Wave Loop 582 — the last open defect closes: right idea, wrong shape

[gHashTag]

☣️ [VERDICT]

Prop. 25b stood open for eight waves: with nothing requiring a DMA first, the MAC could consume an activation buffer nothing had written. Wave 574 tried three interlocks and withdrew all three. Every one was the right idea in the wrong shape — and the shape only became visible once the counterexample could be read.

Wave 574's blocker had already dissolved

All three attempts broke the baseline — the design stopped proving with no property of ours involved — and that was never explained. Re-applying the same interlock to today's design: the baseline proves. Nothing was done to fix it directly; it went away with the three DMA defects closed in waves 578–581.

A blocker recorded rather than forced can dissolve on its own. Prop. 25's discipline — record, do not weaken — cost three withdrawn patches and bought a clean re-attempt eight waves later.

Necessary, and insufficient

With input_loaded gating start, the baseline proves and all 22 properties hold — and 25b still refuted. One query against the trace reader:

 t  input_loaded  use_buffer_a  fv_wrote_a  fv_wrote_b  act_word_valid  mac_valid_q
31            1             1           1           0               0            0   layer 0 done
32            1             0           1           0               0            0   ping-pong flips
37            1             0           1           0               0            1   MAC reads B

Layer 0 completed having emitted no activation words at all. That is legal — a zero-neuron layer completes immediately by design (Prop. 26). The buffers flip, and layer 1 reads one nothing ever wrote.

A global flag cannot answer a per-buffer question

input_loaded asks did anything get written. The property asks was the buffer this layer reads written. No tuning of a single bit answers the second. Two real registers wrote_a/wrote_b, set by the actual write enables, do — exactly the shape predicted in wave 574's open-questions note and not attempted until the counterexample made it obvious.

Error, not stall

Refusing to start a layer whose buffer is unwritten would hang the engine on a legitimately empty layer, and a stalled engine satisfies every safety property. So the layer isn't started and buffer_unwritten drives the error IRQ that Prop. 29c gave a driver. All liveness witnesses still refute: the engine works.

The gate did its job

Prop. 25b was gated as an expected refutation so that closing it would turn the build red and demand promotion. That is precisely what happened. The property now lives in the default set — 23 integration properties, all proving — passes the vacuity oracle, and the gate is replaced by one asserting no expected-refutation guard remains.

33 propositions · 33 gates · 1213 passed, 0 failed · seals 496/496 · no known defect open in the engine.

---

Three variants for the next wave

A — Read-side pairing. Every property constrains writes. The mirror hazards are unchecked: a read-enable held across states (the exact shape of the Prop. 32 defect), a read address sampled a cycle off, or a read of a slot within a layer before that layer wrote it. This is the largest remaining unexamined surface.

B — Audit every strobe in the bundle. local_we was a level pretending to be a pulse. Small, mechanical class: every output reg used as a valid/enable, checked for a default assignment outside the state that sets it. Second sighting of a shape is the trigger, and this is the first — but the class is cheap to enumerate.

C — Raise the bound and re-run everything. Every engine property proves at -seq 40 with DEPTH 4. Prop. 29a showed a bounded proof can be vacuous when the counterexample lies beyond the bound. Re-run the full set at a substantially higher depth and a larger memory, and report which properties still prove — turning "proved at this scale" into a measured curve rather than a fixed claim.