[AdaWorldAPI]

⊘ Correction (2026-10-23, plan §10, commits e10523afb, 46ced03f4). In this description, "R2IL" means lance-graph-r2il::FoldDialect and its procedures. That crate is only the fold reading of R2IL. R2IL itself is an opcode table (ogar-r2il) with two readings:

• machine (0xC400): r2sleigh's r2conc / r2sym;
• fold (0xC401): FoldDialect over mask-risc.

The 94–99 ns and 171–172 ns figures are what the mask-risc and FoldDialect paths cost when chosen per call. They are not the cost of R2IL routing: a route resolved once per ClassId runs at the direct ndarray::simd cost (see D-MPF-4 below).

Lab crate plus board records. This adds no primitive, IR or executor, and it does not touch ONNX. It is independent of the three competing S0 plans (#1744, #1745, #1750) and does not choose between them.

Finding

The Stage 1 mathematical polyfill API already ships:

• the R2IL procedure layer, lance-graph-r2il::procs: selection, comparisons, NULL presence, COUNT/SUM/MIN/MAX, set operations;
• checked scalar arithmetic in FoldDialect: IntAdd, IntSub, IntMult, IntSDiv;
• mask-risc as the engine underneath;
• relalg as the frontend that rewrites before lowering.

Plan: .claude/plans/d-mpf-math-polyfill-v1.md.

Probe (crates/math-polyfill-probe)

• The expression is E = SUM(v | sel) − k·COUNT(sel), with sel = valid(v) ∧ x ≥ lo ∧ y < hi. It is written only with the existing procedures and scalar calls.
• The oracle is an i128 row loop that shares no code with the procedures, the dialect or mask-risc.

tests/polyfill.rs (9 tests):

• E equals the oracle at 64, 1 000, 4 096 and 65 537 rows, for empty, partial and full selections and four multipliers.
• An anti-vacuity check: the cases really cover an empty selection, a strict subset, and NULL rows inside the selected range.
• A check that the NULL plane changes the answer.
• relalg and the procedures count the same rows.
• Typed refusals: lane + lane arithmetic, unsigned compare, overflow (with a fitting product accepted), an expression whose value does not fit i64, and division by zero.

Disable runs, each committed before the run with its edit anchor asserted:

run	edit	tests that turned red
D1	drop the NULL gate	3
D2	≥ → >	2
D3	IntSub → IntAdd	1

Cost split (reported, not gated)

examples/cost_split.rs. Median ns per call, three runs on a 4-core container:

rows	mask-risc exec	dialect count	whole expression	scalar oracle
64	116–129	271–279	576–627	78–86
4 096	1 056–1 246	982–1 116	3 197–3 599	5 237–6 430
65 536	17 102–18 534	15 196–15 785	56 625–59 361	91 886–96 264

• Per row, the target is met. At 64 K rows the expression costs 0.86–0.91 ns/row and is 1.6× faster than the scalar loop. (⊘ superseded by D-MPF-2: that loop was the i128 oracle; an equal-work i64 loop is ~3× faster than the fold.)
• Per call on a single 64-bit word, it is not. One fold costs about 120 ns in mask-risc plus about 150 ns in the dialect, so the scalar loop is faster than the whole expression. Nanosecond-scale hot execution is therefore not met for one-word populations through these paths (see D-MPF-4).

Gaps, each shown by a failing case

• G1: no element-wise value arithmetic. Needs an owner decision.
• G2: no unsigned compare. (⊘ In the fold reading. ndarray has lt/le/gt/ge_u64_to_mask; the refusal is a mask-risc gap for U64 lanes.)
• G3: no float lane.
• G4: about 270 ns of fixed cost per fold on a single word. The next probe, D-MPF-2, attributes it before anything changes.

The ONNX fork AdaWorldAPI/optimum-onnx-rs is empty, and AdaWorldAPI/onnx is not accessible, so there is no ONNX integration surface to wire yet.

Checks run

• cargo fmt --check
• cargo clippy --release --all-targets -- -D warnings
• cargo test --release: 9/9
• entries_index.py --write; fruits_index.py --check passes
• citation_decay.py: 0 new decays
• append_only_gate.py: OK

New CI workflow math-polyfill-probe.yml.

D-MPF-2 — where the cost goes (commit 0a6f54c7c, measured, nothing changed)

Every arm is checked against the i128 oracle at every size before timing. Host: AVX-512, target-cpu=native.

• Per call at 64 rows (~172 ns total):

  layer	cost
  scalar i64 loop, for comparison	12 ns
  ndarray floor	39 ns
  mask-risc execution	+57 ns
  Program::new	+20 ns, 1 allocation
  dialect	+50 ns

• Per row at 64 K rows:

  • mask-risc costs about the same as the ndarray floor.
  • The floor's cost is ndarray::simd::masked_sum_i32, a scalar set-bit walk.
  • Its time tracks popcount: 1.7 / 25 / 44 µs at 0 / 50 / 100 % selected.

• LLVM (codegen-witness.sh, modelled on ndarray's):

  • masked_sum_i32 is a tzcnt/blsr walk with no vector register.
  • gt_i32_to_mask is one vpcmpltd + kmov per 16 lanes.
  • A branch-free sum vectorizes.

• Correction: the earlier "1.6× faster than the scalar loop" was measured against the i128 filter-chain oracle. An equal-work i64 loop is ~3× faster than the fold.

• Proposed, not made: a density-chosen masked_sum_i32 body (owner: ndarray::simd). Sum branch-free when a word has more than ~16 set bits, keep the walk otherwise.

  • The branch-free form equals the oracle and is flat in selectivity.
  • The walk stays 7–10× faster on empty words.

• Second proposal, not made: reuse the dialect's ops vector across folds to remove its one allocation per fold (owner: r2il). (⊘ An existing facility already removes the whole dialect pass for a fixed query: keep last_program() as a CompiledProgram; D-MPF-4.)

• Still open: whether the mask form beats a scalar loop when the mask is reused or combined. (⊘ Measured in D-MPF-2b below.)

Plan §7 has the full tables.

D-MPF-2b — hybrid masked sum and mask reuse (commits 0834609fc, 6efc2743e; plan §9)

Those commits call this D-MPF-3. On the board that id is G1, so it is renamed D-MPF-2b.

• A per-word density threshold (16 set bits) over masked_sum_i32: 2–3.7× faster on uniform masks, 4–5× on clustered ones, and never slower than the walk.
• Reusing one mask across count/sum/min/max: ~2× when sparse. At 50 % selected a fused scalar pass is 6× faster, because min and max still walk the set bits.
• Proposal for the ndarray::simd owner only; nothing in ndarray changed.

D-MPF-4 — R2IL as a ClassId-lazily-bound router (plan §10)

Attribution. Five different things are called R2IL:

• r2sleigh's r2il: IL types only;
• the machine reading: r2conc / r2sym;
• ogar-r2il: the opcode table;
• lance-graph-r2il::FoldDialect: the fold reading;
• mask-risc / ndarray::simd / simd_runtime.

The earlier single-digit-ns figures are all direct kernels. The relevant one is ndarray::simd AND, AND, popcount over 4 words: 2.2–2.8 ns, against 54–70 ns for count_and(3) through r2il + mask-risc (entries/2026-10-21-d-rft-1-cost-breakdown.md).

Routing table (plan §10.3). Every wired fold-reading op is either DIRECT or COMPOSE onto existing ndarray::simd entrypoints, or refused. LOWER (R2Sleigh) is needed only for machine semantics: carry/borrow flags, address-space load/store, branches, width-exact integers. Floats, atomics and CallOther are refused by r2conc itself. Certification (egglog) is separate and runs before execution, never per call.

Probe examples/classid_route.rs. ClassId → LazyLock → callable copied into the binding → direct kernel. Frame, focus and scope are checked on every run by the DR lab's FrameStore::check. ns per call, two runs:

rows	direct nd	route	route, no guard	LazyLock + match per call	mr prepared	r2il prepared	dialect	onnx wrapper
64	36–39	61–67	36–39	37–39	85–94	85–91	167	204–219
512	185–203	199–223	185–203	186–192	229–249	229–250	358–381	344–395

• The prebound route matches direct ndarray. The remaining 27–28 ns is the guard, which allocates nothing: objdump shows four atomic RMWs in FrameStore::check, from Arc::downgrade.
• "r2il prepared" is the existing facility: run FoldDialect once and keep its last_program() as a CompiledProgram. It equals prepared mask-risc. The remaining ~50 ns over direct ndarray is mask-risc's per-call precheck / validate.
• Asserted:
  • one resolution per ClassId;
  • 0 route evaluations and 0 allocations in steady state;
  • LOWER and REFUSE refused at bind;
  • focus, scope and source changes refused at run;
  • rebinding does not re-resolve the route.
• Three disable runs went red.
• LLVM: probe_route_run is the guard followed by a tail jmpq *80(%rax) into the stored callable. There is no LazyLock, Once or backend match on that path.
• Proposal, not made (DR lab owner): compare Weak::as_ptr with Arc::as_ptr in FrameStore::check. Identity semantics are unchanged and the atomics go away.
• Adds no ABI, interpreter or dispatcher to any production crate.

D-NFC cross-reference

This PR is layer [1] of the canonical dependency diagram in #1753. (⊘ Layer [1] is the R2IL router. The procedures and FoldDialect measured here are one strategy beneath it, not the layer itself; #1753's diagram is being corrected to match.) The PR stays in draft pending independent review. The 50 ns one-word target is not met through the mask-risc and FoldDialect paths. The fair i64 scalar baseline supersedes the earlier 1.6× claim (plan §7–§8).

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 45fbfc1a-c7c4-426f-8104-dadd6e5b14b8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T22:19:01.572295Z	46ced03	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46ced03f44

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check overflow in the expression's final subtraction

When the product fits i64 but the final subtraction does not, this expression silently returns a wrapped answer in release builds instead of the promised typed refusal. For example, one selected, present row with v = -2 and k = i64::MAX produces oracle = (1, None) but eval = Ok(i64::MAX) (reproduced against the release build). The existing FoldDialect::INT_SUB implementation uses unchecked x - y, unlike its checked multiplication. Ensure this subtraction is checked and add a boundary case that overflows at subtraction rather than multiplication.

Useful? React with 👍 / 👎.

[AdaWorldAPI]

Confirmed and fixed in 4dc44a4c1. FoldDialect's IntSub was an unchecked x - y. It now uses checked_sub and refuses with FoldError::Overflow(INT_SUB), the same as IntAdd and IntMult.

Your case (one row, v = -2, k = i64::MAX) returned Ok(i64::MAX) before the fix. It is now the test an_expression_that_overflows_at_the_subtraction_is_refused, paired with a version that fits and still answers. The r2il refusal table also gains two IntSub rows.

The r2il, relalg, r2il-mask-abi-probe and math-polyfill-probe test suites pass.

---

Generated by Claude Code