#915's write-path gate arms per EigsState and monotonically: one predicate read — or a bare "report" string — anywhere in an interpreter state arms entropy bookkeeping for every assignment in every module

[InauguralPhysicist]

Found by the phugoid consumer (rung-3 autopilot), blind-critic rounds 10–11, 2026-08-25, eigenscript v0.41.0 / EigenScript@301026d. Gap ledger: phugoid GAPS.md G7.

Corrected 2026-08-25. The first version of this issue said the arming was module-granular and suggested splitting observer-reading code into its own module. Both were wrong — round 11 refuted them from the source and the runtime. See the correction comment; this body is the corrected version.

Summary

#915 (merged as PR #1034) makes observed scalar writes nearly free when a program uses no observer features. obs_needed is a single flag on EigsState (src/eigenscript.h:561), set in compile_ast (src/compiler.c:3717) and documented there as "Monotonic: a later unit that reads the observer turns it on for good."

So arming is process-wide and monotonic: one verdict read anywhere in the process — in a function that is never called, in a different file, in an eagerly-resolved load_file target (obs_gate_resolve_static_loads), or as a bare string constant in the constant pool — arms entropy bookkeeping for every assignment in every module of that program.

Reproduction

wlib.eigs is a 200k-frame observed write loop containing no observer construct of any kind:

define run_w(n) as:
    local u is 0.0
    local w is 0.0
    local i is 0
    loop while i < n:
        u is 280.0 + (sin of (i * 0.01))
        w is 2.0 + (cos of (i * 0.01))
        i is i + 1
    print of f"w {i}"
run_w of (200000)

reader_mod.eigs holds a function nobody calls:

define never_called(z) as:
    if oscillating of z:
        return 1
    return 0

and ctrl_mod.eigs is identical with if z > 0.0:. Four mains load these in combination. n=5 medians, two rounds, with the gate’s own verdict for wlib:

main	EIGS_OBS_GATE_STATS=1 for wlib	1	2
A: loads wlib only	unobserved	0.153	0.151
B: also loads reader_mod.eigs (different file, dead read)	observed	0.219	0.219
C: also loads ctrl_mod.eigs (numeric control)	unobserved	0.155	0.154
D: msg is "report" at module level, no observer construct	observed	0.223	0.223

Row B: a read-free module compiles as observed because a different file held a read that never executes. Row C: the numeric comparison in the same position costs nothing, so this is arming, not parse cost or function-table size. Row D: const_pool_names_observer scans for bare names, so a string literal "report" costs +48% on a program that uses no observer feature.

Why it matters to a consumer

phugoid rung 3 is a closed-loop autopilot that polls observer verdicts as its supervisory layer — the intended use of the feature. Its profile gate measured what it believed was intrinsic observed-write cost at +44% over an unobserved floor. It is not: neutering only the four predicate reads in a function the measured variant never enters drops that to ~1.03, and forcing the gate open for both programs (EIGS_OBS_FORCE=1) collapses the differential entirely, showing the whole spread is arming. Against a genuinely read-free program an observed scalar write is indistinguishable from the unobserved floor.

That inverted a published finding. An early probe reported "observed scalar writes are essentially free"; the consumer could not reproduce it, withdrew it as wrong, and carried the withdrawal for six review rounds. Both measurements were correct — different regimes, and nobody had named the regime variable.

Practical consequence: unobserved: is the only workaround. Restructuring does not help — a consumer cannot escape by moving verdict reads into their own module, because the flag is process-wide.

What would resolve it

Adding scope where today there is one process-wide bit — per-module at least, per-binding ideally. A fix would also need to cover obs_gate_resolve_static_loads’s eager resolution of literal load_file targets, the always-conservative OP_IMPORT path, and the constant-pool name scan (a program whose only "observer content" is the string "report" should not pay).

The consumer pins this live as a write/noread > 1.15 arm with a planted fault, so when this is fixed upstream that gate fails and tells us to re-attribute and close G7.

[InauguralPhysicist]

Correction from the reporter: the granularity in the original report is WRONG, and so is its suggested workaround

Round 11 of the same review loop refuted my own mechanism, from the source and from the runtime. Correcting before anyone acts on it.

What I got wrong. I wrote that arming is per-module. There is no per-module arming. obs_needed is a single flag on EigsState (src/eigenscript.h:561), set in compile_ast (src/compiler.c:3717) and documented in that very comment as "Monotonic: a later unit that reads the observer turns it on for good." compile_ast is the choke point for the main script, eval, load_file, import, the REPL and the embed API.

So the real statement is broader than what I filed: one verdict read anywhere in the process — in a dead function, in a different file, in an eagerly-resolved load_file target (obs_gate_resolve_static_loads), or as a bare string constant — arms entropy bookkeeping for every assignment in every module of the program.

wlib.eigs below is a 200k-frame observed write loop containing no observer construct of any kind, loaded from four different mains. n=5 medians, two rounds, with the gate's own verdict for wlib:

main	EIGS_OBS_GATE_STATS=1 for wlib	1	2
A: loads wlib only	unobserved	0.153	0.151
B: also loads a different file with a never-called if oscillating of z:	observed	0.219	0.219
C: same, but if z > 0.0: (control)	unobserved	0.155	0.154
D: msg is "report" at module level, no observer construct at all	observed	0.223	0.223

Row B refutes per-module: a read-free module compiles as observed because a different file held a dead read. Row D shows the trigger is wider than an observer opcode — const_pool_names_observer scans the constant pool for bare names, so a string literal "report" costs +48% on a program that uses no observer feature at all.

Two corrections to the issue body, both now edited in:

1. The workaround I suggested does not work. I wrote that this "pushes consumers toward splitting observer-reading code into separate modules for performance reasons." Row B measures that not working — 0.284 → 0.385, +36%, with the reads in a separate file. Please don't spend a cycle on it.
2. The fix I asked for is mis-framed. I asked for "per-binding (or per-function) arming rather than per-module." There is nothing per-module to make finer. A real fix has to add scoping where today there is one process-wide bit, and would also have to cover obs_gate_resolve_static_loads's eager resolution, the always-conservative OP_IMPORT path, and the constant-pool name scan.

The measured effect and its consequence for the consumer are unchanged — if anything the true mechanism makes the case stronger, since no amount of consumer restructuring avoids it. unobserved: remains the only workaround.

Consumer-side ledger updated: phugoid GAPS.md G7.

[InauguralPhysicist]

Second correction from the reporter: the scope is per-EigsState, not per-process

Round 13 of the review caught one more inaccuracy in my own corrected body, and this one could send a fix at the wrong object.

I wrote "process-wide". The flag is per interpreter state. src/eigenscript.h says so directly, in the comment above obs_needed:

"Per-state for the same reason as the thresholds above, and it was a real bug when it was not: on EigsThread this field was zero for every spawned worker (eigs_thread_attach xcalloc's a fresh thread, and only the spawning thread ever runs compile_ast), so every assignment executed on a worker silently skipped observation — while the gate's own stats still reported "observed" and EIGS_OBS_FORCE=1 could not rescue it."

For the CLI there is one EigsState per process, so every measurement in this issue stands unchanged. But an embedder running several states gets one flag each, and a fix framed as "narrow the process-wide scope" would be aimed at the wrong object — the scoping that needs adding is below EigsState, not around it.

Corrected wording, which is what the consumer's ledger now carries: one verdict read anywhere in an interpreter state — a dead function, a different file, an eagerly-resolved load_file target, or a bare string constant — arms entropy bookkeeping for every assignment in every module compiled into that state.

Body updated accordingly. Apologies for the churn; the measurements have been stable throughout, and it is the causal/structural description that has needed correcting twice.

[InauguralPhysicist]

Consumer follow-up from phugoid rung 4 (the N-aircraft swarm), 2026-08-26. The body already lists OP_IMPORT as part of the surface a fix must cover. Here is what that clause costs in practice, measured — because it is larger than the dead-code case this issue was filed on, and it changes who the optimisation applies to.

Any import arms the observer, unconditionally

src/chunk.c:1167 — opcode_is_observer_reader() returns 1 for OP_IMPORT, alongside the genuine reader opcodes. So a module that imports anything is armed regardless of whether the imported module touches the observer.

$ cat imp_a.eigs                      # 200k-frame write loop, no import
define wloop(n) as: ...
wloop of (200000)

$ cat imp_b.eigs                      # byte-identical, plus one unused import
import linalg
define wloop(n) as: ...
wloop of (200000)

$ EIGS_OBS_GATE_STATS=1 eigenscript imp_a.eigs   -> obs-gate: unobserved <module>
$ EIGS_OBS_GATE_STATS=1 eigenscript imp_b.eigs   -> obs-gate: observed   <module>

n=5 medians, three rounds:

	1	2	3
no import	0.181	0.160	0.147
+ import linalg (never used)	0.269	0.260	0.271

+49% to +84% for one import the program never calls into. lib/linalg.eigs contains no observer construct — I checked the runtimes own copy, zero matches for any of the seven verdict names.

Why this is the bigger half of #1046

The dead-code case in the issue body is a program a consumer could restructure. This one is not: any program that uses the standard library is armed from its first line, so #915s optimisation never fires for it at all. Every consumer in the fleet that imports linalg, stats, sort, string… — confirmed all four arm — is in that category. The 8.5x banked on EigenMiniSat holds only because that program avoids imports.

Concretely for this rung: phugoids swarm needs linalg exactly once, to solve the trim before the measurement starts. That single setup call arms every frame of the measured loop. I can work around it by precomputing the trim as literals, but "avoid the standard library in anything you want fast" is not a workaround a language should require, and it is worth knowing that the current gate asks for it.

What would resolve this clause specifically

OP_IMPORT is presumably in the list because an imported modules chunk is not available to scan at the point the flag is set. If the import target can be resolved and scanned the way obs_gate_resolve_static_loads already handles literal load_file targets, the conservative arm becomes unnecessary for the common case of a literal module name. That would leave only genuinely dynamic imports conservative.