vcr_dec_001_graph_alloc_differential.py hand-mirrors the frozen codegen anchors — one went stale and reddened main for five merges

[avrabe]

scripts/repro/vcr_dec_001_graph_alloc_differential.py keeps its own copy of the frozen codegen anchors, hand-synced from crates/synth-cli/tests/frozen_codegen_bytes.rs. Its header says so:

# pins from crates/synth-cli/tests/frozen_codegen_bytes.rs oracle_001.
FROZEN = [
    # Synced to frozen_codegen_bytes.rs oracle_001 default block after ...
    ("flight_seam.wasm", "e7152735df88...", 706),
]

What happened

RQ-66-BOTHWRONG (#1249) correctly re-froze flight_seam from 706 to 718 bytes in the Rust golden, with a written cause and an executing differential proving the new bytes correct. It did not know this second copy existed.

Main went red for five consecutive merges — 4a3f6080 through 65d6df39, the release commit and its cold-review follow-up included — with the differential reporting:

flight_seam.wasm    e47705fd59f6  len=718   MISMATCH <--
VIOLATION: 1 check(s) failed.

That is not a compiler regression. It is one source of truth moving and the other not.

Exactly one of the four mirrored anchors was stale, which is what makes this class dangerous: three of four kept agreeing, so nothing looked systemically wrong.

control_step.wasm       8b3f1f6fe3a4  present in the golden: True
flight_seam.wasm        e7152735df88  present in the golden: False   <-- stale
flight_seam_flat.wasm   5a5d67577254  present in the golden: True
signed_div_const.wasm   b277453b7829  present in the golden: True

Why this is a named defect and not a chore

CLAUDE.md's first invariant is "derive what you check against from the artifact you ship" and records that the same failure was invented locally three times before anyone named it. This is a fourth instance, in a file whose own comment advertises that it is a manual sync.

The stale value has been corrected so the oracle is green again, and the header now says the mirror is the defect. But the fix is for the differential to read the goldens rather than copy them.

Interim check, until it does

grep -o '"[0-9a-f]\{64\}"' crates/synth-cli/tests/frozen_codegen_bytes.rs

Every hash in the differential's FROZEN list must appear in that output. A hash present in the mirror and absent from the golden is a stale mirror, not a regression — and telling those apart from the failure message alone currently costs a full local reproduction.

Related

A second-order finding from the same incident: this oracle is not a required status check, and the merge ritual that gates these merges only counts checks that have already reported fail. A pending non-required check is invisible to it, which is how five merges landed on a red main.

Found by the v0.66 release loop while verifying the tag candidate. Attribution: the maintainer's autonomous loop (same avrabe account).