Severity: P3 · Area: 11 (Collapse), 2 (Topology invariants)
Location: src/ts_tree.cpp:286-298 (the audit comment, scoped to score_tree / fitch_na_score only); whole-row memcmps at src/ts_collapsed.cpp:125, :130, :132-133; zeroing relied upon at src/ts_tree.cpp:39-45
Verified REAL as a latent-risk/documentation item — nothing is wrong today (haiku verifier). T-261 removed the std::fill zeroing from reset_states on the argument that "every array entry that is read by score_tree() / fitch_na_score() is written before it is read", and that audit is correct for those two functions. But the collapse kernels compare whole rows (word_bytes = tw * sizeof(uint64_t)), which spans the SIMD pad word, ratchet-zeroed blocks' words, and — for down2 / subtree_actives — non-NA blocks' words inside an NA dataset, none of which any pass ever writes. Sound only because init_from_edge does .assign(..., 0ULL) once at construction. Add the collapse kernels to that audit list before any further T-261-style de-zeroing. Related note for the same fixer: the one-sidedness argument at src/ts_collapsed.cpp:116-122 (T-382) reaches the right conclusion by the wrong reasoning — it claims staleness only makes equality harder, but the stale words are all-zero whenever the block was never active, and non-NA blocks' down2 / subtree_actives are never written at all, so equality is made easier. Still safe (a zero-weight block should be ignored by the collapse decision), but the comment does not describe the case that actually occurs.
Migrated 2026-08-04 from dev/red-team/findings.md; pre-tracker ID T-411. References to T-411 in source comments, dev/red-team/log.md, commit messages and PR bodies mean this issue — see dev/red-team/migration-map.tsv. Cross-repo references use the fully-qualified form agent-issues/TreeSearch#<n>; a bare #n means this repo.
Severity: P3 · Area: 11 (Collapse), 2 (Topology invariants)
Location:
src/ts_tree.cpp:286-298(the audit comment, scoped toscore_tree/fitch_na_scoreonly); whole-rowmemcmps atsrc/ts_collapsed.cpp:125,:130,:132-133; zeroing relied upon atsrc/ts_tree.cpp:39-45Verified REAL as a latent-risk/documentation item — nothing is wrong today (haiku verifier). T-261 removed the
std::fillzeroing fromreset_stateson the argument that "every array entry that is read byscore_tree()/fitch_na_score()is written before it is read", and that audit is correct for those two functions. But the collapse kernels compare whole rows (word_bytes = tw * sizeof(uint64_t)), which spans the SIMD pad word, ratchet-zeroed blocks' words, and — fordown2/subtree_actives— non-NA blocks' words inside an NA dataset, none of which any pass ever writes. Sound only becauseinit_from_edgedoes.assign(..., 0ULL)once at construction. Add the collapse kernels to that audit list before any further T-261-style de-zeroing. Related note for the same fixer: the one-sidedness argument atsrc/ts_collapsed.cpp:116-122(T-382) reaches the right conclusion by the wrong reasoning — it claims staleness only makes equality harder, but the stale words are all-zero whenever the block was never active, and non-NA blocks'down2/subtree_activesare never written at all, so equality is made easier. Still safe (a zero-weight block should be ignored by the collapse decision), but the comment does not describe the case that actually occurs.Migrated 2026-08-04 from
dev/red-team/findings.md; pre-tracker ID T-411. References toT-411in source comments,dev/red-team/log.md, commit messages and PR bodies mean this issue — seedev/red-team/migration-map.tsv. Cross-repo references use the fully-qualified formagent-issues/TreeSearch#<n>; a bare#nmeans this repo.