rea/experiments/atomic-codemode/string-span-oracle.md

Frozen SQLite pooled-string task

Freeze this question and oracle before the three model runs. The target is the Linux x86-64 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6, SHA-256 2e6eef9a727f081f0d453b4e5e6cbd8b9ef8b6f86cbf7681cbad444d3b0b55c8. It is inspected statically, never executed. The independent fixture oracle is verify-string-span-machine.py; its fixed expectations are checked against ELF loaded bytes, GNU disassembly and relocation records, without reading Kuna output. This is a selected corpus check, not a proof of global reference completeness.

Both exact inventory strings are ASCII with an observed NUL and 14 encoded bytes:

String	Inclusive span	Target offsets and occurrence counts
no such table	0x11b376–0x11b383	0: 1; 8: 6
sqlite_schema	0x11b33f–0x11b34c	0: 1; 7: 3

The complete selected data occurrence set is:

From	Target	Owner entry	Native name
0x4215c	0x11b376	0x420d0	sqlite3LocateTable
0x2d709	0x11b37e	0x2d600	sqlite3AlterRenameTable
0x4565e	0x11b37e	0x45590	sqlite3StartTable
0x4573d	0x11b37e	0x45590	sqlite3StartTable
0x48b2e	0x11b37e	0x47ff0	sqlite3EndTable
0xbad38	0x11b37e	0xb90e0	sqlite3Pragma
0xbd1f0	0x11b37e	0xbd1b0	sqlite3InitOne
0x422c5	0x11b33f	0x42280	sqlite3PreferredTableName
0x41f0b	0x11b346	0x41db0	sqlite3FindTable
0x41f65	0x11b346	0x41db0	sqlite3FindTable
0x41fb2	0x11b346	0x41db0	sqlite3FindTable

Order is irrelevant; all eleven distinct sites and owner entries are required. Nine interior-target occurrences are suffix pointers (table, schema), not nine uses of the entire original inventory literal. Scope is retained static data references, not exhaustive machine dataflow, dynamic aliases or executed use.

At 0x2d709, bytes 488d156edc0e00 form 0x11b37e in RDX. There is no RDX overwrite before the direct call at 0x2d716 to 0x29060. The PLT jump slot is 0x159fc8, whose ELF JUMP_SLOT symbol is sqlite3CheckObjectName; this does not establish the runtime bound implementation. Decoding must start at a known instruction boundary, e.g. 0x2d706, rather than a guessed mid-instruction start.

At 0x42158, AND R13D,1 (4183e501) sets flags. The LEAs at 0x4215c (488d1513920d00) and 0x42163 load the base no such table pointer into RDX and no such view (0x11b369) into RAX. These LEAs preserve flags. CMOVNE RDX,RAX at 0x4216a (480f45d0) keeps the table component when the masked result is zero and selects view when nonzero. The separate test/branch at 0x4216e/0x42171 must not be substituted for this selection. On the selected fallthrough path, RDX is still the message component at the call at 0x42185 to 0x2a1e0; RSI separately receives the format pointer 0x11b38c at 0x4217c. The PLT slot 0x15a888 has symbol sqlite3ErrorMsg. Runtime values, feasibility, effects and binding remain unknown.

Grade complete answers against these facts and verify cited Evidence IDs, artifact/engine identity and selected source rows. An answer that misses interior targets, merges the three FindTable sites, claims whole-message use from span membership or reverses CMOVNE behavior fails. Record failures and retries rather than selecting only successful runs. Full real-model task costs include tool schemas, reference help, rejected calls, responses, cached/uncached input, output and reasoning tokens, wall time, local family CPU and kernel family peak memory.

Use one frozen runtime, engine and target for traditional (the complete supported 16-tool selector), atomic Direct (22 tools) and Code Mode (4 tools), serially in fresh isolated profiles. All have the common client JavaScript executor. The canonical provider has exact-address xrefs, so complete spans can be enumerated; only the atomic API exposes the new native span occurrence query. Consequently this is a workflow/profile comparison, not a controlled test of adapter overhead alone. Native Kuna already aggregates string-span counts and owner functions, but that aggregation lacks individual reference endpoints and is not exposed as an equivalent traditional MCP operation.