION · David Lee Wise (ROOT0), with AVAN


THE RCU

Copy it, change the copy, swing the pointer - and then wait, not for a lock, but for every reader who could still hold the old version to simply finish.

THE RCU · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · SPLIT SCREEN ◆ .dlw.fold THE FOLD / CO-OP / SPLIT SCREEN / THE RCU THE RCU never edit what someone might be reading 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Never modify what someone might be reading. Copy it, change the copy, swing the pointer — and then wait , not for a lock, but for every reader who could still be holding the old version to simply finish. LIT verified live. enumerating all 56 interleavings of a five-step writer against a three-step reader: 0 readers see a torn structure and 0 touch freed memory, because each reader captures the pointer once and then holds an entire consistent version — 46 of them see the old one and 10 the new. Remove the grace period and free immediately after publishing, and 12 of the 35 remaining interleavings dereference memory that has already been reclaimed. In every case the reader performs 0 writes to shared state. 2 HOW IT WAS WEAVED · AI + HUMAN Read-copy-update is Paul McKenney’s, in the Linux kernel since 2002; the copy-publish-wait structure and the grace period are his. AVAN (AI) enumerated the schedule space instead of arguing about it, and split the claim in two. The 0 torn reads is structural — a reader that captures the pointer once cannot straddle two versions, and it is worth saying that plainly rather than dressing it up as a surprising measurement. The number that is not structural is 12 of 35 : that is what the grace period is actually buying, and without it the failure is not rare. 3 ONE DIMENSION 56 interleavings. Nobody reads a half-built object. 4 TWO DIMENSIONS · INTERACTIVE Walk a schedule and see which version the reader got. next schedule ▶ toggle grace period 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that RCU makes readers free. The inverse is that the cost did not disappear, it was converted into memory and deferred . The writer cannot reclaim until the last pre-existing reader finishes, so a single slow reader holds the whole reclamation queue open; the garbage is unbounded by construction, because the bound is ‘whenever everyone happens to be done.’ Read backwards, RCU trades a latency you can see — a lock — for a memory footprint you cannot, and the price of never blocking a reader is never being able to promise when the memory comes back. pause spin LIT enumerating all 56 interleavings of a five-step writer against a three-step reader, 0 readers see a torn structure and 0 touch freed memory - 46 see the old version and 10 the new, because each captures the pointer once and holds an entire consistent copy; remove the grace period and free immediately after publishing, and 12 of the remaining 35 interleavings dereference reclaimed memory, with the reader performing 0 writes to shared state in every case FIG Read-copy-update is Paul McKenney's, in the Linux kernel since 2002. AVAN enumerated the schedule space and split the claim in two: the 0 torn reads is STRUCTURAL - a reader that captures the pointer once cannot straddle two versions, and it is worth saying plainly rather than dressing up as a surprising measurement. The number that is not structural is 12 of 35, which is what the grace period actually buys. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SPLIT SCREEN · David Lee Wise (ROOT0), with AVAN


THE HAZARD POINTER

RCU waits for everyone. Michael's alternative asks each reader to name the pointer it is using - and the writer frees everything nobody named.

THE HAZARD POINTER · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · RESPAWN · GARBAGE COLLECTION ◆ .dlw.fold THE FOLD / RESPAWN / GARBAGE COLLECTION / THE HAZARD POINTER THE HAZARD POINTER say out loud which pointer you are holding 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION RCU waits for everyone. Magged Michael’s alternative asks each reader to say, out loud, which pointer it is using — and then the writer frees everything nobody named. LIT verified live. enumerating all 20 interleavings of a three-step reader against a three-step writer, the protocol with the re-verification step suffers 0 use-after-free, aborting and retrying in 16 of them and deferring 16 frees. Delete the re-verification — publish the hazard pointer and dereference — and 3 of the same 20 touch reclaimed memory. The reclamation bound is the other half: 64 threads holding 2 hazard pointers each can strand at most 128 nodes, where a single RCU reader stalled across 50 grace periods at 100 nodes each strands 5,000 — 39 times more. 2 HOW IT WAS WEAVED · AI + HUMAN Hazard pointers are Maged Michael’s (2004); the publish-verify-use protocol and the per-thread bound are his. AVAN (AI) ran the enumeration to isolate which step does the work, because the interesting part of this algorithm is the one that looks redundant. Publishing the hazard pointer is not enough: the node can be unlinked and freed between the load and the publish, so the reader must re-read the shared pointer and confirm it is still the same. Removing only that step gives 3 of 20 . It is a step whose entire justification is a window it is hard to believe exists. 3 ONE DIMENSION 20 interleavings. The redundant-looking step is the whole protocol. 4 TWO DIMENSIONS · INTERACTIVE Delete the re-verification and watch the window open. next schedule ▶ toggle re-verify 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that hazard pointers bound the garbage. The inverse is that they bound it by making every reader pay, forever, for a danger almost none of them are in . RCU costs readers nothing and reclaims late; hazard pointers reclaim promptly and charge every single read a store and a fence, whether or not any writer exists. Read backwards, the two are the same trade seen from opposite ends — and neither removes the cost of not knowing who is looking. One defers it into memory, the other collects it up front from everyone. pause spin LIT enumerating all 20 interleavings of a three-step reader against a three-step writer, the protocol with the re-verification step suffers 0 use-after-free, aborting in 16 and deferring 16 frees; delete the re-verification and 3 of the same 20 touch reclaimed memory - and the bound is the other half, since 64 threads holding 2 hazard pointers each strand at most 128 nodes where one RCU reader stalled across 50 grace periods at 100 nodes each strands 5,000, 39 times more FIG Hazard pointers are Maged Michael's (2004). AVAN ran the enumeration to isolate WHICH step does the work, because the interesting part of this algorithm is the one that looks redundant: the node can be unlinked and freed between the load and the publish, so the reader must re-read the shared pointer and confirm. Removing only that step gives 3 of 20 - a step whose entire justification is a window it is hard to believe exists. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of GARBAGE COLLECTION · David Lee Wise (ROOT0), with AVAN


THE ELIMINATION BACKOFF

Rather than queue a push and a pop at the contended top of a stack, let them meet in a side room and hand the value straight across. The stack never hears about it.

THE ELIMINATION BACKOFF · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · THE MERGE ◆ .dlw.fold THE FOLD / CO-OP / THE MERGE / THE ELIMINATION BACKOFF THE ELIMINATION BACKOFF a push and a pop that cancel each other out 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A push and a pop that collide want opposite things. Rather than queue them both at the contended top of the stack, let them meet in a side room and hand the value directly across — the stack never hears about it. LIT verified live. over 250 rounds of 8 threads on a balanced push/pop mix, the plain lock-free stack is touched 2,000 times — once per operation. With a 4 -slot elimination array, 1,450 operations pair off and never reach the stack at all: 550 touches, a 72.5% reduction. Conservation holds in both: pushes minus pops equals the final depth exactly. And the control that matters — the same array on an all-push workload eliminates 0 , because there is nothing for a push to cancel against. 2 HOW IT WAS WEAVED · AI + HUMAN Elimination backoff is Hendler, Shavit and Yerushalmi (2004), building on Shavit and Touitou’s elimination trees. AVAN (AI) counted the thing that is actually exact — stack touches — rather than inventing CAS-retry figures, which would depend entirely on a contention model chosen to flatter the result. Touches are model-free: an eliminated pair provably never reaches the stack. The conservation check (pushes − pops = depth) is there because a scheme that hands values around outside the data structure is exactly the kind that quietly loses or duplicates one. 3 ONE DIMENSION 1,450 operations that never touched the stack. 4 TWO DIMENSIONS · INTERACTIVE Change the workload mix and watch elimination die. mix: balanced / all push step round ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that contention becomes throughput. The inverse is that the mechanism only works on the workload that did not need a stack in the first place . A push meeting a pop is two threads whose net effect on the structure is nothing; elimination is fast because it recognises the operations that cancel — and at 100% pushes it delivers 0 . Read backwards, this is not a faster stack, it is a detector for work that was self-cancelling, and the more your program genuinely accumulates, the less it can help. pause spin LIT over 250 rounds of 8 threads on a balanced push/pop mix the plain lock-free stack is touched 2,000 times, once per operation, while a 4-slot elimination array pairs off 1,450 operations that never reach the stack at all - 550 touches, a 72.5% reduction - with conservation holding in both runs (pushes minus pops equals final depth exactly), and the control that matters: the same array on an all-push workload eliminates 0 FIG Elimination backoff is Hendler, Shavit and Yerushalmi (2004). AVAN counted the thing that is actually exact - stack touches - rather than inventing CAS-retry figures, which would depend entirely on a contention model chosen to flatter the result. An eliminated pair provably never reaches the stack. The conservation check is there because a scheme that hands values around outside the data structure is exactly the kind that quietly loses or duplicates one. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE MERGE · David Lee Wise (ROOT0), with AVAN


THE FLAT COMBINING

Sixty-four threads fighting for one lock is sixty-four cache-line transfers to do sixty-four small things. Let one thread take the lock and do all sixty-four.

THE FLAT COMBINING · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · BOSS · THE CHOKE POINT ◆ .dlw.fold THE FOLD / BOSS / THE CHOKE POINT / THE FLAT COMBINING THE FLAT COMBINING building the bottleneck on purpose 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Sixty-four threads fighting for one lock is sixty-four cache-line transfers to do sixty-four small things. Let each publish its request and let one thread take the lock and do all sixty-four — the structure moves once. LIT verified live. 64 threads, 128 rounds, 8,192 operations. The lock-based version takes 8,192 lock acquisitions and moves the shared structure 8,192 times. Flat combining takes 128 — one per round, a factor of 64 — and reaches an identical final state. The fairness result is the one worth having: with the combiner rotating, every thread ends up executing exactly 128 operations under both schemes. Nobody does more total work. What changes is the burst: the combiner executes 64 operations back to back where a lock-holder executes 1 . 2 HOW IT WAS WEAVED · AI + HUMAN Flat combining is Hendler, Incze, Shavit and Tzafrir (2010). AVAN (AI) checked the final state against the sequential application before reporting any speed number, because a scheme where one thread executes another thread’s operation is exactly where a silent reordering would hide. The per-thread work count was the surprise worth keeping: the intuition is that the combiner is exploited, and over a rotation it is not — 128 and 128 . The cost is not unfairness in total, it is 64 × latency variance, which is a different complaint and a real one. 3 ONE DIMENSION 8,192 lock acquisitions become 128. 4 TWO DIMENSIONS · INTERACTIVE Watch one thread do everyone else's work. next round ▶ run 20 rounds 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that combining removes contention. The inverse is that it removes contention by removing concurrency — on purpose . The critical section is not made shorter or safer; it is made singular , and every other thread is now waiting on a stranger’s scheduling decisions rather than on a lock it could at least see. Read backwards, this is the deliberate construction of a bottleneck, justified by the discovery that the bottleneck already existed and was merely being paid for in cache traffic instead of in queueing. pause spin LIT 64 threads, 128 rounds, 8,192 operations: the lock-based version takes 8,192 lock acquisitions and moves the shared structure 8,192 times, while flat combining takes 128 - one per round, a factor of 64 - and reaches an identical final state; and with the combiner rotating, every thread executes exactly 128 operations under BOTH schemes, so nobody does more total work, what changes is the burst of 64 operations back to back against 1 FIG Flat combining is Hendler, Incze, Shavit and Tzafrir (2010). AVAN checked the final state against the sequential application before reporting any speed number, because a scheme where one thread executes another thread's operation is exactly where a silent reordering would hide. The per-thread work count was the surprise worth keeping: the intuition is that the combiner is exploited, and over a rotation it is not - 128 and 128. The cost is 64x latency variance, which is a different complaint and a real one. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE CHOKE POINT · David Lee Wise (ROOT0), with AVAN


THE BAKERY ALGORITHM

Lamport, 1974. Lowest number goes first, ties broken by who you are. Correct even if a read that overlaps a write returns garbage.

THE BAKERY ALGORITHM · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · BOSS · THE GATEKEEPER ◆ .dlw.fold THE FOLD / BOSS / THE GATEKEEPER / THE BAKERY ALGORITHM THE BAKERY ALGORITHM take a number; no atomic instruction required 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Lamport, 1974. Take a number at the door; lowest number goes first; ties broken by who you are. No atomic instruction anywhere — it is correct even if a read that overlaps a write returns garbage. LIT verified live. breadth-first search over the entire reachable state space of two threads gives 77 states, of which 14 have a thread in the critical section and 0 have both — mutual exclusion, exhausted rather than argued. The fairness half is measured on one arrival stream served two ways: under the bakery discipline 0 of 10,000 entrants are overtaken by someone who arrived later, while a test-and-set lock choosing among the 8 waiting threads overtakes 8,715 of them. The price is on the counter: after 10,000 entries the ticket number is 10,000 , and it never resets. 2 HOW IT WAS WEAVED · AI + HUMAN Leslie Lamport’s bakery algorithm (1974) is the classic result that mutual exclusion needs no atomic hardware. AVAN (AI) checked mutual exclusion by model checking rather than by reading the proof, and measured fairness rather than repeating the word. The fairness figure was nearly a fabrication: the first version simply set the bakery’s overtake count to zero on the grounds that FIFO is FIFO. It was rebuilt to run both disciplines over the same arrival stream through the same counter, so the 0 is a measurement and not an assumption. The state space is bounded by letting each thread enter once, which is stated rather than hidden. 3 ONE DIMENSION 77 states. Fourteen have someone inside. None have two. 4 TWO DIMENSIONS · INTERACTIVE Step the two threads and try to get both into the room. step thread 0 ▶ step thread 1 ▶ reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that the bakery needs no special hardware. The inverse is that it replaces one atomic instruction with an unbounded counter and 2N shared variables that every thread must read on every entry . Lamport did not remove the cost of agreement; he moved it from a bus lock into 16 shared words and a number that grows forever. Read backwards, ‘no atomic operation required’ is a claim about the instruction set, not about the work — and the work turns out to scale with how many of you there are, which is exactly what the lock instruction was hiding. pause spin LIT breadth-first search over the entire reachable state space of two threads gives 77 states, of which 14 have a thread in the critical section and 0 have both - mutual exclusion exhausted rather than argued; and on one arrival stream served two ways, the bakery discipline lets 0 of 10,000 entrants be overtaken by a later arrival while a test-and-set lock choosing among the 8 waiting threads overtakes 8,715 - the price being a ticket counter that reaches 10,000 and never resets, plus 16 shared words FIG Leslie Lamport's bakery algorithm (1974) is the classic result that mutual exclusion needs no atomic hardware. AVAN checked mutual exclusion by model checking rather than by reading the proof, and measured fairness rather than repeating the word. The fairness figure was nearly a fabrication: the first version simply SET the bakery's overtake count to zero on the grounds that FIFO is FIFO. It was rebuilt to run both disciplines over the same arrival stream through the same counter, so the 0 is a measurement. The state space is bounded by letting each thread enter once, which is stated rather than hidden. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE GATEKEEPER · David Lee Wise (ROOT0), with AVAN


THE SLEEPING BARBER

One barber, a few chairs, customers who leave if the chairs are full. The barber sleeps when there is nobody. The whole problem lives in one gap.

THE SLEEPING BARBER · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · RESPAWN · SECOND WIND ◆ .dlw.fold THE FOLD / RESPAWN / SECOND WIND / THE SLEEPING BARBER THE SLEEPING BARBER the gap between looking and lying down 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Dijkstra’s shop. One barber, a few chairs, customers who leave if the chairs are full. The barber sleeps when there is nobody. The whole problem lives in the gap between looking and lying down. LIT verified live. the naive protocol is four steps — the barber reads ‘is the queue empty?’ then sleeps; the customer joins the queue then wakes the barber if it is sleeping. Enumerating all 6 interleavings, exactly 1 ends with the barber asleep and a customer waiting: the customer arrives and sends its wake-up after the barber has looked and before it has fallen asleep, so the signal is delivered to someone who is still awake and is simply lost. Replace the flag with a counting semaphore and the same 6 interleavings give 0 . Over 5,000 steps with 5 chairs, arrivals reconcile exactly: 2,719 = 2,363 served + 353 turned away + 3 still waiting. 2 HOW IT WAS WEAVED · AI + HUMAN Dijkstra’s sleeping barber (1965) is one of the founding synchronisation problems, alongside the dining philosophers. AVAN (AI) reduced it to the smallest space in which the bug is visible — two operations each — because the lost wake-up is usually described in prose and prose lets it sound rare. It is 1 in 6 . The conservation check is a separate matter of hygiene: any simulation of a queue with balking should be made to account for every arrival before its other numbers are believed. 3 ONE DIMENSION Six interleavings. One loses the wake-up. 4 TWO DIMENSIONS · INTERACTIVE Walk the six and find the one that sleeps forever. next interleaving ▶ toggle semaphore 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that a semaphore fixes the lost wake-up. The inverse is that the bug was never about sleeping — it was about a signal with no memory . A flag says ‘wake up’ to whoever is listening now; a semaphore says ‘one customer happened’ to whoever asks later. Read backwards, every lost-wake-up bug ever written is the same substitution: an event was represented as a state to be observed rather than a count to be consumed , and observation has a moment while counting does not. pause spin LIT enumerating all 6 interleavings of the naive two-step protocol, exactly 1 ends with the barber asleep and a customer waiting - the customer arrives and signals AFTER the barber has looked and BEFORE it has fallen asleep, so the wake-up is delivered to someone still awake and is simply lost - while replacing the flag with a counting semaphore gives 0 of the same 6; and over 5,000 steps with 5 chairs the arrivals reconcile exactly, 2,719 = 2,363 served + 353 turned away + 3 still waiting FIG Dijkstra's sleeping barber (1965) is one of the founding synchronisation problems. AVAN reduced it to the smallest space in which the bug is visible - two operations each - because the lost wake-up is usually described in prose, and prose lets it sound rare. It is 1 in 6. The conservation check is separate hygiene: any simulation of a queue with balking should account for every arrival before its other numbers are believed. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SECOND WIND · David Lee Wise (ROOT0), with AVAN


THE DINING PHILOSOPHERS

Five philosophers, five forks, and a rule so reasonable it is fatal: pick up your left fork, then your right. Everyone can obey it at once, and if they do, nobody eats again.

THE DINING PHILOSOPHERS · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · BOSS · THE GAUNTLET ◆ .dlw.fold THE FOLD / BOSS / THE GAUNTLET / THE DINING PHILOSOPHERS THE DINING PHILOSOPHERS everyone correct, in the same way, at the same time 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Five philosophers, five forks, and a rule so reasonable it is fatal: pick up your left fork, then your right. Everyone can obey it simultaneously, and if they do, nobody eats again. LIT verified live. breadth-first search over the entire reachable state space of the symmetric protocol finds 82 states, of which exactly 1 has no successor at all — the state 11111 , every philosopher holding a left fork and waiting on a right that will never be released. Reverse the order for a single philosopher and the search finds 70 reachable states and 0 deadlocks. One asymmetry, applied to one of five, removes the whole failure — and it also removes 12 reachable states, which is what the fix costs. 2 HOW IT WAS WEAVED · AI + HUMAN The dining philosophers are Dijkstra’s (1965); the asymmetric fix — make one philosopher left-handed — is the standard remedy, as is the resource hierarchy it generalises to. AVAN (AI) searched the state graph rather than reasoning about the cycle, so the deadlock is not a story about it but an enumerated fact: 1 terminal state, and it is identified by name. The 82 → 70 is the part that arguments usually omit — the fix does not merely delete the bad state, it deletes twelve reachable configurations, because forbidding a symmetry forbids more than the one arrangement you were afraid of. 3 ONE DIMENSION 82 states. Exactly one of them has no way out. 4 TWO DIMENSIONS · INTERACTIVE Pick up forks yourself and try to reach the trap. philosopher +1 grabs toggle asymmetric fix reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that breaking the symmetry breaks the deadlock. The inverse is that the deadlock was not caused by scarcity but by everyone being correct in the same way at the same time . Every philosopher followed a locally sound rule; the failure is a property of the set , invisible in any one of them. Read backwards, a protocol that is safe for each participant can be lethal for all of them, and the only cure is to make somebody behave differently for no reason they could justify locally — correctness bought by mandating an inconsistency. pause spin LIT breadth-first search over the entire reachable state space of the symmetric protocol finds 82 states of which exactly 1 has no successor at all - the state 11111, every philosopher holding a left fork and waiting on a right that is never released - while reversing the order for a single philosopher gives 70 reachable states and 0 deadlocks, so one asymmetry applied to one of five removes the whole failure and also removes 12 reachable states, which is what the fix costs FIG The dining philosophers are Dijkstra's (1965); the asymmetric fix is the standard remedy. AVAN searched the state graph rather than reasoning about the cycle, so the deadlock is an enumerated fact with a name rather than a story. The 82 to 70 is the part arguments usually omit - the fix does not merely delete the bad state, it deletes twelve reachable configurations, because forbidding a symmetry forbids more than the one arrangement you were afraid of. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE GAUNTLET · David Lee Wise (ROOT0), with AVAN


THE BANKER DEADLOCK

Dijkstra's banker will not lend money he has, if lending it means he might later be unable to pay anyone in full. The resources are available. The request is legal. He refuses.

THE BANKER DEADLOCK · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · BOSS · THE WALL ◆ .dlw.fold THE FOLD / BOSS / THE WALL / THE BANKER DEADLOCK THE BANKER DEADLOCK he can afford it and he refuses anyway 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Dijkstra’s banker will not lend you money he has, if lending it means he might later be unable to pay anyone in full. The resources are available. The request is legal. He refuses anyway. LIT verified live. the classic five-process, three-resource state is safe , with the completion order P1, P3, P4, P0, P2 found by the algorithm. Enumerating every single request a process could legally make within its declared need gives 65 requests, and all 65 have enough free resources to be granted on the spot. Only 56 are safe. The remaining 9 — 13.8% — are requests the banker can afford and must still refuse, because granting them leaves a state from which some completion order no longer exists. 2 HOW IT WAS WEAVED · AI + HUMAN The banker’s algorithm is Dijkstra’s (1965), and the five-process instance is the one from Silberschatz. AVAN (AI) enumerated the request space rather than showing the single textbook example, because one example makes the gap look like a curiosity. 65 requests are affordable and 9 of them are traps — availability and safety are genuinely different predicates, and the difference is not rare. The algorithm’s real cost is stated on the page rather than buried: every process must declare its maximum future need before it starts, which is information almost no real program has. 3 ONE DIMENSION 65 affordable requests. Nine of them are traps. 4 TWO DIMENSIONS · INTERACTIVE Try a request the banker can afford and watch him refuse. next request ▶ next TRAP ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that the banker prevents deadlock. The inverse is that he can only do it by demanding a promise nobody can keep . Safety here is computed from declared maxima, so the guarantee is exactly as good as the declarations — and a process that must state its worst-case need in advance will either overstate it, wasting the resources it reserved against a case that never comes, or understate it and void the proof. Read backwards, deadlock avoidance is not an algorithm problem, it is an information problem, and the algorithm is what you get once you assume the information away. pause spin LIT the classic five-process three-resource state is safe, with the completion order P1, P3, P4, P0, P2 found by the algorithm; enumerating every request a process could legally make within its declared need gives 65 requests and ALL 65 have enough free resources to be granted on the spot, but only 56 are safe - the remaining 9, or 13.8%, are requests the banker can afford and must still refuse because granting them leaves a state from which some completion order no longer exists FIG The banker's algorithm is Dijkstra's (1965) and the five-process instance is Silberschatz's. AVAN enumerated the request space rather than showing the single textbook example, because one example makes the gap look like a curiosity: 65 requests are affordable and 9 are traps, so availability and safety are genuinely different predicates and the difference is not rare. The real cost is stated on the page rather than buried - every process must declare its MAXIMUM future need before it starts, which is information almost no real program has. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE WALL · David Lee Wise (ROOT0), with AVAN


THE TWO PHASE COMMIT

Ask everyone whether they can commit; if they all say yes, tell them all to do it. The protocol is correct, and it has a hole you cannot patch.

THE TWO PHASE COMMIT · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · THE PULL REQUEST ◆ .dlw.fold THE FOLD / CO-OP / THE PULL REQUEST / THE TWO PHASE COMMIT THE TWO PHASE COMMIT correct, and it hangs seven times in nine 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Ask everyone whether they can commit. If they all say yes, tell them all to do it. The protocol is correct, and it has a hole you cannot patch: a participant that has said yes is no longer allowed to decide anything by itself. LIT verified live. injecting a coordinator crash at each of the 9 points in the protocol, under both an all-yes and a one-no vote — 18 scenarios — produces 0 atomicity violations. No run ever has one participant commit while another aborts. But 7 of the 9 crash points leave at least one participant blocked : it voted yes, it is holding its locks, it has no decision, and it may not abort unilaterally because the coordinator might have committed. Safe in 9 of 9 ; live in 2 . 2 HOW IT WAS WEAVED · AI + HUMAN That 2PC is safe but blocking is the standard result, and the reason three-phase commit and consensus protocols exist at all. AVAN (AI) injected the failure at every point rather than describing the bad case, so the two properties separate into two numbers instead of one paragraph. The pairing is the whole content: a protocol can be 100% correct and 22% available, and a summary that reports only the first is not wrong, it is just answering a question nobody was asking during the outage. 3 ONE DIMENSION Nine crash points. Zero break. Seven hang. 4 TWO DIMENSIONS · INTERACTIVE Kill the coordinator at each step and read the participants. crash later ▶ crash earlier toggle a NO vote 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that 2PC guarantees atomicity. The inverse is that it guarantees it by making blocking the only safe behaviour . A participant holding locks with no decision is not malfunctioning — waiting is the correct action, because any unilateral choice risks disagreeing with a decision that may already have been made and written down somewhere it cannot see. Read backwards, the outage is not a failure of the protocol, it is the protocol working: when a system cannot distinguish ‘slow’ from ‘dead’, correctness and availability stop being separable goals and one of them has to be surrendered on purpose. pause spin LIT injecting a coordinator crash at each of the 9 points in the protocol, under both an all-yes and a one-no vote - 18 scenarios - produces 0 atomicity violations, with no run ever having one participant commit while another aborts; but 7 of the 9 crash points leave at least one participant BLOCKED, holding its locks with no decision and forbidden to abort unilaterally because the coordinator might have committed - safe in 9 of 9, live in 2 FIG That 2PC is safe but blocking is the standard result, and the reason three-phase commit and consensus protocols exist at all. AVAN injected the failure at every point rather than describing the bad case, so the two properties separate into two numbers instead of one paragraph. The pairing is the whole content: a protocol can be 100% correct and 22% available, and a summary reporting only the first is not wrong, it is answering a question nobody was asking during the outage. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE PULL REQUEST · David Lee Wise (ROOT0), with AVAN


THE PAXOS QUORUM

The entire safety of distributed consensus rests on one fact about finite sets: any two majorities of the same set must share a member. Everything else is scaffolding around that intersection.

THE PAXOS QUORUM · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · THE PUSH ◆ .dlw.fold THE FOLD / CO-OP / THE PUSH / THE PAXOS QUORUM THE PAXOS QUORUM safety was settled by arithmetic before anyone wrote a line 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION The entire safety of distributed consensus rests on one fact about finite sets: any two majorities of the same set must share a member. Everything else — ballots, promises, acceptors — is scaffolding around that one intersection. LIT verified live. with 5 acceptors there are 10 majority quorums of size 3 and 45 pairs of them; 0 pairs are disjoint and the smallest intersection is exactly 1 . With 7 acceptors, 35 quorums, 595 pairs, 0 disjoint. Now take 6 acceptors and quorums of size 3 — half, not a majority: 20 quorums, 190 pairs, and 10 of them are disjoint. Two decisions can be made with nobody in common, which is what ‘split brain’ means arithmetically. Fault tolerance follows the same counting: with 5 acceptors all 10 two-failure sets still leave a quorum, and all 10 three-failure sets leave none. 2 HOW IT WAS WEAVED · AI + HUMAN Leslie Lamport’s Paxos (1998, and 1990 in draft) rests on quorum intersection; the result is his and it long predates the protocol. AVAN (AI) checked it by exhaustion because the interesting number is the one for the wrong configuration. That majorities intersect is easy to believe; that 10 of 190 half-sized quorum pairs on 6 nodes are disjoint is the concrete form of an error people actually make when they size a cluster. The even-numbered cluster is not slightly weaker, it is unsafe at that quorum size, and this is the count that says so. 3 ONE DIMENSION Any two majorities share a member. Any two halves need not. 4 TWO DIMENSIONS · INTERACTIVE Pick two quorums and look for the overlap. next pair ▶ toggle 5 nodes / 6 nodes 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that a majority quorum makes consensus safe. The inverse is that the safety is not in the protocol at all — it is a counting argument, and the protocol merely refuses to outrun it . No amount of care in the message handling can rescue a quorum size that permits disjoint sets; no carelessness in it can break one that does not. Read backwards, all the difficulty of consensus is in the liveness , where FLP guarantees no protocol can always terminate — safety was settled by arithmetic before anyone wrote a line. pause spin LIT with 5 acceptors there are 10 majority quorums of size 3 and 45 pairs of them, 0 disjoint, smallest intersection exactly 1; with 7 acceptors, 35 quorums and 595 pairs, 0 disjoint; but take 6 acceptors with quorums of size 3 - half, not a majority - and of the 20 quorums and 190 pairs, 10 are disjoint, which is what split brain means arithmetically; fault tolerance counts the same way, since all 10 two-failure sets on 5 acceptors still leave a quorum and all 10 three-failure sets leave none FIG Leslie Lamport's Paxos rests on quorum intersection, a result that long predates the protocol. AVAN checked it by exhaustion because the interesting number is the one for the WRONG configuration: that majorities intersect is easy to believe, but that 10 of 190 half-sized quorum pairs on 6 nodes are disjoint is the concrete form of an error people actually make when sizing a cluster. The even-numbered cluster is not slightly weaker, it is unsafe at that quorum size, and this is the count that says so. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE PUSH · David Lee Wise (ROOT0), with AVAN


THE UNVERIFIED SURFACE

A figure a checker cannot reach is not lightly checked. It is unchecked, permanently, and it drifts at whatever rate the work moves.

THE UNVERIFIED SURFACE · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CHEAT · THE BACKDOOR ◆ .dlw.fold THE FOLD / CHEAT / THE BACKDOOR / THE UNVERIFIED SURFACE THE UNVERIFIED SURFACE coverage reports on the covered 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A figure a checker cannot reach is not lightly checked. It is unchecked , permanently, and it drifts at whatever rate the work moves — while the coverage number beside it keeps reporting how well everything else is doing. LIT verified live. take 120 figures of which 118 lie inside the verifier’s reach, each touched with probability 0.02 per edit round over 50 rounds. Coverage reads 98.3% . The probability that at least one of the two unreachable figures has silently drifted is 86.7% — closed form 1−(1−p) (F−V)R , confirmed by simulation at 85.8% . The exposure is exponential in the number uncovered , not in the fraction covered, so 98.3% and 100% are not neighbours: at full coverage the probability is exactly 0 . 2 HOW IT WAS WEAVED · AI + HUMAN The arithmetic is elementary; what it is applied to is not. AVAN (AI) built this after finding a wrong number on line 5 of a document that shipped beside 73 checks, 47 crosschecks and a 6-of-6 mutant gate. None of them read that file. The model says why that is not bad luck: coverage is reported as a fraction, and a fraction hides the only quantity that matters, which is the raw count of things nothing looks at. Two is a small number and 86.7% is not a small probability. 3 ONE DIMENSION 98.3% covered. 86.7% chance something drifted. 4 TWO DIMENSIONS · INTERACTIVE Slide the coverage and watch the exposure refuse to fall. cover one more ▶ expose one 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that more coverage means less drift. The inverse is that a coverage percentage is a statement about the covered, and the risk lives entirely in the complement . Going from 110 to 118 figures moves coverage from 91.7% to 98.3% and moves the drift probability from 99.996% to 86.7% — a heroic-looking gain that leaves the situation almost unchanged. Read backwards, every coverage metric is computed by the very instrument whose blind spot is the question, and it can only ever report on the part of the world it can see. pause spin LIT take 120 figures of which 118 lie inside the verifier's reach, each touched with probability 0.02 per edit round over 50 rounds: coverage reads 98.3% while the probability that at least one of the two unreachable figures has silently drifted is 86.7% - closed form 1-(1-p)^((F-V)R), confirmed by simulation at 85.8% - because the exposure is exponential in the number UNCOVERED, not in the fraction covered, so 98.3% and 100% are not neighbours and only at full coverage is the probability exactly 0 FIG The arithmetic is elementary; what it is applied to is not. AVAN built this after finding a wrong number on line 5 of a document that shipped beside 73 checks, 47 crosschecks and a 6-of-6 mutant gate, none of which read that file. The model says why that is not bad luck: coverage is reported as a fraction, and a fraction hides the only quantity that matters, which is the raw count of things nothing looks at. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE BACKDOOR · David Lee Wise (ROOT0), with AVAN


THE NAME OUTSIDE THE PARENS

A regular expression cannot count. Hand it something that nests and it does not refuse - it matches the part it can reach and returns that, with no sign the rest was ever there.

THE NAME OUTSIDE THE PARENS · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · GLITCH · UNDEFINED BEHAVIOR ◆ .dlw.fold THE FOLD / GLITCH / UNDEFINED BEHAVIOR / THE NAME OUTSIDE THE PARENS THE NAME OUTSIDE THE PARENS the wrong answer of the right type 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A regular expression cannot count. Hand it something that nests and it does not refuse — it matches the part it can reach and returns that, with no indication that the rest of the structure was ever there. LIT verified live. over all 196 balanced-parenthesis strings of up to six pairs — the Catalan numbers 1, 2, 5, 14, 42, 132 — a one-level nesting pattern spans the whole string in 6 cases, returns a partial match in 190 , and fails to match in 0 . It is wrong 96.9% of the time and silent 100% of the time. On the case that matters, dasum:dx((+ i 1)) , it returns (+ i 1) — the index survives and the array name is gone , because the name is the one component that sits outside every bracket. 2 HOW IT WAS WEAVED · AI + HUMAN That regular languages cannot recognise balanced parentheses is the pumping lemma, and is older than every tool this happens in. AVAN (AI) counted the failure modes rather than restating the theorem, because the theorem says the pattern is wrong and the count says it is quiet . The 0 is the whole finding: not one of 196 inputs produced a non-match. A pattern that failed loudly would be a nuisance; this one hands back a well-formed answer of the right type, and the loss shows up four call frames away as an unbalanced token stream naming neither parentheses nor names. 3 ONE DIMENSION 196 balanced strings. 190 wrong. 0 complaints. 4 TWO DIMENSIONS · INTERACTIVE Grow the nesting and watch the match stop keeping up. deeper ▶ shallower show the name case 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is: do not parse nesting with a regex. The inverse is that the danger is not the wrongness, it is the type . The pattern returns a string when a string was expected; nothing downstream can tell a truncated capture from a complete one, because both are strings and both are non-empty. Read backwards, the reason this bug is written again and again is that the failure is type-correct — and every safeguard we have, from static types to assertions to the shape of a return value, is watching the type. pause spin LIT over all 196 balanced-parenthesis strings of up to six pairs - the Catalan numbers 1, 2, 5, 14, 42, 132 - a one-level nesting pattern spans the whole string in 6 cases, returns a partial match in 190, and fails to match in 0, so it is wrong 96.9% of the time and silent 100% of the time; on the case that mattered, dasum:dx((+ i 1)), it returns (+ i 1) - the index survives and the array NAME is gone, because the name is the one component that sits outside every bracket FIG That regular languages cannot recognise balanced parentheses is the pumping lemma. AVAN counted the failure modes rather than restating the theorem, because the theorem says the pattern is wrong and the count says it is QUIET: not one of 196 inputs produced a non-match. A pattern that failed loudly would be a nuisance; this one hands back a well-formed answer of the right type, and the loss surfaces four call frames away as an unbalanced token stream naming neither parentheses nor names. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of UNDEFINED BEHAVIOR · David Lee Wise (ROOT0), with AVAN


THE ORIENTATION DOUBLE COVER

Two strips of six squares glued end to end, one straight and one with a half turn. Count corners, edges and faces and the two are indistinguishable. They are not the same object.

THE ORIENTATION DOUBLE COVER · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · RESPAWN · THE PHOENIX ◆ .dlw.fold THE FOLD / RESPAWN / THE PHOENIX / THE ORIENTATION DOUBLE COVER THE ORIENTATION DOUBLE COVER a census asked a question it cannot answer 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Two strips of six squares, glued end to end. One glued straight, one glued with a half turn. Count everything about them — corners, edges, faces — and the two are indistinguishable. They are not the same object. LIT verified live. building both as cell complexes: the annulus has 12 vertices, 18 edges, 6 faces; the twisted strip has 12 , 18 , 6 . Euler characteristic 0 = 0 . Every count agrees. Walking the boundary separates them immediately: the annulus has 2 rims of length 6 each, the twisted strip has 1 rim of length 12 — the same edges, joined into one circuit instead of two, and it takes 2× as long to come home. 2 HOW IT WAS WEAVED · AI + HUMAN The Möbius band, its non-orientability and its orientation double cover are classical, and the χ = 0 coincidence is standard. AVAN (AI) built the complexes and ran the walk rather than quoting the result, because the coincidence is the useful part and it is usually mentioned in passing. An audit performed by counting reports these two as the same object. Not approximately, not with low confidence — identically, on every count available. What separates them is not a bigger census but a different kind of observation: you have to travel. 3 ONE DIMENSION Every count identical. One walk tells them apart. 4 TWO DIMENSIONS · INTERACTIVE Walk the rim and see whether it closes on the first lap. straight / twisted step the walk ▶ reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that orientation is invisible to counting. The inverse is that a census is a local instrument being asked a global question . Vertices, edges and faces are all answerable by looking at one neighbourhood at a time and adding up; orientation is not answerable that way at any resolution, because every neighbourhood of the twisted strip is identical to a neighbourhood of the flat one. Read backwards, no amount of local checking accumulates into a global fact, and an auditor who only ever counts will report two different worlds as one. pause spin LIT building both as cell complexes gives the annulus 12 vertices, 18 edges and 6 faces and the twisted strip 12, 18 and 6 - Euler characteristic 0 = 0, every count agreeing - while walking the boundary separates them immediately, the annulus having 2 rims of length 6 each and the twisted strip 1 rim of length 12: the same edges joined into one circuit instead of two, taking 2x as long to come home FIG The Mobius band, its non-orientability and its orientation double cover are classical, and the chi = 0 coincidence is standard. AVAN built the complexes and ran the walk rather than quoting the result, because the coincidence is the useful part and is usually mentioned in passing. An audit performed by COUNTING reports these two as the same object - not approximately, but identically, on every count available. What separates them is not a bigger census but a different kind of observation: you have to travel. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE PHOENIX · David Lee Wise (ROOT0), with AVAN


THE SAFE DIRECTION

A checker can be wrong two ways. It can cry wolf, or it can wave something through. These are not symmetric, because only one of them brings a human to look.

THE SAFE DIRECTION · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · GLITCH · HEISENBUG ◆ .dlw.fold THE FOLD / GLITCH / HEISENBUG / THE SAFE DIRECTION THE SAFE DIRECTION only one kind of error summons a person 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A checker can be wrong two ways. It can cry wolf, or it can wave something through. These are not symmetric errors, because only one of them summons a human to come and look. LIT verified live. 10,000 items at a 5% defect rate is 500 defects. Under a policy where every flag is investigated and every pass is not, sweeping the false-alarm rate from 0 to 50% leaves the surviving defect count pinned at 50 — unchanged at every point, while the investigation load climbs from 0 to 4,750 . Sweeping the miss rate over the same range takes survivors from 0 to 250 , a straight line of slope 500 , exactly the defect count. One error direction costs effort and cannot cost correctness. The other costs correctness and is free. 2 HOW IT WAS WEAVED · AI + HUMAN The asymmetry between false positives and false negatives under an investigate-on-flag policy is standard decision theory. AVAN (AI) built this the day it happened. A null test on another program reported ‘ 0 of 3 refused’ when the program had refused all three; the fault was in the checker, which caught the wrong exception class. It was found within one run — because the alarming number sent someone looking. Had the same bug reported 3 of 3 when nothing was refused, nothing would have looked, and the sweep above says how long that lasts: indefinitely. 3 ONE DIMENSION Raise the false alarms: nothing breaks. Raise the misses: everything does. 4 TWO DIMENSIONS · INTERACTIVE Turn each dial and watch which one moves the survivors. false alarms + misses + reset both 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is to prefer a noisy checker over a quiet one. The inverse is that a checker’s error rate is not a property of the checker — it is a property of the checker and the policy together . The false alarm is harmless only because somebody looks; make investigation expensive enough that flags start being dismissed unread, and the two directions collapse into one. Read backwards, every ‘fail loudly’ design is quietly relying on an attention budget nobody measured, and it degrades into the silent kind the moment that budget runs out. pause spin LIT 10,000 items at a 5% defect rate is 500 defects, and under a policy where every flag is investigated and every pass is not, sweeping the false-alarm rate from 0 to 50% leaves the surviving defect count pinned at 50 at every point while the investigation load climbs from 0 to 4,750, whereas sweeping the miss rate over the same range takes survivors from 0 to 250 in a straight line of slope 500, exactly the defect count - one error direction costs effort and cannot cost correctness, the other costs correctness and is free FIG The asymmetry between false positives and false negatives under an investigate-on-flag policy is standard decision theory. AVAN built this the day it happened: a null test on another program reported '0 of 3 refused' when the program had refused all three, the fault being in the checker, which caught the wrong exception class. It was found within one run because the alarming number sent someone looking. Had the same bug reported 3 of 3 when nothing was refused, nothing would have looked, and the sweep says how long that lasts: indefinitely. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of HEISENBUG · David Lee Wise (ROOT0), with AVAN


THE FINGERPRINT MATCH

A guess reproduced an output character for character. That feels like proof. How much evidence it is depends on a number nobody computes: how many other outputs the guess could have produced.

THE FINGERPRINT MATCH · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · LOOT · THE JACKPOT ◆ .dlw.fold THE FOLD / LOOT / THE JACKPOT / THE FINGERPRINT MATCH THE FINGERPRINT MATCH evidence is measured in the alternatives you wrote down 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A guess reproduced an output character for character. That feels like proof. How much evidence it actually is depends entirely on a number nobody computes: how many other outputs the guess could have produced. LIT verified live. treating the 13 -character string as free text over a 96 -character alphabet gives odds of 5.9 × 10 25 to one — a number that means nothing, because a wrong reconstruction was never going to emit random bytes. Enumerating what it could plausibly emit instead — 3 function spellings × 7 argument forms × 3 bracketings × 2 paddings = 126 candidate paths — 2 of them land on the target, so the honest likelihood ratio is 126 / 2 = 63 to one. The naive figure overstates the evidence by a factor of 9.3 × 10 23 . Those 126 paths collapse to 120 distinct strings: 6 collisions, and the target is one of them. 2 HOW IT WAS WEAVED · AI + HUMAN Likelihood ratios and the base-rate problem are ordinary Bayesian practice. AVAN (AI) ran this on its own reasoning rather than in the abstract. Lacking the real tool, it reconstructed an input, and the reconstruction reproduced a documented failure exactly — and it then treated that match as sufficient grounds to proceed. This is the audit of that decision. 63 to one is good evidence and it is not the certainty the exactness felt like, and the gap between those two is the entire finding. The 2 was also a correction: the first count asserted a unique path and the enumeration found two. 3 ONE DIMENSION 5.9e25 to one, or 63 to one. Same match. 4 TWO DIMENSIONS · INTERACTIVE Add or remove ways the guess could have been wrong. more ways to be wrong fewer 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that an exact match is strong evidence. The inverse is that evidence is measured in the alternatives you bothered to write down , and the alternatives are supplied by the same person who made the guess. Widen the space and the ratio grows; narrow it and the same match becomes proof. Read backwards, the strength of a confirmation is a statement about the imagination of whoever enumerated the ways it could have gone otherwise — which is why a match found by someone who wanted it is worth so much less than the same match found by someone trying to break it. pause spin LIT treating the 13-character string as free text over a 96-character alphabet gives odds of 5.9 x 10^25 to one, a number that means nothing because a wrong reconstruction was never going to emit random bytes; enumerating what it could plausibly emit instead - 3 function spellings x 7 argument forms x 3 bracketings x 2 paddings = 126 candidate paths - finds 2 landing on the target, so the honest likelihood ratio is 126/2 = 63 to one and the naive figure overstates the evidence by a factor of 9.3 x 10^23, with those 126 paths collapsing to 120 distinct strings, 6 collisions, the target among them FIG Likelihood ratios and the base-rate problem are ordinary Bayesian practice. AVAN ran this on its own reasoning rather than in the abstract: lacking the real tool it reconstructed an input, the reconstruction reproduced a documented failure exactly, and it then treated that match as sufficient grounds to proceed. This is the audit of that decision. 63 to one is good evidence and it is not the certainty the exactness felt like. The 2 was also a correction - the first count asserted a unique path and the enumeration found two. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE JACKPOT · David Lee Wise (ROOT0), with AVAN


THE BELADY ANOMALY

Give a program more memory and it faults more often. Not as a pathology of a bad implementation - on the plainest replacement policy there is, doing exactly what it says.

THE BELADY ANOMALY · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · BOSS · THE WALL ◆ .dlw.fold THE FOLD / BOSS / THE WALL / THE BELADY ANOMALY THE BELADY ANOMALY more memory, more faults 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Give a program more memory and it faults more often. Not in theory, not as a pathology of a bad implementation — on the plainest replacement policy there is, first in first out, doing exactly what it says. LIT verified live. the classic reference string 1 2 3 4 1 2 5 1 2 3 4 5 takes 9 page faults with 3 frames and 10 with 4 . Searching for a shorter witness: over every reference string of length 1 to 11 on five pages with no immediate repeats — 6,990,505 strings, since a repeated reference is always a hit under any policy — the anomaly occurs 0 times. So the minimum length is exactly 12 . LRU cannot do it at any length: over 187,246 sampled strings the resident set at 3 frames was a subset of the set at 4 every single time, 0 violations. 2 HOW IT WAS WEAVED · AI + HUMAN László Bélády found this in 1969; the stack-algorithm property that exempts LRU is Mattson, Gecsei, Slutz and Traiger, 1970. AVAN (AI) went looking for a shorter witness and did not find one, which is the more useful result. The first search covered lengths up to 10 and reported 0 , and a gate written from intuition called that a failure — it was not, it was the answer. Pruning immediate repeats made length 11 reachable and it is also 0 . The LRU check tests the inclusion property rather than the fault count, because that is the actual reason LRU is safe, and a count that happened to agree would prove nothing. 3 ONE DIMENSION Seven million strings. The anomaly needs exactly twelve. 4 TWO DIMENSIONS · INTERACTIVE Step the reference string through both frame counts at once. step ▶ run to end reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that FIFO is simply a bad policy. The inverse is that the anomaly is a statement about what ‘more memory’ means, not about FIFO’s quality . LRU is immune because its resident set at k frames is always contained in its set at k+1 — adding a frame can only ever add a page. FIFO has no such guarantee, so its two configurations are not nested, they are merely different , and comparing their fault counts is comparing two unrelated caches. Read backwards, monotonic improvement was never a property of memory; it is a property of policies that keep their smaller self inside their larger one. pause spin LIT the classic reference string 1 2 3 4 1 2 5 1 2 3 4 5 takes 9 page faults with 3 frames and 10 with 4; searching for a shorter witness over every reference string of length 1 to 11 on five pages with no immediate repeats - 6,990,505 strings, since a repeated reference is always a hit under any policy - the anomaly occurs 0 times, so the minimum length is exactly 12, and LRU cannot do it at any length because over 187,246 sampled strings the resident set at 3 frames was a subset of the set at 4 every time, 0 violations FIG Laszlo Belady found this in 1969; the stack-algorithm property that exempts LRU is Mattson, Gecsei, Slutz and Traiger, 1970. AVAN went looking for a shorter witness and did not find one, which is the more useful result. The first search covered lengths up to 10 and reported 0, and a gate written from intuition called that a failure - it was not, it was the answer. The LRU check tests the INCLUSION property rather than the fault count, because that is the actual reason LRU is safe, and a count that happened to agree would prove nothing. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE WALL · David Lee Wise (ROOT0), with AVAN


THE PRIORITY INVERSION

The highest-priority task waits for a lock held by the lowest. A middle-priority task, holding no lock and wanting nothing, preempts the low one - and the highest task in the system now waits on the one it outranks.

THE PRIORITY INVERSION · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · RESPAWN · HARD RESET ◆ .dlw.fold THE FOLD / RESPAWN / HARD RESET / THE PRIORITY INVERSION THE PRIORITY INVERSION the highest waits on the lowest 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION The highest-priority task is waiting for a lock held by the lowest. A middle-priority task, holding no lock and wanting nothing, preempts the low one — and the highest-priority task in the system now waits on the one thing it outranks. LIT verified live. a low task holds a critical section of 10 ticks; a medium task runs for m ticks; a high task needs the lock. Without priority inheritance the high task’s delay is 10 + m — sweeping m from 0 to 100 gives a straight line of slope 1 , ending at 110 . With inheritance the low task temporarily runs at high priority, the medium task cannot preempt it, and the delay is 10 at every point on the sweep — flat, bounded by the critical section alone. Across all 50 medium-runtimes tested, 50 are inverted without inheritance and 0 with it. 2 HOW IT WAS WEAVED · AI + HUMAN Priority inversion and the priority-inheritance and priority-ceiling protocols are Sha, Rajkumar and Lehoczky, 1990. The famous instance is Mars Pathfinder , July 1997: the lander kept resetting on Mars and the cause was an inversion on a shared information bus, fixed by enabling inheritance on an already-shipped mutex. AVAN (AI) reports the shape rather than the anecdote. The number that matters is the slope : without inheritance the high-priority task’s delay is a function of a task it has nothing to do with, so the bound is not merely large, it is not a bound at all — it is whatever the middle of the system happens to be doing. 3 ONE DIMENSION Bounded by the lock, or bounded by a stranger. 4 TWO DIMENSIONS · INTERACTIVE Give the medium task more work and watch who pays for it. medium task +10 toggle inheritance reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that inheritance fixes the inversion. The inverse is that priority was never a property of a task — it is a property of a task and everything it happens to be waiting on . A scheduler assigns numbers to threads; the lock silently rewrites them, so the effective priority of the high task becomes the priority of whoever holds what it needs. Read backwards, inheritance does not repair a broken scheduler; it makes the scheduler’s numbers mean what they already claimed to mean, and a system without it has a priority ordering that is decorative below the first shared resource. pause spin LIT a low task holds a critical section of 10 ticks, a medium task runs for m ticks, and a high task needs the lock: without priority inheritance the high task's delay is 10 + m, so sweeping m from 0 to 100 gives a straight line of slope 1 ending at 110, while with inheritance the low task temporarily runs at high priority, the medium task cannot preempt it, and the delay is 10 at every point on the sweep - and across all 50 medium-runtimes tested, 50 are inverted without inheritance and 0 with it FIG Priority inversion and the inheritance and ceiling protocols are Sha, Rajkumar and Lehoczky, 1990. The famous instance is Mars Pathfinder, July 1997: the lander kept resetting on Mars, the cause was an inversion on a shared information bus, and the fix was enabling inheritance on an already-shipped mutex. AVAN reports the shape rather than the anecdote. The number that matters is the SLOPE: without inheritance the delay is a function of a task it has nothing to do with, so the bound is not merely large, it is not a bound at all. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of HARD RESET · David Lee Wise (ROOT0), with AVAN


THE CONDITION NUMBER

THE CONDITION NUMBER · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · GLITCH · DIVIDE BY ZERO ◆ .dlw.fold THE FOLD / GLITCH / DIVIDE BY ZERO / THE CONDITION NUMBER THE CONDITION NUMBER the residual is small and every digit is wrong 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION A small residual is the thing everyone checks and it proves almost nothing. Plug a badly wrong answer into a near-singular system and the equations come out satisfied to fifteen decimal places. LIT verified live. for A = [[1,1],[1,1.0001]] the determinant is 1.0e-4 and the condition number is κ = 40,004 . Perturbing the right-hand side by a relative 10 -10 over 2,000 random directions, the worst relative change in the solution is 40,002 times larger — within 0.005% of κ, which is exactly the bound doing its job. And a deliberately wrong answer, off by 1.414 in norm, leaves a residual of 1.0e-4 : the error is 14,142 times the residual, so a check on ‖Ax−b‖ reports success while every digit of x is wrong. 2 HOW IT WAS WEAVED · AI + HUMAN The condition number, the perturbation bound and the residual/error distinction are the first chapter of numerical linear algebra — Wilkinson, and Higham’s Accuracy and Stability . AVAN (AI) measured the amplification rather than quoting the bound, because a bound is an upper limit and the question is whether it is attained. It is: 40,002 against a κ of 40,004 . The second number is the one worth carrying — the residual is what a program can compute without knowing the answer, and it is precisely the quantity that stays small when the answer is wrong, because a nearly-singular matrix maps a large error onto a small one by construction. 3 ONE DIMENSION The residual is small. Every digit is wrong. 4 TWO DIMENSIONS · INTERACTIVE Nudge the matrix toward singular and watch both numbers move. more singular ▶ less 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that ill-conditioning amplifies error. The inverse is that the amplification and the reassurance are the same map . A squashes a large change in x into a small change in b — that is what near-singular means — and the residual is computed by applying A . So the very property that makes the answer untrustworthy is the property that makes the check come back clean, and it is not a coincidence or a weakness in the check: no function of Ax−b can do better, because A has already thrown the information away. pause spin LIT for A = [[1,1],[1,1.0001]] the determinant is 1.0e-4 and the condition number is 40,004; perturbing the right-hand side by a relative 1e-10 over 2,000 random directions, the worst relative change in the solution is 40,002 times larger - within 0.005% of kappa, the bound doing its job - and a deliberately wrong answer off by 1.414 in norm leaves a residual of 1.0e-4, so the error is 14,142 times the residual and a check on the residual reports success while every digit of x is wrong FIG The condition number, the perturbation bound and the residual/error distinction are the first chapter of numerical linear algebra - Wilkinson, and Higham's Accuracy and Stability. AVAN measured the amplification rather than quoting the bound, because a bound is an upper limit and the question is whether it is attained. It is: 40,002 against a kappa of 40,004. The residual is what a program can compute without knowing the answer, and it is precisely the quantity that stays small when the answer is wrong. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of DIVIDE BY ZERO · David Lee Wise (ROOT0), with AVAN


THE SHEWCHUK PREDICATE

THE SHEWCHUK PREDICATE · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · GLITCH · SEGFAULT ◆ .dlw.fold THE FOLD / GLITCH / SEGFAULT / THE SHEWCHUK PREDICATE THE SHEWCHUK PREDICATE 289 points collapsed onto one line 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Is this point left of that line, right of it, or on it? Three answers, and a geometry program is built entirely out of them. In floating point the question does not reliably have an answer at all. LIT verified live. take q = (12,12) , r = (24,24) and p on a 17×17 grid of one-ulp steps around (0.5, 0.5) — 289 points. Computing the orientation determinant in double precision and again exactly in integer arithmetic, the two disagree on 272 of them: 94.1% . The floating-point predicate reports every one of the 289 points as lying exactly on the line. 17 of them actually do. The products are around 270 and the true determinant is around 10 -15 , so the subtraction has nothing left to subtract. 2 HOW IT WAS WEAVED · AI + HUMAN The failure of naive geometric predicates is Kettner, Mehlhorn, Pion, Schirra and Yap (2008); the adaptive exact-arithmetic fix is Jonathan Shewchuk (1997), and it is why CGAL exists. AVAN (AI) computed the exact answer with big integers rather than a higher-precision float, because a longer float is another approximation and would only move the grid. The first attempt found 0 disagreements — the coordinates were close together, so the subtraction was exact and no error was possible. That failure was the useful one: it says the danger is not small numbers but large numbers that nearly cancel . One honest note: an antisymmetry check on the float predicate passes 49 of 49 , and it passes because every answer is zero and zero is its own negation. 3 ONE DIMENSION 289 points. It calls all of them collinear. 17 are. 4 TWO DIMENSIONS · INTERACTIVE Move the point one ulp at a time across the line. k + 1 m + 1 reset 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that exact predicates fix the geometry. The inverse is that the failure is not error, it is collapse . A wrong sign would be a bug you could measure and bound; what happens instead is that a two-dimensional neighbourhood is reported as a one-dimensional line, and a program built on that predicate does not compute a slightly wrong hull — it computes on a world where 289 distinct points are the same point. Read backwards, the guarantee a geometric algorithm needs is not accuracy in the answer but consistency between answers , and consistency is exactly what an approximation cannot promise no matter how many digits it is given. pause spin LIT taking q = (12,12), r = (24,24) and p on a 17x17 grid of one-ulp steps around (0.5, 0.5) - 289 points - and computing the orientation determinant in double precision and again exactly in integer arithmetic, the two disagree on 272 of them, 94.1%: the floating-point predicate reports every one of the 289 points as lying exactly on the line, and 17 of them actually do, because the products are around 270 while the true determinant is around 1e-15 and the subtraction has nothing left to subtract FIG The failure of naive geometric predicates is Kettner, Mehlhorn, Pion, Schirra and Yap (2008); the adaptive exact-arithmetic fix is Jonathan Shewchuk (1997), and it is why CGAL exists. AVAN computed the exact answer with big integers rather than a higher-precision float, because a longer float is another approximation and would only move the grid. The first attempt found 0 disagreements - the coordinates were close together, so the subtraction was exact - and that failure was the useful one: the danger is not small numbers but large numbers that nearly cancel. One honest note: an antisymmetry check on the float predicate passes 49 of 49, and it passes because every answer is zero and zero is its own negation. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SEGFAULT · David Lee Wise (ROOT0), with AVAN


THE SUCCINCT RANK

How many 1s appear before position i in a bit array? Counting is linear. Answering instantly usually costs a word per bit. There is a third option that costs a fraction and answers in a fixed number of touches.

THE SUCCINCT RANK · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · LOOT · THE HOARD ◆ .dlw.fold THE FOLD / LOOT / THE HOARD / THE SUCCINCT RANK THE SUCCINCT RANK three touches, wherever you ask 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION How many 1s appear before position i in a bit array? Answering it by counting is linear. Answering it instantly usually costs a word per bit. There is a third option that costs a fraction, and answers in a fixed number of touches. LIT verified live. over 1,048,576 bits containing 524,772 ones, a two-level index of 256 superblock counters and 16,384 block counters occupies 270,336 bits — 25.8% of the data. Every query is answered in exactly 3 memory touches: one superblock, one block, one masked popcount, regardless of where i falls. Checked against a naive running count at every one of the 1,048,576 positions: 0 mismatches. 2 HOW IT WAS WEAVED · AI + HUMAN Two-level rank indexes are Jacobson (1989) and Clark (1996); the whole succinct-structures programme follows from them. AVAN (AI) reports the overhead as 25.8% rather than calling this succinct, because at this size it is not. The o(n) result needs the block size to grow with log n , and at 2 20 bits the constant factors are still in charge — the asymptotics are real and this measurement does not demonstrate them. What it does demonstrate is the part that is true at every size: 3 touches, verified at every position rather than sampled, because an index that is right at 99.99% of positions is not an index. 3 ONE DIMENSION 1,048,576 positions checked. Three touches each. 4 TWO DIMENSIONS · INTERACTIVE Change the block size and watch space trade against nothing. bigger blocks smaller blocks 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object. AVAN’s addition (the inverse-companion): the forward reading is that a clever index buys constant-time rank cheaply. The inverse is that it is not the index that is clever, it is the popcount . The two levels only get you to within one block; the last step is counting the bits of a single word, and that is O(1) solely because the hardware has an instruction for it. Read backwards, this data structure is a negotiation with a particular machine — move the block size away from the word size and the ‘constant’ grows a loop — and a great deal of what is called algorithmic constant time is an instruction somebody put in silicon. pause spin LIT over 1,048,576 bits containing 524,772 ones, a two-level index of 256 superblock counters and 16,384 block counters occupies 270,336 bits - 25.8% of the data - and every query is answered in exactly 3 memory touches, one superblock, one block and one masked popcount, regardless of where i falls; checked against a naive running count at every one of the 1,048,576 positions, 0 mismatches FIG Two-level rank indexes are Jacobson (1989) and Clark (1996). AVAN reports the overhead as 25.8% rather than calling this succinct, because at this size it is not: the o(n) result needs the block size to grow with log n, and at 2^20 bits the constant factors are still in charge, so the asymptotics are real and this measurement does not demonstrate them. What it does demonstrate is true at every size - 3 touches, verified at every position rather than sampled, because an index that is right at 99.99% of positions is not an index. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE HOARD · David Lee Wise (ROOT0), with AVAN


THE DODGSON

Dodgson condensation in the 5-window house format — Lewis Carroll's 1866 algorithm for the determinant, which skips the cofactor tree entirely. Replace every 2×2 window of an n×n matrix by its own little determinant, divide entrywise by the interior of the previous matrix, and repeat: the single number left at the top is the determinant. The engine underneath is the Desnanot–Jacobi identity. Verified live by an independent exact-integer Laplace expansion: over thousands of random 3×3 to 6×6 integer matrices, condensation returns exactly the same big-integer determinant, and Desnanot–Jacobi holds with zero error. The known limitation is measured rather than hidden — when an interior entry is zero the division is undefined and the method stalls, which happens on roughly a third of random integer matrices here, and the page counts them. Neon-noir traced. See the cascade shrink in 1D, condensation checked against cofactors in 2D, and the shrink-inward-instead-of-expanding inverse in 3D.

THE DODGSON · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CHEAT · THE SPEEDRUN ◆ .dlw.fold THE FOLD / CHEAT / THE SPEEDRUN / THE DODGSON THE DODGSON a determinant shrunk out of 2x2 windows 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION Dodgson condensation is Charles Dodgson’s (Lewis Carroll’s) 1866 algorithm for the determinant, and it works by shrinking the matrix one ring at a time. Replace every 2×2 window of an n×n matrix by its own little determinant — that gives an (n−1)×(n−1) matrix — then divide entrywise by the interior of the previous matrix , and repeat until a single number is left. That number is the determinant. No cofactor expansion, no row reduction, no fractions if the divisions stay exact: just 2×2 minors and a division. The engine underneath is the Desnanot–Jacobi identity , which says det(M)·det(M with first+last rows and columns removed) = det(M₋₋)det(M⁺⁺) − det(M₋⁺)det(M⁺₋) — the exact bookkeeping that makes the shrink legal. LIT verified live: over thousands of random integer matrices of size 3×3 to 6×6, Dodgson condensation returns exactly the same big-integer determinant as an independent cofactor (Laplace) expansion — and the Desnanot–Jacobi identity itself holds with zero error in exact integer arithmetic (window.__dodgson). FIG no framing. The honest caveat is measured too, not hidden: when an interior entry hits zero the division is undefined and the method stalls — that happens on roughly a third of random integer matrices here, and the page counts them rather than quietly skipping them. 2 HOW IT WAS WEAVED · AI + HUMAN David (human) seated this at the-speedrun — the cheat that skips the whole cofactor tree and runs the determinant down a ladder of 2×2 windows. AVAN (AI) built the instrument: the condensation cascade, an independent exact-integer Laplace expansion to check it against, the direct Desnanot–Jacobi test, and the stall counter. Credit as content: Charles Lutwidge Dodgson, Condensation of Determinants (1866); the underlying identity is Desnanot’s and Jacobi’s. The weave: David names the speedrun; I confirm the shortcut lands on exactly the same determinant — and report where it refuses to run. 3 ONE DIMENSION The cascade: 5×5 → 4×4 → 3×3 → 2×2 → one number. Each step is 2×2 minors divided by the previous interior. 4 TWO DIMENSIONS · INTERACTIVE New matrices; condensation is checked against an independent exact cofactor expansion. new matrix ▶ verify ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object: the single number at the top of the condensation pyramid — the determinant. AVAN’s addition (the inverse-companion): do not expand the determinant outward into n! signed products — shrink it inward. The inverse of ‘sum over every permutation’ is ‘a pyramid of 2×2 windows, each divided by the one below it’. Magenta is the matrix being eaten ring by ring; green is the apex the whole determinant collapses to. A determinant with no permutations in sight. pause spin LIT Genuine Dodgson condensation (Charles Lutwidge Dodgson, 'Condensation of Determinants', 1866) resting on the Desnanot–Jacobi identity. Verified live: over 3,000 random integer matrices of size 3×3 to 6×6, condensation equals an independent exact big-integer cofactor expansion on every matrix that does not stall, and the Desnanot–Jacobi identity itself is exact on 600 further matrices; the ~1/3 of draws that stall on a zero interior entry are counted and reported, not skipped (window.__dodgson.ok, .tested, .agree, .stalls). FIG No framing; the condensation cascade and the cofactor expansion both run in-browser in exact integer arithmetic and are compared digit for digit. The stall rate is a measured limitation of the method, not a defect of the page. The AVAN inverse is honest — instead of expanding a determinant outward into n! signed products, shrink it inward: the inverse of 'sum over every permutation' is 'a pyramid of 2×2 windows, each divided by the one below it'. Magenta is the matrix being eaten ring by ring; green is the apex it collapses to. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE SPEEDRUN · David Lee Wise (ROOT0), with AVAN


THE MACWILLIAMS

The MacWilliams identity in the 5-window house format — the theorem that says you never have to look at the dual code. Every linear code C has a dual C⊥, and each has a weight enumerator: the tally of how many codewords carry 0 ones, 1 one, 2 ones, and so on. Jessie MacWilliams proved in 1963 that the dual's entire tally is a fixed linear transform of the primal's, B_j = (1/|C|)·Σ_i A_i·K_j(i), where K_j is the Krawtchouk polynomial. Count one side and the other side is already known, even when the dual is astronomically larger. Verified live: for Hamming(7,4) the brute-forced dual — the [7,3] simplex code, tally 1,0,0,0,7,0,0,0 — is reproduced exactly by the Krawtchouk transform of the primal tally 1,0,0,7,7,0,0,1, and over 400 random binary linear codes the transform matches a brute enumeration of the dual with zero error in whole numbers. Neon-noir traced. See the two tallies in 1D, random codes checked both ways in 2D, and the count-once-know-twice inverse in 3D.

THE MACWILLIAMS · WORLD II — THE FOLD ◀ THE FOLD 0ROOT.AI // WORLD II · CO-OP · THE BROADCAST ◆ .dlw.fold THE FOLD / CO-OP / THE BROADCAST / THE MACWILLIAMS THE MACWILLIAMS a dual code counted without ever listing it 1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION The MacWilliams identity is one of the quiet marvels of coding theory: you never have to look at the dual code . Every linear code C has a dual C⊥ — all the words orthogonal to everything in C — and each has a weight enumerator , the tally of how many codewords have 0 ones, 1 one, 2 ones, and so on. Jessie MacWilliams proved in 1963 that the dual’s entire tally is a fixed linear transform of the primal’s: B₃ = (1/|C|)·Σₕ Aₕ·K₃(i), where K₃ is the Krawtchouk polynomial K₃(i) = Σₛ (−1)ₛ·C(i,s)·C(n−i,j−s). Count one side, and the other side is already known — even when the dual is astronomically large. LIT verified live: for the Hamming(7,4) code the brute-forced dual (the [7,3] simplex code, weights 1,0,0,0,7,0,0,0) is reproduced exactly by the Krawtchouk transform of the primal tally 1,0,0,7,7,0,0,1 — and over hundreds of random binary linear codes the transform matches a brute enumeration of the dual with zero error, in whole numbers (window.__macwilliams). FIG no framing; the dual is enumerated the slow way and computed the MacWilliams way, and the two integer vectors are compared entry by entry. 2 HOW IT WAS WEAVED · AI + HUMAN David (human) seated this at the-broadcast — the co-op cell where one side speaks and the other already knows what was said: the primal broadcasts its weight tally, and the dual’s whole tally arrives with it. AVAN (AI) built the instrument: the code and dual enumerators, the Krawtchouk transform, and the entry-by-entry integer comparison. Credit as content: Florence Jessie MacWilliams (1963); Mikhail Krawtchouk for the polynomials. The weave: David names the broadcast; I confirm that counting one code counts its dual too. 3 ONE DIMENSION Hamming(7,4) weight tally (magenta) and its dual the simplex code (green) — the second read off the first. 4 TWO DIMENSIONS · INTERACTIVE New random linear codes; the dual is both enumerated and transformed, then compared. new code ▶ verify ▶ 5 THREE DIMENSIONS + AVAN’S INVERSE The green forward object: the dual’s weight tally, obtained without ever listing the dual. AVAN’s addition (the inverse-companion): do not enumerate the other code — transform this one. The inverse of ‘list all 2ⁿ⁻ᵏ dual codewords and count their weights’ is ‘one Krawtchouk matrix applied to the tally you already have’. Magenta is the primal tally; green is the dual tally the transform hands you. Count once, know twice. pause spin LIT Genuine MacWilliams identity (Florence Jessie MacWilliams, 1963; Krawtchouk polynomials after Mikhail Krawtchouk). Verified live: the Hamming(7,4) dual weight enumerator obtained by brute enumeration equals the Krawtchouk transform of the primal enumerator exactly, and over 400 random binary linear codes with n=4..9 the transformed tally matches the brute-enumerated dual tally entry for entry in integers (window.__macwilliams.ok, .pass, .tot). FIG No framing; the dual is enumerated the slow way and computed the MacWilliams way, and the two integer vectors are compared entry by entry in-browser. The AVAN inverse is honest — instead of listing all dual codewords and counting their weights, transform the tally you already have: the inverse of 'enumerate the other code' is 'one Krawtchouk matrix applied to this one'. Magenta is the primal tally; green is the dual tally the transform hands you. ◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE BROADCAST · David Lee Wise (ROOT0), with AVAN