THE FOLD / CO-OP / SHARED MEMORY / THE RESTRICT KEYWORD
THE RESTRICT KEYWORD
a promise nothing can check
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
restrict is a promise, made by you, that two pointers never touch the same object. The compiler cannot check it. It can only believe you, keep values in registers, and produce a different answer if you were wrong.LIT verified live. adding two length-8 vectors into an output that overlaps the input by a shift k: the honest loop reloads on every iteration, the loop compiled under a
restrict promise reads the input once. At shift 0 — fully in place — the two agree, 0 positions differ. At shift 8 — disjoint, the promise true — they agree, 0 differ. In between they differ in exactly 8−k positions: 7, 6, 5, 4, 3, 2, 1. The damage is exactly the size of the overlap, and both endpoints are silent.2 HOW IT WAS WEAVED · AI + HUMAN
restrict is C99 6.7.3.1; it is the reason Fortran vectorised better than C for two decades, since Fortran forbids aliasing by default.AVAN (AI) swept the whole overlap rather than showing the broken case, because the endpoints are the finding. A test with disjoint arrays passes; a test done fully in place also passes; the failure lives strictly between them and scales linearly with how wrong the promise was. A keyword whose violation is undetectable, silent at both extremes and proportional in the middle is not a sharp edge — it is a gradient, and gradients do not get caught by a test that samples the ends.
3 ONE DIMENSION
The damage is exactly the size of the overlap.
4 TWO DIMENSIONS · INTERACTIVE
Slide the output across the input and watch the error grow.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object.
AVAN’s addition (the inverse-companion): the forward reading is that
restrict lets the compiler keep values in registers. The inverse is that it is the one place C asks you to prove something and then does not look at the proof. Every other type error is checked; this one is a sworn statement. Read backwards, the keyword is not an optimisation hint, it is a transfer of liability — the compiler gains speed, you gain the obligation, and the only instrument that can detect the breach is the wrong answer itself, arriving later, in proportion to how wrong you were.LIT adding two length-8 vectors into an output overlapping the input by a shift k, the honest loop reloads every iteration while the loop compiled under a restrict promise reads the input once: at shift 0, fully in place, 0 positions differ, and at shift 8, disjoint and the promise true, 0 differ - but in between they differ in exactly 8-k positions, 7, 6, 5, 4, 3, 2, 1, so the damage is exactly the size of the overlap and both endpoints are silent
FIG restrict is C99 6.7.3.1; it is the reason Fortran vectorised better than C for two decades, since Fortran forbids aliasing by default. AVAN swept the whole overlap rather than showing the broken case, because the endpoints are the finding: a test with disjoint arrays passes, a test done fully in place also passes, and the failure lives strictly between them and scales linearly with how wrong the promise was. A gradient does not get caught by a test that samples the ends.
FIG restrict is C99 6.7.3.1; it is the reason Fortran vectorised better than C for two decades, since Fortran forbids aliasing by default. AVAN swept the whole overlap rather than showing the broken case, because the endpoints are the finding: a test with disjoint arrays passes, a test done fully in place also passes, and the failure lives strictly between them and scales linearly with how wrong the promise was. A gradient does not get caught by a test that samples the ends.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SHARED MEMORY · David Lee Wise (ROOT0), with AVAN