catch / 3

The ralph clean/dirty gate (run_regression.py --rust-only --skip-bimodal --threshold 0.15 --retry-failures 2) can spuriously fail cow_fork_scaling with a consistent +19-22% regression across all 3 retries when the box is under load (e.g. the ralph systemd scope + Z3 memory pressure). Iter31 failed this way; at HEAD a fresh subprocess (run_single.py cow_fork_scaling --engine rust) measured 2.29-2.30s = baseline 2.28s, and re-running the exact gate command passed 20/20. cow_fork_scaling is a fork-scaling synthetic (run_regression.py SUITE @ ~line 191, prebuilt x86_64 in synthetic_examples/) and is timing-sensitive like the bimodal benches even though it is not in BIMODAL_BENCHMARKS. Before chasing a cow_fork_scaling gate regression: reproduce in a clean subprocess first; if it is at baseline there, the gate failure was load variance, not a real regression.

angr-t3mr (write-through boundary): adding a Rust-owned fork API exposed via PyO3 must NOT enable Python-side monkey-patching of the Rust pyclass method. PyO3 0.27 pyclass methods are read-only on the Python object — raises 'attribute is read-only'. Test dispatcher routing by patching the Python-side hook (mgr._add_rust_state for off-path; observe stash count delta for on-path). Gate plumbing matches the established 4-step pattern: kwarg with default None → env var fallback → bool attribute on manager → getattr(self, 'use*', False) in mixin.

The 15% gate threshold on tests/benchmarks/run_regression.py --skip-bimodal is tight for sub-second benches: a 0.79s baseline only buffers 0.118s before failing. Single-sample wall-clock variance routinely hits +5-15% in the full 15-bench sequential gate (much more than in isolation). When a 'gate red' commit looks unrelated to perf, check: (1) is the failing bench close to its baseline? (2) does its isolated 10-sample median still match baseline? If isolated median has drifted, refresh baseline rather than hunting for a code fault. See 868be2609 for one such refresh.

The prefer_native_library_hooks gate-on fork storm on xmllint (angr-sgcye/angr-z21g0) is RESOLVED as of 2026-07-14, commit 71314609e. Root cause was apply_state_metadata dropping ZERO_FILL_UNCONSTRAINED* across the init cache — see invariant-apply-state-metadata-option-allowlist. Both original hypotheses (native string procs under-constraining; native malloc fill policy) were disproved. Post-fix, gate-on xmllint 220-step no-find: 1 active state / 359MB, matching Python (1 active / 272MB) and gate-off Rust.

gate-runner consistently hits 0.38-0.39s on sub-second synthetic smoke benches (mips32_le_branch, mips64_be_branch, android_arm_license_validation) when local 5-sample median is 0.33s — 15-20% env-drift gap. The smoke benches are rust_only with no python_time, so a baseline bump is pure noise-floor calibration, not perf concealment. Refresh tactic: new_baseline = gate_max / 1.15 + ~5% safety. See angr-zzfk (iter 78, 3 benches) and angr-5r0s (iter 79, mips32) for precedents.

Native getenv() heap-allocates a buffer for the value string via state.heap_alloc(len+1), writes value bytes + NUL, returns pointer. The heap region (0xC0000000+) must be mapped before getenv is called — this is handled by Python state sync which maps heap pages. If the heap isn't mapped, memory_store will fail silently (no page mapped). Environment data lives in HashMap<Vec, Vec> on RustSimState, cloned on all 5 fork methods and merge.

ROOT CAUSE of silent symbolic syscall dispatch (angr-gffd, 2026-05-17): CallbackInterpreter::get_syscall_num in native/angr/src/interpreter_cb/exits.rs read the syscall register then called .as_u64().unwrap_or(0). For a symbolic register .as_u64 returns None and unwrap_or pinned the dispatch number to 0. On amd64 syscall 0 is read (NativeReadSyscall), so any symbolic rax at a syscall instruction silently invoked read() with whatever happened to be in rdi/rsi/rdx — completely bypassing Python's _resolve_syscall enumeration and NO_SYMBOLIC_SYSCALL_RESOLUTION logic. Fix: thread Option through BlockResult::Syscall, RunResult::Syscall, CallbackReason::Syscall, and stepping.rs::RunResult::Syscall (the latter uses num.and_then(|n| self.native_syscalls.get(arch, n)) so symbolic syscalls skip native dispatch entirely and force the Python callback).

Backfilled python_time for all 20 missing entries in tests/benchmarks/baseline_timings.json (commit a571d4634, 2026-05-09). Notable speedups vs Python: csaw_wyvern 16.92x (Py 15.9s, Rust 0.94s), ekopartyctf2016_rev250 15.65x (Py 31.65s), flareon2015_5 10.27x (Py 57.16s), defcamp_r100__dfs 4.51x, ais3_crackme 2.95x. Known Rust-slower benches surfaced as SLA WARN (not FAIL): google2016_unbreakable_1 0.56x (bimodal — saw a one-off SLA FAIL at 0.48x in slow-mode), ekopartyctf2016_sokohashv2 0.58x, mma_howtouse 0.65x, hackcon2016_angry-reverser 0.88x, fauxware 0.99x. The new tests/benchmarks/backfill_python_time.py is reusable for future drift. To re-run: PYTHONPATH=/home/ubuntu/repos/angr python tests/benchmarks/backfill_python_time.py [--only NAME] [--force].

angr-gmad2 verdict (2026-07-04): the source-side assume ptr-dedup does NOT drop an intended constraint on fauxware -- the kenpr caveat is resolved as a false alarm. (1) STRUCTURAL PROOF: dedup_set stale-ptr false positives are impossible because the only path that shrinks local.z3_assertions (transaction_rollback in symbolic/transaction_ops.rs) already does dedup_set.clear()+dedup_set_seeded=false (angr-sfp9). Every insert keeps dedup_set <=> z3_assertions in sync via contains_or_insert_ptr, so every dedup_set ptr is backed by a live Bool; Z3 hash-consing then guarantees a ptr HIT means a live structurally-equal AST exists. (2) EMPIRICAL: fauxware fires ZERO dedup HITs (z3_assume_dedup_hit=0 AND add_constraint_raw_dedup_hit=0; symbolic assumes happen deeper than step(n=10)). A new Debug-gated audit fn SymContext::debug_verify_dedup_backing (symbolic/constraint_ops.rs, called from check_z3_dedup_if_seeded when dup && log_enabled(Debug)) logs no UNBACKED warnings -- it is a permanent zero-cost sentinel: run RUST_LOG=rustylib::symbolic=debug to audit future dedup HITs for stale-ptr false positives. CONCLUSION: the kenpr constraint_count pin (snapshot-constraint-count-pin) STANDS; restore [4] is NOT more correct; the [3]->[4] inflation is a restore-replay COUNT artifact, not a dedup drop. No dedup_set invalidation-on-free needed. Commit 140490098.

God-module split of a FLAT-FILE module into sibling #[path] submodules that keep FREE FUNCTIONS + private helper structs together (nbim4.3, core_outcome.rs 1659->622+190+883). Keys: (1) A private fn moved to a child submodule is NOT visible to the parent (E0603) — mark the fns the PARENT still calls 'pub(super)' (core_outcome run_post_step_core dispatches to bounce/materialize_deferred_forks_core/handle_simprocedure_core/handle_syscall_core/handle_symbolic_jump_target_core). Fns called only among siblings stay private; externally-used ones stay pub(crate) (materialize_bounce_forks). (2) Private helper structs (ForkPayload/ForkSink/SimProcCall) with PRIVATE FIELDS that the moved handlers construct must STAY IN THE PARENT, not move to a sibling types file — private fields are visible to DESCENDANT modules (child handlers.rs) but NOT to siblings, so keeping them in the parent lets handlers.rs use 'use super::*' + field access with zero visibility edits. (3) Struct methods called from a SIBLING module need pub(crate) (CcSnapshot's 4 marshalling methods, called via ctx.cc from handlers.rs). (4) PATH FIX: 'super::helpers::X' in code moved one level deeper becomes 'super::super::helpers::X' (super=core_outcome now, need exploration). Complements god-module-split-state-rs / -impl-across-files / -test-glob-imports.

God-module split NEW gotcha (zel8z.2 callbacks.rs): (1) ONE inherent impl block CAN be split across multiple sibling files — moving half of 'impl PythonCallbacks { call_inspect_* }' to inspect.rs and half ('call_memory_/lift/hook' + private fn bv_to_bytes) to dispatch.rs each as its own 'impl PythonCallbacks { }' wrapper Just Works; submodules see private struct fields as descendants, and 'use super::' picks up the parent's private 'use' imports (RustBV/PyBytes/Arc) so no per-file import fixups were needed and clippy -D warnings stayed clean. (2) DETERMINISTIC-SLICER PITFALL: a test submodule decl with TWO stacked attributes ('#[cfg(test)]' then '#[path = ...]' on consecutive lines) is easy to mis-range — grabbing only the '#[path]'+'mod tests;' lines orphans '#[cfg(test)]' onto the preceding item -> 'expected item after attributes'. Likewise an item's CLOSING range that strays one struct too far (the LoopExecutionEvent impl end vs the doc comment of the item that followed it — at the time, the since-deleted CallbacksRef wrapper; angr-9ke6b.214 removed it as dead code) yields 'expected item after doc comment'. Always git-show the original and verify each slice boundary lands on a blank line between complete items before deleting the source. Complements god-module-split-test-glob-imports + -visibility-pitfall + -private-mod-deadcode.

God-module split gotcha (NEW, zel8z.4 ccall.rs): moving a 'pub mod foo'/'pub const' block from a crate-reachable file into a NEW PRIVATE submodule (e.g. 'mod arm32;' holding 'pub mod arm_cond') demotes those pub items from crate-reachable to module-private. dead_code/unused_variables then FIRES on genuinely-unused members that were silently allowed before (complete constant tables: arm_cond ARM_COND_LE/LO/LS/LT/NE/PL/VC). Fix: add #[allow(dead_code)] to the table module (it documents the full 0-15 encoding), NOT delete the constants. Distinct from god-module-split-visibility-pitfall (that one is E0603/E0446 private-not-reachable ERRORS on items that ARE used); this is dead_code on items that are NOT used but were reachable-hence-allowed pre-split. See native/angr/src/vex/ccall/arm32.rs arm_cond.

god-module split E0446/private_interfaces: a private struct used only as a field-less helper bundle (e.g. interpreter/statements_cas.rs DcasState passed through cas_writeback/execute_cas_stmt) becomes 'more private than the item' once those fns move to a submodule with pub(super) visibility. Fix: widen the struct to pub(super) too. Complements god-module-split-visibility-pitfall (which covers fns + struct doc/derive).

God-module split (zel8z.1 state.rs 3692->2030 ln, the largest in the zel8z epic): the giant 'impl RustSimState' block (~1400 ln, ~130 methods) was chopped NON-CONTIGUOUSLY — only the fork/merge family (clone_py_metadata + fork/fork_true/fork_false/replace_solver/fork_from_snapshot/merge) extracted to state/fork.rs as a NEW 'impl RustSimState {}' wrapper; the remaining ~120 methods stayed in state/mod.rs. KEY DECISION: NEXT_STATE_ID static + private fn next_state_id() were KEPT in mod.rs (NOT moved to types.rs as the bead suggested) because they are pervasively called (new/from_vex_arch/fork/...) — a private free fn moved to a child submodule is NOT visible to the parent mod.rs (E0603), whereas keeping it in the parent lets child submodules reach it via descendant visibility (use super::). Value-type submodules (filesystem/inspection/types) own their already-pub fields so they are clean cut/paste; inspection.rs needed NO 'use super::' (self-contained serde+std) — clippy flags the unused glob (E0-unused-imports under -D warnings), so omit it when a value-type module references nothing from the parent. Deterministic /tmp/split_state.py slices 1-indexed ranges + wraps fork methods. Test mod path -> #[path="../state_tests.rs"]. Complements god-module-split-impl-across-files / -visibility-pitfall / -test-glob-imports.

god-module dir-split pitfall (zel8z.5 claripy_bridge): a sibling #[path] test module using 'use super::*' silently inherits external TYPE names (e.g. RustBV, Arc, SymContext) from the PARENT module's private top-level 'use' declarations — glob-import of a child sees ancestor-private items. When the split moves those 'use' lines OUT of mod.rs into submodules (cache.rs/import.rs/export.rs), the test file loses them and fails E0433/E0425 'use of undeclared type'. Fix: add explicit 'use std::sync::Arc; use crate::symbolic::{RustBV,SymContext};' to the test file (claripy_bridge_tests.rs) — only the names it actually references, to avoid unused-import clippy warnings. Also: a leaf helper used by BOTH a kept-in-mod fn AND a moved submodule (extract_int_value, called from mod.rs and from import.rs::try_extract_bvv) is cleanest left in mod.rs as a private fn — children call it via 'use super::extract_int_value' and the test glob still resolves it. (The mod.rs-side caller at the time of the split, extract_concrete_value, was deleted as dead code in angr-9ke6b.214; try_extract_bvv is now the live consumer.) Complements god-module-split-visibility-pitfall + god-module-split-private-struct.

angr-0mqkc.5 god-object decomp COMPLETE for state/mod.rs. Increments: 1 constructors->construction.rs; 2 registers->registers.rs; 3 memory->memory.rs; 4 options->options.rs; 5 solver->solver.rs; 6 history/call-stack->history.rs; 7 hooks/metadata->hooks.rs; 8 process/OS-env->process.rs + inspection wrappers->inspection.rs (1807->1448); 9 (7ac9c0fe2) the whole #[pymethods] impl PyRustSimState block -> state/pymethods.rs (1448->697, UNDER the ~1200 acceptance target). state/mod.rs now holds only: module decls, CtypeLocPtrs/GetoptExternAddrs/NativeResumeFrame structs, the RustSimState struct def + core 'impl RustSimState' mechanics (state_id/pc/arch identity + apply_changes incremental-sync + track_history/max_history/concretizer setters), the PyRustSimState pyclass struct, and its inner()/inner_mut() plain impl. The pymethods move is the single-block MOVE pattern (B) from invariant-pyo3-single-pymethods-impl. exploration/mod.rs (2764) is structurally floored -- NOT peeled, the ~1200 target does not apply to it (see this key's prior guidance). Task closed: state half meets target, exploration half floored by design.

gorvf.1 bounce-service cost attribution (measure-first, zero-Python epic). MEASURED 2026-07-04 via run_single.py --counters-json; the reconstruction-vs-exec split already existed (no new instrumentation needed — measure-first confirmed it): simproc path uses add_simprocedure_phase(state_create/execute/sync_back/state_copy) in rust_callback_dispatch.py::handle_simprocedure_callback; parallel-migration path uses migrate* phase timers (migrate_phase_timers.rs, env-gated ANGR_MIGRATE_PHASE_TIMERS=1).

KEY FINDING: "reconstruction" means TWO DIFFERENT THINGS on the two servicing paths, with OPPOSITE cost profiles: (1) SimProcedure bounce path (xmllint_getenv init storm, real-binary Python-simproc callbacks): reconstruction = _create_state_for_callback (state_create phase) = 48.6% of simproc service wall; execute=35.5%, sync_back=15.6%, state_copy=0.1% (sp_total=180ms, count=26). Also lift_block=28.2ms ~= 30% of the run-loop (gil) wall. (2) Parallel steady-migration bounce path (fork_solve_W6_S8, fork_solve_pbounce_W6_S8_M12_B2 under RUST_PARALLEL_WORKERS=2 RUST_PARALLEL_STEADY=1): reconstruction = migrate leaf_rebuild = 0.1% (W6_S8) / 0.7% (pbounce) of migrate_roundtrip. Here the cost is Z3 CONSTRAINT SERDE: serde 47.4%/37.4%, smtlib2 emit+parse 0%/30.1%. leaf_rebuild is NEGLIGIBLE. pbounce migrate_roundtrip=5.12s of 69.2s wall (~7.4%); W6_S8 0.15s of 23s (~0.6%). gil_frac ~0% both (pure-symbolic, no libc).

GO/NO-GO for lazy-SimState-views bead (angr-gorvf.2): GO, scoped to the SimProcedure bounce path only. state_create is 48.6% (>30% gate) of simproc service wall on the init-storm/real-binary path — lazy/delta SimState views directly attack that. Do NOT expect it to help the parallel-migration path: leaf_rebuild there is <1%; that path needs a constraint-transfer (SMT-LIB2/serde) optimization instead, not lazy SimState views.

libVEX-FFI (angr-z087y) win sizing: helps the INIT/COLD-block phase, ~0 in steady state. xmllint lift_block=28.2ms ~= 30% of the run-loop wall (135 blocks) -> native libVEX could reclaim most of the Python lift dispatch on init-heavy real binaries. Steady parallel benches: lift 22/118 blocks, <1% of wall -> libVEX-FFI gives ~nothing there. So z087y is an init-storm/cold-block optimization, not a steady-loop one.

angr-gorvf.19 (commit a291a5a43 + 1074f883e): the SimProcedure-bounce register SERVICE cost was reducible — the gorvf.10 acquire-once lever generalizes from state.memory to the REGISTER file. Two symmetric wins on the callback register path, both from talking to the register UltraPage directly instead of the memory-mixin stack (state.registers is DefaultMemory+UltraPage, all GP regs in page 0, register_endness=Iend_LE): (1) WRITE side — export_callback_bundle's sc_bundle phase was 98% a loop of state.registers.store(offset,val,size) (17 AMD64 regs, ~37us each = full mixin traversal); _apply_bundle_registers (in rust_state_sync.py) acquires the reg page once (writing=True for COW) and blits concrete values into page.concrete_data + clears symbolic_bitmap over the range, matching UltraPage.store's concrete branch. sc_bundle 8.40->0.67ms (12.5x). (2) READ side — sync_back's _extract_register_changes called getattr(state.regs,name) for OLD and NEW state (~34 mixin loads building claripy ASTs) just to diff; _reg_concrete_from_page reads the concrete int straight off the page (read-only _get_page(pageno,False), no claripy, any() over symbolic_bitmap to detect symbolic) so concrete regs need zero getattr, falling back to getattr only for symbolic regs (the return reg rax). sync_back 8.60->2.44ms (3.5x). SUM 17.0->3.11ms=5.46x on defcon2016quals_baby-re. KEY: _acquire_ultrapage grew a memory= param to target state.registers. GENERALIZABLE: any per-crossing register store/diff that goes through the mixin stack is a candidate — same GENERALIZABLE RULE as memreplay-bottleneck-root-cause. Measure-first counters kept: sc_bundle_ffi/apply, sb_regdiff/memdiff/resume.

gorvf.2 state_create sub-attribution (measure-first, xmllint_getenv 26 callbacks). The bead PREMISE was WRONG: it assumed state_create's cost is a full SimState copy ('reconstruction'); on the real-binary init-storm path sc_copy=0 (NO copy — find target is a plain addr so has_predicates=False, and the callback proxy gates default-off). Actual state_create=88.3ms breakdown: sc_meminstall=38.4ms/43.6% (_install_rust_memory_proxy, rust_state_sync.py), sc_memreplay=30.2ms/34.1% (_replay_rust_dirty_pages), sc_bundle=19.2ms/21.7% (export_callback_bundle FFI+reg apply), sc_copy=0, sc_sympage~0. So sc_memory (install+replay) = 77.7% is the real target, NOT the copy. KEY: both _install_rust_memory_proxy and _replay_rust_dirty_pages early-return when _is_rust_memory_proxy(state.memory) (angr-ryf6 clobber-guard) — i.e. the use_callback_memory_proxy gate (ANGR_RUST_USE_CALLBACK_MEMORY_PROXY=1) IS the lazy/delta-SimState view the bead asked for: it makes state.memory a live on-demand Rust proxy so both eager-writeback helpers become no-ops. MEASURED gate-on: state_create 88.3ms->30.1ms (2.9x, meets bead >=2x criterion), sc_meminstall 38.4->2.4ms, sc_memreplay 30.2->0.67ms, fidelity preserved (xmllint found=1 both, baby-re validated in ryf6). CAVEAT: negligible WALL impact on xmllint (3.47->3.56s) — state_create is only ~50% of simproc service wall and simproc service is a small fraction of init-dominated total wall; 58ms saved / 26 callbacks vs 3.5s wall. Instrumentation committed d9db0c565 (add_state_create_subphase, callback_simprocedure_sc*_ns in --counters-json).

gorvf.3.1 measured the xmllint_getenv 27 SimProc->Python fallbacks per-PC (tools/xmllint_fallback_classify.py): ALL 27 are Bucket A (is_in_binary-gate misroute) -- 8 distinct hook PCs (strcmp x10, pthread_once x4, pthread_mutex_lock x4, pthread_mutex_unlock x3, malloc x3, time/getenv/calloc x1) all resolve INSIDE libc.so.6's executable region, and a native proc exists for all 8, so the gate (native-dispatch-skipped-for-loaded-libs) routes every one to Python. ZERO are Bucket B (ADDS_EXITS-dependent): no hooked angr SimProc sets ADDS_EXITS (pthread_once is modelled as a leaf). This REVISES the ~14/27-A hypothesis in the bead -- it is 27/27 A. Consequence for gorvf.3: .4c (native dispatcher ADDS_EXITS/sub-call wiring) is UNFUNDED by the canonical libc bench (nothing to wire); all value lives in .4b (the gate flip), whose net win is already <0.1% per a8epx-gate-measured-defer (strcmp x10 dominant runs symbolic -> native bails symbolic anyway). Reproduce: ANGR_EXAMPLES_DIR=... python tools/xmllint_fallback_classify.py.

rustylib::vex::ir::Endness variants are 'Little' and 'Big' (NOT 'LE' / 'BE' as in some other VEX libraries). The enum is defined in native/angr/src/vex/ir/arch.rs (pub enum Endness, ~line 138) after vex/ir.rs was split into the vex/ir/ directory (commit 327f12229).

Phase 1.4 wiring of MultiwriteAnnotation in _cb_memory_store_symbolic_full landed but in practice rarely fires today: Rust's default write_range_limit=128 matches Python's MultiwriteAnnotation default, so the symbolic-store path inside Rust hits ConcretizationResult::Multiple (eager ITE) BEFORE escalating to TooLarge / the Python callback. To exercise the Phase 1.4 path in production, either raise write_range_limit so TooLarge fires more, or wait for Phase 2 (angr-qh5u) which flips Multiple/Strided to use Multi cells directly in Rust — bypassing the callback entirely and making the annotation check moot for the common case. Implication: do NOT expect a benchmark improvement from Phase 1.4 alone; the win is Phase 2.

PyO3-generated pyclass methods are read-only attributes on the Python wrapper — raises 'attribute is read-only'. To monkey-patch in tests, wrap the call in a thin Python method on the higher-level Python class (e.g. _rust_state_memory_store_symbolic_multi → calls _rust_mgr.state_memory_store_symbolic_multi). Pattern used in angr/exploration/rust_manager.py for Phase 1.4 (angr-5zw8) test fakes.

AddressConcretizer with default settings has enable_stride_detection=true. Two solutions with a regular delta (e.g. {0x1000, 0x2000}) get classified as ConcretizationResult::Strided{base=0x1000, stride=0x1000, count=2}, NOT Multiple. Tests that need a Multiple result must use 3+ non-strided candidates or relax the assertion to accept either variant. Bit me in test_store_symbolic_unified_multi_multiple_round_trip (commit 405f4c3db); fix was matches!(.., Multiple(_) | Strided{..}). Both variants route through install_multi_for_candidates so functional behavior is identical, only the type tag differs.

grub Z3_solver_translate panic (angr-xtk/angr-6vg) is FIXED by lazy solver materialization — we no longer call Z3_solver_translate at all. However grub now fails with 'list index out of range' error, which is a separate 32-bit x86 handling bug. Python engine completes grub in 2.07s successfully.

grub crash is z3-rs panic at Z3_solver_translate (Solver::clone) returning None during state fork. This is in the z3 crate (z3-0.19.7/src/solver.rs:663), not our code. Happens during solver context fork via SymContext::fork(). May be use-after-free or context mismatch in Z3 C API.

angr-h0dv (commit 24311a484, 2026-05-22): Rust→Python constraint-sync FFI chain fully removed. Python: _cb_sync_constraints, sync_rust_constraints_to_python, set_sync_constraints registration, and cb_sync*/pending_ast_sync_calls counters all gone. Kept: rust_ctx_missing counter (defensive Path A telemetry). Rust: sync_constraints field/setter/call_sync_constraints gone from callbacks.rs; engine.rs post-loop sync removed; sync_before_callback in interpreter_cb/constraints.rs reduced to clearing tracked constraints. The Rust-internal tracker (pending_python_constraints, track_concretization_constraint, track_branch_constraint, PendingConstraint struct) is RETAINED — it backs in-process unit tests in constraints.rs but no longer crosses the FFI. Path A (rust_solver_ctx attach in rust_callback_dispatch.py::_install_rust_solver_on_callback_state) is the single live path; Python's state.solver is monkey-patched to delegate to the Rust solver context, so constraints never need to be replayed across the FFI.

hackcon2016 (pre-optimization era, 67s) had ZERO Python overhead — 0 callbacks, 1 FFI crossing, 0s in callbacks. All time was spent in pure-Rust solving (see hackcon-z3-ast-structure for breakdown). Note: current rust_time is ~11.7s post-optimization (baseline_timings.json 2026-05), so the 67s figure is historical. Constraint AST structural mismatch with Python remained the root of the residual 0.9x gap.

hackcon2016 11.7s -> 30.6s regression (2026-05-17, bisected 2026-05-18, fix landed in commit f54bbba93): root cause is fced54a07 (angr-9maq, 'skip eager allocation of all-zero filler pages') which made all-zero pages lazy-only in _sync_extra_python_pages. For hackcon2016 (~35 zero pages per state), keeping those pages lazy structurally slows the FINAL Z3 solve from ~10s to ~28s — explore phase stays fast and fetch_page callbacks are 0, so the lazy path's slowness is NOT FFI roundtrip cost. The slowdown must come from the constraint AST built by the Rust solver picking up different shape when its memory model has fewer concretely-mapped pages during exploration. Exact AST-structure delta unmeasured. The fix (commit f54bbba93) is a per-state cap: if total zero-candidate pages <= 200, eager-map all (hackcon path); else lazy (mma_howtouse path which has ~2058 per-state and was the original reason for the optimization). Cap sits with headroom on both sides. Page counts measured 2026-05-18 (used to size the cap): hackcon2016 = 66 zero pages over 2 state-syncs, max 35/state; mma_howtouse = 184860 zero pages over 90 state-syncs, ~2054 avg/state. Post-fix samples (3-run median): hackcon=15.22s (still above pre-regression 11.7s — residual cost is the Z3 Extract/Reverse AST mismatch from hackcon-z3-ast-structure, not page-allocation related). Not investigated further: WHY the lazy-zero-page path produces worse Z3 ASTs when no fetch_page callbacks fire during exploration. If future work hits another regression here, instrument: (a) symbolic-spans diff between eager and lazy, (b) Z3 assertions added during explore, (c) which pages get queried in the final solve_for_flag step. The current fix is a heuristic, not a root-cause repair.

angr-rbnk (2026-06-02, commit 4dc7fc064): hackcon2016_angry-reverser AST-structure divergence root-caused. Rust BVOp::SignExt to-Z3 emission at native/angr/src/symbolic/value.rs:2353 used a hand-rolled concat loop: 'let sign_bit = inner.extract(w-1, w-1); for _ in 0..bits { result = sign_bit.clone().concat(&result); }'. When inner is itself an Extract(byte_range, flag), this emits nested (extract 7 7 (extract X Y flag)) terms — 2.7x more extracts than Python (19649 vs 7158) and 1.7x more total chars (740K vs 432K) on the 58-assertion hackcon final solve. Fix: 'BVOp::SignExt(bits) => operands[0].to_z3_ast_cached(cache).sign_ext(*bits)'. Result: AST shrunk 13.7x (54K chars, 449 extracts, 0 concats — 8x smaller than Python). Median ~30s → ~22.5s (8-run campaign). Now bimodal: fast tail 9s matches Python solve time, slow tail 35s on Z3 SAT-search nondeterminism. Investigation tool: tools/dump_hackcon_smtlib.py uses rust_ctx.get_all_constraints_str() for Rust and claripy.backends.z3.convert(c).sexpr() for Python. Spike report in docs/advanced-topics/rust_engine.rst. Lesson: when porting symbolic ops to Z3, prefer the z3-rs native operator (sign_ext, zero_ext) over hand-rolled concat/extract — Z3's bv_rewriter handles native ops natively but a hand-rolled equivalent forces it to do extra simplification work AT BEST, and prevents propagation pruning AT WORST.

angr-hfr0 (commit b40768356, 2026-05-21): opcode_map.rs width-family macros use strip_prefix + inner match + 'return Some(...)' from inside the enclosing parse_* fn. Each macro is a statement that falls through on miss, so multiple macros chain naturally. Macros are local (macro_rules! at top of file, no #[macro_export]). The 'return' inside an if-let block returns from the function — works because parse_* return Option. Macros sharing a prefix (e.g. 'Iop_And' for both And and VAnd arms) are fine because the inner match selects unique suffixes. For arms with multiple suffix-to-same-elem (e.g. InterleaveLO 8x8 and 8x16 both -> elem=I8), the macro repeats the arm — works because each match arm is independent. Pattern saves ~50% LOC on hand-written N×M dispatch tables.

The ONLY non-executable page the high-level RustExplorationManager maps into Rust is the STACK page (perms=6, via rust_state_sync.py _setup_stack_region/_sync_stack_page). All loader pages (_build_loader_pages_cache_entry batch_pages) and lazy-fetched pages hardcode perms=7 (RWX), and unmapped/bad accesses get swallowed to zero buffers or routed to deadended — NOT errored. So the deterministic way to drive the HIGH-LEVEL manager into the errored stash from Python is: entry_state(add_options={STRICT_PAGE_ACCESS, ENABLE_NX}), set state.regs.pc = state.solver.eval(state.regs.sp) (PC into the eagerly-mapped stack page), then mgr.run(). The NX fetch fails before lift and lands a RustErrorRecord (error_class='memory') in errored. Used to de-vacuify test_errored_returns_error_records (angr-9drh4).

hitcon2017_sakura 'list index error' is NOT the same as csgames2018. sakura uses address-based find/avoid with multi-stage exploration (loop: explore(find=addr), found[0], new simgr(found)). The crash is simgr.found[0] on empty found list. The Rust engine doesn't find the first address-based target. This is a separate issue from the callable predicate re-evaluation bug.

Materialize cost on hot benches: per-bench breakdown from 2026-05-21 hk7k research spike (run_single.py --counters-json). HIGH cost (24-31% of wall): defcamp_r100 (14 mats, 60.5ms, 24.2%), ais3_crackme (50 mats, 244ms, 28.4%), google2016_unbreakable_0 (52 mats, 261ms, 28.4%), defcon2016quals_baby-re (30 mats, 138.7ms, 30.8%). LOW cost (<2%): fauxware (2 mats, 3ms, 1.6%), mma_howtouse (45 mats, 0.34ms, <0.01%), securityfest_fairlight (16 mats, 60ms, 0.3%). Per-mat cost is bimodal: ~5ms when fork happens with substantial constraint prefix, ~10us when prefix is small (mma). Key insight: high-mat-cost benches are all ALREADY ≥1.5x speedup; the sub-1.0x benches that the rust-symex epic actually cares about (mma, fairlight, hackcon-likely, sokohashv2-likely) do NOT have materialize as a meaningful bottleneck. hk7k optimization is general-perf, not a lever for closing slow-bench gaps. See angr-hk7k notes.

Hook length parameter is correctly honored in Rust dispatch via UserHook semantics, NOT via dispatch logic.

When user calls proj.hook(addr, fn, length=N) with a callable, project.py wraps it: UserHook(user_func=fn, length=N). UserHook.run() calls self.successors.add_successor(self.state, self.state.addr + length, claripy.true(), Ijk_Boring|Ijk_NoHook). The successor's address (hook_addr+length) propagates through dispatch as new_pc = succ_state.addr and into Rust via resume_after_simprocedure(new_pc, ...) -> state.set_pc(new_pc).

The dispatch's hook_length variable in rust_callback_dispatch.py:375-378 is only used for is_zero_length_hook (skip_hook_addr decision); the actual PC advancement happens via the UserHook's add_successor call. This is functionally correct and matches canonical angr's behavior.

Why: Bead angr-03ej claimed this was broken, but the diagnosis was wrong. Verified via test_hook_length_advances_pc_userhook (fauxware) and instrumented run loop logging. How to apply: When debugging hook-related issues with length>0, do NOT assume the dispatch logic needs to plumb hook_length to advance PC; UserHook does it. If a hook re-fires repeatedly, look elsewhere (e.g., unconstrained PC concretization, basic block boundaries, succ.addr extraction).

Live-manager hook sync (angr-969g): _sync_hooks_before_step in rust_state_sync.py must DIFF the registered set against proj._sim_procedures, not just add. proj.unhook() on a live RustExplorationManager mutates _sim_procedures (removes the key) but the old add-only sync + 'len==len' fast path never propagated removals to the Rust hook table -> stale hooks keep firing. Fast path is now 'registered == sim_procedures.keys()' (set==dict_keys, no copy); removals call unregister_simprocedures FFI (exploration/mod.rs, removes from self.hooks and self.simprocedures) + registered.difference_update. Also: when _find_simprocedure returns None (stale/unknown hook) the dispatcher (rust_callback_dispatch.py) must set_skip_hook_addr(addr) + resume at addr, NOT resume_after_simprocedure(addr+1) which lands a misaligned PC.

Profile of _overlay_relocated_sections (fauxware, 2026-05-11, 20 iters wall-clock): per-call mean 1.79ms / median 1.475ms / max 7.74ms (cold). NOT the 6.1ms cProfile claim — cProfile inflates because the function makes thousands of attribute accesses through angr's 14-layer memory-mixin chain. Cost breakdown across 29 sections (25 concrete, 4 symbolic, all <4KB): state.memory.load = 1.250ms (97%), solver.eval+to_bytes = 0.026ms (2%), rust map FFI = 0.016ms (1%). Same root cause as z8xa register sync — fundamental angr memory-model cost. Naive manager-scope caching of section_patches is unsafe because the current code gates each overlay on per-state val.symbolic — caching would lose this gate and overwrite symbolic page contents in forked successors. The disk cache + _try_fast_memory_sync already handles the safe case (states without user-symbolic). Decision: rationale, no code change. Wrote profile harness at tests/benchmarks/profile_overlay_relocated.py.

angr-hzd9e corpus-add re-decision (iter50, commit 94918464b): expanded tests/benchmarks/collect_simproc_fallbacks.py CANDIDATE_BENCHES beyond CTF-heavy x86_64 with libc-I/O (write_stream_heavy, cli_ctype_fprintf, busybox_static, xmllint_getenv) + non-x86 arch-smoke (arm/aarch64/mips LE+BE branch). FINDINGS: (1) dominant closable native gap = write-side stdio fileno fallback fwrite(144)+fputc(48)=192 of 247 closable simproc fallbacks, ALL from write_stream_heavy — already tracked+human-triaged modest-cost in angr-csyy9 (WON'T-FIX-leaning). (2) Non-x86 arch workloads surface ZERO VEX-op fallbacks: native VEX coverage holds for ARM/AArch64/MIPS LE+BE. (3) No FP/SIMD fixture exists in corpus (all integer/string-bound) — a dedicated one needs a new fixture. CONCLUSION per aq26d charter: native coverage is NOT the perf bottleneck; redirect to z3_/ffi_crossings/concretize_ per mgr.stats().

mma_howtouse 0.6x residual gap is attributed (angr-i9f2, 2026-05-19, HEAD 2870a3429). Per-Callable RustExplorationManager perf_report() breakdown: Init total 43.3ms (Memory sync 36.7ms, Register sync 3.1ms, Python init 1.2ms); SimProcedure CallReturn callback 8.4ms; Lift 1.0ms total; Z3 7.1ms/check. Per-Callable Rust extras ≈58ms → 45 × 58ms = 2.6s, matches observed 3s gap. Dominant cost: _sync_memory_to_rust slow path runs every Callable because _run_python_init_if_needed (rust_manager.py:2317) returns immediately for state.addr in a real binary, so _mem_cache is never populated and _try_fast_memory_sync (rust_state_sync.py:229) returns False. Each manager re-iterates loader.all_objects, re-loads pages via loader.memory.load, and re-issues map_memory_batch. Follow-up fix: angr-bzsc — cache _extract_loader_pages output class-wide keyed by (binary_path, arch_name). Output is a pure function of loader state. Expected impact: ~36ms × 44 ≈ 1.6s recovered (closes most of the residual 3s). Doc updated: docs/advanced-topics/rust_engine.rst mma_howtouse section.

Determinism audit (angr-iaol, commit 2038bd4ea, 2026-05-25): every std::HashMap in native/angr/src/ classified for iteration-order leaks into exploration output. Result: ZERO output-affecting sites. Caches (claripy_bridge AST_CACHE, vex/lifter IRSB cache, symbolic/registry, symbolic/table) and registries (syscalls/handlers, procedures, vex/dirty handlers, state.simprocedures*) are lookup-only. State.symbolic_pages / hook_symbolic_memory / addr_to_ast are iterated into PyDict (state_api.rs:261/292/323) but consumers read by key — data-equivalent run-to-run. Stash maps (stashes/state_index/state_roots): per-stash order is the VecDeque (FIFO/LIFO honored); cross-stash iteration only writes same value to every state (set_max_history) or finds unique state_id. So FxHashMap conversion is NOT needed anywhere; remaining nondeterminism is Z3-only. See rust_engine.rst 'Determinism contract' section for the full table.

Z3 random_seed gap (angr-iaol audit, 2026-05-25): build_solver_params at native/angr/src/symbolic/context.rs:888 sets timeout + bv_extract_prop + mul2concat but NEITHER smt.random_seed NOR sat.random_seed. Two consequences: (1) defcamp_r100 trailing-byte mismatch — unconstrained stdin bytes get different fill values run-to-run; run_regression.py papers over with output normalization. (2) test_model_stability_constraint_order only verifies order-independence WITHIN a process — not run-to-run. Pin smt.random_seed=0 + sat.random_seed=0 via z3::Params::set_u32 in build_solver_params; that closes most of the gap. Residual: Z3 4.13 reserves heuristic latitude (eval() answer stability across rebuilds NOT guaranteed even with seed pinned). AVOID parallel.enable=true (correctness-breaking per avoid-z3-parallel-enable). Tracked in iaol.1 (pin seed) -> iaol.2 (deterministic=True flag + e2e test).

angr-1ilq.3 (scheduler<->run_loop integration) is DONE/closed as of iter49 (verify-and-close, no code change). The full parallel integration lives on HEAD: run_loop.rs dispatches RUST_PARALLEL_WORKERS>1 to run_loop_parallel (wave loop) or run_loop_parallel_steady (nkoct persistent worker-local frontiers), workers<=1 stays on verbatim run_loop_single_threaded. Real counters: parallel_tasks/parallel_migrations wired for the live parallel path (record_migration_sample in helpers.rs is a SEPARATE single-threaded ANGR_PARALLEL_WORKERS cost-estimate MODEL, not the real path). Canonical env is RUST_PARALLEL_WORKERS -> parallel_real_workers field. Determinism gate + real-counter tests: tests/engines/rust/test_parallel_wave.py (7 tests, green). REMAINING open work is 1ilq.5 (perf ship-gate: >=1.5x@2 workers) which does NOT yet materialize — workload-bound per vh834-phase6-go-not-materialized + parallel-per-wave-migration-dominates memories.

'except (ImportError, Exception)' is a bug shape — Exception is a base class of ImportError so the ImportError clause is redundant AND the Exception catches everything else (too wide for an optional-import pattern). Correct fix: '(ImportError, AttributeError)' covers 'module missing' AND 'attribute missing from module' which is the actual concern when probing 'from angr import sim_options as o; ... o.LAZY_SOLVES'. Found 2 cases in rust_manager.py (sim_options probes); fixed in angr-z1fb.

import_z3_constraint_ptrs hardening (angr-33t9, 2026-06-01, commit 6c15b9c19): Z3_get_sort + Z3_get_sort_kind sanity check rejects null, foreign-context ptrs, and non-Bool sort kinds as PyValueError before reaching unsafe add_constraint_raw. Validation is atomic — runs over full list before any constraint is added, so on failure the state's solver is unmutated. RESIDUAL UB: truly arbitrary integers (e.g. 0xdeadbeef) still segfault inside Z3's deref before the API call returns. Z3 does NOT magic-byte-validate AST headers before dereferencing them; closing that gap needs either an opaque Py newtype or a thread-local side-table of blessed exported ptrs. The sanity check covers realistic misuse (wrong sort, stale export, null mid-list) at cost of one Z3 C call per ptr.

BOTTLENECK FOUND: sync_memory_to_rust scanned ALL memory pages (2000+) via memory.load() looking for user symbolic data. After Python init, most pages are unconstrained fill (mem*/unconstrained) with empty symbolic_data dicts. memory.load() costs ~0.3ms/page = 670ms total. Fix: use get_symbolic_addrs() or page.symbolic_data (O(1)) to filter. Memory sync: 684ms->19ms for fauxware. Init: 917ms->265ms.

When auditing value.rs for #[inline] candidates: by 2026-06-01, ALL arithmetic _into variants and operator pairs (add/sub/mul/udiv/sdiv/urem/srem/and/or/xor/shl/lshr/ashr/rotl/rotr/eq/ne/zero_extend/sign_extend/truncate/extract/concat/ite/clz/ctz/popcount/neg/not/reverse + their *_into counterparts) ALREADY have #[inline]. So do width(), is_concrete(), is_symbolic(), is_expression(), as_u128(), as_u64(), to_u128(), to_u64(), op(), operands(), into_arc(), concrete(), zero(). Remaining trivial candidates that lacked it as of angr-l4bs: RustBV::ones, BitWidth::{bits,bytes,mask,from_bits}, CallbackInterpreter::get_pc. Larger matches like BVOp::is_unary/is_binary/is_ternary deliberately left alone (could bloat compile output at every call site). Skip RustBV::symbolic/symbolic_with_id constructors — they allocate Z3 ASTs under the vex-engine-z3 feature, not trivial.

InspectionManager lives in state/inspection.rs (state.rs split into state/ dir module, angr-zel8z.1): bitmask u8 for enabled events (bit N = InspectEvent N), ring buffer Vec (max 1024), event_counts [u64; 6]. InspectEvent: 0=MemRead, 1=MemWrite, 2=RegRead, 3=RegWrite, 4=Fork, 5=Exit. is_active() checks bitmask != 0, is_enabled() checks single bit. State has inspect_mem_read/write/fork/exit convenience methods (in state/mod.rs) that check bitmask before recording. Cloned on all 5 fork methods (state/fork.rs). The interpreter drives inspection (statements_inspect.rs/expressions.rs/execution.rs use InspectEvent). NOTE (angr-04tw3.13, 2026-07-30): the manager-level Python FFI surface (enable_state_inspection/enable_all_inspections/get_state_inspection_counts/get_state_inspection_events pymethods + _-prefixed helpers in state_api.rs + InspectionEventInfo type alias) was DELETED as dead — zero callers anywhere, since state.inspect raises NotImplementedError on the Rust engine (docs/advanced-topics/rust_engine.rst). The core InspectionManager machinery + interpreter wiring stays live and is exercised by state_tests.rs. Original wiring commit a07a999f4.

interpreter dedup helpers (commit f9b73e641, angr-24pv4.6): four shared interpreter primitives now exist as pub(super) methods on impl<'a> VEXInterpreter<'a> — DO NOT re-inline them. (1) inspect_ast(py, callbacks, event_bit: u8, value: &RustBV) -> Option<Py> in expressions.rs is the shared gate+import(claripy)+rustbv_to_claripy preamble for all dispatch_*_inspect methods (split across expressions.rs + statements_inspect.rs). (2) concretize_and_pin(&self, v) -> Option in expressions.rs is the solver-eval + equality-pin soundness primitive for GetI/PutI index + dirty-arg concretization (statements.rs). (3) try_convert_symbolic_value (expressions.rs) is the handle->claripy->fresh symbolic ladder; load_from_callback in mod.rs is deliberately NOT routed through it because it fires a symbolic_variable inspect BP on the fresh-symbol fallback that the helper does not model. (4) RustRegisters::get_offset_u64(offset, ctx) in arch/mod.rs reads a reg to concrete u64 honoring the symbolic overlay — distinct from get_sp_value which reads raw bytes. ConcretizationResult::addresses() (concretize.rs) is the canonical Single/Multiple/Strided->Option<Vec> materializer.

Symbol-table handle-lookup misses (RustSolverContext op_/add_constraint_handle in native/angr/src/solver.rs + pending_api.rs set_pending_register_symbolic) MUST raise via solver::invalid_handle_id(&[u64]) -> PyValueError. Standardized in angr-ghwsd.1: was PyRuntimeError in 34 op sites (no id in msg) vs PyValueError in 1 site. Pass every handle id the op dereferenced; helper formats single id ('invalid handle id: N') or all ('invalid handle id (one of [..])'). New op_* methods must use the helper, not a hand-rolled ok_or_else, to keep the type from diverging. BEHAVIOR CHANGE: callers excepting RuntimeError on a bad handle now get ValueError.

VEX IRSB JSON deserialize is NOT a bottleneck (spike angr-3ijo, 2026-05-03). Microbench on 500 captured codegate_2017-angrybird IRSBs (avg 3KB JSON each): full deserialize_irsb = 17 µs/call, of which 12.8 µs is serde_json parse and 4.2 µs is PyVex→IRSB convert. For codegate (most lift-heavy benchmark, 1282 lifts): total deserialize = 21.8 ms = 0.8% of 2.72s total runtime. Even bincode at 5x faster parse would save only ~13 ms = 0.48% of total. Lift_time-python_callback_time delta in profiler = 70% deserialize, 30% Arc::new+cache.put. Across all benchmarks, deserialize is ~10% of lift_time, lift_time is ~10% of total = ~1% total. Spike fails its threshold of '>20% of lift'. Verified by running native/angr/examples/bench_deserialize on captured samples.

VEX IRSB serialization lives in angr/exploration/rust_irsb_serializer.py (extracted 2026-05-03 from RustExplorationManager._serialize_irsb). Module-level: serialize_irsb(irsb)->str (entry point), with _serialize_const/_serialize_descr/_serialize_cee/_serialize_expr/_serialize_stmt helpers. Constants: CONST_TYPES (frozenset of Ico tags), _EXPR_FIELDS (table of RdTmp/Get/Load/Unop/Binop/Triop/Qop/ITE field schemas), _STMT_FIELDS (IMark/WrTmp/Put/Store/StoreG/AbiHint/MBE/NoOp). Class method _serialize_irsb just forwards. Output is JSON, consumed by Rust VEX interpreter on lift_block callback.

Iter 88 start: planning angr-4scu step 2 (symbolic-address store via lazy Multi-cell)

tests/benchmarks/run_single.py supports --dump-counters (categorized aligned table) and --counters-json (raw stats dict as JSON, suppresses curated sections so JSON is the only structured stdout payload). Both Rust-engine only. Time keys ending in time_ns and time_in* floats auto-render as ms. dict-valued keys (only simprocedure_fallback_by_name today) print inline as {name=count,...}. Counter categorization is data-driven in run_single.py: explicit per-key sets for exploration/python-side/fallbacks; prefix-based for rust_/z3_/vex_/mem_/concretize_/bvop_/zext_*. New counter prefixes land in a 'misc' bucket — update _DUMP_PREFIX_GROUPS in run_single.py when adding a new family. Commit dcf821df7, 2026-05-20 (angr-j4hl).

mgr.stats() returns 132 keys as of 2026-05-20 (after angr-2j5v instrumentation landed). 11 logical categories (see j4hl-counter-dump-cli). simprocedure_fallback_by_name is the only dict-valued key — needs explicit type-handling in any non-JSON printer. reset_solver_stats() in native/angr/src/symbolic/context.rs:408 resets ALL angr-2j5v counters (vex_, mem_, concretize_, bvop_, zext_) in addition to z3_; called automatically at explore() start, so end-of-bench values are effectively delta-since-explore-start. Multi-explore() solve.py scripts will overwrite earlier counter values — known limitation.

angr-kkpr (commit 65b97cec9, 2026-05-21): canonicalize commutative-op operand order at RustBV construction in add_into/mul_into/and_into/or_into/xor_into/eq_into/ne_into. Z3 mk_bv* hash-cons by AST identity but NOT by commutative-arg permutation, so add(x,y) and add(y,x) used to produce distinct Z3 ASTs. The canonical_sort_key in native/angr/src/symbolic/value.rs returns (variant_priority, sub_key): Symbolic=0/by-id, Constrained=1/by-id, Expression=2/by-Arc-ptr, Concrete=3/by-value. Concretes always sort to the right. Canonicalization runs AFTER constant-folding short-circuits. SLT/SLE/ULT/ULE/Concat/Sub/etc are NOT canonicalized (not commutative). Regression test: native/angr/src/symbolic/value.rs::tests::commutative_ops_canonicalize_operand_order.

Surprising measurement (angr-kkpr, 2026-05-21): commutative-arg canonicalization at RustBV construction was expected to reduce zdho's structural-duplicate rate on benches with high dup rates. ACTUAL impact: ais3_crackme 39.7%→38.1% (45 fewer ptrs, 44 fewer dups out of 1685); fauxware/csaw_wyvern/defcamp_r100 UNCHANGED (exact same numbers). Root cause: VEX lifters emit operands in CONSISTENT order from a given binary — they don't randomly permute. Permutation noise mostly arises from cross-binary symbolic-constraint shape variance, which only shows up in benches with diverse symbolic interactions like ais3_crackme. The bead's premise that 'most of zdho's 27-85% dups are commutative permutations' was OVER-OPTIMISTIC — most dups are different RustBV Arcs that Z3 then hash-cons via to_z3_ast. The actionable subset is small but real and the fix is cheap (one helper call per commutative-op fallback).

Batched add_constraints (angr-kol7, 2026-05-20): SymContext exposes add_constraints_raw_batch(Vec<(z3_ast_ptr, RustBV, is_true)>) at native/angr/src/symbolic/context.rs ~line 720. Single local_constraints.lock(), single solver() guard, single sat_cache invalidate, short-circuiting batched model-invalidation. Use this when you have N>1 constraints to assert from already-extracted Z3 AST pointers. Fast path in RustSolverContext::add_constraints (solver.rs:165) collects pointers up front then dispatches in one call. If ANY ast fails extract_z3_ast_ptr/claripy_to_rustbv, the whole batch falls back to the per-constraint slow path so semantics stay identical.

angr-kwpi.2 benchmark verification (2026-05-25): the failing regression benches (google2016_unbreakable_0 1.04s vs baseline 0.88s; whitehatvn2015_re400 1.43s vs 1.23s; ais3_crackme 0.97s vs 0.84s) are STALE-BASELINE drift, not regressions caused by lazy materialization. Confirmed by stashing the change and running the same 5-sample medians on commit 80046806f — identical results. Sub-second benches still noise-dominated as baseline-timings-stale-2026-05-14 and benchmark-regression-noise-floor noted. Validation pattern: stash diff, re-run 3-5x, compare medians.

REAL warm _add_rust_state on fauxware (cProfile, 50 samples, 2026-05-11): 17.0ms total per call, dominated by _sync_registers_to_rust 7.8ms (46%) + _sync_memory_to_rust 7.2ms (42%, of which _overlay_relocated_sections=6.1ms). _extract_symbolic_pages was only 1.56ms (9%) — the bead's '0.95ms = 79%' claim from add-state-init-breakdown-2026-05-11 was wrong about share but right about being wasted work. Optimizing symbolic_pages saves ~1.3ms (7.5%); the next big wins are register and memory sync.

Before commit 88c5b60b5, .github/workflows/nightly-ci.yml::benchmark_regression checked out angr/binaries but NOT angr/angr-examples — and tests/benchmarks/run_regression.py resolves the example corpus from ~/repos/angr-examples/examples via run_single.EXAMPLES_DIR. So in CI $HOME/repos/angr-examples did not exist and the step exited with sys.exit(2) 'ERROR: Missing examples: ...'. The fix adds an angr/angr-examples checkout + sets ANGR_EXAMPLES_DIR (now honored by run_single.py). If anyone re-introduces a CI bench step elsewhere, replicate that env var or it'll silently fail.

Lazy symbolic memory (angr-czph Phase 1) follows a sidecar architecture, NOT an enum-per-byte design. The design doc says 'Add Multi variant to byte-cell enum in memory/page.rs' but the actual byte representation in page.rs is concrete bytes + Option<Box>, with symbolic data stored in SymbolicMemory.symbolic_objects (FxHashMap<addr, RustBV>). To match that pattern, Phase 1.1 (commit ca509f925) added: (a) a separate multi_objects: FxHashMap<u64, MultiPayload> sidecar on SymbolicMemory, parallel to symbolic_objects, and (b) a multi_bitmap on MemoryPage parallel to symbolic_bitmap. A byte is Multi when its page bit is set AND multi_objects has an entry at that address. set_multi_alternatives() is the only public path that installs Multi cells; it auto-maps the page, clears any conflicting symbolic_objects/spans entry, and calls record_mem_ite_depth(len) to satisfy invariant-mem-ite-depth-counter.

SymContext::fork() now uses lazy solver materialization. solver field is Optionz3::Solver, starts as None. Materialized on first access via self.solver() helper method (uses parking_lot::MutexGuard::map for ergonomic access). Z3 assertions are cached in z3_assertions_cache and replayed during materialization. This eliminates O(n) replay cost for states that never query the solver (pruned/avoided/deadended). Committed cb3dac5bd.

LAZY_SOLVES set after RustExplorationManager construction (e.g. sm.one_active.options.add(LAZY_SOLVES)) was not propagated to Rust interpreter. Fixed by re-checking _state_cache at explore() time (commit 25b3244f4). Also: init cache (in-process and disk) must preserve user globals and LAZY_SOLVES option from original state.

Lazy symbolic memory store gate is GONE as of HEAD. Phase 2 (angr-qh5u, bce90fef4) added SymbolicMemory::use_multi_cell_stores default-OFF, but Phase 4.3 (angr-mmdh.3, commit e5c594fe1, 2026-05-15) ENABLED Multi-cell stores by default and removed the flag + its getter/setter/PyO3 bindings + the dead eager store_conditional_multiple helper. Multi-cell lazy stores are now the ONLY path for Multiple/Strided symbolic-address store results. Phase 4.1 (wider-load cache, angr-mmdh.1) + 4.2 (flush coalescing, angr-mmdh.2) closed the load-time/Z3 gap that justified the gate. Any doc/task citing 'use_multi_cell_stores' or 'gated default-OFF' for stores is stale -- the angr-miac task description itself was.

Lazy Z3 AST for Expression nodes: removed ast field, added build_z3_ast() that recursively builds from op+operands. Also binary_regions use Arc<Vec> for O(1) clone per step. Commit 779a10442. No performance regression on fauxware/ais3/defcamp.

leak-check baseline (mma_howtouse, 2026-06-03 commit 9eb1edf52): peak_rss after each main() across N=10 iters is ~231 MB throughout, ratio iter10/iter1 = 1.002. Wall-time per main() ~4.3-4.6s. Three iters gives 1.001; five iters gives ~1.001; ten iters gives 1.002. Confirms post-293aa8163 cleanup() path holds RSS flat across repeated Callable workloads. Use as reference baseline when tuning --threshold for new Callable-heavy benches added to run_leak_check.py.

Legacy non-callback interpreter (interpreter.rs + engine.rs RustVEXEngine PyO3 class) is unused by production code — angr/exploration/rust_manager.py calls interpreter_cb's CallbackInterpreter exclusively. RustVEXEngine is registered to PyO3 module but no Python imports it. When cleaning up dead code in interpreter.rs / engine.rs, only the cargo unit tests + engine.rs's from_result() actually consume ExecutionResult.

Legacy VEX interpreter (VEXInterpreter in interpreter.rs + RustVEXEngine pyclass) deleted 2026-05-31 via commit 25c3a3dd3 (angr-febn / B26). Replacement for the three typed-error tests is execute_irsb_for_test (in engine.rs, exposed as angr.rustylib.vex_engine.execute_irsb_for_test) which constructs a CallbackInterpreter with empty PythonCallbacks::new() and runs a single block via the new pub fn CallbackInterpreter::execute_block in interpreter_cb/execution.rs (thin delegate to the private execute_block_with_callbacks). CbExecutionError -> RustExecError mapping lives in engine.rs::cb_execution_error_to_typed (replaces the prior execution_error_to_typed). RustVEXEngine had no live callers in angr/ Python source — was only exercised by the three TestRustExecutionErrorHierarchy cases at test_rust_exploration.py:11498/11543/11585. CallbackInterpreter was a strict superset already (CAS/DCAS, dirty helpers, VECRET/GSPTR, pending stores, prefetch, deferred forks; safer CCall fallback via NeedPythonFallback instead of legacy concrete-0 silent corruption — defensive fix in angr-ppgx was made superfluous by this deletion).

libafl 0.15.3 API drift fixed in fuzzer feature (angr-ckzr): (1) the separate SetTimeout executor trait was removed — set_timeout is now a required method on HasTimeout itself (libafl src/executors/mod.rs trait HasTimeout has both timeout() and set_timeout()); merge the impl. (2) libafl::inputs::NopToTargetBytes was renamed NopBytesConverter (StdFuzzer's 3rd type param IC; StdFuzzer::new yields StdFuzzer<CS,F,NopBytesConverter,NopInputFilter,OF>). CI clippy + .claude/hooks/cargo-check-stop.sh now run --all-features again.

IRCallee.addr must be normalized to 0 in the native libVEX marshaller (marshal_callee in native/angr/src/vex/libvex_lifter.rs). The C IRCallee.addr is the HOST address of the VEX helper (e.g. the in-process pointer to amd64g_calculate_condition) -- non-deterministic across loads and UNUSED by the Rust interpreter, which dispatches CCalls by cee.name. The pyvex serializer (rust_irsb_serializer._serialize_cee) hardcodes addr:0, so the native path must too or corpus IRSB parity diverges on any block with a CCall (surfaced by angr-3s5js.4 on fauxware block @0x400490, amd64g_calculate_condition). Same applies to Dirty callees. See [[libvex-corpus-parity-gate]].

libVEX-FFI corpus parity gate (angr-3s5js.4): native/angr/src/vex/libvex_corpus_tests.rs replays a checked-in block corpus through BOTH NativeLibVEXLifter.lift(bytes) AND pyvex_bridge::deserialize_irsb(json), asserting structural IRSB equality. Corpus is MULTI-ARCH since angr-qwyti.20: 77 AMD64 + 1 each ARM/ARM64/MIPS32/MIPS64 blocks (fn arch_from_str maps the corpus arch string to VexArch and panics on anything else). IRSB/IRStmt/IRExpr do NOT derive PartialEq, so equality is compared via derived Debug: format!("{:#?}", irsb) string-compare (both paths target the same vex::ir shape -> identical trees render identically; also catches field-order/variant drift). Fixture native/angr/tests/fixtures/libvex_corpus.json generated by gen_libvex_corpus.py: lightweight recursive-descent (project.factory.block(addr) + irsb.constant_jump_targets, no CFG) over fauxware/ais3_crackme/r100, dumping {addr,arch,bytes(hex),pyvex_json} where pyvex_json comes from the SAME serialize_irsb production _cb_lift_block uses. Gate: 100% parity. Test is feature-on-only: cargo test --features libvex-ffi corpus (needs Z3_SYS_Z3_HEADER + PYVEX_FFI_LIB_DIR + LD_LIBRARY_PATH per libvex-lift-params memory). See invariant-libvex-native-lifter-arch-support.

libvex_corpus.json (the libVEX-FFI Stage-1 parity gate fixture) is generated by a recursive-descent walk of a real AMD64 binary, which reaches ZERO SSE/AVX-const blocks — so the corpus alone never exercised V128/V256 const marshalling and the gate was green against a broken marshaller (angr-op0dn.2.1). gen_libvex_corpus.py now appends SYNTHETIC_BLOCKS: hand-assembled byte sequences lifted via pyvex.lift + the same serialize_irsb, merged into the fixture by (addr, bytes). When adding coverage for an IR shape a normal binary never emits, add a SYNTHETIC_BLOCKS entry rather than hunting for a binary that contains it. Real AMD64 only emits the all-zero / all-ones restricted-vector patterns, so mixed patterns need direct unit tests (libvex_lifter_tests.rs::test_expand_v128_pattern).

libVEX FFI Stage-1 build scaffolding (angr-3s5js.1, commit d4902afac) is DONE. Non-default cargo feature 'libvex-ffi' in native/angr/Cargo.toml. build.rs::configure_pyvex_ffi (gated on CARGO_FEATURE_LIBVEX_FFI) calls find_pyvex_lib_dir (mirrors find_z3_pkg_from_python: honors PYVEX_FFI_LIB_DIR override, else python3 -c 'import pyvex' + /lib, checks libpyvex.so/.dylib) and emits rustc-link-search + link-lib=dylib=pyvex + rpath. setup.py::_resolve_pyvex_libdir sets PYVEX_FFI_LIB_DIR (mirrors _resolve_z3_header). To build the feature via direct cargo: set Z3_SYS_Z3_HEADER=/usr/include/z3.h + PYVEX_FFI_LIB_DIR=/site-packages/pyvex/lib, cargo build --features libvex-ffi. NEXT: angr-3s5js.2 = FFI decls (bindgen) from pyvex.vex_ffi.ffi_str cdef.

libVEX FFI Stage-1 .2 DONE (angr-3s5js.2, commit 85efd11a9): FFI decls generated by bindgen, all behind the libvex-ffi feature (DEFAULT-ON since 807bfd74d / angr-3trr7 — setup.py::rust_features appends it; opt out with ANGR_LIBVEX_FFI=0). Vendored cdef: native/angr/vendor/pyvex_ffi.h (from pyvex.vex_ffi.ffi_str, pin 9.2.209; regen via tools/regen-pyvex-ffi-header.py — prepends #include <stddef.h> for size_t). NOTE: the script's emitted banner text and vendor/pyvex_ffi.h must be edited in LOCKSTEP or the vendored file drifts from what regen writes (angr-656mp). Cargo.toml: libvex-ffi = ["dep:bindgen"] + [build-dependencies] bindgen={version="0.72",optional=true} (same major z3-sys already locks; only prettyplease added to Cargo.lock). build.rs::generate_pyvex_ffi_bindings (cfg libvex-ffi; no-op cfg(not) sibling) runs bindgen with allowlist roots vex_lift/vex_init/register*/VEXLiftResult/IRSB/VexArch/VexArchInfo + allowlist_recursively + NewType enums (FFI-safe vs rustified) + layout_tests(false), writes OUT_DIR/pyvex_ffi_bindings.rs. vex/libvex_ffi.rs include!()s it; wired in vex/mod.rs #[cfg(feature=libvex-ffi)]. Generated file ~1914 lines: _VEXLiftResult{exits[400],const_vals[1000]}, IRSB, IRStmt/IRExprTag, ExitInfo/DataRef/ConstVal. Build recipe: Z3_SYS_Z3_HEADER=/usr/include/z3.h PYVEX_FFI_LIB_DIR=/pyvex/lib cargo build --features libvex-ffi.

libvex-ffi is ON by default as of angr-3trr7 (commit 807bfd74d, human GO 2026-07-15). setup.py::_rust_features returns ['libvex-ffi'] UNLESS ANGR_LIBVEX_FFI in {0,false,off,no} (opt-OUT escape hatch) OR PYVEX_FFI_LIB_DIR is unset (no libpyvex.so next to pyvex, e.g. Windows -> graceful degrade to callback lift). Stock pip install -e . and released wheels now link the native libVEX lifter on ELF/Mach-O; use_native_lift default True + libvex_ffi_enabled() both satisfied on a stock AMD64 .so. Wheels: wheels.yml excludes libpyvex.so from auditwheel (Linux) / delocate (macOS) repair and relativizes RUNPATH to $ORIGIN/../pyvex/lib (@loader_path/../pyvex/lib on macOS), exactly mirroring the libz3 handling -- so the wheel resolves the USER's pyvex, not a vendored 2nd libVEX. Build-system gotchas from the opt-in era still hold: setuptools-rust pyproject table cannot express a conditional feature (mutate ext.features in build_rust.run()); do NOT declare via setup(rust_extensions=[...]) in this hand-assembled venv.

vex/libvex_lifter.rs + vex/libvex_ffi.rs are gated behind the non-default cargo feature 'libvex-ffi' (Cargo.toml: libvex-ffi = [dep:bindgen]; vex/mod.rs #[cfg(feature)]). The default clippy gate (cargo clippy --all-targets -D warnings, no --features) and the pytest suite do NOT compile or exercise these files. To verify any change to the NativeLibVEXLifter marshallers, run: cargo clippy --manifest-path native/angr/Cargo.toml --features libvex-ffi --lib -- -D warnings, and cargo test ... --features libvex-ffi --lib libvex (6 unit+corpus tests). All 11 marshaller fns are private unsafe fns so clippy::missing_safety_doc never fires on them; the only missing_safety_doc allow is in libvex_ffi.rs guarding include!'d bindgen output (module-scoped, non-narrowable).

libVEX-FFI Stage-1 (angr-3s5js) DONE + closed iter47. NativeLibVEXLifter lives behind non-default cargo feature 'libvex-ffi' (Cargo.toml: libvex-ffi=["dep:bindgen"]) in native/angr/src/vex/libvex_lifter.rs, slotting into the VEXLifter trait beside the pyvex-callback path. Verify with: cargo test --manifest-path native/angr/Cargo.toml --features libvex-ffi --release test_corpus_native_vs_pyvex_structural_parity (in vex::libvex_lifter::corpus_tests; source native/angr/src/vex/libvex_corpus_tests.rs). Gate: 100% structural IRSB parity on 65-block AMD64 corpus (fauxware/ais3/r100) vs pyvex_bridge::deserialize_irsb. marshal_callee normalizes IRCallee.addr->0 to match pyvex. NEXT: umbrella angr-z087y still open for Stage 2 (flag-gated engine use) + Stage 3 (AMD64 default); downstream gorvf.4 zero-bounce milestone. Feature is NOT wired into the engine yet.

libVEX FFI Stage-1 (angr-z087y) is feasibility-GO: a native NativeLibVEXLifter needs NO from-scratch lifting and NO separate libVEX build. (1) The installed pyvex ships pyvex/lib/libpyvex.so which exports pyvex's exact-config shim vex_lift + vex_init AND the raw LibVEX_* API -> link the SAME .so via build.rs (search=pyvex/lib, link-lib=dylib=pyvex, rpath), gated behind a NON-default cargo feature so the default build/bench-gate takes no new libpyvex.so rpath dependency. (2) The wheel ships no C headers, but pyvex.vex_ffi.ffi_str (~44KB) is the AUTHORITATIVE cdef: vex_lift signature (VexArch guest, VexArchInfo archinfo, insn bytes, max_insns/max_bytes, opt_level, traceflags, ...px_control, lookback) returning VEXLiftResult* {IRSB* irsb; ...; ExitInfo exits[400]; inst_addrs[200]; DataRef data_refs[2000]; ConstVal const_vals[1000]} plus IRSB/VexArchInfo/ExitInfo layouts -> use as bindgen source. (3) Link target == the in-process lifter pyvex loads -> byte-for-byte IRSB parity, no opt/arch/endness divergence. Marshal VEXLiftResult->irsb into vex::ir::IRSB (same shape as pyvex_bridge.rs::PyVexIRSB but from the C struct not JSON), via the existing VEXLifter trait seam in vex/lifter.rs. RISKS: libVEX arena clobbers VEXLiftResult* on next vex_lift (copy out first); cdef ABI is pinned to pyvex==9.2.209 (regen on any bump); libVEX globals are non-reentrant (per-worker lock for parallel). Verifier: tools/probe-libvex-ffi.py (asserts all 3, exits nonzero on NO-GO). Full recipe+plan: docs/advanced-topics/rust_libvex_ffi.rst. Impl remainder = bead angr-3s5js.

NativeLibVEXLifter::lift calls vex_lift with pyvex _lift defaults (disassembled from pyvex/lifting/libvex.py): opt_level=1, traceflags=0, allow_arch_optimizations=1, strict_block_end=0, collect_data_refs=0, load_from_ro_regions=0, const_prop=0, px_control=VexRegUpdUnwindregsAtMemAccess (cross_insn_opt=True branch), lookback_amount=0, max_insns=99, max_bytes=min(slice_len,5000). AMD64 archinfo from archinfo.ArchAMD64().vex_archinfo: hwcaps=0, endness=VexEndnessLE, x86_cr0=0xFFFFFFFF, hwcache_info{num_levels:0,num_caches:0,caches:NULL,icaches_maintain_coherence:1}, rest 0. For the .4 parity harness these MUST match whatever the Rust engine's actual pyvex lift_block callback passes; if parity diverges, re-check allow_arch_optimizations and hwcaps first (hwcaps=0 means baseline SSE only, no AVX). V128/V256 IRConst are marshalled as raw u16/u32 zero-extended (Stage-1 stub) — exact expansion deferred to .4.

NativeLibVEXLifter (native/angr/src/vex/libvex_lifter.rs, libvex-ffi feature) marshals C VEXLiftResult->irsb into vex::ir::IRSB by reusing opcode_map.rs string parsers (parse_opcode/parse_type/parse_jumpkind/parse_endness). The bridge: build.rs::generate_pyvex_ffi_enum_names parses the vendored cdef (vendor/pyvex_ffi.h) enum blocks and emits reverse discriminant->name tables (irop_name/irtype_name/ijk_name/iend_name) into OUT_DIR/pyvex_ffi_enum_names.rs, included as libvex_ffi::enum_names. Marshaller reads raw C tag (.0 on bindgen NewType), looks up name, calls parser. Single source of truth = same header bindgen consumes, so parity-safe. Structural target shape mirrors pyvex_bridge::convert_* node-for-node.

z087y Stage-3 DECISION (angr-op0dn.2.2, commit 63d201a88): RustExplorationManager use_native_lift now defaults TRUE, still double-guarded by libvex_ffi_enabled() + arch==AMD64, so a stock build (libvex-ffi is NOT a default cargo feature) is inert. Evidence, feature-on cargo build, run_single.py --native-lift vs --no-native-lift, 3+ reps: codegate_2017-angrybird 4.33-4.42 -> 3.68-3.94s (~13%); ekopartyctf2016_rev250 2.53-2.75 -> 2.40-2.47s (~7%, 221 native / 0 fallback, gil_work 356ms->198ms); xmllint_getenv 3.84 -> 3.79s (135/0, gil 96->65ms); fauxware/mma_howtouse/cow_fork_scaling flat; unbreakable_1 within bimodal noise. NOTHING regressed, found unchanged. Real payoff is the 30-45% GIL-work drop (parallel-warmup serialization point). Full table in docs/advanced-topics/rust_libvex_ffi.rst 'Stage-3 verdict'. To A/B: cargo build --release --features libvex-ffi (Z3_SYS_Z3_HEADER=/usr/include/z3.h) then cp target/release/librustylib.so angr/rustylib.cpython-312-x86_64-linux-gnu.so.

asisctffinals2015_license rust TIMEOUT — FINAL root cause + fix (supersedes license-timeout-fread-root-cause's 'z3 churn' theory, which was WRONG). The hang is NOT z3/130-asserts and NOT the Python fread. Real cause: the Rust manager's Python-init-to-main path (_run_python_init_if_needed) hits the init cache (_try_disk_init_cache / try_in_memory_init_cache), which is built from a plain blank_state with an EMPTY filesystem. apply_state_metadata copies constraints/options/globals but NOT the fs plugin, so the cached callback state's state.fs is empty. fopen then takes the ALL_FILES_EXIST branch and mints a fresh symbolic-size SimFile (filesize_file_1* unbounded). fseek(SEEK_END)+ftell returns that unbounded symbolic size (max 2^63-1); fread(dst, size*nm) over-reads, spawning tens of thousands of fill BVS -> 4GB RLIMIT_AS blowup -> timeout. Pure-Python keeps the user-inserted SimFile (size 0x22=34) so fread size is CONCRETE 34 and finishes ~1.7s. FIX (commit 00a1bb3dc): rust_disk_cache._state_has_user_symbolic now also returns True when state.fs._files is non-empty, disabling the init cache when the user inserted SimFiles. RESOLVED 2026-07-03 (angr-0xyq2 Phase 3+4): the bench now PASSES under Rust ~0.9s vs Python ~1.7s (~1.9x), catalog rust_ok=True. Two unlocks: (1) bounded-symbolic-file export (_export_fs_files_to_rust) registers the 34-byte SimFile in the Rust FileSystem, so read/fread serve natively and fstat/ftell see concrete sizes (effective_len) — the symbolic-fread-size explosion is gone by construction; (2) solve.py's inline strlen (SIM_PROCEDURES execute on the found state) needed _LazySimStateRef to delegate _inspect — fixed via _MATERIALIZING_PRIVATE allowlist in rust_state_export.py.

Lineage chase finally closed 2026-05-25 (angr-0hdq + 2 children + angr-1gfa). All four beads converged on the verdict that materialize-cost win from angr-hk7k is NOT capturable in current engine architecture. What landed and survived:

1. Simple-variant dismantle (commit 971d35545, angr-v5ht) — opt-in via use_shared_lineage_solver=True only. Detects baby-re-shaped (LOSE) workloads via hot-cache hit rate <35% within 10/20-window, then disables the lineage solver path. 35% threshold justified by N=4 data: LOSE=30.2%, WINs=44.7/51.0/84.2% (4.8pp/9.7pp margins; see v5ht-threshold-justification-2026-05-25 memory).

2. Doc verdict in docs/advanced-topics/rust_engine.rst:456 'Shared-lineage Z3 solver — rejected' (175 lines, commit 14709cea8).

3. Behavioral tests in native/angr/src/exploration tests (cold/hot/overhead).

What was REMOVED: native/angr/src/symbolic/lineage_assumptions.rs (alt-d spike; recover via git show 561aa838b if ever needed).

Default state: use_shared_lineage_solver=False in rust_manager.py:753. Don't reopen this chase without new measurement data showing the architectural prior has changed (BFS-thrash + 15.6% hot-cache hit rate ≈ theoretical 1/N for N=5-10 active states).

Recipe for measuring hot-cache hit ratio under use_shared_lineage_solver=True: python tests/benchmarks/run_single.py <example> --engine rust --use-shared-lineage-solver --counters-json | grep -E 'lineage_switch_count|lineage_switch_hot_count|lineage_dismantle|lineage_sample'. Ratio = lineage_switch_hot_count / lineage_switch_count. If lineage_dismantled=1 the ratio reflects the pre-dismantle window; if 0 the ratio is the natural workload hot-cache rate over the whole run. lineage_sample_call_count / lineage_sample_decision_count tell you how many sampler decisions fired (sampler hooks every 10 ticks, decides once min_switches=20 events have accumulated).

User-facing SharedLineageSolver rejection rationale lives in docs/advanced-topics/rust_engine.rst, section 'Shared-lineage Z3 solver — rejected' (top-level, between ANGR_Z3_TACTIC and SimOption matrix). Any future lineage-architecture proposal must cite this section and explain how it discriminates WIN vs LOSE on multiple benches (not just one). Bead trail: angr-v5a5 (spike rejected), angr-3ms1 (alternatives enumerated), angr-v5ht (simple-variant landed), angr-0dgq (full-variant reverted). Landed in commit 14709cea8 (2026-05-25, angr-0hdq.1).

list

To de-vacuify a test that needs a LIVE pending_callback (with_pending succeeds only while self.pending_callback is Some): use _RustExplorationManager directly, register a SimProcedure at a HOOK addr, set the arg register SYMBOLIC (set_register_symbolic on rdi via claripy.backends.z3.convert(BVS).as_ast().value), then mgr.run(N). The run loop's SimProcedure Python fallback (run_loop.rs sets PendingCallback::with_context) fires ONLY for symbolic args — a symbolic arg makes extract_concrete_arg yield SymbolicArgument, so the native callable is NOT invoked and a live pending_callback is established. After run returns event.callback_reason=='simprocedure', pending_memory_load_symbolic_page reads the forked active state's memory. GOTCHA: add_state (state_lifecycle::_add_state) FORKS the supplied state and mints a fresh monotonic id, so state.state_id is NOT the manager's id — use mgr.get_state_ids('active')[0] for any state_memory_store_symbolic_multi/query call. PyRustSimState does NOT expose memory_store_symbolic_multi to Python; only the manager does (state_memory_store_symbolic_multi).

memory/load.rs site 2 (~line 675-683) and site 1 (~line 209-227) use DIFFERENT extract semantics for the wider-symbolic-containment case. Site 1 honors endianness (Endness::Big and Endness::Little branches, mirror of angr-v1q2 fix). Site 2 uses ONLY the LE-style extract: high=(byte_offset+size)8-1, low=byte_offset8, regardless of memory endianness. This is a pre-existing inconsistency in load_concrete_lazy_inner. angr-uwtj preserved both behaviors when introducing the containing_wider_sym helper. If a BE memory ever hits site 2 with a wider sym containment, the extract returns wrong bytes. Real reachability of site 2 is also rare (same dead-code analysis as site 1).

As of 2026-05-07 16:24 the benchmark gate (run_optimization_loop.run_benchmark_gate, called after each commit) works end-to-end: passed=12, failed=0, gate_broken=False, duration ~19.6s. PYTHONPATH=REPO_DIR is set in the systemd-run scope env so multiprocessing spawn workers can import angr despite the editable install having no .pth file. Verified by direct invocation 2026-05-07 16:24 against the current source. Premise of angr-p5hl ('fix didn't land') was wrong — the fix did land; the previous orchestrator process was running stale bytecode.

angr-caplg LoopHeadRoundRobin selection policy (selection_policy.rs): round-robin over (loop-head, callstack-class) buckets to prevent a looping state starving siblings. bucket_key() folds loop-head (most-frequent addr in state.history(), matching LoopBound's exceeds_loop_bound frequency test; falls back to state.pc() when no addr repeats) with the return-addr chain from state.call_stack() (same signal record_reconvergence_sample uses). select() picks the least-dispatched bucket (Mutex<HashMap<u64,u64>> counts, strict < → FIFO tie-break) and bumps it. KEY: both signals are per-state accessible inside the two-hook seam — NO seam widening needed, same lesson as m9fpp (see coverage-guided-policy-m9fpp, selection-policy-seam-limits). Opt-in: set_state_selection_loop_head (mod.rs, single #[pymethods] block) + set_exploration_strategy('loop_head') (rust_manager.py). Never default. Completes the a32jl.2 policy trio (random/coverage/loop_head).

run_optimization_loop.sh output is block-buffered when piped to tee, so .claude/loop-logs/iteration-*.log files show 0 bytes until the process exits. Fix: use 'stdbuf -oL bash run_optimization_loop.sh 2>&1 | tee logfile' to force line-buffered output. Or use 'script -c' as alternative. Without this fix, you cannot monitor loop progress in real-time.

angr-4arn: the native LoopSeer wiring was mostly pre-existing. register_loop_bound (mod.rs) + NativeTechnique::LoopBound enforcement (helpers.rs exceeds_loop_bound: any single addr appearing > bound times in history) already existed; only the Python translation in rust_techniques.py use_technique() was missing (LoopSeer branch was a debug-log no-op). Wired LoopSeer/LocalLoopSeer.bound -> mgr._rust_mgr.register_loop_bound(bound, discard_stash). bound=None registers nothing; bound_reached callback disables native path (can't invoke from Rust) with warning. See concretization-config-readback for the use_technique() dispatch pattern.

test-python-baseline make target (added 2026-06-03 in angr-r0di) is the per-PR 'we didn't break Python angr' gate. Curated 64-test subset spans tests/test_load_shellcode.py + tests/engines/{test_actions,test_hook,vex/test_lifter}.py + tests/state_plugins/{solver,posix}/* + tests/procedures/test_sim_procedure.py + tests/factory/test_callable.py. CI job python_baseline in ci.yml clones angr/binaries beside angr/ (matches tests/common.py's ../../binaries lookup) and runs uv --directory angr run make test-python-baseline. Does NOT build the Rust extension. When adding a test file: keep the total under the ~5min soft budget; update PYTHON_BASELINE_TESTS in Makefile only (CI just calls the make target). Locally requires angr/binaries cloned at $(REPO_ROOT)/../binaries; if missing, the target prints a clear git clone hint and exits 1 — CI=true env var bypasses the check (same as tests/common.py's CI gate).

Mass-rename pattern used in angr-sy4g (interpreter_cb -> interpreter + CallbackInterpreter -> VEXInterpreter, ~23 files): 1) git mv directory, 2) 'git grep -l PATTERN | xargs sed -i s/OLD/NEW/g' for each token, 3) git grep PATTERN to verify zero remaining. Works across .rs/.py/.rst/.md uniformly. Only manual cleanup needed: lines that referenced a separate deleted file (CLAUDE.md had both interpreter.rs AND interpreter_cb/ — first one was stale since angr-febn deleted interpreter.rs). cargo check + pytest verify correctness.

Baseline metrics for lazy symbolic memory work (angr-czph / angr-qh5u). After adding mem_ite_depth_max/mem_ite_depth_total counters in symbolic/context.rs (Phase 0 / angr-0nme): sym-write rust run = depth_max=2 depth_total=16; strcpy_find = 0/0; fauxware = 0/0. Counters track eager ITE chains built by store_strided / store_conditional_multiple / store_symbolic Multiple-branch. Phase 1 Multi cells (angr-czph) should record the same metric on Multi insertion so before/after comparison is direct. Surfaced through get_solver_stats() (Python) and printed by run_single.py under 'symbolic memory ite-depth' section.

Native memcpy/memmove/memset had ZERO Python-boundary test coverage despite shipping extensive Cargo unit tests for symbolic byte/size/address paths (cudgw.4, e4qwq, 1yv58, 3l72p, 7ifq6). TestNativeMemoryCopyAndSet in tests/engines/rust/test_procedures.py now covers the concrete fast paths via fauxware .ctors stub + get_state_memory readback. Pattern: num_args=3 stub, rdi=dst/rsi=src(or fill-value)/rdx=size SysV, single-step, assert call_counts + dst bytes + rax==dst. get_state_memory(sid,addr,size) returns memory-order bytes and is the readback API for buffer-writing procedures. memset value arg uses only low 8 bits. The symbolic paths (symbolic addr/size) remain Cargo-only — bounded candidate-pair ITE logic is exercised directly in memcpy_tests.rs/memset_tests.rs, not cheaply reachable from a clean Python integration test.

memcpy/memmove handle a SYMBOLIC dst and/or src address natively via module-level fn copy_symbolic_addr in native/angr/src/procedures/memcpy.rs (follow-up to memset-symbolic-address-native). Both NativeMemcpy/NativeMemmove now declare args dst_bv:bv, src_bv:bv (was concrete); body extracts both with extract_concrete_arg and routes to copy_symbolic_addr when EITHER is Err. Pattern: ctx.eval_upto(dst_bv, CAND+1) and eval_upto(src_bv, CAND+1) for the two bounded candidate sets; reject empty/>cap (unbounded). Cross product: for each (dst d, src s) pair build guard = dst_bv.eq(d).and(src_bv.eq(s)) (eq returns 1-bit bool, .and is logical AND on 1-bit), then per byte i: store(d+i, guard.ite(src_byte[s+i], orig)). ALL src candidate bytes snapshotted into a HashMap<u64,RustBV> BEFORE any store so overlapping src/dst copy pre-store values (memmove contract) — same reason both procs share the helper, like copy_symbolic_size. Composition correct because dst/src each equal at most one candidate so <=1 guard true per physical addr; orig reload per pair layers ITEs. Caps: MAX_SYMBOLIC_ADDR_CANDIDATES=64 each, MAX_SYMBOLIC_ADDR_COPY_SIZE=256, MAX_SYMBOLIC_ADDR_STORES=4096 (|dst|*|src|*size budget, saturating_mul). Falls back to Python (Err SymbolicArgument) on symbolic size (addr+size out of scope), unbounded candidates, or budget exceeded. Pre-existing test_memcpy_symbolic_dst (unconstrained dst, no mem mapped) still asserts Err via the unbounded-fallback branch.

memcpy/memmove symbolic-SIZE handled natively (native/angr/src/procedures/memcpy.rs, fn copy_symbolic_size; NativeMemcpy/NativeMemmove). Mirrors memset-symbolic-size-native: size arg is 'bv' not 'concrete'; concrete size -> fast 8-byte-chunk copy_forward (untouched, corpus is concrete-size); symbolic size -> ctx.max(size,false) upper bound, Err(SymbolicArgument) fallback if unknown or > MAX_SYMBOLIC_COPY_SIZE (4096), else per-byte ITE(i<n, src[i], dst[i]). KEY for memmove overlap: copy_symbolic_size snapshots ALL source bytes into a Vec BEFORE any store, so it needs no backward-copy special case (concrete memmove path still uses backward copy when dst>src && dst<src+size). dst/src stay 'concrete' arg type so a symbolic ADDRESS still auto-falls-back to Python via extract_concrete_arg (symbolic-address is a separate, unstarted design). Commit 3b4aeeab7.

Memory-citation staleness audit (iter19, 2026-06-23, HEAD 5eeb1f45b): bd memory store is CLEAN — zero stale citations. Method (bounded, read-only, no compute): dump 'bd memories' to a file (USE grep -a / -aoE — bd dump trips grep's binary-file heuristic so plain grep silently returns nothing), regex-extract path citations matching (native|angr|tests|docs|tools)/....(rs|py|rst|json|txt|toml|sh) -> all 73 unique paths exist on disk; same check on CLAUDE.md Key Files -> all exist; extract 'fn ' symbol citations -> all real ones resolve in native/angr/src (check_ast_passthrough is a Python def in tests/smoke/wheel_ast_passthrough.py; get_or_lift_block in interpreter/execution.rs; splice_lane0_u128 in vex/ops_vec_set_lo.rs). Caveat: bd dump truncates bodies with '...' so paths/symbols past the cutoff are invisible (get_or_lift_blo / splice_lane0_u12 were truncation artifacts, not rot) and 'fn ' (arg/in/defined/signature) are prose false-positives. Re-run only after a large rename sweep; routine iterations need not repeat it.

Memory->memory cross-ref audit (iter62, 2026-06-25): CLEAN. Audited all 918 bd memory bodies for citations to OTHER memory keys that no longer resolve. Method: dump 'bd memories --json' (flat key->body dict), extract refs via patterns [[wikilink]], 'bd recall KEY', 'bd memory KEY', 'see KEY', 'key KEY', plus a broad pass for backtick kebab tokens ending in memory-key suffixes (-pattern/-rule/-invariant/-root-cause/-decision/-method/-audit/etc). Cross-check each ref against the valid-keys set. Result: 0 unresolved key citations. The only 3 raw hits were false positives (generic words 'both'/'each' after 'bd recall', and a literal '[[wikilink]]' mention inside docs-rst-crossref-audit-clean). Completes the citation-hygiene sweep series: docs file-paths (iter58), bd-memory file-paths (iter59), bd-memory symbol anchors (iter60), docs .rst cross-refs (iter61), memory->memory cross-refs (iter62) -- ALL CLEAN. No remaining un-swept hygiene surface absent a rename wave.

memory-area dedup (angr-24pv4.3) added shared helpers; anchor by symbol name: load.rs free fns bytes_to_bv + concat_bytes_endian (endian byte->BV packing, balanced concat angr-kg58) and method try_partial_overwrite_load (angr-jvjf guard); store.rs store_eager_ite_candidates (Multiple/Strided eager-ITE loop — caller still does assert_address_disjunction for Multiple only) + check_pages_mapped_lazy (lazy-vs-Unmapped precheck, NOT for store_concrete/automap_internal which differ); mod.rs materialize_pending_ite (flush_pending_writes arms) + ConcretizationResult::to_symbolic_address_error (centralizes 'range too large' msg, used via catch-all 'other =>' at 6 dispatch sites); page.rs free fns clear_bitmap_range (drops bitmap when all-zero)/set_bitmap_range; ite_builder.rs build_ite_tree_generic (recursion scaffold parameterized over a leaf-loader closure FnMut(&Self,u64,u32,&SymContext)->Result<RustBV,MemoryError> — lazy uses load_concrete_lazy, unified wraps infallible load_concrete_or_unconstrained in Ok). Cluster 10 store_symbolic_unified vs _multi left UNMERGED: _safe vs bare install_multi_for_candidates is deliberate lazy-region semantics divergence.

memory/mod.rs structure after angr-0lre close (commit 12d8caaa2): mod.rs 762 lines (was 2881 at start of bead). Sub-modules: load.rs 662, store.rs 495, tests.rs 992, page.rs 251, ite_builder.rs 219, symbolic_objects.rs 115, concretize_glue.rs 75. mod.rs now contains: PendingWrite + MemoryError + SymbolicMemory struct/new, perms helpers (check_perms_range, check_executable, set/get enforce_permissions, set/get zero_fill_unconstrained, endness), map/unmap/is_mapped/map_data, fork+Clone, pending_writes API (count, get, add, drain, flush_pending_writes — flush is the only non-trivial body remaining at ~60 lines), page-mgmt (page_count, mapped_size, dirty pages, load_page_concrete, get_page_data, page_permissions, set_page_permissions), lazy regions (add/clear/is_in/is_addr_in/lazy_region_count, get_region_prefetch_list, get_nearby_prefetch_list), map_page, auto_map_zero_page, merge. If a future split is needed: pending_writes::flush + merge are the two largest standalone chunks left.

memory_store_symbolic_full IS now registered in production (key name is historical — formerly 'not-registered'). angr/exploration/rust_manager.py:1589-1590 calls callbacks.set_memory_store_symbolic_full(self._cb_memory_store_symbolic_full) when the Rust callbacks object exposes the setter; the callback cb_memory_store_symbolic_full is defined at rust_manager.py:2104. So has_memory_store_symbolic_full() returns true in production and the richer multi-addr StoreG path is wired up. (Prior state, pre-angr-tfic era: setter unwired, has*=false, multi-addr concrete-guard StoreG fell back to the ITE chain via memory_store_symbolic_value.)

Effective method for instrumenting RustExplorationManager memory sync phases without rebuilding Rust: monkeypatch RustStateSyncMixin._sync_memory_to_rust in Python to wrap each substage (._find_user_symbolic_pages, ._map_loader_pages, ._overlay_relocated_sections, ._overlay_python_state_pages, ._add_loader_lazy_regions, ._setup_stack_region, ._sync_stack_page, ._sync_extra_python_pages, ._scan_user_symbolic_pages) with time.perf_counter_ns() and aggregate into a per-manager log. Mma_howtouse Callable workflow makes the LAST manager's perf_report (built-in) ambiguous because each Callable is a fresh manager — averaging across 2nd-onward managers (skipping cache-miss first) gives cache-hit steady-state. Skip manager 0 to factor out the loader-pages-cache miss.

mempcpy/stpcpy native procs (memcpy.rs NativeMempcpy / strcpy.rs NativeStpcpy) now have Python-boundary integration tests in TestNativeMemoryCopyAndSet (test_procedures.py): test_mempcpy_returns_dst_plus_n + test_stpcpy_returns_pointer_to_written_nul. Key contract distinction tested: mempcpy returns dst+n (vs memcpy's dst), stpcpy returns dst+strlen (ptr to written NUL, vs strcpy's dst). Modeled on test_memcpy/test_strcpy via shared _store_cstr/_run/_make_stub harness. These were the LAST untested native copy procs — the test-hardening seam for the copy/string family is now fully drained.

memset SimProc handles a SYMBOLIC destination address natively via the module-level helper fn memset_symbolic_addr in native/angr/src/procedures/memset.rs. Pattern: extract_concrete_arg(dest) Err -> enumerate concrete address solutions with ctx.eval_upto(dest_bv, MAX_SYMBOLIC_ADDR_CANDIDATES+1); reject if empty or >cap (unbounded pointer). For each candidate a, build cond=dest_bv.eq(concrete(a)) once, then per byte i in 0..size: orig=memory_load(a+i,1); store(a+i, cond.ite(byte_bv, orig)). Distinct candidates compose correctly because dest equals at most one — a later candidate's store at a shared position layers another guarded ITE and only one guard is true (same composition reasoning as memcpy-symbolic-size-native overlap). Caps: MAX_SYMBOLIC_ADDR_CANDIDATES=64, MAX_SYMBOLIC_ADDR_MEMSET_SIZE=256, MAX_SYMBOLIC_ADDR_STORES=4096 (candidates*size budget). Falls back to Python (Err SymbolicArgument) when size is symbolic (addr+size both symbolic out of scope), candidate set unbounded, or budget exceeded. Used candidate-enumeration in the proc (NOT state.memory_store_symbolic/store_symbolic_unified concretizer) because the main VEX store path routes symbolic stores back to Python (statements.rs call_memory_store_symbolic); self-contained enumeration is deterministic+fully testable. memcpy/memmove symbolic-address (src×dst cross product) is follow-up angr-7ifq6.

memset symbolic-size is handled natively (native/angr/src/procedures/memset.rs, NativeMemset). The size arg is now 'bv' not 'concrete'. Concrete size -> fast 8-byte-chunk path (untouched, no bench impact since corpus is concrete-size). Symbolic size: query ctx.max(&size_bv,false) for an upper bound on n; fall back to Python (Err(SymbolicArgument)) if unknown or > MAX_SYMBOLIC_MEMSET_SIZE (4096); else store ITE(i<n, fill, original_byte) per byte up to the bound, preserving contents past the symbolic length. The bound MUST be the true solver max (loop must cover every byte that COULD be filled). Pattern reusable for memcpy/memmove symbolic-size. Symbolic ADDRESS still falls back. See commit d2e7856ed.

memset native SimProc (procedures/memset.rs) handles a SYMBOLIC byte value without Python fallback: arg is declared 'value_bv: bv'; if value_bv.as_u64() is None it builds an 8-bit byte = value_bv.extract(7,0,&ctx) and a 64-bit chunk = concat_balanced of 8 identical copies (endianness-agnostic), then stores chunks+remainder. Concrete values keep the fast precomputed-u64 chunk path. dst (extract_concrete_arg) and size stay concrete-required. strlen already preserves symbolic contents via an ITE null-position chain; memcpy/memmove copy symbolic BVs verbatim. Remaining mem* gap = symbolic size/address (tracked angr-e4qwq, high-risk).

Testing SymContext::merge (snapshot_fork_ops.rs) in a Rust unit test: create two SEPARATE fresh SymContexts but give the shared variable the SAME name (e.g. RustBV::symbolic(&s1,"x",32) and &s2) — Z3 name identity makes both constraints reference the same const, which is what forked-state merges rely on. merge_conditions are 1-bit BVs (cond.to_z3_bool() == (bv==1)); pass one per context, self first. To verify branch-guarding, just call merged.solution(&x, v): it implicitly solves for the merge-flag assignment, so x==5 and x==9 are each admissible while x==7 is rejected (Or(flags) forces one branch). No need to pin flags. range_seeded(&bv, smallest_known, largest_known): min searched in [0,smallest_known], max in [largest_known,2^w-1] — pass seeds that are valid solutions; concrete bv short-circuits to (v,v); UNSAT returns None. See context_tests/solver.rs test_merge_guards_each_branch_under_its_condition / test_range_seeded_*.

SymbolicMemory::merge (memory/mod.rs) test pattern: per-byte ITE selection needs a real solver — gate under #[cfg(feature="vex-engine-z3")], build self/other mems with differing concrete bytes at same addr, call merge with a fresh 1-bit symbolic cond, then ctx.fork()+assume_true(cond==1/0)+eval(byte) asserts other vs self. The 3 structural branches (page-only-in-other adoption, non-page symbolic_objects union, pending_writes extension) need NO z3 — new_mock suffices since they skip the ite() build. KEY: to isolate the final non-page symbolic-object union loop, insert into other.symbolic_objects WITHOUT page.mark_symbolic so op.has_symbolic()=false and the s_data==o_data short-circuit skips the per-byte loop. Tests in memory/tests/merge_prefetch.rs (lib unit tests, no .so rebuild).

SymbolicMemory::merge Multi-cell + pending_writes semantics (angr-op0dn.11.2.2, M3-2b, commit bd966b737). BOTH-Multi bytes: a byte in multi_objects on both arms unions into ONE lazy Multi cell — self alts guarded And(!m,cond), other alts guarded And(m,cond), count==n_self+n_other. Sound because each arm's exactly-one-cond-true invariant + the m-partition makes the two arm groups mutually exclusive, so the concrete page default byte is a don't-care (never the else-leaf under valid models). MIXED (Multi on one arm, plain/concrete on other): collapse the Multi side via MultiPayload::collapse(page_byte,ctx) and ITE into symbolic_objects — the existing path, generalized by the merge_byte_value helper. CRITICAL: the byte loop drove off is_symbolic()/symbolic_objects only, which are SEPARATE from multi_bitmap/multi_objects (Multi and Symbolic are mutually exclusive per-byte); before this fix a both-Multi divergent byte was merged as concrete = silently dropped. Added !has_multi() to the page concrete-equality early-out (s_data==o_data early-out is blind to multi_objects divergence) + MemoryPage::has_multi. PENDING_WRITES: was a blind extend (unsound — other's deferred store fired on self's paths, and self's own writes fired on other's). Now GUARDED not flushed (flush needs an AddressConcretizer merge doesn't have): self writes get condition=And(!m,prior), other get And(m,prior), via guard_pending_write. Tests memory/tests/merge_multi.rs (vex-z3-gated).

SymContext::merge (snapshot_fork_ops.rs) is shared-prefix-aware since angr-op0dn.11.3. It detects when every input context's z3_assertions_shared Arc is Arc::ptr_eq to all_contexts[0]'s (the fork-freeze self-invariant makes sibling diamond arms hold the SAME frozen prefix Arc to the merge point). On that fast path it asserts the common prefix ONCE UNGUARDED and guards only each arm's local z3_assertions suffix, so guarded-Or count == Sigma(divergent local) + 1 flag-Or instead of Sigma(shared+local) + 1. SOUNDNESS: the old full-guard shape already forces the prefix on every model (Or(conds) => some cond_i true => its guard forces the identical prefix), so lifting it out removes/adds no models; fires only when Arcs are ptr-eq (byte-identical), and local is strictly additive to the frozen prefix (freeze_into_shared only appends, never retracts). Fallback to full-guard when prefixes are not all ptr-equal. The unguarded prefix is still recorded in local_constraints.non_bv_assertions so the to_snapshot debug invariant (z3_count <= assumed + non_bv) holds; assume_class_reconstructible stays false. Observed via cfg(test) merge_instrument counter (context.rs) in context_tests/merge_prefix.rs.

mimalloc as #[global_allocator] in native/angr/src/lib.rs delivers NO measurable speedup for the Rust engine. Evaluated 2026-06-22 (angr-kq43): mimalloc 0.1.52 vs system allocator, 5-sample medians same-host on defcamp_r100/ais3_crackme/csaw_wyvern/ekopartyctf2016_rev250/mma_howtouse. All deltas within run-to-run noise (mma_howtouse, the only non-bimodal slow outlier, +0.5%). NOT adopted; dep removed. Root cause: engine wallclock is Z3 check()/PyO3-state-sync FFI bound, not malloc-throughput bound, so a faster allocator has no headroom. The earlier FxHash win (state_fork -20%, benchmark-memory-fxhash) was a per-op microbench, not an end-to-end allocator effect. Do NOT re-attempt without a profile showing allocation as a hot path. Negative result in docs/advanced-topics/rust_engine.rst 'Global allocator ... evaluated, not adopted'. NOTE: crates.io network is reachable in-sandbox as of 2026-06-22 (cargo add/search work), lifting the long-standing kq43 offline blocker.

Audit (angr-cudgw.1) confirmed the native MIPS-O32 syscall table in syscalls/mod.rs register_syscalls!("MIPS32", ...) is FULLY consistent with angr's mips-o32 table (block 8 in linux_kernel.py, line ~6181). All ~82 native numbers match angr's by number, including the +2-divergent *at family: mkdirat=4289 (upstream 4287), unlinkat=4294 (upstream 4292), renameat=4295 (upstream 4293); openat=4288/readlinkat=4298/faccessat=4300 match upstream. No de-registration hazard found. Regression guard: test fn mips32_at_family_uses_angr_divergent_numbers in syscalls/mod_tests.rs pins divergent numbers and asserts upstream slots (4287/4292/4293) stay unregistered. Re-run the parser in the commit msg if angr deps bump. Note old_mmap registered at 4090 which angr's table calls 'mmap' (O32 old-style); correct by number.

MIPS32 register dispatch coverage status (angr-w2gj.1, 2026-06-01): All entries in offsets32 module at native/angr/src/arch/mips.rs:18 (R0-R31, PC, HI, LO, F0-F31, FIR/FCCR/FEXR/FENR/FCSR, GUEST_STATE_SIZE) are wired into CANONICAL_MIPS32 and ALIASES_MIPS32 dispatch tables. Removed stale '#[allow(dead_code)] // see angr-w2gj' attribute — cargo check is clean without it. set_register/get_register Python paths go through arch.register_offset(name) -> RegisterFile.set/get(offset, size) which handles 32-bit and 64-bit ops uniformly. Pattern for new arch register-family tests: assert round-trip on canonical mnemonic AND aliases (e.g. f0 AND $f0; k0 AND $26). Test added: test_mips32_full_register_family_dispatch in TestMultiArchSupport. Note: dead-code audit flagged this because no test had EXERCISED these families end-to-end through Python, even though dispatch was complete — placeholder was a test-gap signal, not a wiring-gap signal.

MIPS64 Big-Endian works end-to-end through the Rust engine with no new code changes. Verified 2026-06-01 via test_mips64_explore_be_real_elf (real ELF64 with EI_DATA=MSB, ELF64+EM_MIPS+EF_MIPS_ARCH_64) and the mips64_be_branch synthetic bench (0.48s rust_time). archinfo's 'mips64be'/'MIPS64'/'mips64'/'MIPS64BE'/'mipsbe64' aliases all resolve to MIPS64 with both memory_endness and instruction_endness = Iend_BE; cle's ELF backend picks up EI_DATA=MSB correctly. To build a MIPS64 BE inline ELF: ELF64 header packed with '>HHIQQQIHHHHHH', PT_LOAD phdr '>IIQQQQQQ', instruction words '>I' (big-endian). Solution shape used: a0<<1 + 16 == 100 ⇒ a0=42. Same opcode encodings as MIPS32 (registers still 5 bits; ADDIU sign-extends 16-bit imm to 64 bits on MIPS64).

MIPS64 register dispatch (post angr-w2gj.2 + angr-mpln0 offset fix): ALIASES_MIPS64 covers GPRs (numeric rN + $N), HI/LO, FPU F0-F31 (canonical + $f-prefixed, 8-byte), FPU control regs (FIR/FCCR/FEXR/FENR/FCSR, 4-byte). Offsets in mod offsets64 (native/angr/src/arch/mips.rs) MUST match the VEX guest_mips64 layout: F0=296..F31=544, FIR=552, FCCR=556, FEXR=560, FENR=564, FCSR=568 (were +8 each pre-mpln0 => name-based FPU access aliased adjacent reg, fcsr clobbered guest_ULR@576). Because get_register/set_register share the table, in-isolation round-trip tests can't catch offset drift — guard with a ground-truth parity test vs archinfo.ArchMIPS64().registers (test_mips64_fpu_offsets_match_archinfo in test_multiarch.py: raw register file is host-native little-endian). CANONICAL_MIPS64 stays narrow (reverse-lookup only).

miri feasibility on the rust-symex core (qwyti.8 spike): of 71 unsafe sites across 21 files, exactly ONE is pure-Rust/miri-executable — icicle_tests.rs::hitmap_raw_pointer_aliases_the_slice (the 'unsafe { *ptr.add(3)=0xAB }' write through Hitmap::as_mut_ptr() into a Pin<Box<[u8]>>, behind #[cfg(feature=fuzzer)]). All 70 others bottom out in a Z3 (from_borrowed_raw->Z3_inc_ref, {Bool,Float,BV,Ast}::wrap, Z3_get_sort, Z3_simplify), libVEX (vex_lift), or PyO3/CPython (raw py-ctx ptr, CStr::from_ptr) C ABI call that miri aborts on. migration.rs/scheduler.rs unsafe hits are comment-only (unsafe-free designs). Verdict: miri technically feasible but low-value — not worth a CI gate for one already-#[test]-guarded block. Actual run is network-gated (nightly+miri not installed) -> angr-qwyti.22.

Calling clear_all_caches() (thread-local AST/CLARIPY_AST/EXPRESSION caches) between callable() invocations in mma_howtouse reduced wall time from 6.62s to 5.07s (~23% improvement) without affecting correctness. The caches stay populated even after a manager goes out of scope because they are thread-local, not per-manager. Did NOT affect memory (still 1606MB peak). Suggests AST cache lookup overhead grows with total entries across all managers — likely O(n) hashmap probes hitting cold cache lines.

mma_howtouse 0.65x slowdown vs Python is dominated by Python-side memory leak when using Rust engine. Diagnostic: Python-only run is FLAT (RSS 207MB constant across 45 callable() invocations, py_heap 21MB constant). Rust engine grows ~24MB Python heap + ~8MB Rust per call, reaching 1606MB RSS / 1108MB py_heap by call 45. Top tracemalloc growth (since i=0): UltraPage bytearray(page_size) at ultra_page.py:30 and :34 (+359MB each = 181368 page allocations total, ~4030 fresh pages PER call), dirty_addrs_mixin.py:10 set updates (+170MB / 2.7M blocks). Each new RustExplorationManager creates a fresh angr state via factory.call_state, that state's pages aren't being freed across callable invocations even with explicit gc.collect(). Suspected cycle: state -> solver.eval (bound method) -> RustSolverFallback wrapper -> state via attach() in rust_state_export.py:52 (sets state.scratch.rust_mgr and patches solver methods to bound wrapper methods). Thread-local AST caches stay empty for this benchmark (concrete-only), global symbolic registry stays at 0 — those are NOT the cause. Clearing AST caches between calls reduces TIMING by ~1.5s (6.6s -> 5.1s) but does not affect memory.

mmap MAP_FIXED divergence from procedures/posix/mmap.py: the Python procedure returns -1 on MAP_FIXED collision (procedures/posix/mmap.py:107-109), but real Linux mmap(2) atomically discards colliding pages and remaps at the requested addr. angr-ttr7 (commit 7d517864e) chose the POSIX semantics for the native fast path because (a) angr's whole-program analyses generally want kernel-faithful behavior, (b) MAP_FIXED+collision is rare enough that diverging from Python here doesn't affect existing tests, and (c) the native unmap is page-granular and trivial. Implication: if a test ever pins the Python -1 behavior, it will now see addr returned natively. Test code added in TestMmapMapFixedNative locks the new contract.

Multi-arch Rust-engine showcase (angr-4n26m.6) ships PARITY-ONLY, not a speed claim — this is a deliberate, evidence-backed decision (angr-4n26m.2 closed 2026-06-19). Why: the only real non-x86 ELF in the corpus, android_arm_license_validation, runs ~0.8x (SLOWER) under Rust (baseline_timings.json python_time=0.2 / rust_time=0.25); synthetic arch ELFs are ~124B with python_time=null; the firmware corpus (../binaries) is absent offline so no real MIPS/ARM busybox baseline can be sourced. Conclusion recorded in show_multiarch.py docstring, multiarch_numbers.json ('claim' field), and docs/blog/rust_symex_showcase.md sec 2. Do NOT make a non-x86 SPEED claim without first sourcing a real firmware ELF AND a Python baseline that actually wins.

angr-mwbp (2026-06-03): extending dedup_set to assume_true/assume_false revealed a quadratic-in-exploration-depth regression. Unconditionally seeding the dedup_set from assume_*/false made flareon2015_2 timeout at 30s (5x baseline). Root cause: every fresh fork's first symbolic assume triggers an O(N) walk over shared+local z3_assertions, repeated per-fork. Fix: only consult dedup_set when ALREADY seeded (by an earlier add_constraint_raw). On unseeded contexts, fall through to legacy push-only. Counters: z3_assume_dedup_scanned/hit. Current fast-tier activation rate: 0% (the contexts where assume runs are generally not the same ones where add_constraint_raw seeds). Future work: heuristic that seeds when shared.len() crosses a threshold could lift the activation rate without re-triggering the regression.

Native access() parity: procedures/access.rs NativeAccess mirrors libc/access.py — mint RustBV::symbolic(name,32), build Or(ret.eq(concrete(0,32)), ret.eq(concrete(0xFFFFFFFF,32))) where 0xFFFFFFFF is 32-bit -1, then state.add_constraint(or). Build the constraint INSIDE a solver().borrow() scope, drop ctx, THEN state.add_constraint (mirrors read.rs/fgets.rs — add_constraint re-borrows). path+mode declared bv and discarded. Constraint feasibility tested in cargo via ctx.can_be_true (default features include vex-engine-z3 so it's meaningful). The linux_kernel/access.py FS-walking variant stays Python. Registered in procedures/mod.rs after rand. Committed c3034e059.

Native bzero (procedures/memset.rs NativeBzero): Python angr's posix/bzero.py subclasses memset and forwards memset(s,0,n). Native bzero is the same DRY pattern as the fortify _chk wrappers — a declare_proc! whose call body does NativeMemset.call(state, &[dest_bv, RustBV::concrete(0,8), size_bv]). The .call method on a proc unit-struct is an INHERENT method generated by declare_proc! (no trait import needed). Registry test API is registry.has_native("bzero") (bool), NOT .lookup(). Remaining simple sandbox-safe parity gaps from the libc/posix-vs-native name diff: abort (NO_RET exit), putchar/getchar (need posix fd write/read), access/time (return stubs), memccpy (needs memory.find symbolic scan — bigger). strcasecmp/strncasecmp/strdup/strndup also Python-only.

Native char-IO stdio procs (fputc/putc in puts.rs; fgetc/getc/getchar in fgets.rs) now register their _unlocked aliases via declare_proc! 'aliases' field: fputc_unlocked, putc_unlocked, fgetc_unlocked, getc_unlocked, getchar_unlocked. All five _unlocked names resolve in SIM_PROCEDURES['libc'] (fputc.py/fgetc.py/getchar.py define x_unlocked=x as module attrs), so without the alias a glibc-heavy binary emitting the unlocked symbol round-trips to Python. Same gap class as stdio _unlocked (native-stdio-unlocked-aliases) and fileops fseeko/ftello (native-fileops-largefile-aliases). fgetpos/fsetpos and _IO_putc/_IO_getc are NOT in SIM_PROCEDURES['libc'] so no native parity gap there. Test: mod_tests::test_char_io_unlocked_aliases_dispatch.

Native coverage matrix in docs/extending-angr/simprocedures.rst (added angr-3u87, commit 24a43dc1f): two list-tables tracking which libc procedures and Linux syscalls have native fast paths today vs Python fallback. Format follows rust_vex_ops.rst 'Unsupported op coverage matrix' but uses fractional M/N counts in the 'Native' column (since every row has a Python fallback — meaningful axis is how many named members reach the fast path, not implemented/placeholder/stubbed). When closing an angr-f16h.* (procedures) or angr-0hif.* (syscalls) child, flip Native column for affected members and bump M/N. Sources of truth: native/angr/src/procedures/mod.rs lines 176-299 (proc registrations), native/angr/src/syscalls/mod.rs register_ blocks. Validation: codepoint heading-underline scanner + list-table cell-count scanner (both in .ralph/state/session.md from prior iters).

Native libc real-binary coverage tail = epic angr-tx7ec (sibling of angr-11djq). Curated ~12 high-confidence procs that real CLI binaries hit: fortify _chk printf/mem/str families (.1/.2/.3 — DRY: wrap base proc + bound check, never reimplement), locale ctype __ctype_b_loc/_loc (.4), getopt (.5, fork-safe optind/optarg state) + getopt_long (.6), fscanf (.7), vfprintf/vprintf (.8), vsnprintf/vsprintf (.9), stpcpy/mempcpy (.10), memrchr/strchrnul (.11), alloc family getline/getdelim/asprintf (.12, GATED on angr-um39j heap_brk fix). fprintf stays in existing angr-884yn (not duplicated). CUT as architecturally impossible: qsort/qsort_r/bsearch (no guest-callback infra) + strtok (static saveptr not fork-safe); CUT as zero-corpus-demand: mbtowc/realpath/strftime/abs/isascii tail. Gate is blind to these (FAST_SUITE only hits fprintf via sharif7_rev50) -> angr-11djq.20 adds a getopt+fprintf+ctype CLI micro-bench fixture. Real-binary gaps also under angr-11djq: format %n/%[]/float (.17/.18/.19), stat-family i386/ARM/MIPS32 (.5.1-.3), symbolic-file+symlink (.6.1-.2). DRY/KISS/SOLID now in .ralph/prompts/_footer.md CODE QUALITY section. No self-replenishing factory by design: when curated set drains, ralph idling is correct (real bottleneck was human-gating not bead scarcity, per iter77 zero-fallback corpus audit).

Native ctype parity gap CLOSED (angr-ae54t.7, iter21): Python angr ships isascii/isblank/iscntrl/isgraph/ispunct as libc SimProcedures but native procedures/ctype.rs originally only had isdigit/isalpha/isspace/isalnum/isupper/islower/isxdigit/isprint/tolower/toupper — the 5 were silently falling back to Python. Added them via the existing ranges_predicate (isascii [0,127]; iscntrl [0,31]+[127,127]; isgraph [33,126]; ispunct [33,47][58,64][91,96][123,126]) and set_predicate (isblank space|tab) helpers; registered in procedures/mod.rs NativeProcedureRegistry::new. PITFALL: clippy::byte_char_slices fires on a 2-element &[b' ', b'\t'] literal passed to set_predicate — use a byte-str b" \t" instead (existing isspace has 5 elems so escapes the lint). All native ctype procs truncate arg to low 8 bits (arg_byte) per the established 'as u8' convention, so faithfulness is byte-level not full-int — same as the pre-existing procs.

NativeFgets/NativeFgetc (native/angr/src/procedures/fgets.rs) used to declare _stream: bv and IGNORE it, always synthesizing stdin_* symbols (recorded as stdin input) for ANY FILE* stream. This diverged from Python fgets/fgetc, which resolve stream->_fileno via posix.get_fd and read from that SimFileDescriptor (returning -1 when missing). Same bug class as iter53/54/58 NativeFwrite/Fputs/Fputc arbitrary-fd fixes. FIXED (commit 399958bb0): args changed to stream: concrete, resolve fd via read_fileno (fileops.rs); fd==0 keeps native symbolic-stdin path, fd>0 (real file) returns Err->Python fallback, fd<0 returns -1, symbolic FILE*/_fileno falls back. getchar unchanged (always stdin, no arg). getc/getc_unlocked/fgetc_unlocked/fgets_unlocked delegate to the fixed bases. read.rs and fread.rs (NativeFread) were already correct (resolve fileno). NOTE: native stdin fgets still does NOT add Python's EOF/newline path constraints — pre-existing, out of scope.

Native fprintf = NativeFprintf in procedures/printf.rs (registered after NativePrintf in procedures/mod.rs). Stream variant of NativePrintf: read_fileno_for_stream(stream) -> scan_concrete_lossy(fmt) -> write_fd. Writes RAW format string (no %-substitution), mirroring printf's CTF asymmetry vs Python fprintf which does out_str=fmt.replace(va_arg). Returns -1 on fd<0 (Python returns -1 when simfd is None). Unblocks __fprintf_chk half of angr-iv0hv (now has a native base to DRY-forward to). Closed sharif7_rev50's 44 fprintf fallbacks (0.32s->0.17s). angr-884yn / commit a3e30a789.

NativeFputc and NativePutc (native/angr/src/procedures/puts.rs, declare_proc! macro) previously IGNORED the FILE* stream arg (declared _stream: bv) and always wrote to stdout via write_stdout. Fixed in commit dd4f8d5a4 (angr-15eod): now declared 'stream: concrete', resolve stream->_fileno via procedures::stdio::read_fileno_for_stream (made pub(crate)), write to that fd via state.write_fd, return -1 (0xFFFFFFFF, 32-bit) on negative fd. A symbolic FILE* now falls back to Python (concrete extraction fails) instead of silently writing stdout. putchar correctly stays stdout-only (no stream arg). Same fix class as NativeFwrite/NativeFputs arbitrary-fd (see stdio-fwrite-fputs-arbitrary-fd) — keep all four stdio byte/buffer write shims in sync. write_stdout is just write_fd(1,..) so stdout case is unchanged.

Native fscanf/__isoc99_fscanf (procedures/scanf.rs NativeFscanf; __isoc99_fscanf is an aliases() entry, not its own struct — see invariant-libc-alias-not-duplicate-proc) is the stream variant of scanf, exactly mirroring how NativeFprintf extends NativePrintf: resolve stream->_fileno via fileops::read_fileno (pub(crate), uses io_file_for_arch offset e.g. AMD64=112), return -1 (concrete -1 at arch bits) on fd<0 (matches Python fscanf when simfd is None), else route through shared do_scanf core. do_scanf was generalized with (source: &str, record_stdin: bool) params: scanf/__isoc99_scanf/sscanf pass ("stdin", true); fscanf passes ("stdin", true) only when fd==0 else ("file", false) so non-stdin file reads do NOT call record_stdin_symbol and thus do not pollute posix.dumps(0). Like NativeSscanf, parsed values are minted as fresh unconstrained symbolic BVs — the file CONTENT is not parsed (documented simplification, less accurate than Python interpret(simfd=...) for concrete files but consistent with existing sscanf).

Native getopt (bead angr-bhk0a) is now DECOMPOSED into 3 ordered drainable children — iter38 firsthand 350-line getopt.py read confirmed the full port is genuinely multi-session, so it was sliced. ID/role map (bd auto-suffixes do NOT match creation order): bhk0a.3 = cursor-fields FOUNDATION (DONE iter38, commit 3e491c484): getopt_optind/getopt_optchar:u32 on RustSimState, exact posix_brk mirror (struct field decl + 3 constructors + 6 fork.rs sites + snapshot.rs field/to_snapshot/from_snapshot + inner getopt_cursor()/set_getopt_cursor() + RustStateProxy PyO3 getter/setter passthrough getopt_optind/getopt_optchar), defaults (optind=1,optchar=0) match glibc/Python state.libc; tests = test_getopt_cursor_default_and_fork_isolation + assertion threaded through test_state_snapshot_round_trip_buckets_a_b_c. bhk0a.1 = NEXT, the Python->native extern-addr init-push (optind/optarg/optopt resolved Python-side via loader.find_symbol, pushed into 3 new u64 RustSimState fields mirroring the cursor plumbing) — the no-template EXTRA-RISK driver. bhk0a.2 = LAST, port getopt.py _getopt() short-opt engine to a native proc consuming .3+.1, faithfulness-or-ProcedureError-fallback (getopt_long/long_only/symbolic-argv/ambiguous defer to Python). Adding a posix_brk-style state field = ~13 edit sites: struct decl + 3 ctors + 6 fork + 3 snapshot points + getter/setter; for PyO3 exposure add RustStateProxy passthrough.

Native getopt (bead angr-bhk0a) — iter11 NEW risk + touch-point map. (1) NOVEL-CHANNEL RISK that iters9/10 missed: the posix_brk/mmap_base precedent syncs Rust->Python (native bumps the field, _sync_rust_posix_brk_to_state in rust_state_export.py pushes it back to angr_state). getopt needs the OPPOSITE direction — Python (the only side with loader.find_symbol) must push the 3 project-constant extern addrs (optind/optarg/optopt) INTO native RustSimState at init. There is NO existing template for a Python->native init-push of a resolved project constant; simprocedure addrs go to the ProcedureRegistry (register_simprocedures), NOT to state. This new channel (a setter on RustStateProxy called once at export/init) is the genuinely novel infra and the true source of bhk0a's EXTRA-RISK P4 framing — not the cursor fields. (2) TOUCH-POINT MAP for the 5 state fields, mirror posix_brk exactly: state/mod.rs = 1 field decl (:273 region) + 3 constructors (:468/516/574) + getter/setter pair + 2 RustStateProxy passthrough methods (:1611/1620); state/snapshot.rs = 1 snapshot-struct field (:69) + 2 sync points (to_snapshot ~:143, from_snapshot ~:192); state/fork.rs = 6 fork sites (grep 'posix_brk' fork.rs = 6). So ~13 edit sites PER field for the 2 cursor fields; the 3 addr fields additionally need the novel Python->native init-push (no template). Faithfulness is LOW-risk by construction: ProcedureError->Python fallback for getopt_long/getopt_long_only + symbolic argv + any unported edge = native can only ever match Python or defer, never diverge. CONCLUSION (5th consecutive iter): genuine multi-session feature, correctly NOT force-started under scope discipline.

Native getopt(3) engine (NativeGetopt in procedures/getopt.rs, bhk0a.2, commit e41c8375b) ports ONLY the short-option path of getopt.py _GetOptBase._getopt. Registered for plain 'getopt' (3 args) in procedures/mod.rs; getopt_long/getopt_long_only stay Python (the proc never sees longopts). Faithfulness = match-or-defer: symbolic argc/argv/optstring/argv-element-ptr/scanned-byte -> ProcedureError -> Python (which produces the unconstrained BVS itself). Reads (optind,optchar) cursor via state.getopt_cursor()/set_getopt_cursor (bhk0a.3 fields), and the optind/optarg/optopt guest addrs via state.getopt_extern() -> GetoptExternAddrs (bhk0a.1 init-push). None extern addr just skips that store, mirroring Python _store_int/_store_ptr when _global_addr returns None. load_cursor honours a guest optind reset (0 -> full rescan to (1,0)). KEY mechanics learned: state.memory_load(addr,size).as_u64() is endness-correct (None=symbolic); state.memory_store(addr, RustBV::concrete(v,bits)) honours mem endness; int returns use width 32 (-1 = 0xFFFFFFFF). Python e2e test pattern: _RustExplorationManager raw class -> mgr.get_state_memory(sid,addr,n) DIRECTLY (NOT mgr._rust_mgr, that's only on the Python RustExplorationManager wrapper); hook getopt at out-of-binary PC so native dispatch fires (in-binary hooks force Python per dispatch rule 1).

Native getopt extern-addr init-push (bead angr-bhk0a.1, DONE iter40, commit 505ae229d). KEY CORRECTION to native-getopt-design-no-elf-resolution's 'NO existing template' claim: the ctype table-ptr push IS the exact template for the Python->native init-push direction (NOT posix_brk, which syncs the OPPOSITE Rust->Python way). Pattern mirrored verbatim: GetoptExternAddrs{optind/optarg/optopt:Option} struct (Clone+Copy+serde, like CtypeLocPtrs) -> getopt_extern field on RustSimState -> 3 ctors default + 6 fork.rs sites + snapshot.rs (field+to_snapshot+from_snapshot) + inner getopt_extern()/set_getopt_extern() + RustStateProxy PyO3 #[getter]get_getopt_optind_addr/#[setter]set_getopt_optind_addr pairs (PyO3 strips get_/set_ -> property getopt_optind_addr). Python init-push lives in rust_manager._build_seed_state right after the ctype block: loader=self.project.loader; for (name,setter) in optind/optarg/optopt: sym=loader.find_symbol(name); if sym: setattr(rust_state, 'getopt'+name+'_addr', sym.rebased_addr). None default = native proc defers to Python. Consumer is bhk0a.2 (_getopt engine port, LAST/still open). NOTE venv pip is broken (no .venv/bin/pip, only pip3); rebuild via tools/rebuild-rust.sh --cargo-only --keep-cargo-cache.

Native gets() is a real port (not a no-op/forward seam) landed in procedures/fgets.rs::NativeGets (commit 987367874, angr-ae54t.23). Key: extracted fn store_symbolic_line(state, buf, size, sym_bytes, label, read_id) -> RustBV from the fgets SHORT_READS 'case 2' block; it builds a symbolic real_size in [0,size-1], adds per-byte newline/EOF constraints, stores fixed-address ITE bytes with NUL at real_size, returns real_size. Now shared by fgets (SHORT_READS path) AND gets. DIVERGENCE FROM fgets: Python procedures/libc/gets.py applies case-2 ALWAYS (not gated on SHORT_READS like fgets), so NativeGets always invokes the helper; it has no size/stream args -> always stdin fd 0, fixed MAX_GETS_SIZE=256 (Python SimStateLibc.max_gets_size default, NOT exposed to Rust so a user raising it diverges), returns the buffer pointer (not real_size). Native gets assumes symbolic stdin (matches native fgets which never handles Python's concrete-stdin case 0).

The 'native-lift' Cargo feature is NOT in the default feature set in native/angr/Cargo.toml (default = ['vex-engine', 'vex-engine-z3', 'automaton'] — native-lift is opt-in). Effect: any code under #[cfg(feature = 'native-lift')] in native/angr/src/interpreter_cb/execution.rs is dead code in default builds. The fallback path is _cb_lift_block (Python lift via project.factory.block). Important consequence for angr-k67f: my native-lift SMC fast path (read_concrete_bytes_for_lift from rust_memory for dirty pages) only activates when native-lift is enabled. For default builds, SMC support requires Python-side state.memory sync.

Native locale string parity (ae54t.8): strcoll/strxfrm now native. In C/POSIX locale (angr default) strcoll==strcmp (registered as alias on NativeStrcmp in strcmp.rs) and strxfrm==strncpy(dest,src,n) + return strlen(src) UNTRUNCATED (NativeStrxfrm in strcpy.rs, reuses scan_concrete_until_null for the strlen + write_concrete_bytes for the bounded NUL-padded n-byte window; return can exceed n, snprintf-style). Remaining string/stdio parity gaps still falling back to Python: memccpy (needs memory.find symbolic semantics), strtok (stateful static ptr, fork-unsafe like getopt/bhk0a), gets/fputs/feof/fflush/setbuf/ungetc/perror, vsnprintf/vsprintf (format). Productive seam: continue per-family Python-SimProc vs native parity audit.

ae54t.2 (memrchr/rawmemchr/strchrnul) implemented by extending strchr.rs scan cores with bool flags rather than new scan functions: (1) scan_for_byte gained nul_returns_addr — when stop_at_null hits a NUL before the target, return the NUL's address (strchrnul) vs concrete 0 (strchr); threaded through build_ite_chain's stop_at_null ITE arm AND the concrete fast-path Stop. (2) scan_for_byte_last gained stop_at_null — false (memrchr) scans the full min(n,MAX_SCAN) window ignoring NULs and returns last_match-or-0 on Exhausted, true (strrchr) stops at NUL and errors on Exhausted. rawmemchr = scan_for_byte stop_at_null=false MAX_SCAN. Python procs reuse strlen+strchr (strchrnul=If(strchr==0, s+strlen, strchr)), memchr (rawmemchr, n=libc.max_buffer_size=48), and a forward-ITE backward-override loop (memrchr). Same option-a pattern as ae54t.1 stpncpy.

Native SimProcedures that heap_alloc a struct then write to it (fopen writing _fileno into a fresh _IO_FILE, also calloc/realloc/posix_memalign/strdup) used to fail with Memory(Unmapped) and fall back to Python, because the heap range [0xC0000000,0xC1000000) was never registered as a lazy region (only loaded objects + stack were) and RustSimState::memory_store called plain store_concrete (no auto-map). Fix (state/mod.rs): new_state_memory() registers the heap as a lazy region in all 3 constructors via HEAP_REGION_START/SIZE consts, and memory_store now uses store_concrete_automap_internal so writes to fresh heap auto-map a zero page. Unwritten heap reads stay Unmapped -> Python fallback, preserving symbolic-fill semantics. Diagnosed via symmetric handler-Err logging added at the proc dispatch fallback site in exploration/stepping.rs (mirrors the existing arg-extraction log). Cascading win: sharif7_rev50 fseek=86/fputc=43/fopen=1/fclose=1 all went native, 175->44 SimProc fallbacks (remaining 44 = unregistered fprintf), 0.9s->0.32s. Verified: 1441 rust unit tests + 968 python rust tests pass, bench gate 20/20 (flareon2015_2 'regression' was CPU-contention noise: identical op counts, identical timing under equal load).

RESOLVED by angr-kzjv6: native SimProcedures CAN now query SimOptions via RustSimState::has_option (see native-simoption-has-option). The old blocker (options were Python-only) is fixed for the symex-relevant subset (_NATIVE_SIMOPTIONS, currently SHORT_READS). efvao (fgets short-read) is now unblocked.

Native pthread_mutex_lock/unlock are pure no-ops returning 0 (SUCCESS), word-width, matching Python (both 'return 0'). Live in native/angr/src/procedures/pthread.rs as NativePthreadMutexLock/NativePthreadMutexUnlock via declare_proc!, registered in NativeProcedureRegistry::new. Mutex ptr arg declared 'bv' (cloned, never inspected) so a symbolic pointer does NOT fall back. Single-path symex has no real concurrency so locks always succeed. pthread_once is NOW ALSO NATIVE as NativePthreadOnce (hand-written, not declare_proc) using the sub-call mechanism — call_ex reads the once-guard byte, sets the done-bit (value 2) BEFORE the CallAndResume{target:func} sub-call (recursion-safe), resume returns 0; symbolic control/guard/SP fall back to Python. Done in adea42e52 (xxukz, 2026-06-26). Still NOT native: pthread_create (spawns symbolic branch). __ctype_b_loc native as NativeCtypeBLoc. Justified by angr-11djq.4 xmllint_getenv: lock x4 + unlock x3 + pthread_once x4 fallbacks eliminated.

Native CallAndResume sub-call machinery is LIVE (not dead/unfinished): RustExplorationManager::setup_native_subcall (exploration/stepping.rs) is called from run_loop.rs sequential path; production resume runs via core_outcome::handle_native_resume_core (angr-vh834 refactor). The stepping.rs handle_native_resume method is a TEST-ONLY direct-call harness for subcall_tests.rs — gated #[cfg(test)] (angr-0mqkc.2), not #[allow(dead_code)]. SubcallSetupError is live too; its #[allow(dead_code)] is the 'fields read only via Debug' idiom, not scaffolding. When wiring gorvf.3 ADDS_EXITS/sub-call work, the primitives already exist — do not rebuild.

CONFIRMED root cause for angr-8mjd native ReturnUnconstrained explosion (was 'unconfirmed' in simproc-fallback-statecreate-bottleneck): Python's angr.procedures.stubs.ReturnUnconstrained calls state.solver.Unconstrained(name,size,key=('api','?',display_name)), and SimSolver.Unconstrained (angr/state_plugins/solver.py) returns a CONCRETE BVV(0) unless sim_options.SYMBOLIC_INITIAL_VALUES is in state.options — which is OFF by default and absent on csaw_wyvern. So for the ~24 pointer-returning C++ stubs, Python writes concrete 0 (null), NOT a symbolic value: downstream null-checks and address-uses resolve concretely with zero forks. The reverted native fast-path (iter46) minted a FRESH symbolic BVS per call, so every null-check forked and every store/load through the symbolic pointer paid concretization cost -> 2.7s->86s explosion. CORRECTED RECIPE for any re-land: gate on SYMBOLIC_INITIAL_VALUES — when absent (common case) write Ok(Some(BVV(0, returnty_bits))) to the return reg, only mint a symbolic BVS when the option is set; void-return stubs (returnty None -> Ok(None)) always safe. This makes 8mjd tractable again (no longer a dead-end). Documented in docs/extending-angr/simprocedures.rst (Native section, .. warning:: after the ProcedureError enum para).

Native sleep/usleep parity (angr-ae54t.15, commit ac0f203df): NativeSleep/NativeUsleep in procedures/sleep.rs return concrete 0 sized to arch.bits(), mirroring getid.rs constant-return form. KEY TRICK for no-op procs that ignore their arg: declare the arg as 'bv' kind (not 'concrete') and bind it to _name — this discards it WITHOUT forcing concretization, so a symbolic duration returns 0 natively instead of falling back to Python. Registered under SIM_PROCEDURES['posix'] (same gotcha as strndup/htonl/perror — see native-htonl-htons-parity). 5 cargo + 2 parametrized Python integration tests.

Native read-side stdio procs (fgets/fgetc in fgets.rs) cannot resolve stream->_fileno for cle standard streams (stdin/stdout/stderr): their _IO_FILE lives in the cle##externs object, mapped LAZILY, and lazy pages are NOT fetchable from a SimProcedure context (only the VEX interpreter can fetch them). So read_fileno() hits an unmapped page and returns ProcedureError::Memory for the common fgets(buf,n,stdin) call. iter59 added naive read_fileno and this forced a ~100ms Python fallback per call -> defcamp_r100 regressed +92-117%. Fix (resolve_stream_fd fn, commit 878093d15): on Memory error, serve fd 0 natively (an unmapped FILE* can only be a cle standard stream, and a read from one is overwhelmingly stdin; matches Python stdin._fileno==0). Symbolic _fileno still falls back to Python; fopen'd files allocate _IO_FILE in Rust memory so resolve normally. Write-side procs (fwrite/fputs/fputc/putc) may have the SAME latent issue if they ever pass a cle stdout/stderr FILE* - verify before trusting their native fd-resolution on standard streams.

stpncpy parity (angr-ae54t.1): added Python SimProc angr/procedures/libc/stpncpy.py + native NativeStpncpy (strcpy.rs, registered procedures/mod.rs). Both REUSE the existing strncpy copy core (DRY, mirrors how stpcpy reuses strcpy). stpncpy semantics: bounded copy of n bytes + NUL-pad, RETURN = dst + min(strlen(src), n) (ptr to written NUL, or dst+n if no NUL fits). Native captures ret offset = buf.len() BEFORE the NUL-pad resize. KEY GOTCHA: pre-existing strncpy padding divergence — native NativeStrncpy NUL-pads the full n-window (buf.resize(n,0)), but Python strncpy only copies min(limit, src_len+1) bytes (NO full-window pad). stpncpy inherits this per-engine; only the return-pointer (stpncpy's actual point) matches both engines. This divergence is in strncpy itself, out of stpncpy scope. Resolves the tx7ec.10 SKIP noted in native-stpcpy-mempcpy-parity.

strncasecmp native proc lives under SIM_PROCEDURES['posix'] not ['libc'] (same as strcasecmp). NativeStrncasecmp in procedures/strcmp.rs is a 1-block declare_proc! combining strncmp's max_len=n.min(MAX_STRCMP_LEN) bound + strcasecmp's case_insensitive=true through the shared compare_bytes helper. Python procedures/libc/strncasecmp.py == strncmp with ignore_case=True. Registry test API: NativeProcedureRegistry::new() then .has_native(name)->bool (NOT with_defaults).

Native sub-call dispatcher (angr-5gf0s / xxukz) risk-#5 enum-vs-trait is QUANTIFIED, not just KISS-asserted. Measured HEAD over NativeSimProcedure scope (procedures/ only; NativeSyscall is a separate trait, untouched by either option): Option A = ProcOutcome enum replacing Option in call() signature = ~198 mechanical edits (24 impl NativeSimProcedure call signatures + 148 Ok(Some)+24 Ok(None) return sites across 6 files + trait def + stepping.rs Ok(ret_val) arm). Option B (RECOMMENDED) = sibling-trait pair: keep call() as-is, add enum ProcOutcome + default call_ex() wrapping self.call into ProcOutcome::Return + default resume()->Err(NotImplemented) = ~4 new items, ZERO edits to the 24 existing procs. Both express CallAndResume identically; B is more SOLID. Data appended to tools/decisions/native_subcall_dispatcher_design.md 'Addendum (iter 44)'. The go/no-go itself remains human-gated.

Native sub-call resume-stack S1 (bead angr-pn3w8, commit abd0c1544) LANDED: per-state Vec<NativeResumeFrame{proc_name:String, resume_tag:u32, saved_args:Vec}> LIFO field on RustSimState, foundation for the ADDS_EXITS dispatcher (design tools/decisions/native_subcall_dispatcher_design.md). Plumbing mirrors getopt-cursor bhk0a.3 EXACTLY: struct decl in state/mod.rs + 3 ctors + 6 fork.rs sites (fork/translate_state/fork_true/fork_false/fork_from_snapshot/merge — Clone delegates to fork) + snapshot.rs (field with #[serde(default)] for forward-compat + to_snapshot clone + from_snapshot move) + accessors native_resume_stack()/push_native_resume_frame()/pop_native_resume_frame(). NativeResumeFrame is Clone+Serialize+Deserialize but NOT Copy (holds Vec); RustBV already derives serde (symbolic/value.rs RustBVData). NO RustStateProxy/Python passthrough added — S2 dispatcher is pure Rust stepping.rs, Python never reads the stack (unlike getopt which needed proxy). Empty default = zero behaviour change. NEXT: S2 dispatcher core (bead angr-xxukz chain) needs spike angr-5gf0s human go/no-go (enum-vs-trait CallAndResume return) before the hard interpreter work.

NativeSyscall::name() is diagnostic-only and has ZERO callers: the production dispatcher in exploration/stepping.rs keys on (arch_name, syscall_num) and never reads handler.name(). angr-9ke6b.214 confirmed this with rustc's dead_code lint once syscalls/ was demoted to pub(crate) — the trait method is now tagged #[allow(dead_code)] at its declaration in syscalls/mod.rs with that rationale, which also covers the $label argument of the stub_syscall!/constant_syscall! macros. It was retained rather than deleted because the ~50 impls are the only in-tree mapping from handler type to syscall name and a diagnostic log line is the obvious consumer. Implication: handler types that vary only by syscall number can be unit structs (single registration class, multiple numeric keys) — see exit::NativeExitSyscall, registered at 11 sites across 5 arches but only one impl. Lookup is via NativeSyscallRegistry::get(arch: &str, num: u64), not by name.

Native syslog-family parity (angr-ae54t.20): openlog/closelog are void no-op stubs. Added procedures/syslog.rs via declare_proc! macro: NativeOpenlog (3 args ident/option/facility, all 'bv' & discarded -> symbolic-safe), NativeCloselog (0 args). Both 'call |_state| { Ok(None) }' -> run_loop does return-addr dance, writes NO rax (void parity with libc/{openlog,closelog}.py: return). syslog(3) itself NOT modeled (FormatParser subclass, posix/syslog.py, left to Python). Registered in procedures/mod.rs after system::NativeSystem. 5 cargo tests (syslog_tests.rs) + TestNativeSyslog (2 dispatch tests, _dispatch helper). Same void-noop pattern as setbuf. Remaining NAME-grep-verified absent simple gaps: time (forwards to linux_kernel time syscall -> needs native syscall path), strtok/strtok_r (per-state saved ptr -> bigger).

Native system() (procedures/system.rs NativeSystem) mirrors angr/procedures/libc/system.py: mints a fresh 8-bit symbolic BV ('system_returncode_N' via symbol_counter) and zero_extends to 32 (sizeof int), NOT arch.bits — same idiom as rand.rs which returns a 32-bit int. cmd pointer declared 'bv' arg and discarded so a symbolic command pointer stays native (no concretization/Python fallback). Registered under registry by name='system' (categorization libc-vs-posix only matters Python-side, not for native registry). Return is symbolic so Python integration test asserts call_counts['system']==1, not a concrete rax.

Native libc time() proc (procedures/time.rs::NativeTime, angr-ae54t.21) forwards to the linux_kernel time SYSCALL model, NOT a fresh impl. The shared core is fn fresh_monotonic_time(state) in syscalls/sim_time.rs: fresh symbolic time_t constrained sge(last_time or 0), set_last_time. Both NativeTimeSyscall and NativeTime call it (DRY); each does the optional *pointer store + outcome-wrap itself because the error types differ (SyscallError vs ProcedureError). KEY enabler: a native proc CAN return a symbolic rax — call() returns Result<Option, ProcedureError>, so Ok(Some(symbolic_bv)) sets rax (mirrors the syscall's ContinueSymbolic). pointer is 'concrete' arg -> symbolic *tloc falls back to Python, matching the syscall's extract_concrete_arg gate. This pattern (libc proc forwarding to an existing native syscall core) generalizes to any libc fn that inline_calls a kernel syscall in Python.

Native printf-family va_list variants vprintf/vfprintf are declare_proc! aliases on NativePrintf/NativeFprintf (printf.rs) -- byte-identical to their bases because the native printf core writes the RAW format string with NO substitution (trailing va_list never read; format/stream at same arg slots). Pattern mirrors fseeko=fseek. Test: mod_tests.rs::test_vprintf_family_aliases_dispatch. UPDATE (ae54t.4, 2026-06-25): Python SimProcs for vprintf/vfprintf/vsprintf NOW EXIST (angr/procedures/libc/, raw-write, no substitution) -- the prior 'angr has NO Python vprintf/vfprintf SimProcedure' note is OBSOLETE. vsprintf got its own native struct NativeVsprintf (can't alias NativeSprintf, which substitutes). See native-vsprintf-vprintf-vfprintf-parity.

native __vsnprintf_chk parity: NativeVsnprintfChk (fortify_printf.rs) num_args=6 [dest,maxlen,flag,slen,fmt,ap], drops args[2] flag + args[3] slen, forwards [dest,maxlen,fmt,ap] to NativeVsnprintf. Python __vsnprintf_chk (vsnprintf.py) subclasses vsnprintf, run(s,maxlen,flag,slen,fmt,ap) calls super().run(s,maxlen,fmt,ap). Base vsnprintf is the degenerate stub (size==0->0, else single NUL + return 1) so fmt/ap pass through unused. Same drop-flag/slen pattern as __snprintf_chk/__sprintf_chk. Drained the last ae54t fortify-printf leaf (ae54t.5).

ae54t.4 SHIPPED (commit follows 7e7479a59): Python vprintf/vfprintf/vsprintf SimProcs in angr/procedures/libc/ + native NativeVsprintf in procedures/sprintf.rs. ALL THREE write the RAW format string with NO %-substitution (va_list unmodeled). vprintf=puts-style raw write to stdout(fd1, no newline) returns len; vfprintf=resolve FILE* fd then raw write returns len(-1 if simfd None); vsprintf=inline strcpy(dst,fmt)+strlen(DRY). Native NativeVsprintf(num_args=3: str,fmt,va_list) reuses read_string+write_cstr (NOT format_string), registered after NativeVsnprintf in mod.rs. KEY DECISION: vsprintf writes RAW format (consistent w/ vprintf/vfprintf raw-write family) rather than copying vsnprintf's degenerate NUL-stub -- vsnprintf is the grandfathered odd-one-out. Native vprintf/vfprintf were already declare_proc! aliases (printf/fprintf). Tests: sprintf_tests.rs test_vsprintf_writes_raw_string + test_vsprintf_no_substitution. Before this, Python had NO v-printf procs -> ReturnUnconstrained -> diverged from native aliases (latent faithfulness gap, now closed).

angr-tukg NEON epic complete as of iter 37 (2026-05-31, commit 6c5c6dec5). All 8 sub-beads landed: .1 QAdd/QSub, .2 PwAdd/PwAddL/PwMin/PwMax, .3 Avg, .4 Reverse, .5 RecipEst/RSqrtEst (integer URECPE/URSQRTE), .6 Cnt/Clz/Cls/PolynomialMul, .7 Shl/Shr/Sar/Sal-by-vector, .8 QShl/QSal saturating-by-vector. Only Iop_PwAdd32Fx2 (FP pairwise add) remains in parse_neon_unimplemented — parked indefinitely with no known consumer. The pytest canary in test_raise_unsupported_neon_op_via_execute_irsb has been retargeted to that op as a Binop. When/if PwAdd32Fx2 is implemented, the canary needs another retarget OR (more likely) deletion since no NeonUnimplemented variant would remain.

AArch64 NEON integration test in tests/engines/test_rust_exploration.py (TestMultiArchSupport::test_aarch64_neon_mla_blob) uses these encodings (verified individually via pyvex.IRSB before committing): FMOV S0,W0=0x1E270000 (lifts to PUT(q0)=0; PUT(s0)=w0_low32 — zeros upper 96 bits), MLA V0.16B,V0.16B,V1.16B=0x4E219400 (lifts to t=Mul8x16(v0,v1); v0=Add8x16(v0,t)), UMOV W0,V0.B[0]=0x0E013C00 (lifts to GET:I32 from byte alias). Pattern for verifying new ARM/AArch64 encoding before adding to integration tests: 'pyvex.IRSB(struct.pack("<I",encoded)+b"\x00"*16, 0x400000, archinfo.ArchAArch64(), num_inst=1).pp()' — confirms the lifter emits the expected NEON Iop.

NEON saturating-narrowing VEX ops (Iop_QNarrowUn*, Iop_QNarrowBin* signed/unsigned for 16->8, 32->16, 64->32) were implemented in angr-hzs0 (commit 7630b1d66, 2026-05-14). 21 ops total mapped in native/angr/src/vex/opcode_map.rs (9 VQNarrowUn variants in 1115-1167 + 12 VQNarrowBin in 1171-1244) and dispatched in vex/ops.rs (concrete fast path + symbolic ITE fallback). Five unit tests in vex::ops cover the variants. Bead angr-h1uh, filed 2026-05-19 to do exactly this work, was closed as duplicate without code changes. Future 'NEON XYZ unimplemented' beads — grep parse_neon_unimplemented first; the ~145 remaining placeholders are QAdd/QSub (32), QShl/QSal (16), RecipEst/RSqrt (16), Avg (12), Reverse (14), Pw* (32), Cnt/Clz/Cls (14), vector shifts Shl/Shr/Sar/Sal (32), PolynomialMul (3). QNarrow is NOT in that list anymore.

When implementing a previously-unimplemented opcode that pytest uses as the canary in test_raise_unsupported_neon_op_via_execute_irsb (tests/engines/test_rust_exploration.py L11652), retarget the test to another still-unimplemented op of the same shape (currently Iop_RecipEst32Ux2 — Ity_I64 unary, remains placeholder under angr-tukg.5). Otherwise pytest fails because the canary now succeeds. Same dance applies to the cargo test_neon_unimplemented_routing sanity list in opcode_map.rs L1473 — keep at least one still-unimplemented op in the for-loop.

Network reachability snapshot 2026-06-06: pypi.org reachable (verified via /usr/bin/pip download archinfo, both 9.2.209 and 9.2.221 fetched). github.com unreachable (curl https://github.com/angr/archinfo returns 000 within 5s). venv pip (.venv/bin/pip) is broken for download — hits pip._vendor.resolvelib internal ImportError ('cannot import name RequirementInformation'). System /usr/bin/pip works. Implication: bd tasks gated on 'fetch upstream source' (e.g. angr-b3sc archinfo PR prep) ARE actionable offline if they only need source review/patch-prep; tasks gated on 'open PR' / 'check CI result' / 'clone github' are NOT. Apply the upstream-pr-offline-prepare-slice-pattern when feasible.

As of 2026-07-30 (iter 82, angr-1yge9.14) the rust-symex --no-default-features build was BROKEN, and had been silently red because ralph commits directly to the branch (PR-time rust_feature_flags_check gate never runs) and nobody watches nightly rust_feature_flags. Two layers: (1) LIB: symbolic/value_ops.rs (extract_no_ctx, drive_extract) called bv_codec::concrete_extract_u128 but the whole bv_codec module is #[cfg(feature=vex-engine-z3)]; and snapshot_fork_ops.rs (to_snapshot, restore_from_snapshot, the not-vex-engine-z3 merge variant) read/wrote SymContext.deterministic / .use_shared_lineage_solver which are vex-engine-z3-gated AtomicBool fields. FIXED in angr-1yge9.14: moved the Z3-free concrete_extract_u128 into a new ungated symbolic/bv_concrete.rs; gated the 3 snapshot sites (struct-literal cfg defaults to false, restore store in a cfg block, dropped the no-z3 merge's meaningless stores). This restored cargo check/build --no-default-features + the feature_flag_smoke target. (2) TESTS still broken (angr-cagbn, P2): in-crate #[cfg(test)] modules reference z3 / bv_codec / add_constraint / to_z3_ast ungated, so cargo test --no-default-features (what nightly runs) still fails ~16 errors. CORRECTION to bug-class-elimination-2026-07: its claim that nightly has 'run cargo test for all 4 combos since 2026-05-01' is only true when the build compiles -- it has NOT actually been green. Lesson: a nightly-only gate on a branch with no PR-gate enforcement can rot unnoticed; the angr-1yge9.14 ci.yml change adds a PR-time feature_flag_smoke execution step for the '' combo as a partial backstop.