Packed coroutine words require a defined seed

Proof obligation before the correction

For suspension edge e and packed word w, let D(e,w) be the mask of Boolean lanes whose logical values the continuation stores, and L(e,w) the mask live on the outgoing edge, both from the certified distilled CFG. Only P(e,w) = L(e,w) & ~D(e,w) must pass through unchanged. The physical output is therefore

new_word = (P != 0 ? old_word & P : 0) | encode(stored_values)

For every live lane in D, the output equals its new Boolean value; for every live lane outside D, it equals the incoming value. Other bits are dead. If P is empty, the expression has no incoming-word dependency. If P is nonempty, materialization already includes this physical word in the continuation input set. This is a whole-word transfer requirement, not an additional logical frame value or a frame-pool initialization policy.

The previous split lowering unconditionally loaded the old physical word, then applied an AND/OR sequence for each stored bit. A new local CoroFrame is instantiated with UNDEFINED; no payload is required at coroutine entry. Metal4 represents XIR UNDEFINED as LLVM poison. Bitwise operations on poison do not make the overwritten bits defined, so the generated initial packed word store can disappear. Changing backend undefined semantics, clearing the pool, or disabling sorting/tail would conceal this violated precondition.

Original-module reduction (before correction)

Psycles renderer implementation 9e3ba165, Luisa 03a0f5158, Apple M1 Max, Metal4 graph, sorting and automatic tail enabled. A host-only diagnostic driver repeats the same legal sample range [0,64) twice at 64x64 while keeping the sampler’s total sample count at 256. Production renderer algorithms are unchanged. This is a replay-invariance check, not a renderer reference or a performance benchmark.

  • Keeping only physical field 90 stale (all other frame fields cleared) reproduces DiffCol relative RMSE 0.14322 and mean ratio 0.85914.

  • This uint field is payload slot 83, packing five logical Boolean values into two interfering bit lanes. Its diagnostic name _reg_101849 is not a unique logical variable identity and is not the sorting key.

  • A readback immediately after the first entry launch in each replay gives low-two-bit histograms [131072,0,0,0] and [29290,12377,89405,0]. The second fresh entry retains previous payload.

  • Tail-pool readback found no global pool modifications by the tail itself. Clearing the pool makes replay pass; sorting-off and tail-off controls also pass, but none is an acceptable compiler fix.

The permanent minimal XIR regression extends the existing six-interfering- Boolean split test: its entry defines all live bits and must contain no incoming-word load. Before correction: 1 failure among 38 tests / 386 assertions. After correction: all 38 tests / 386 assertions pass.

Correction and focused validation

coro_packed_word.h computes one shared D/P projection for split lowering and materialization’s physical input metadata. Split starts from zero when P is empty, otherwise masks the incoming word to P, then ORs encoded new bits. Suspend and ordinary branch transitions use their exact outgoing edge’s liveness. No extra slots, pool clears, backend conditionals, changes to undefined semantics, or renderer changes are introduced.

Host suites pass: split 38 tests / 386 assertions; materialize 15 / 113; distill 56 / 493; dataflow 2 / 17. The existing all-schedulers suite passes 20 / 100 on both Metal and Metal4. The new device regression passes 1 / 14 on both Metal and Metal4, checking 40 dispatches of 4096 instances: state-machine, wavefront, and graph with AoS/SoA, sorting off/on, and tail off/on. Graph uses a 128-frame pool for 4096 instances and changes every Boolean truth-table case between replays; all tail-enabled cases assert that the tail actually executes.

With all temporary SDK diagnostics removed, the original-module 64x64 same-range replay now gives:

Pass

Relative RMSE

Second/first mean

Normal

5.7967241e-7

1.0000000661

DiffCol

3.4739715e-7

1.0000000059

Combined

4.3721874e-7

1.0000000033

All inspected values are finite. Sorting and automatic tail remain enabled. Logs are retained under Psycles’ ignored build-macos/benchmarks/2026-09-09/lone-monk-metal-schedulers directory.

Full original-module Cycles gate

The unchanged upstream film implementation 9e3ba165 is rendered again at 1920x1080 / 256 spp, four 64-sample batches, using the corrected Luisa build with all temporary diagnostics removed. Both compact/populate switches are 1, fast math remains enabled, the main shader cache is disabled, and graph sorting/automatic tail remain enabled. No builds, profiling or other device work overlap this gate. A fresh version-verified Blender Cycles 5.2.1 Metal reference uses the same source blend, frame, seed, integrator and 15 passes.

  • Both actual EXRs have exactly 46 finite channels. Every pixel’s integer sample count is checked against 256 by the original output path.

  • Combined relative RMSE: 0.007764527, mean luminance / Cycles: 0.999891523, versus 0.230399849 / 0.775731912 in the original failure.

  • DiffCol relative RMSE: 0.000850013, luminance ratio 1.000004020.

  • The full-resolution Combined comparison removes the coherent dark regions; per-pass residuals, including maximum errors, remain in the report and are not waived as universal Cycles compatibility.

  • Render-only wall: 328.193 s; session initialization: 106.560 s; fresh Cycles main-loop wall: 50.778 s. This is one correctness-gate observation, not a repeated performance conclusion or an improvement over invalid renders.

  • The frame remains 7 stages / 91 fields / 456 B, capacity 131072.

Evidence: packed-word-original-gate/graph/run-1/benchmark.json, the 15-pass comparison report.json, packed-word-original-gate-audit.json, binary/source hashes, and original logs in the directory above. This gate’s manifest records the pre-commit parent and dirty fix plus exact implementation hashes. New-upstream performance measurements use a separate published cohort.