`TS_SECT_COLREDUCE` per-sector reducer leaves per-pattern arrays stale — inert under the EW-only gate, would be a live wrong-score + OOB bug if the gate is ever loosened toward IW/weighted

[ms609]

Severity: P3 · Area: 3 (Ratchet/Perturbation)

Location: src/ts_sector.cpp:315-317 (EW-only gate), :407-411 (stale-array copy in reduce_sector_columns_ew)

The new opt-in per-sector column-axis reducer (830b8cc3, TS_SECT_COLREDUCE, default-OFF) rewrites pattern_index to identity (0..nchar-1) but leaves n_patterns / min_steps / pattern_freq / precomputed_steps at full-dataset size and content (unmodified copy), and additionally leaves the newer per-block plane_state field zero-initialized (CharBlock cb{} at ts_sector.cpp:362 never assigns it, even though the reducer repacks planes into a new layout — added 2026-07-24 area-5 round as PACK-COLRED-01, verified REAL-but-inert by haiku; its only consumer ts_na_debug_char at ts_rcpp.cpp:494 is NA-only and builds a fresh full dataset, never a reduced one, so it is never read on this EW path). Inert today (verified): a hard gate at :315-317 restricts the reducer to pure EW — scoring_mode==EW && all_weight_one && no block has upweight_mask/has_inapplicable — and the EW scorers actually invoked on the reduced sector (fitch_score→fitch_downpass/fitch_uppass, fitch_indirect_length_cached, ts_fitch_combine, fitch_score_ew+ew_offset) read only block structure (active_mask/n_states/block_word_offset/weight/upweight_mask), never those four per-pattern arrays. So the stale arrays are never read on this path. Why filed (tripwire, not a live bug): if the EW gate is ever loosened toward IW/weighted, or the reducer is reused for a mode that reads pattern_freq/min_steps, the identity pattern_index + stale pattern_freq/min_steps would give wrong weighted scores AND a possible OOB read (min_steps/precomputed_steps stay sized for the OLD n_patterns, which can exceed the reduced char count). Filed P3 because a concurrent session is actively extending ts_sector (mission-b speed work) — this is exactly the gate a perf change might widen. The firewall (full-dataset score_tree on splice-back accept, see area-3 round 2026-07-24) still catches the returned score even if this breaks; direct impact would be search-quality/OOB inside a sector. Fix if the reducer is generalised: rebuild n_patterns/min_steps/pattern_freq/precomputed_steps/plane_state to the reduced character set, not just pattern_index. Verified REAL (haiku): stale-array copy + EW-only gate + scorer array-independence all confirmed; inert under current gates.

---

Migrated 2026-08-04 from dev/red-team/findings.md; pre-tracker ID T-335. References to T-335 in source comments, dev/red-team/log.md, commit messages and PR bodies mean this issue — see dev/red-team/migration-map.tsv. Cross-repo references use the fully-qualified form agent-issues/TreeSearch#<n>; a bare #n means this repo.