rea/experiments/atomic-codemode/switch-study.md

Native cases as composable facts

The SQLite VM has 182 table entries and 149 distinct targets. Its native jump-table owner already knows labels and exact row-to-out-edge mappings; the experiment previously exported only the optimized CFG. This closes that export/query gap without deriving labels from edge order or block addresses. It remains an opt-in experiment, not stock-provider parity or integration.

Owners and contracts

atomic_membership gathers BRANCHIND identities during its existing checked membership scan. Read-only JumpTable accessors borrow native address/label rows and edge positions. atomic_switches checks the exact linked operation, indexes mappings once and exports an independent version-1 facet alongside unchanged graph schema 3 and its optional schema-4 compression envelope. Ordinary non-opt-in analysis and target executable bytes are unchanged.

Native limits are 12,000 switches, 100,000 rows/mappings and a shared 2 MiB selector/type/address-space text budget, within the existing supervised process and 8 MiB document bounds. Source labels stay exact hex strings. Missing tables, labels, targets/mappings and the native reserved no-label marker remain explicit. No-label status comes from the native owner; it is not guessed from an integer.

native-switch-contract admits rows before expanding validation errors; native-switch-views owns identity checks, partial coverage and indexes. A full graph cross-checks operation/value/edge ownership; without it, shared values are checked against available calls/projection facts. Bad switch data makes that facet unavailable while preserving independently valid graph/calls/C.

switches returns metadata and selector facts, never an embedded case inventory. relations(kind:cases) selects labels or original row indexes and pages individual case-to-edge relations. A case has a stable case_id; distinct edges have distinct relation IDs. Unmapped cases produce one explicit unknown-edge row. Relation totals are separate from native row and mapping counts. This avoids an unbounded edge array even when limit=1; a regression reads a late two-edge page from a 4,096-mapping case in under 1 KiB of returned items.

Raw rows are retained once. Row lookup is direct, labels have an index, and prefix offsets permit paging without constructing all relation projections. Single-label offsets are cached only for existing labels, bounded by the retained source; arbitrary missing labels and filter combinations do not grow that cache. The validated model/lease owns its lifetime. Both MCP adapters and the JavaScript CLI consume these same owners.

The native writer keeps old graph/call coverage ahead of the new facet when space is scarce. A source review found that a later projection omission could free space without restoring saved switch facts. bounded_reclaiming retries that saved facet whenever a preferred smaller combination fits. It moves trees, does not clone them, and bounds both encoded string alternatives. A focused native regression and real 2 MiB CLI captures verify the restored facts.

Real provider evidence

Upstream: fe01d6294eb0d1053ce343c8943646df88e143fc. Final preserved engine: a9ca8a8ac224936afb08a9d4be9c1225feb69473ad9f35764e8d1c4f04875b5b. Patch SHA-256: 9b6642f498f3c9f356b253a2b8b14daf2154cde8eae2d4ab0696f018566e9b73. The initial public checks used preserved ac6bc7ab..., before the formatter reclamation fix. Binaries are copied outside mutable Cargo outputs and not committed. Target/digest and independent machine oracle are in switch-oracle.md.

Both final actual MCP paths compare every one of the 182 labelled original targets with independently reconstructed ELF table entries. Selected loaded bytes and dispatch instructions also agree. The native mappings cross-check against the full recovered graph; graph and ordinary C/metadata/calls match the prior complete golden. That producer comparison does not independently prove whole machine/IR equivalence. Each route executes fourteen MCP requests.

The final wire document is 3,818,818 bytes. Two real native CLI processes with an explicit 2 MiB output budget instead produce identical 823,908-byte records: graph and projection are explicitly unavailable, while C, 416 calls and all 182 cases survive. Replaying their retained source through the shared decoder again verifies every original target. This establishes the native CLI/decoder boundary, not a public MCP no-graph run; the MCP owner keeps its 8 MiB budget.

The recovered selector is eight bytes but comes from a one-byte LOAD/ZEXT. The machine computes its jump address in a different register. Native default edge 8:42 points to block 778, origin 0xeacf0; the unsigned machine out-of-range guard instead jumps to 0xea998. Defaults, original addresses and optimized edge identities have separate authority, now stated in the contracts.

Executed checks and costs

The shared JS suites pass 73 cases. Selected native CLI tests pass thirteen; one native jump-table test separately checks nonmatching ordinals/labels/edges, missing labels and inconsistent row lengths. Focused source lint passes without warnings; upstream compiler warnings are outside this patch. Full native corpus, stages/workspace and whole-REA gates remain unexecuted or previously resource limited; no integration readiness is claimed.

Executed scope	Family wall s	Family CPU s	Kernel peak MiB
First native export build	397.637	366.618	2,169.6
Identity/text-budget build	432.413	388.136	2,130.6
Initial twelve CLI tests	100.723	99.982	647.3
Native jump-table test, including compile	277.247	276.646	2,855.5
Final thirteen CLI tests	52.204	40.984	476.4
Formatter-fix build	63.414	50.208	524.5
Cached final build	0.522	0.189	30.1
Initial Code MCP, ac6bc7ab	41.698	41.415	656.5
Initial direct MCP, ac6bc7ab	96.920	75.949	639.2
Two 2 MiB native CLI captures	79.377	79.060	514.7
Final direct MCP	44.440	44.201	635.0
Final Code MCP	43.828	43.504	643.0
Both catalog/reference checks	2.033	1.839	144.4
Real CLI empty switch/ID selection	3.646	3.397	188.8

All resource runs use one CPU, 4 GiB hard / 3 GiB early-stop memory bounds, verified cleanup and OOM 0. Peaks include charged file cache, not RSS. Final same-lease snapshot plus selected-case reuse takes 4.8 ms / 0.006 CPU seconds direct and 8.2 ms / 0.009 Code; cumulative memory peaks only upper-bound isolated warm memory. OS caches and host contention are uncontrolled. These scripted measurements do not establish token savings or model outcomes.

The initial direct capture also ran slowly (about 90 seconds), despite sequential requests and no model. This shows the earlier long capture is not unique to Code Mode or model interaction. The overlap diagnostic did not reproduce it. Its native/host cause remains unresolved; no speed fix or causal dispatch comparison is claimed.

Model question

The question and oracle must be committed before either real model launch. They ask for selected labels, source-byte/normalized-selector widths, signed relative target arithmetic and the native-default versus machine-guard distinction, starting from function name/messages. Both lanes get the full catalog and the same exact discovery, envelope and stopping guidance; reverse engineering facts are not precomputed for the measured models. Real-model results are pending.