Headline

Patch release. Clears the v1.1.0 Track D carry-forward and fixes a real operand-ordering bug in the ægraph commutativity normalizer that prevented Add(0, x)-shaped identity folds when the constant was numbered before the variable.

Fixed

• ægraph commutativity normalization. EGraph::canonicalize_commutative ordered operands purely by union-find class id, so when a constant operand was inserted (and numbered) before its variable sibling, Add(0, x) stayed constant-left and the (wild, Const) identity rules could not match. The sort key is now (is_constant, uf-root id) — constants always move to the right, matching every identity rule's LHS shape. The previously #[ignore]'d test_commutativity_zero_plus_x_folds is un-ignored and passing; test_commutativity_idempotent confirms the new order remains a fixpoint.

Housekeeping (v1.1.0 Track D, closed)

• Instruction and BlockType now derive Eq + Hash (was PartialEq only) — lets downstream passes key hash sets/maps on instructions structurally instead of via Debug-formatted strings.
• AdapterInfo and its fields lifted from module-private to pub(crate) for future cross-module use.
• optimize_module no longer discards FusedOptimizationStats or silently swallows fused-optimization outcomes: it now logs a one-line summary of what the fused passes did on success (positive signal they ran) and keeps the non-fatal warning on failure.

Verification

379 loom-core lib tests pass (was 378 + 1 ignored); cargo fmt --all -- --check clean; cargo clippy --all-targets --all-features -- -D warnings clean. CI: 11 substantive checks green (Build×3, Clippy, Format, Differential Testing vs wasm-opt, Z3 Verification Build, WASM Build, Validate WebAssembly Output, Rivet Artifact Traceability).

Known CI red — same as v1.1.0: Rocq Formal Proofs fails due to an upstream rules_rocq_rust toolchain breakage (rocq-of-rust cannot link libLLVM-19-rust-1.85.0-nightly on the CI runner). The fix is upstream PR #34 (rules_rust migration, still draft); when it merges, a one-line MODULE.bazel pin bump turns this check green.

Deferred

• Track E — real meld-fused multi-component fixture. meld v0.9.0 now installed and working (no longer the blocker), but the cross-memory-adapter fixture still needs a memory-sharing component pair that doesn't exist ready-made in either repo.
• Rocq CI fix — gated on upstream rules_rocq_rust PR #34.

Headline

ægraph substrate goes production + first mechanized roundtrip proof. A minor-version bump consolidating the v1.1.0 sprint. The v1.0.4 ægraph substrate is now a default-on pipeline pass with cost-driven extraction and a widened rule set, and the parser/encoder roundtrip proof (#48) gains a real Rocq scaffold.

Byte-neutral on the current corpus — this is an infrastructure and correctness release, not a size-win release.

What's in it

• #134 Track B — cost-driven ægraph extraction. egraph::extract() finds the union-find root of the requested class, scans every class id resolving to that root, and emits the representative with the lowest total encoded-byte cost (Op::encoded_byte_cost: 1 for opcodes, 1 + LEB128 for immediates). Subtree cost is a HashMap-memoized DP keyed on UF root. Closes the v1.0.5 Track 1 substrate gap — the manual UF-root scan in egraph_optimize_body is deleted.
• #137 Track C — ægraph rule-set widening. 11 new i64 Op variants + 8 new identity rules (i64 +0 / |0 / &-1 / *1 and three shift-by-zero folds). New Op::is_commutative() + EGraph::canonicalize_commutative() normalize operand order so each positional rule also fires on the mirrored form.
• #135 Track A — Path A for #48. Rocq parser/encoder roundtrip proof scaffold. proofs/ Admitted. count drops 4 → 2; TermBijection.v rewritten with both bijection theorems closing by Qed; StackSignature.v kind-composition associativity closed.
• Track F — ægraph pass is default-on. Revert-safe by construction: extraction is spliced back only when strictly shorter, so a function is either improved or left byte-identical. New docs/measurements/v1.1.0-corpus-baseline.md.

Also pays down pre-existing lint debt (repo-wide cargo fmt + 12 clippy fixes) so the fmt + clippy gates pass cleanly.

Deferred to v1.1.1

• Track D — Track-3 housekeeping (touches every fused-optimizer call site).
• Track E — real meld-fused fixture (blocked on a meld-binary permission wall); shipped as a documented placeholder.

Verification

378 loom-core lib tests pass; cargo fmt --check and cargo clippy --all-targets -- -D warnings clean. CI build/clippy/format, Differential Testing vs wasm-opt, Z3 Verification Build, and WASM Build all green.

Known CI red: Rocq Formal Proofs — a pre-existing upstream rules_rocq_rust toolchain breakage (rocq-of-rust cannot link libLLVM-19-rust-1.85.0-nightly on the CI runner); fails identically on main. LOOM's .v proof files are unaffected. To be resolved by an upstream toolchain bump in v1.1.1.

Corpus

No regression on any corpus fixture (every LOOM Δ% ≤ 0).

Headline

Four-track v1.0.4 follow-through. Each v1.0.4 infrastructure piece grew a real consumer this release.

What's in it

• #130 Track 1+4 — ægraph pipeline consumer + #48 Rocq prep doc. New egraph_optimize pass (opt-in via --passes egraph) walks straight-line maximal (0→1) trees through the v1.0.4 ægraph engine. 4 new tests. Plus docs/research/v1.0.5/rocq-roundtrip-prep.md surveying the proofs/ tree's remaining Admitted state and recommending paths forward for #48.
• #131 Track 2 — #70 six-pass chain composition. Composes the v1.0.4 async-callback adapter detector with inline_functions + directize + constant_folding + eliminate_dead_code + new forward_global_shim peephole + eliminate_dead_stores. ~600 LOC. 8 new tests. Each constituent pass uses its own verify_or_revert Z3 gate.
• #132 Track 3 — #68 Tier-1.1 + Tier-2.2. Two new fused_optimizer.rs passes: inline_scalar_adapters (slots between devirt and dead-fn elim) + dedupe_function_bodies (groups by (sig, body) hash, redirects calls to lowest-index representative). ~510 LOC. 6 new tests.

Tests

+18 new (4 + 8 + 6). 400+ loom-core lib tests total.

Strategic moat unchanged

simple_component −18.8%, calc_component −11.3%, gale −4.9% file / −2.0% code.

Honest measurement note

Per-fixture deltas re-measured: gale −4.9%, httparse −2.1%, json_lite −3.8%, state_machine −5.9%, calc_component −11.3%. New passes byte-neutral on these non-fused fixtures — wins land once real meld-fused multi-component fixtures arrive.

Suspicious pre-existing observations (no fixes in this PR)

Track 3 agent flagged 4 worth tracking for v1.0.6+:

1. Instruction derives PartialEq but not Eq / Hash — forces dedup to hash Debug strings.
2. AdapterInfo is module-private but cross-pass usage wants pub(crate).
3. FusedOptimizationStats invisible in CLI --stats.
4. optimize_fused_module silently swallows errors with eprintln!.

Deferred to v1.0.6+

• Cost-driven ægraph extraction
• ægraph rule widening (i64, commutativity)
• Default-on ægraph after corpus measurements
• Path A for #48 (~1400 LOC Rocq, v1.1.0)
• Real meld-fused multi-component fixture (would surface Track 3 wins)
• Pre-existing observations 1-4

🤖 Generated with Claude Code

Headline

All four tracks shipped successfully (vs v1.0.3 where Track 3 died). Plus a subagent issue-sweep that found zero new issues since the v1.0.3 triage. Code-section bytes unchanged on the current corpus — all four tracks ship infrastructure that will produce measurable wins once their consumers land in v1.0.5+.

What's in it

• #125 Track A — async-callback adapter pass. First piece of issue #70's six-pass chain. New Phase 4 in component_optimizer.rs detects the meld P3 adapter shape and folds the discriminant test + slow-path branch when EXIT_OK is statically true. Three safety guards (no Unknown, local-read-count = 1, I32Const == 0). 4 new tests.

• #126 Track B — verifier table-resolver teaching. Drops directize's Z3 bypass from v1.0.2. The verifier now resolves i32.const N; call_indirect (type T) to the same pure_call_<F>(args) Z3 expression PR-K3 uses for direct call F — they prove equal under congruence closure. All 3 directize tests pass with Z3 verification ACTIVE.

• #127 Track C — ægraph rewrite engine. Builds on the v1.0.3 substrate. Adds union() + rebuild() (congruence closure), Pattern/Rule API, apply_rules + saturate_with_rules, and 3 hand-proven identity rules (x+0=x, x*1=x, x&(-1)=x). 7 new tests (14 total egraph tests).

• #128 Track D — island-model parallel optimization (issue #71). New loom-core/src/islands.rs (~580 LOC) + CLI --islands N. Runs N configs concurrently via rayon. Each independently passes Z3 + stack validation. Picks min_by_key(encoded_size) with deterministic name lex tie-break. N=4 takes 1.4× wall time for 4× serial work — rayon distribution confirmed.

Strategic moat unchanged

Issue tracking

Subagent sweep: zero new issues since v1.0.3. Open set unchanged: {#48, #68, #70, #71, #72, #73, #74}.

Deferred to v1.0.5+

• ægraph pipeline integration + cost-driven extraction + more rules
• Six-pass chain composition from #70 (inline, directize, const-fold, forward, DCE on post-detection IR)
• KEEP issues #48, #68 (Tier-1.1 + 2.2)
• 9 pre-existing rivet schema-fit errors

🤖 Generated with Claude Code

Headline

Five-track parallel sprint. Four agent worktrees + one direct-work track addressing v1.0.2's deferred-list. Three tracks shipped real work; one track's agent died and got deferred to v1.0.4. Lifecycle coverage gaps closed from 4 → 0.

What's in it

• #121 PR-Q: real corpus fixtures (3rd attempt — finally success). All-Rust, no-deps sources for httparse / json_lite / state_machine (749 LOC) + their built .wasm files (4.7 KB / 3.5 KB / 1.7 KB). Three of the previously-n/a rows in the harness now have real numbers.

• #122 PR-egraph: ægraph MVP. Acyclic Cranelift-style e-graph substrate at loom-core/src/egraph.rs (~432 LOC + 7 tests). Hash-consing, acyclic invariant, basic extraction. Rewrite engine deferred to a future PR; this lands the substrate.

• #120 Track 4: safety-goal lifecycle closure. Added 4 safety-context artifacts (SC-CTXT-2..5) and 3 new safety-solutions (SOL-6..8). rivet validate no longer reports a "Lifecycle coverage gaps" section.

• #123 Track 5: issue triage + roadmap. 11 open issues classified: 4 CLOSE, 4 KEEP with roadmap entries, 3 DEFER. Output: docs/research/v1.0.3/issue-roadmap.md (~2200 words).

Issues closed via this release

• #45 Rocq foundation — proofs/ tree complete; TEST-ROCQ-PROOFS runs them in CI
• #47 StackSignature::compose associativity — 23 Qed's, 0 Admitted's in proofs/rust_verified/stack_signature_proofs.v
• #50 Crocus-style ISLE rule verification — loom-core/src/verify_rules.rs has been Crocus-shaped since day 1
• #75 P3 async callback trampolines — duplicate of #70

Track deferred to v1.0.4

• Track 3 (verifier table-resolver teaching) — agent died with no work product. The directize Z3 bypass stays in place; soundness is still provided by structural guards (no Unknown + slot resolves + signature matches).

Lifecycle coverage progress across the v1.x arc

Remaining 9 errors from rivet validate are pre-existing schema-fit issues (SG decomposition link types + CP acted-on-by link not in schema), tracked for a separate cleanup PR.

Strategic moat unchanged

Component-Model adapter specialization: −18.8% on simple_component, −11.3% on calc_component, gale ties wasm-opt code section.

Still deferred to v1.0.4+

• Track 3: verifier table-resolver teaching
• ægraph rewrite engine + per-rule Z3 proofs
• KEEP issues from the roadmap: #48, #68 (Tier-1.1 + 2.2), #70, #71
• Schema-fit cleanup for the 9 pre-existing rivet validate errors

🤖 Generated with Claude Code

Headline

Infrastructure-completion release. Closes v1.0.0's deferred-list gaps in three direct-work tracks. Honest measurement note up front: code-section bytes are UNCHANGED on the current corpus — the new infrastructure is correct and tested, but doesn't fire on what we measure today (directize is gated off by table mutation on the calculator components; gale doesn't have power-of-2 multipliers in our shipped range). Real byte wins land when the corpus grows (PR-Q deferred).

What's in it

PR-C: directize MVP wired into CLI

The directize implementation existed in loom-core/src/lib.rs since v1.0.0 (silently merged with PR-K3) but was never wired into the CLI pipeline. v1.0.2 registers it as a CLI pass between precompute and inline. Folds i32.const N; call_indirect (type T) → Call(F) when:

• No function in the module contains Unknown (rules out table.set/.fill/.copy/.init/.grow)
• The element section maps slot N to function F via constant i32.const offset
• F's signature is byte-identical to the call_indirect's type_idx

Z3 verification intentionally bypassed. The verifier models call_indirect(N) and call F as INDEPENDENT uninterpreted functions; congruence cannot prove them equal without teaching the verifier about the table resolver. The three structural guards imply soundness without Z3.

PR-L3: 4 power-of-2 mul → shl rules

Only ships rules where LEB128(2^k) > LEB128(k). Below k=7 the rewrite would be byte-neutral.

Rivet design-decision cleanup

5 new DD-* artifacts close all REQ-side lifecycle gaps.

Lifecycle coverage progress

Remaining 4 are SG-3..6 safety-context/safety-solution gaps (separate cleanup, different artifact types).

Tests

+7 new tests, all 335+ loom-core lib tests pass.

Strategic moat unchanged

Deferred to v1.0.3+

• PR-Q: real corpus fixtures (httparse, nom_numbers, etc.). Two prior agent attempts stalled.
• Cranelift-style acyclic ægraph mid-end.
• Verifier-side teaching of the table resolver (would let directize use Z3).
• 4 remaining safety-goal lifecycle gaps (SG-3..6).

🤖 Generated with Claude Code

Headline

Imports spar's pattern (commit ba329f3d) of making rivet artifacts EXECUTABLE rather than purely descriptive. Every requirement REQ-1 through REQ-18 now has at least one TEST-* feature artifact with fields.method: automated-test and fields.steps[].run shell commands.

What's in it

• 16 new TEST-* artifacts in safety/requirements/verification.yaml, one per requirement family.
• tools/run_verification.py — executes each artifact's steps via rivet list + rivet get + bash -c.
• tools/post_verification_comment.py — sticky PR comment with N/M passed + failed IDs.
• .github/workflows/verification-gate.yml — new CI job on PRs.

Requirement → Test mapping

Coverage delta (per rivet validate)

The remaining 9 gaps are pre-existing design-decision / safety-context / safety-solution issues, orthogonal to the verification work.

How CI sees this

On every PR:

1. Verification Gate workflow installs pinned rivet (v0.7.0 at commit b7a17bef — first release with rivet list --filter <sexp>).
2. Runs tools/run_verification.py --filter '(and (= type "feature") (matches id "^TEST-"))'.
3. Each test step's exit code determines pass/fail.
4. Sticky PR comment shows N/M passed + failed IDs.
5. Job fails if any verification artifact fails.

Per-PR override: add Verify-Filter: <sexp> to the PR body.

Cross-project pattern

Second pulseengine project (after spar) to adopt this. Same tooling will work for kiln, meld, witness, and gale once their requirements are similarly mapped.

🤖 Generated with Claude Code

Headline

v1.0.0 marks the point where LOOM's cross-call optimization infrastructure is end-to-end functional. The verifier-side blocker that kept cross-call CSE dedup dormant for two releases is lifted, and the size-threshold fallback closes the calculator_root timeout.

What's in it

• #115 PR-K3 (Track A): model pure+no-trap Call as uninterpreted function for Z3 congruence. The Z3 validator modeled every Instruction::Call as a fresh BV::new_const, so two identical pure helper calls produced INDEPENDENT symbolic constants. PR-K3 uses FuncDecl::apply so Z3's congruence closure proves them equal. Combined with the cost gate, two previously-#[ignore]'d tests now PASS as positive cases.

• #115 PR-K3.2 (Track B): size-threshold fallback. Bodies above LOOM_Z3_MAX_INSTRUCTIONS (default 2000) skip Z3 and rely on the stack validator. Closes the >60-min hang on the meld-fused 2.3 MB calculator core. Tunable via env var.

• #116 PR-bench (Track E): criterion-based corpus baseline + wasm-opt version pinning. New loom-testing/benches/corpus_baseline.rs (~870 LOC) replicates scripts/measure_corpus.sh as a cargo bench. wasm-opt version pin at scripts/wasm-opt.pinned (currently version_116). Skip-if-same logic, non-fatal mismatch warning.

Cross-call optimization timeline (now complete)

Strategic moat — measured

From the v0.9.0 corpus harness (docs/measurements/v0.9.0-corpus-baseline.md):

LOOM beats wasm-opt on small components and on packaging hygiene; ties on small core modules; loses on large cores (where PR-K3.2's size-threshold gate now at least lets LOOM complete).

Tests

• 5 CSE tests now pass (was 3 pass + 2 ignored since v0.9.0).
• 10 summary:: IPA tests pass.
• 330+ loom-core lib tests total.

Deferred to v1.0.1

• Track C: directize MVP — agent stalled mid-task.
• Track D: real corpus fixtures (httparse, nom_numbers, etc.) — agent stalled.

The harness honest-marks the missing fixtures n/a.

Compatibility

No breaking API changes. New env var LOOM_Z3_MAX_INSTRUCTIONS (default 2000) controls the Z3 size-threshold gate.

🤖 Generated with Claude Code

Headline

First objective measurements of LOOM vs wasm-opt -O3 across multiple workloads, plus harvesting of v0.8.0's infrastructure into concrete wins on component-shaped fixtures.

Measured results (gale + 3 components)

Two strategic facts established:

1. LOOM beats wasm-opt -O3 on gale by 4.1 points at total-file level. First measured workload where LOOM dominates.
2. PR-M (v0.8.0) delivers −11% to −19% on small adapter-heavy components. The strategic moat is real: wasm-opt cannot process Component-Model components at all.

What's in it

• #110 PR-P: corpus-wide LOOM vs wasm-opt measurement harness. New scripts/measure_corpus.sh + docs/measurements/v0.9.0-corpus-baseline.md. Hard-errors on invalid wasm. Discovered the attestation overhead during validation (without the fix, gale showed +45.6% — entirely the --attestation custom section, not actual code growth).

• #111 PR-K2: span-based CSE replacement infrastructure + verifier-gap finding. PR-K (v0.8.0) recognized pure+no-trap Call expressions in CSE but couldn't replace them. PR-K2 implements the span-based replacement with five defense-in-depth gates. Critical finding: the Z3 verifier models every Call as a fresh symbolic constant, so it rejects every dedup with a counterexample. Per the proof-first policy, tests stay #[ignore]'d until PR-K3 (verifier-side change to model pure calls as uninterpreted functions f(args)).

• #112 PR-L2: grow Souper rule set to 12 identities + wire into pipeline. PR-L (v0.8.0) shipped the module but never registered it with the CLI optimizer — discovered during measurement. PR-L2 fixes the wiring and adds 9 new rules (i32.mul·1, i32.sub-0, three shift-by-zero variants, four i64 identities), each with documented algebraic proof. 24 tests pass (was 6).

Two surprises discovered during measurement

1. PR-L was never wired into the optimizer pipeline. Two releases of "Souper infrastructure" and the pass never ran. Fixed in PR-L2. The measurement harness caught it via --stats per-pass breakdown.

2. The Z3 verifier models Call as opaque. This blocks every cross-call optimization that relies on call equivalence. PR-K3 will fix this in verify.rs.

Deferred to v1.0.0

• PR-K3 (verifier-side): model pure+no-trap Call as uninterpreted-function applications. Unblocks the entire cross-call dedup feature.
• PR-L3: power-of-2 mul/div → shift rules.
• PR-Q: land a real corpus under tests/corpus/ so harness has more rows.
• PR-R: handle Component-Model components fairly in the harness (unbundle cores, run wasm-opt on each, re-bundle for comparison).

Compatibility

No breaking API changes. New CLI pass peephole-synth runs by default (between canonicalize and cse).

🤖 Generated with Claude Code

Headline

Cross-call optimization release. Four PRs landed in parallel via worktree-isolated agents (three completed by agents, one rescued from agent timeout).

What's in it

• #105 PR-J: arg-aware pure-call-drop fold. Extends PR-F (v0.7.0). v0.7.0's vacuum peephole only folded ZERO-arg Call f; Drop pairs. PR-J lifts this restriction when the N preceding instructions are themselves all pure pushers — N pure pushers contribute exactly N values and nothing observable, so removing them alongside the Call+Drop preserves stack balance and observable behavior.

• #106 PR-K: CSE cross-call dedup recognition (INFRASTRUCTURE). Adds Expr::Call { func_idx, args } to the CSE expression model. Pure + no-trap + single-result calls are now recognized as deterministic values, hashed, and cost-gated. Replacement (turning a duplicate call site into local.get) requires span-based substitution and is deferred to PR-K2.

• #107 PR-L: Souper-shaped peephole synthesis MVP. New module loom-core/src/peephole_synth.rs with 3 hand-curated right-identity rules: x+0=x, x|0=x, x&(-1)=x. Iterate-to-fixpoint linear scan with stack-validation safety net. Foundation for the full Souper analog tracked in docs/research/v0.7.0/algorithmic-solver-feasibility.md.

• #108 PR-M: Component-Model adapter specialization. LOOM's strategic moat — wasm-opt operates on core wasm and cannot see adapter residue at all. New specialize_adapters pass folds canon lift/lower trampolines (empty blocks with identity signatures get unwrapped).

Why infrastructure-heavy

Two PRs build directly on PR-F's function-summary IPA (J and K). One ships the harness for algorithmic-solver work (L). One delivers LOOM's first concrete component-pipeline win (M). None move bytes on gale, because gale's wasm doesn't have the targeted patterns — but each is the foundation for compound wins on component-shaped workloads and hand-written wasm.

Test count

294 → 308+ across the four PRs.

Soundness

Every PR explicitly enumerates the safety conditions it relies on:

• PR-J: stack-effect arithmetic (pure pusher = consumes 0, produces 1).
• PR-K: IPA correctness (pure ∧ no-trap ∧ args-determinate).
• PR-L: algebraic identity proofs documented per-candidate.
• PR-M: byte-identical block type + empty body + two-layer revert.

Engineering note: parallel agent development

The v0.8.0 sprint validated worktree-isolated agent parallelism as a development pattern: each agent gets its own working tree + target/ cache, four agents run concurrently against the same .git directory without colliding. PR-M's agent timed out with the implementation complete but uncommitted; rescue time was under 10 minutes because the worktree state was clean.

Deferred to v0.9.0

• PR-K2: span-based CSE replacement (the replacement half of cross-call dedup).
• PR-L2: Z3 startup-time candidate admission gate for peephole synthesis.
• PR-N: Verus-clause ingestion MVP per the gale deep-scan shortlist.
• PR-O: Cranelift-style acyclic ægraph mid-end.

Measurement

No measurable change on gale_in_baseline (still 795 B / -1.97% net since v0.6.1). Gale's wasm doesn't have the patterns these passes target. This release is infrastructure — wins compound on component-shaped workloads (calculator-class) and on hand-written wasm.

Compatibility

No breaking API changes.

🤖 Generated with Claude Code