Observer entropy is computed on EVERY assignment regardless of use: 88% of runtime / 8.50x ceiling on a consumer that uses no observer features

[InauguralPhysicist]

Summary

Every assignment in every EigenScript program computes the entropy of the
assigned value, whether or not anything ever observes that binding. On a real
consumer workload that uses zero observer features, this is 88% of
runtime — a measured 8.50x ceiling.

src/compiler.c:1804 emits the observe opcode unconditionally:

    emit_op_u16(c, obs_op, obs_arg, line);   /* every assignment, always */
    emit_op_u16(c, set_op, set_arg, line);

vm.c:4630 (OBSERVE_ASSIGN_LOCAL) then calls observer_slot_update
(eigenscript.c:547) → compute_entropy (eigenscript.c:339), which for a
list walks every element via ent_child (eigenscript.c:331), each doing a
log2. Assigning a list of length n costs O(n) log2 calls.

In a CDCL solver, watch-list assignment is the hottest loop in the program.

Measurement

Workload: EigenMiniSat Tseitin torus 4x4-odd, current CDCL defaults, v0.39.0,
devbox (Celeron N3350). Real workload, not a proxy. The solver contains no
observe/report/predicate usage anywhere (grep count: 0 files).

perf record -F 199, self time:

symbol	self
ent_child	46.46%
__log2_sse2 (libm)	21.92%
entropy_of_num	10.05%
compute_entropy_impl	3.32%
entropy subtotal	81.75%
vm_run_ex (interpreter dispatch)	4.21%
gc_collect_impl	1.91%
jit_helper_index_get	1.46%
_int_malloc + malloc_consolidate	1.65%

Ceiling probe

Semantics-breaking, timing-only: early-return from observer_slot_update and
observer_slot_update_num behind an env var, so one byte-identical binary
serves both arms. (Patch was reverted; tree is clean.)

arm	4x4 wall
baseline	299.95 s
observer disabled	35.28 s (n=3, spread 0.5%)
	8.50x

Counters byte-identical across both arms (conflicts=9986 resolutions=33873),
confirming the probe changed only observer bookkeeping.

External reference

Native MiniSat 2.2.1 on the byte-identical CNF, same box: 0.25 s (and it
uses 84,150 conflicts to our 9,986 — our search is better, our throughput is
not). Gating the observer moves us from ~1,200x native to ~141x.

Why this matters beyond one consumer

1. The JIT is a net 3.0% LOSS on this workload (299.95 s on / 290.83 s off,
   counters identical). Now explained: it cannot win, because only 4.21% of time
   is dispatch. It pays compile cost against a 4% slice. scanned=62 compiled=56, so it is compiling fine — there is just nothing there to get.

2. This is a flag for the AOT performance case. AOT is positioned as the
   strategic native-performance path, but it eliminates interpreter dispatch,
   and dispatch is 4.21% here. Unless AOT also elides observer updates, its
   ceiling on this workload is ~1.04x, not the ~8x assumed in
   EigenMiniSat#88 / ouroboros#86. AOT's correctness and self-hosting value is
   untouched by this — only the throughput argument.

3. Every consumer repo pays this, on every assignment, forever. This is the
   largest single measured lever in the ecosystem.

4. It likely compounds with size. Entropy walk cost scales with list length,
   so larger instances pay more per assignment. This may be a substantial part
   of the per-conflict cost growth seen on the 5x5 lane (0.083 → 0.165
   s/conflict), which was provisionally attributed to "bigger DB = more
   propagation work". Untested — profiling 4x5 would settle it.

Direction (not prescriptive — this is the observer owner's call)

The obvious shape is to stop paying for bindings nothing interrogates.
compiler.c already computes an interrogated name set
(name_set_has(&c->interrogated, name)), which suggests a compile-time gate is
tractable. It cannot be a naive static elision: bare predicates read the
last-observed binding (the last-alias semantics), and report can reach
bindings that were never syntactically interrogated, so the gate has to be
whitelist-shaped (observe only what is provably reachable by an interrogation)
rather than blacklist-shaped.

A cheaper interim option worth measuring separately: make entropy lazy —
store the value and compute entropy only when a slot is actually read. That
preserves semantics exactly and moves the cost from every-assignment to
every-query.

Caveats

• One workload, one size (4x4). It is the real workload, but the 8.50x is
  specific to a consumer that uses no observer features at all — that is the
  best case, and programs that genuinely use observers will gain less.
• 8.50x is a ceiling, not an achievable win. A correct gate captures some
  fraction of it.
• Baseline is n=1 (299.95 s) against n=3 for the probe arm; at 8.5x separation
  the distributions do not come close to overlapping, but a shipped fix needs
  the full n=5 treatment on both arms.

Reproduce

# EigenMiniSat @ 6754b29, EigenScript @ v0.39.0
perf record -F 199 -o perf44.data -- \
    ../EigenScript/src/eigenscript benchmarks/tseitin_ladder.eigs 4 4 999
perf report -i perf44.data --no-children --stdio --percent-limit 0.4

# external reference
eigenscript benchmarks/dump_tseitin_cnf.eigs 4 4 > t44.cnf   # added this session
minisat t44.cnf /dev/null

[InauguralPhysicist]

Prior art for the gate: the ouroboros AOT emitter already implements it

The "Direction" section above asks for a whitelist-shaped gate (observe only
what an interrogation can reach, because bare predicates and report read
bindings never syntactically interrogated). That analysis already exists and
ships: ouroboros/aot/compile.eigs:85-105 sets g_observed only when the AST
contains a bare observer predicate or a report of x call, and only then emits
aot_observe_num on numeric assignments; otherwise assignments compile to bare
C stores with zero observer cost.

Verified 2026-08-11: a loop+assignment probe compiled through the emitter
contains zero observer/entropy references in the generated C, and its output
matches the VM. (ouroboros#86 thread has the details.)

Two implications for this issue:

1. The gate condition has a working reference implementation to diff against —
   whatever the VM-side gate whitelists should be reconcilable with what
   g_observed's AST walk accepts, or one of them is wrong. The AOT
   differential harness can then catch divergence mechanically.
2. The AOT emitter's granularity is program-level (one bit: observed or not),
   which is the coarsest correct whitelist. A VM gate could start at the same
   granularity — per-chunk "this program observes nothing" — and capture most
   of the 8.50x before attempting per-binding precision. On EigenMiniSat,
   program-level is already the full win.

Caveat carried over from the emitter: aot_observe_num covers the numeric
channel; if the VM gate is derived from this analysis, the non-numeric
(compute_entropy on lists/dicts/strings) reachability needs its own check
rather than inheriting the numeric-only assumption.

[InauguralPhysicist]

Correction + measured mitigation: unobserved: already captures the full ceiling

Two updates, one of them fixing this issue's own text.

The issue's "Direction" section is missing the existing mechanism. I hunted
env-var toggles and missed the language feature: the runtime already has
unobserved: blocks (README "Don't Ask — unobserved"; global depth, propagates
into callees — the same instrument that attributed #685). The interim option is
not "make entropy lazy", it is one line in the consumer.

Measured (EigenMiniSat, Tseitin 4x4, devbox):

arm	wall	counters
baseline (observed)	299.95 s	9,986 / 33,873
ceiling probe (C early-return, semantics-breaking)	35.28 s	byte-identical
unobserved: wrapper (supported semantics)	34.73 s	byte-identical

The one-line wrapper captures the entire 8.50x ceiling — the achievable win
equals the ceiling, at least at program granularity. Landed as
benchmarks/tseitin_ladder_unobserved.eigs in EigenMiniSat (6816837), baseline
kept per the keep-both-paths rule.

What this does to this issue. It does not close it — it sharpens it:

1. The cost is now opt-out, but the default is still "every program pays 8.5x
   unless annotated", and no consumer discovers the annotation from a profile
   (ent_child means nothing to a user). The ask stands as a default fix:
   the compile-time whitelist (or the ouroboros g_observed-style program-level
   bit) makes the unannotated program cheap.
2. The gate's expected value is no longer an estimate. Program-level gating on
   this workload = 8.50x, measured twice by independent instruments (C probe,
   language block) agreeing within 1.6%.
3. Validation shape: any gate implementation can be differentially tested
   against unobserved: — same program, gate-on vs wrapped, must produce
   identical wall-class behavior and identical counters.

[InauguralPhysicist]

The suggested direction does not survive contact — two findings that redirect it

This issue proposes a compile-time gate ("compiler.c already computes an
interrogated name set, which suggests a compile-time gate is tractable").
Measured at HEAD, that shape is both unsound and, for the motivating consumer,
inert.

1. load_file is a RUNTIME builtin with no module cache
(src/builtins_host.c:926). The compiler that compiles minisat.eigs never sees
the AST of lib/solver.eigs, so a per-compilation-unit static elision cannot
know whether a later-loaded module interrogates a binding this unit assigns.

2. And the motivating consumer is exactly that case. EigenMiniSat opens with
four of them:

minisat.eigs:5:  load_file of "lib/int_vector.eigs"
minisat.eigs:6:  load_file of "lib/dimacs.eigs"
minisat.eigs:7:  load_file of "lib/solver.eigs"
minisat.eigs:8:  load_file of "lib/bench.eigs"

So a gate that conservatively bails on dynamic loads would never fire for the
workload that motivated the issue — the 8.50x would be reported as unreachable
for the one consumer it was measured on.

What the ceiling probe actually proves

The 8.50x in this issue was measured by early-returning from
observer_slot_update behind an env var — a runtime gate. That is the
number's provenance, and it means a runtime process-global gate captures the
entire measured ceiling. A compile-time elision would add, on top of that, only
the interpreter-dispatch slice this issue measures at 4.21% — while carrying
all of the silent-wrong risk, because a program misclassified as unobserved still
runs and still prints, just with a dead observer channel.

So the correct shape is a runtime gate on a process-global (per-EigsState)
"can anything ever interrogate?" bit, not static elision.

Why the runtime gate is tractable — the single choke point

Every compilation path in the tree goes through compile_ast
(src/compiler.c:3152): main.c:340 (script), builtins.c:2684 (eval),
builtins_host.c:999 (load_file), repl.c:70, eigs_embed.c:104,
vm.c:5594 (import), and ext_http.c:1363/1383 (dynamic request handlers).
OR-ing a scan result into the bit inside compile_ast therefore covers every
unit — including eval and dynamically loaded modules — with no
hand-maintained caller list, which is the failure mode #921/#925 are open on.

Three supporting facts checked while scoping this:

• The gate is not pre-empted by loops. OP_LOOP_STALL_CHECK reads observer
  state, but it is only emitted when the loop condition is observer-based
  (cond_is_observer_based, compiler.c:1834); plain loops get
  OP_LOOP_CAP_CHECK. A program full of loops and no predicates still gates.
  That function is also good prior art for the scan — a deliberately conservative
  compile-time classifier, encoded into the opcode so interpreter and JIT cannot
  disagree.
• Tape recording is a force-on condition. g_trace_obs_hist (trace.c:52)
  gates observer snapshots into the tape, so a traced run must observe
  regardless of the program's own surfaces. --step/eigsdap/tape_read read
  from a recorded tape rather than a live slot, so they are covered by that same
  condition rather than needing their own.
• ouroboros already ships this shape — the AOT emitter gates on a
  program-level g_observed bit (aot/compile.eigs:89), including the
  per-function refinement, and fails loudly rather than miscompiling the case it
  cannot handle.

The residual unsoundness, stated plainly

A runtime bit that flips 0→1 when a later-compiled unit introduces an
interrogation loses the history of bindings assigned before the flip — they read
as unobserved. The mitigation is a compile-time pre-scan that follows
string-literal load_file/import targets transitively and forces the bit on
for any non-literal target. EigenMiniSat's four are all literals, so it stays
gated and sound. The REPL is the genuinely unfixable case (line N+1 can
interrogate a binding from line N) and should force the bit on outright.

The bar, built and validated

tools/observer_gate_diff.sh — a full-corpus differential oracle, since the
whole risk here is silent-wrong and "the suite passes" does not test for it. All
438 tracked .eigs programs, byte-exact stdout+stderr+exit code.

Two properties worth stating, because a gate harness that lacks them reports
success it has not earned:

• It establishes the deterministic subset by diffing the baseline against
  itself first. That correctly excluded 23 programs — the examples/invariant_*
  family prints wall-clock timings (eigs ms: 105.09… vs 96.31…), which would
  otherwise have read as gate breakage on every run, forever.
• It refuses to pass vacuously: a clean diff against a build that gated
  nothing proves nothing, and the harness says so.

Validated with a planted fault before being trusted. Against a
deliberately-broken gate (observer disabled outright — this issue's own ceiling
probe), it reports:

compared: 413
mismatches: 27
RESULT: FAIL — the gate changed observable behaviour on 27 program(s)

and the 27 are exactly the observer-facing programs: test_convergence_oracle,
test_trajectory, test_entropy_{cycles,query_time,reference_stop,types},
test_windowed_converged, test_observer_large, the four observer_corpus
programs, examples/observer_predicates, examples/structural_observer, and
the new test_observer_level_set from #862. A harness that had stayed green
there would have been worthless, and that is not a hypothetical — my first
attempt at #862's regression test was vacuous for the analogous reason.

Not yet built: the gate itself. The oracle, the design, and the force-on
conditions are settled; the remaining work is the scan + the bit + the n=5
before/after on the 4x4 lane, which needs the full measurement treatment this
issue's caveats already call for (its baseline is n=1).

[InauguralPhysicist]

Oracle preserved on branch perf/observer-gate-915-oracle (tools/observer_gate_diff.sh, not yet a PR — it is the bar for the gate change, and lands with it rather than alone).

Deliberately not wired into run_all_tests.sh: three full-corpus captures cost ~6 min on the devbox, which does not belong in the default suite. It is a pre-merge gate for this change, run as:

make && tools/observer_gate_diff.sh capture base1
tools/observer_gate_diff.sh capture base12        # same build — the determinism reference
# ...apply the gate, make...
tools/observer_gate_diff.sh capture gated
tools/observer_gate_diff.sh compare base1 gated

[InauguralPhysicist]

PARKED — branch perf/observer-gate-915-oracle (4 commits, not a PR)

Working gate exists and is correct. It is not being landed, because as it
stands it buys nothing for the consumer that motivated this issue while adding a
permanent maintenance surface. Recording the state so this is recoverable rather
than re-derived.

The headline number is RETRACTED for EigenMiniSat

Measured 8.70x (n=5 vs n=5, 4x4 Tseitin, arms interleaved, ONE byte-identical
binary, final counters identical across arms — conflicts=9986 resolutions=33873 decisions=15275 propagations=44166 restarts=11). That measurement was sound, but
it was taken against a version since proven unsafe.

The safe version forces observation on for any eval / load_file / import.
EigenMiniSat opens with four load_file calls, so it now gates 0 of 6 units
and gets no speedup at all. 118 of the first 190 corpus programs still gate,
but none of those are throughput-sensitive.

Why the safe version is blunt: the pre-scan failed three times

I tried to prove loaded modules observer-free by resolving string-literal targets
and scanning them. Adversarial review broke it in a new place each round:

1. a computed path (parts[0] + parts[1] + ...) is not a string constant, so
   nothing resolved and nothing was scanned;
2. resolved_any was an OR across candidates, so ONE benign literal load
   disarmed the conservative fallback for every other load in the same unit —
   the failure got less likely as the program got simpler, which is why no
   corpus differential would ever have found it;
3. the six predicates lex to their own token types, so matching them as
   TOK_IDENT was dead code and a module using the documented "preferred form"
   went unseen.

Plus import was never scanned at all — it is an opcode with a bare-name
operand, so nothing about it reaches the constant pool for a name list to match,
while import is the idiomatic module form throughout examples/.

Common root: the pre-scan was trying to prove things about code that does not
exist yet. That is the wrong shape, not a patchable bug.

What the follow-up must do

Compile literal load targets eagerly at parent compile time, with the real
compiler — not token heuristics — so the parent's gate decision accounts for
what its modules actually do. That is what recovers the 8.70x soundly. It is a
bounded addition on top of what is already on the branch, not a rewrite.

What IS solid on the branch, and worth keeping

• Gate on EigsState.obs_needed, decided by a bytecode scan at compile_ast
  (the one choke point all seven compilation paths share). Bytecode not AST: an
  AST walker's default: answers "does not observe" for a forgotten node kind,
  which is the silent-wrong direction.
• Constant-pool name scan catching the aliased form (local r is report emits no
  reader opcode at all).
• tools/observer_gate_diff.sh — 438-file byte-exact differential, validated
  against a deliberately broken gate (FAIL on 27 programs).
• tools/observer_reader_ops_check.py — drift gate, detection 9 → 13 readers
  after its own blind spot was closed (it had been reporting
  OP_LOOP_STALL_CHECK as a non-reader, the exact opcode its docstring cites).
• Suite section [99n], 8 checks, asserting observed VALUES not gate stats.
• Suite 3877/3877, corpus differential 413/413 byte-identical.

Five silent defects found, all by adversarial review, none by the gates

Worth recording because it is the durable lesson: obs_needed on EigsThread
meant every spawned worker silently skipped observation while the gate's own
stats printed "observed" and EIGS_OBS_FORCE=1 could not rescue it. The corpus
differential reported PASS — 412/413 byte-identical on that tree, because its
only spawn+observer program asserts iteration counts and never report content.
An instrument that agrees with you is not the same as one that could have
disagreed.

Also unresolved and riding on the branch: a two-signal SIGUSR1 contract. The
gate left the #660 dump printing every binding as equilibrium — "everything is
settled" where the truth is "nothing was measured". The first signal now declares
the absence and arms observation; the second carries real data. That is a
deliberate change to a shipped debugging feature and needs its own decision
before it lands anywhere.