rea/experiments/atomic-codemode/value-query-study.md

Exact value locations and use occurrences

Real stripped OpenSSH exposed two missing query directions: selecting retained SSA versions by an observed storage coordinate, and finding uses of a function input/constant without a defining operation. Literal-constant lookup is not storage lookup, and operation-definition users cannot represent input uses.

values(locations:[{space,offset,size_bytes}]) now matches exact retained coordinates and widths. It preserves multiple SSA versions, intersects ID/input filters, honors field selection and pages results. IDs retain caller order; otherwise distinct locations retain caller order, then native value order. Empty selections select none. unretained_locations reports coordinates with no known retained match before other filters. location_coverage preserves the count of values with unresolved spaces; an empty location request leaves that count null. These are not alias, pointer-content or live-memory queries.

relations(kind:"value_uses", seeds:[valueID]) returns exact operand occurrences, including constants and inputs with null definitions. Its rows have the same {operation,input_index,value_id,definition,phi_predecessor,phi_predecessor_edge} grain as operands. Repeated slots/PHI incoming edges stay distinct. Paging spans distinct seed order, then native operation/slot order. Missing value seeds and partial retained-use scope remain explicit. Call-boundary-only captures support location lookup; value_uses is explicitly unavailable there.

One value-query owner serves full graphs, bounded projections and call-boundary values; the duplicate input-filter implementations are removed. Operand-row construction is shared by forward and reverse reads. Native operation-relation routing also has one owner across full/projection/unavailable views. Both new indexes build lazily, contain only retained facts, and expire with their resident snapshot model; arbitrary missing queries do not grow retained state. Existing two-model/retained-source and execution/resource bounds are unchanged. CLI, SDK and both MCP adapters share these implementations; the catalog stays 15 methods, 18 direct tools or 4 Code Mode tools. No native engine rebuild is required.

Real artifact and verification

Target: Debian openssh-client 1:9.2p1-2+deb12u10 amd64 /usr/bin/ssh, stripped ELF, SHA-256 04f2ff5f506a3f332e7adeb1478a4c551ae74acdd328e6fb5c2495664d4064e6. Engine remains preserved a9ca8a8a..., upstream fe01d629... plus the pinned experimental exporter. The caller 0x280c0 contains 11,534 recovered operations, 19,504 values and 245 blocks. Location ram:0x1144c8/4 has 250 retained versions and 369 input occurrences; this does not mean 250 physical objects or prove the global unchanged across calls. Independent GNU decoding finds the four-byte load/TEST/JE at 0x28e58/0x28e63/0x28e66; unwind FDEs corroborate the selected function starts. Native INDIRECT/PHI versions do not solve memory aliases.

Both actual MCP routes verify every selected version and occurrence against the prior retained complete graph, preserving C, calls and all ordinary native function fields. They also find the warning callee's incoming RDI value and its first call use without a whole graph/report read. Case-sensitive spaces, missing coordinates, source identity, field selection and paging are checked. Each route executes fifteen MCP requests. The 78 shared JS tests pass, including projection/call-only scope, null spaces, repeated input slots and PHI bindings.

Executed scope	Family wall s	Family CPU s	Kernel peak MiB
Shared 78 tests	4.653	4.409	88.9
Real Code Mode MCP	9.081	8.730	372.3
Real direct MCP	9.080	8.800	338.9
Retained-source query diagnostic	1.327	1.145	156.9

All use one CPU, 4 GiB hard / 3 GiB early-stop bounds, verified cleanup and OOM 0. Kernel peaks include charged file cache, not RSS. The public MCP checks verify adapter parity; they issue each query separately rather than optimizing a multi-query Code Mode script. First indexed tasks take 148.5 ms / 0.149 CPU seconds Code Mode and 79.7 ms / 0.080 direct. Same-lease selected-value/use reuse takes 9.7 ms / 0.011 CPU and 4.3 ms / 0.005 respectively. Cumulative peaks only upper-bound isolated warm memory. No model-token or general speed claim follows.

Equivalent core query diagnostic

profile-value-queries.mjs replays the same retained real source and completes the same task: select all versions at that exact location and all their retained operand occurrences. Both strategies return exactly the same 250 values and 369 occurrences. It uses the existing paged API as the scan baseline.

Strategy	Core reads	Core-result JSON bytes	Elapsed ms	Family CPU s
Page values and operation inputs	244	5,632,444	213.34	0.214
Exact locations and value uses, first indexes	6	85,421	53.51	0.054
Same indexed task, warm	6	85,421	2.72	0.003

Parsing the retained source separately takes 611.4 ms / 0.652 CPU seconds. These query timings include diagnostic JSON byte accounting. They measure core reads on a previously captured native graph: no fresh native computation, MCP wire, schema/discovery, model rounds or tokens. The scan reads all 19,504 values and 11,534 operations; the indexed path reads 250 values and selected use rows. The memory peak is cumulative across strategies. OS caches/host contention and query order are uncontrolled. This establishes a useful query boundary, not a native analysis acceleration or completed-agent efficiency advantage.

Local receipts use .cache/atomic-codemode/ssh-values-{code,direct}-v1*, ssh-value-query-profile*, and value-query-shared-tests.log. The real-agent comparison now completes the stripped application's warning/caller/stack-format/local-guard task in all three lanes. Code Mode uses the new queries correctly; direct atomic answers with machine facts alone and has lower observed whole-task costs. The new core-query result must not be substituted for that completed-task comparison.