Reduce hand-rolled code: replace objdump scraping in audit vectorization with object + yaxpeax, and audit the workspace for accidental reinvention

[tamashi095]

Why

The owner's stance, stated 2026-09-04 while verifying PR #373:

We don't have to be 100% dependency-free as long as the dependency is battle-tested, popular in the ecosystem, genuinely reduces a lot of error potential in our engine, and is able to compile to WASM. We should be spending most of our effort on audio and sound-related features, not these super low level mechanical issues.

The trigger: PR #373 (LANE-9, #372) went through three consecutive text-format bugs in tools/audit/src/vectorization.rs, a hand-rolled scraper of objdump output. A substring match fired on tbl and on *_block symbol names; the rewrite that anchored on the mnemonic then mistook the 8-character AArch64 encoding word for the mnemonic, so a real bl _memset_pattern16 inside probe_svf_simd4 on Darwin passed silently. None of these were logic bugs. All of them were "we parsed a text format we do not own".

This issue is the umbrella for replacing that kind of code with crates that meet the four criteria above. Part 1 is concrete and researched. Part 2 is a workspace-wide audit whose results will be appended when the sweep finishes.

Part 1: replace objdump text scraping in audit vectorization

Recommended stack (research report with comparison table, API sketch, measurements and sources: written 2026-09-04 by a Sonnet research agent, proof-of-concept compiled and run on x86_64 with rustc 1.97.1):

role	crate	version	license	downloads (total / 90d)	last release	maintainer
container + symbol table (ELF, Mach-O)	object	0.40.0	Apache-2.0 OR MIT	595.8M / 105.9M	2026-08-01	gimli-rs
match demangled Rust paths (legacy + v0)	rustc-demangle	0.1.28	MIT/Apache-2.0	548.7M / 85.7M	2026-07-08	rust-lang
x86_64 decoder	yaxpeax-x86	2.2.0	0BSD	615K / 115K	2026-07-05	iximeow (solo)
AArch64 decoder	yaxpeax-arm	0.4.0	0BSD	332K / 51.6K	2025-10-20	iximeow (solo)

All pure Rust, no C toolchain at build time. Trimmed dependency tree: 13 crates. Clean release build of the whole stack: ~5.7 s. The audit binary is a dev/CI tool, never render-reachable and never shipped, so docs/REALTIME_DEPENDENCY_POLICY.md does not apply; wasm32 support is not required for this part.

What the rewrite gives us

• Symbol bodies come from object's symbol table as exact byte ranges, not from <symbol>: header lines. Fail loudly on zero or multiple matches per probe name.
• Instructions are decoded into typed opcodes and operands. "Is this a call" becomes Opcode::CALL | Opcode::CALLF (x86) and Opcode::BL | Opcode::BLR (AArch64). "Is this a .4s vector op" becomes Operand::SIMDRegisterElements(SIMDSizeCode::Q, _, SIMDSizeCode::S) versus scalar Operand::SIMDRegister(SIMDSizeCode::S, _). YMM width is RegisterClass::width() == 32. No text, no dialects (GNU vs LLVM vs Apple syntax stop mattering).
• Both decoders are plain functions over byte slices with no cfg(target_arch). The x86 nightly can therefore decode a cross-compiled aarch64 artifact, which closes the "AArch64 is compile-checked only" caveat in VECTORIZATION.md. Cross-building the release audit binary for aarch64-unknown-linux-gnu and aarch64-apple-ios from x86_64 with the pinned toolchain was demonstrated during the LANE-9: Update the native vectorization allowlist to the unfused truth and forbid calls inside kernels #373 verification (about one minute each with rust-lld). The Darwin memset_pattern16 true positive would have been caught by CI instead of by someone running the script on a Mac.
• A byte sequence the decoder does not recognise returns a typed Err, never a fabricated opcode. The audit should treat a decode error inside a probe body as a hard failure.
• An AArch64 b used as a tail call becomes detectable: a B whose PCOffset target lands outside the probe's byte range is a probable tail call. Text scraping could not do this.

Compile both decoders unconditionally, not behind features. Measured: adding yaxpeax-arm next to yaxpeax-x86 costs ~69 KB of stripped binary and ~0.03 s of build time. A feature split would recreate inside the decoder the exact asymmetry that let the aarch64 path go untested.

Rejected

• capstone / capstone-sys and bad64 / bad64-sys: both compile vendored C at build time (cc::Build unconditionally; bad64-sys also needs bindgen/libclang). Disqualified on that alone.
• iced-x86: excellent and far more popular, but x86-only, so it does not reduce the crate count, and its Code enum bakes encoding form into variant names (VEX_Vmulps_ymm_ymm_ymmm256), a worse fit for the allowlist's mnemonic-family shape.
• disarm64: credible pure-Rust AArch64 fallback if yaxpeax-arm maintenance stalls; it also decodes SVE/SME, which yaxpeax-arm explicitly refuses with DecodeError::IncompleteDecoder. Younger, solo maintainer, operand shape baked into variant names.

Risks and mitigations

• Solo maintainer for the three yaxpeax crates, hosted on a self-hosted git server. Exact-pin versions as the workspace already does for sha2 and wide; vendor or mirror if the host ever becomes unreachable in CI; disarm64 is the documented AArch64 fallback.
• yaxpeax-arm does not decode SVE/SME. Our NEON kernels only need baseline .4s; a future SVE kernel would need disarm64 or an upstream fix.
• object needs .symtab. The release profile has debug = 1 and no strip, same assumption the current objdump path makes. Add a one-line comment at the profile site.
• Demangled-path suffix matching (v0 mangling adds crate disambiguators): assert exactly one match per probe, as certify() already does for missing symbols.
• No explicit rust-version on the yaxpeax crates; object declares 1.85. All build on the pinned 1.97.1. Exact pins protect against implicit MSRV bumps.

Scope of the Part 1 PR

1. Owner ruling on the four crates above (this issue is that ruling once accepted).
2. Rewrite symbol_bodies / certify in tools/audit/src/vectorization.rs on object + yaxpeax; keep the TSV format and the report JSON schema; keep the unit tests' shape but feed them bytes, not text.
3. Add a cross-compile step to the nightly (--target aarch64-unknown-linux-gnu, link with rust-lld and stub libs or emit objects) and run the AArch64 rows from that artifact on the x86 runner. Retire the "compile-checked only" sentence in VECTORIZATION.md.
4. Extend scripts/test-native-vectorization-report.sh mutations to byte-level injection (patch a call/bl encoding into a copy of the artifact) and assert the failure class.
5. Land after LANE-9: Update the native vectorization allowlist to the unfused truth and forbid calls inside kernels #373 merges; do not fold this into LANE-9.

Part 2: workspace-wide audit of hand-rolled code

A Fable agent is sweeping the workspace for accidental reinvention of well-known formats and algorithms (hand-written JSON writers, CLI arg loops, error boilerplate, hex/base64, ring buffers and atomics protocols, FFT/resampling, test harness machinery, WASM glue). Each candidate is checked against: crates.io downloads, maintainer, license, MSRV vs 1.97.1, wasm32-unknown-unknown support, whether it would enter the render path (must be alloc-free and lock-free there or it is out), the concrete error potential removed, and effort. Contract-driven hand-rolling (unfused fma, flush-to-zero, bit identity across scalar/W4/W8/wasm, the realtime zero-alloc path) is recorded as KEEP, not flagged.

Results will be appended to this issue as a comment when the sweep finishes, with a ranked table and a suggested first three.

Definition of done for this issue

• Part 1 landed and the nightly checks all six allowlist rows from one x86 runner.
• Part 2 results triaged into REPLACE / KEEP / DISCUSS with an owner decision on each REPLACE, and one child issue per accepted REPLACE.

[tamashi095]

Part 2 results: workspace-wide hand-rolled code audit

Full report from the Fable audit agent (2026-09-04, main @ c40c840, read-only). Ranked table first, then evidence per finding, then the KEEP list with the contract that justifies each, then a suggested first three.

---

Owner policy: "We don't have to be 100% dependency-free as long as the dependency is battle-tested, popular in the ecosystem, genuinely reduces a lot of error potential in our engine, and is able to compile to WASM. We should be spending most of our effort on audio and sound-related features, not these super low level mechanical issues."

Read first, in order: AGENTS.md, docs/REALTIME_DEPENDENCY_POLICY.md, docs/TARGET_MATRIX.md, the workspace Cargo.toml, all 46 crate manifests, Cargo.lock (263 packages). Direct external runtime dependencies today: wide =1.6.1 (lane), sha2 =0.11.0 (control plane + tools), jstrict =0.14.0 (session). Everything else is dev/tool-only (loom, serde_json, jsonschema, flatbuffers, wasmtime, libfuzzer-sys). bytemuck is present only transitively via wide.

Executive summary

1. This workspace is unusually disciplined: the render plane (engine, lane, math, effects) contains no accidental reinvention. Every hand-rolled DSP or concurrency primitive I checked carries a contract comment (bit identity D5, unfused D3, FTZ D7, no-unsafe-in-realtime) and a gate that would catch a regression. Those are KEEPs with evidence, listed at the end.
2. The accidental reinvention that does exist lives almost entirely in tools/ and is small: a 140-line hand-written SHA-256 in tools/bench/src/session.rs while bench_support::digest::sha256_hex (a sha2 wrapper) is one import away, and a two-character JSON escaper in tools/audit/src/vectorization.rs that is the exact bug class audit 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F4 already fixed nine copies of.
3. tools/parameter-metadata emits two shipped SDK JSON documents through ~360 lines of push_str/format! with no serde_json; it is the one hand-rolled serializer in the tree with no stated rationale.
4. The single largest policy mismatch is not hand-rolling but its inverse: jstrict, the sole runtime JSON acceptance parser for every shipped host (native, mobile, wasm), has 296 total downloads, one owner, was first published 2026-07-25, carries 26 unsafe sites in 10.3k lines, and pulls nine crates into the wasm artifact. Under "battle-tested, popular" it needs a ruling; the upstream it forks (json-syntax, 3.45M downloads, API-identical per the fork's README) is a low-effort fallback.
5. ~35 hand-rolled std::env::args() loops across ~22 tool files are a maintenance tax, not a correctness risk; lexopt/pico-args would own them opportunistically.
6. SplitMix64 is copied ~15 times and xorshift64* ~10 times; the algorithm is bit-frozen so consolidation (on conformance::SplitMix64 or rand_xoshiro::SplitMix64, which is the identical recurrence) moves no digest.
7. Serialization-adjacent hand-rolls that look replaceable but are contract-bound and correctly so: the session canonical JSON writer (documented as not-serde in SESSION_SCHEMA_V1.md), the 25k-line BTLV protocol, the three effect-package wire formats, the RF64/WAVE decoder, the offset_of!-driven ABI layout generator.
8. Candidate crates that would enter the render path (rtrb, ringbuf, seqlock, arc-swap) are alloc-free where it matters, but the in-tree SPSC/seqlock/plan-exchange are Loom-modelled on the real code, layout-pinned by resource fixtures and inspected for wasm no-atomics; swapping removes no demonstrated error and costs L. KEEP.
9. Three things to do first, all S effort and zero risk: delete the private SHA-256, route the vectorization escaper through bench_support::json::escape, and open the jstrict ruling with the json-syntax fallback measured.
10. Corroboration: today's independent test-usefulness ledger (docs/audits/test-usefulness-2026-09-04/03-compilers-hosts-tools.md:236) reached the same conclusion on the hand-rolled SHA-256.

Ranked table

#	Location	What	Candidate crate	wasm-ok	Render path	Effort	Verdict
1	tools/bench/src/session.rs:446-585	Complete hand-written SHA-256 (~140 lines)	bench_support::digest::sha256_hex (already wraps sha2 0.11.0)	n/a (native tool)	no	S	REPLACE
2	tools/audit/src/vectorization.rs:293-295	JSON string "escaper" handling only \ and "	bench_support::json::escape (already a dependency)	n/a (native tool)	no	S	REPLACE
3	tools/parameter-metadata/src/lib.rs:129-273, src/abi_layout.rs:~435-650	Hand-assembled JSON documents (96 push_str/format! sites, ~360 lines) shipped as sdk/assets/*.json	serde_json 1.0.151 (preserve_order)	n/a (native build tool)	no	M	REPLACE
4	crates/session/Cargo.toml (jstrict =0.14.0)	Sole runtime JSON parser in every shipped host; 296 downloads, 6 weeks old, 26 unsafe	json-syntax 0.12.5 (upstream, API-identical) or serde_json + visitor	yes (all options)	no (control plane)	S–M / L	DISCUSS (policy inverse)
5	~22 files under tools/, crates/*/src/bin, crates/*/examples	~35 hand-rolled env::args() parsers, 8–70 lines each	lexopt 0.3.2 (0 deps) or pico-args 0.5.0	n/a	no	M (many small sites)	DISCUSS
6	tools/audit/src/fixture_builtins.rs:1964-2130, 2675-2870, 4074-4130	Hand [[case]] TOML block parser, substring JSONL field extractor beside a real JsonParser, positional CSV parser	toml 1.1.5, serde_json	n/a	no	M	DISCUSS
7	15 SplitMix64 + ~10 xorshift64* copies (list below)	Duplicated test/corpus PRNGs	conformance::SplitMix64 (in-tree) or rand_xoshiro 0.8.1	yes	no (corpus/test)	S–M	DISCUSS (consolidate)
8	hosts/host-web/web/miso-engine-v1-audio-worklet{,-host}.js:20,51	COMMAND_RECORD_BYTES = 48 and sibling ABI literals typed by hand in shipped JS, outside the offset_of! generator	emit a constants prelude from abi_layout.rs; no crate	yes	no	S	DISCUSS (codegen gap)
9	crates/conformance/src/fixture.rs:185-197	Bitwise CRC-32C, 12 lines, vector-tested	crc32c 0.6.8	yes	no	S	KEEP
10	crates/effect-package/src/cid.rs:130-179	CIDv1 prefix + RFC 4648 base32 (60 lines, official vectors)	cid 0.11.3 + multibase 0.9.3	yes	no	S	KEEP
11	crates/math/src/vendored/* (5.3k lines)	Vendored libm 0.2.16 with target-conditional paths removed	libm 0.2.16	yes	yes	M	KEEP (contract)
12	crates/engine/src/realtime/{spsc,observe,plan_exchange,disjoint}.rs	SPSC ring, safe-Rust seqlock, plan swap/retirement, disjoint arena	rtrb, seqlock, arc-swap, triple_buffer	mixed	yes	L	KEEP (contract)
13	crates/protocol/src/* (25k lines)	BTLV caller-buffer binary codec	postcard, flatbuffers	yes	no	L	KEEP (contract identity)
14	crates/session/src/{canonical,value,json_preflight}.rs	Canonical JSON writer, f32 spelling, duplicate-key/depth preflight	serde_json, ryu	yes	no	M	KEEP (documented)
15	crates/source/src/native_wave.rs (~950 prod lines)	RIFF/RF64/ds64/EXTENSIBLE decoder, bounded, seekable	hound 3.5.1, symphonia	n/a (native only)	no (worker)	L	KEEP
16	crates/graph-compiler/src/schedule.rs:9-278	Kahn topo levels, cycle witness, linear-scan buffer colouring	petgraph	yes	no	M	KEEP (determinism #99 F1)
17	crates/capi/include/miso_engine_v1.h + src/abi.rs	Hand-written C header + offset_of! tests + C _Static_assert consumer	cbindgen 0.29.4	n/a	no	M	KEEP
18	hosts/host-web/src/ffi.rs, tools/parameter-metadata/src/abi_layout.rs	25 hand extern "C" exports, offset_of!-generated ABI JSON, independent Python validator	wasm-bindgen, ts-rs	yes	no	L	KEEP (documented)
19	tools/bench-support/src/{timing,stats}.rs	Single-shot timer with hash-outside-timer invariant; nearest-rank percentile	criterion, divan	n/a	no	L	KEEP (AGENTS.md benchmark rule)
20	scripts/test-*.sh (30 files, 5.7k lines)	sed-mutate-and-expect-red harnesses for the policy checkers	cargo-mutants	n/a	no	—	KEEP (no crate owns this)

Ranking within REPLACE is by error potential removed per unit of effort; #1 and #2 are near-zero effort and remove a live divergence, #3 is a medium re-pin with moderate upside. #4 is ranked above the remaining DISCUSS items because it is the only finding that touches every shipped artifact.

---

Findings

1. REPLACE — hand-written SHA-256 in tools/bench/src/session.rs

• Location / size. /home/bl/misofm/engine/tools/bench/src/session.rs:446-585, ~140 lines: INITIAL, the 64-entry K table, message schedule, compression loop, padding, hex rendering. Unit-tested against the "abc" vector at line ~637.
• What it does. Hashes the canonical session bytes for the benchmark record's identity field.
• What already exists. /home/bl/misofm/engine/tools/bench-support/src/digest.rs:71-73 exports pub fn sha256_hex(bytes: &[u8]) -> String over sha2::Sha256::digest. tools/bench/Cargo.toml already depends on bench-support (and on sha2 directly, unused in this file). session.rs line 3 already imports bench_support::json::escape.
• Crate facts. sha2 0.11.0 — RustCrypto, 905M downloads, MIT OR Apache-2.0, released 2026-03-25, MSRV 1.85, pure Rust, compiles to wasm (irrelevant here: bench is a native tool). Already approved in REALTIME_DEPENDENCY_POLICY.md ("Issue 011 runtime boundary and issue 029 package hashing dependency").
• Error potential removed. A private cryptographic primitive with a single test vector, in a record whose identity field is compared across machines. More concretely, the reason it exists appears to be a policy grep: scripts/check-bench-policy.sh:57 fails any "converted subject" that matches Instant::now|Sha256::new|sha2::, so a subject that needs a one-shot digest and does not know about bench_support::digest::sha256_hex is pushed toward writing its own. Today's test ledger reached the same verdict: docs/audits/test-usefulness-2026-09-04/03-compilers-hosts-tools.md:236 — "sha half pins a hand-rolled SHA-256 (L446-585) ... DELETE 1 after replacing the private SHA-256 with bench_support::digest::sha256_hex (the F4 'second copy' check-bench-policy.sh cannot see)".
• Render path. No.
• Effort. S: delete lines 446-585, use bench_support::digest::sha256_hex, keep or drop the "abc" test. Consider extending the check-bench-policy.sh sole-owner rule (line 40 covers struct Sha256Sink only) to also refuse const K: [u32; 64]-shaped tables or the string 0x6a09e667 outside bench-support.
• Adjacent literal duplicates in the same crate (no crate needed, fold into the same PR). physical_core_count() is byte-identical in tools/bench/src/session.rs:423-434 and tools/bench/src/conformance.rs:319-330; format_f64/microseconds/Percentiles are identical in tools/bench/src/console.rs:1700-1709 and tools/wasm-console/src/main.rs:848-855. Both belong in bench-support next to stats.rs.

2. REPLACE — incomplete JSON escaper in tools/audit/src/vectorization.rs

• Location / size. /home/bl/misofm/engine/tools/audit/src/vectorization.rs:293-295:

  fn json_string(value: &str) -> String {
      format!("\"{}\"", value.replace('\\', "\\\\").replace('\"', "\\\""))
  }

  Used at line ~381 to emit a failure string that is built from external objdump/demangled symbol text.
• What already exists. /home/bl/misofm/engine/tools/bench-support/src/json.rs:16-36, pub fn escape — RFC 8259 §7 complete, with tests. tools/audit/Cargo.toml already depends on bench-support.
• Error potential removed. The file header of json.rs is the evidence: "Audit 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F4 found nine copies. Two of them were wrong: rack-bench escaped only " and \ and passed control characters through raw ... so a backslash or a control character in any environment value produced a record that no validator could parse." This copy is that exact shape. It survived the consolidation because scripts/check-bench-policy.sh:36-37 enforces sole ownership with the regex ^(pub )?fn (json_)?escape\(, and this function is named json_string. Its output is validated only by an rg pattern in scripts/test-native-vectorization-report.sh:38, never by a JSON parser, so a control character in a symbol name would produce an unparseable report that the test would not notice. The file was introduced by Draft: preserve legacy research and expose #144 gate blockers #145 (9be15c0e), i.e. it is a genuine regression relative to 104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104, not a pre-existing copy.
• Crate facts. None needed; the in-tree escaper is the replacement. If the owners ever want to stop maintaining the escaper, serde_json::to_string(&str) produces the same escapes (it also escapes U+007F? No — serde_json escapes only <0x20, " and \, identical to bench_support::json::escape).
• Effort. S. Also worth widening the sole-owner regex to fn json_(string|escape|quote)\(.

3. REPLACE — hand-assembled JSON documents in tools/parameter-metadata

• Location / size. /home/bl/misofm/engine/tools/parameter-metadata/src/lib.rs:129-273 (render(), ~145 lines, 59 push_str/format! sites) and /home/bl/misofm/engine/tools/parameter-metadata/src/abi_layout.rs:~435-650 (render(), 37 sites), plus helpers comma(), number() (lib.rs:279-289, formats f32 with {value:?} and appends .0), optional_number(). Output: sdk/assets/miso-engine-v1-parameter-metadata.json and sdk/assets/miso-engine-v1-abi-layout.json, consumed by sdk/codegen/generate.mjs (JSON.parse) to produce sdk/src/generated/{catalog,abi}.ts.
• What it is. The only hand-rolled JSON producer in the tree with no stated rationale (the WASM sweep confirmed: ffi.rs explains why no catch_unwind, abi_layout.rs:1-17 explains why offset_of!, nothing explains why not serde_json). Cargo.toml has no serde/serde_json. --check (lib.rs:712-742) compares bytes with the committed file; it never re-parses. Structural validation happens in scripts/check-parameter-metadata-v1.py and scripts/check-abi-layout-v1.py (both json.loads, both with --self-test).
• Crate facts. serde_json 1.0.151 — dtolnay, 1.255B downloads (297M last 90 days), MIT OR Apache-2.0, released 2026-07-20, MSRV 1.71. Already in Cargo.lock as a dev-dependency of session, native-pcm-runner, session-validator, so no new transitive tree. Native build tool only; wasm irrelevant.
• Error potential removed. Missing/extra commas, unescaped strings, and mis-nesting in two shipped documents. Today CI catches malformed JSON only downstream (Python validators, generate.mjs); a #[derive(Serialize)] model catches it at the type level and lets the SDK generator and the Python validators share one schema source. The commandReasons table in lib.rs carries the Web host .d.ts omits observe() and the subscription-map types (#143 follow-up) #151 comment: a vocabulary drift between five hand-written spellings "killed the whole host with a sticky 255". A typed serializer does not fix vocabulary drift by itself, but it removes one of the five hand spellings.
• Constraints the swap must respect (this is why it is M, not S). (a) The documents are byte-pinned: any change to key order, indentation or number spelling is a re-pin of both committed JSON files, catalog.ts, abi.ts, and the check-web-audioworklet.sh:361 --check gate. serde_json with preserve_order + to_string_pretty gives 2-space indentation and insertion order; expect a one-time diff. (b) Number spelling: number() uses Rust {:?} for f32; serde_json uses ryu for f32 directly. Both are shortest-round-trip, but exponent thresholds differ (Rust switches to 1e-7 below 1e-5 and above 1e16; ryu's format_finite uses its own thresholds), so a few lattice rows may respell. Either accept the re-pin or keep number() and emit numbers via serde_json::value::RawValue. (c) The two Python validators are deliberately "a second implementation"; they stay.
• Effort. M (a day: model structs, preserve_order, re-pin, run the three gates).

4. DISCUSS — jstrict is the opposite of "battle-tested, popular"

This is outside the literal brief (it is a dependency, not hand-rolled code) but squarely inside the policy quoted above, and it touches every shipped artifact, so it is ranked here.

• Facts (verified 2026-09-04 against crates.io and the local registry source). jstrict 0.14.0: 296 downloads total (all in the last 90 days), versions 0.13.0 and 0.14.0 only, crate created 2026-07-25, single owner mskvarc, MIT OR Apache-2.0, MSRV 1.96. Entered the manifest 2026-09-03 in 337bd33b feat(#338). Local source: 10,315 lines, 26 unsafe sites (src/number/mod.rs 15, src/parse/slice.rs 3, src/print/mod.rs 3, src/object/mod.rs 2, src/unordered.rs 1, src/lib.rs 1, src/parse/number.rs 1); only one is behind a feature gate (canonicalize). With default-features = false the session crate still pulls, into the wasm artifact, decoded-char, hashbrown 0.17.1, json-escape-simd, lexical 7.0.5 → lexical-core 1.0.6 (five sub-crates), locspan, memchr, smallstr, smallvec, utf8-decode (per cargo tree -p session -e normal). Advisory check: lexical-core RUSTSEC-2023-0086 is patched >= 1.0.0 (locked 1.0.6 is clear); hashbrown RUSTSEC-2024-0402 was patched in 0.15.1 (locked 0.17.1 is clear); the four historical smallvec advisories predate 1.x.
• What it is. Per its README ("Why this fork"): a performance fork of json-syntax by Timothée Haudebourg — "Semantics are unchanged — same strictness, same Value, same CodeMap" — adding a byte-slice parser, SWAR/memchr scanning, hashbrown key index, lexical number parsing, and folding json-number in. json-syntax 0.12.5: 3.45M downloads (701k last 90 days), last release 2024-07-03, maintained by the ssi/JSON-LD author.
• Why it was chosen (recorded rationale). .github/ISSUE_SPECS/338-...md:500-505: it "preserves raw numeric source spans through its byte-based CodeMap; the typed walk therefore applies the existing exact-f32 reader to the original lexeme rather than an intermediate f64." No alternative-parser comparison is recorded in Make canonical JSON the sole Session V1 document format #338, SESSION_SCHEMA_V1.md, or REALTIME_DEPENDENCY_POLICY.md ("Issue 004 control-plane parser dependencies" describes the dependency but not the selection).
• How much of the API is load-bearing. crates/session/src/parse.rs imports jstrict::{CodeMap, Object, Parse, Value, array::JsonArray} and uses Value::parse_str (line 580) plus code_map[offset].span for SourceSpan (62 mentions). json_preflight.rs uses jstrict::parse::parse_str_value once, to decode a key string. The spans reach Diagnostic.span: Option<SourceSpan> and are asserted in crates/session/tests/json_grammar.rs (14) and diagnostic_parity.rs (5). They do not cross a host boundary: crates/host-core/src/diagnostics.rs:89-115 encodes only code\tpath\n, and no Rust code outside session, no hosts/host-web/web/*.js, and no sdk/src/** consumes a session span.
• What jstrict does not give them, and they wrote anyway. json_preflight.rs (202 lines) exists because the parser reports neither duplicate keys nor depth. serde_json would not report duplicates either (last wins) but does enforce a 128 recursion limit by default, which happens to equal MAXIMUM_JSON_DEPTH.
• Options.
  • (a) Pin to upstream json-syntax 0.12.5. Same Value/CodeMap/Parse API per the fork's own claim, 11x the downloads and a two-year track record, no lexical/hashbrown/json-escape-simd in the artifact. Cost: char-iterator parser is slower (irrelevant on the control plane at Boot v2: single-verb engine boot — boot(document, options), self-configuration, parse metering (#239 Phase 1) #240's parse budget unless measured otherwise) and its number type comes from json-number (also Haudebourg). Effort S–M: rename imports, re-run crates/session tests, re-measure the Boot v2: single-verb engine boot — boot(document, options), self-configuration, parse metering (#239 Phase 1) #240 boot-transient budget, re-run the wasm size gate. This is the fallback to measure first.
  • (b) serde_json + arbitrary_precision + preserve_order with a Visitor-based walk. 1.255B downloads, dtolnay, already in the lock. Exact-f32 from the lexeme is preserved (arbitrary_precision keeps the number string). Byte spans are lost, so the 19 span assertions and SourceSpan become path-only; duplicate-key detection must move into a MapAccess visitor. Effort L (rewrite of the 1.4k-line typed walk's substrate) for the same functional result — not recommended unless (a) fails a measurement.
  • (c) Keep jstrict, own the risk explicitly: record the selection rationale and the unsafe inventory in REALTIME_DEPENDENCY_POLICY.md, add it to the fuzz/ targets (the session_parse fuzz target already exercises it), and revisit at 0.15.
• Verdict. DISCUSS, owner ruling required. The policy sentence that matters is "popular in the ecosystem"; 296 downloads with one downstream (this repo) is not that, whatever the code quality. Option (a) is cheap enough to measure before the ruling.

5. DISCUSS — ~35 hand-rolled CLI parsers

• Locations. grep -rn 'env::args' crates hosts tools → 35 sites in ~22 files. Representative sizes: tools/native-pcm-runner/src/lib.rs:121-165 (44 lines, 4 required flags, typed RunnerError codes for missing/duplicate/unknown), tools/parameter-metadata/src/lib.rs:697-745 (~50 lines, 4 modes), tools/audit/src/unfused_fma.rs:1257-1295 (~40 lines), tools/wasm-gates/src/main.rs:53-118 (~65 lines; matches on arguments.len() == 7 && arguments[1] == "--wasm-timing" && arguments[3] == "--expect-backend" && arguments[5] == "--round", so flag order is fixed and a reordering silently prints usage), and seven near-identical 8–12-line --blocks/--probe micro-parsers across tools/audit/src/{gate_expander,parametric_eq,graph,compressor,delay,builtins_graph,builtins}.rs. tools/audit/src/main.rs:106 and tools/bench/src/main.rs:98 are subject dispatchers that re-exec themselves, so each subject owns its own parser.
• Candidate crates. lexopt 0.3.2 — 12.3M downloads, MIT, zero dependencies, released 2026-02-28, no MSRV pin; pico-args 0.5.0 — 71.5M, MIT, zero deps, last release 2022-06 (stable, effectively frozen); clap 4.6.6 — 1.1B, MSRV 1.85, but a heavy tree for tools whose flags number 1–7. All tools are native-only; wasm is irrelevant. No shipped crate parses arguments.
• Error potential removed. Low per site (each parser is small and several have typed error codes and tests), moderate in aggregate: the order-sensitive wasm-gates matcher and the seven copy-pasted micro-parsers are the brittle spots. No CLI-related bug fix appears in git log.
• Effort. M only because of the count. Recommendation: adopt lexopt in tools/* on touch, starting with wasm-gates and the seven audit micro-parsers (one shared helper in tools/audit/src/record.rs would already remove six copies). Do not touch native-pcm-runner: its parser's error codes are part of NATIVE_PCM_REFERENCE_RUNNER_V1.md.

6. DISCUSS — hand parsers in tools/audit/src/fixture_builtins.rs (6,025 lines)

• Three formats, three hand parsers, one file.
  • cases.toml (fixtures/builtins/v1/cases.toml, genuine TOML with [[case]] tables): parsed at lines 1964-2130 by text.split("[[case]]\n") plus strip_prefix(key).strip_prefix(" = \"") line matching (~170 lines). It enforces canonical spelling (exact field order, parsed.to_string() == value), which a TOML crate would not.
  • JSONL records: two styles side by side. A real strict JsonParser (lines 2706-2800, ~100 lines, 4 call sites) that rejects non-ASCII, leading zeros, duplicate keys and trailing bytes; and substring extractors json_string_field/json_u64_field/json_u32_hex_field/json_u64_hex_field (lines 2675-2704, 11 call sites) that split_once("\"key\":\"") and split([',', '}']) — correct only because the records are canonical and flat.
  • reference/filter-response.csv: positional 14-field split(',') (lines 4074-4130) with parse_canonical_response_f64 requiring format!("{parsed:.17}") == value.
• Candidate crates. toml 1.1.5 (epage, 875M downloads, MSRV 1.76) for cases.toml; serde_json for the JSONL; csv 1.4.0 (BurntSushi, 238M) is overkill for a fixed 14-column file.
• Assessment. The canonicality checks are the point of this tool (it is the fixture checker), so a crate replaces the tokenizing, not the validation, and the file would shrink by perhaps 150 of 6,025 lines. The real error potential is the dual JSON style: the substring extractors should call the JsonParser that already exists ten lines below them. That is an in-tree fix (S), and the crate question is secondary (M, low value). Ranked below CLI parsing for that reason.

7. DISCUSS — SplitMix64 / xorshift64* copied across the workspace

• SplitMix64 (identical constants 0x9E3779B97F4A7C15, 0xBF58476D1CE4E5B9, 0x94D049BB133111EB): crates/conformance/src/prng.rs (the "one definition", 38 lines), crates/dsp-reference/src/signals.rs:67-82 (doc says "without depending on the conformance PRNG"), crates/lane/tests/support/mod.rs:44, crates/parametric-eq/tests/support/mod.rs:383-406, crates/true-peak-limiter/src/lib.rs:3258 and tests/{bench,gain_law}.rs, crates/rack/src/lib.rs:2190, crates/rack-compiler/src/lib.rs:527-533, crates/graph-compiler/src/lib.rs:9071, crates/session/tests/fuzz_smoke.rs:13, crates/effect-package/tests/effect_interchange_mutation.rs:13-20, tools/audit/src/fixture_builtins_listening.rs:238-248, tools/wasm-gate-corpus/src/lib.rs:818.
• xorshift64* (Vigna 2016) in nine crates/*/src/corpus.rs files (soft-clip, compressor, effect-runtime, math, builtins, transient-shaper, delay, multiband-compressor, true-peak-limiter) and a xorshift32 in gate-expander/src/corpus.rs:57-70, each with the same rationale comment ("defined entirely in terms of wrapping integer operations" so native and wasm agree).
• Candidate crate. rand_xoshiro 0.8.1 — rand-rs organisation, 121M downloads, MIT OR Apache-2.0, no_std, MSRV 1.85, released 2026-05-16. Its SplitMix64::next_u64 is the identical recurrence, so every SplitMix64-seeded corpus digest is unchanged by a swap; the f32 mapping (>> 40 scaled by 2^-24 etc.) is local and stays. There is no xorshift64* in the rand family (rand_xorshift is xorshift128), so those nine copies would consolidate onto one in-tree type, not a crate.
• Assessment. Zero correctness risk today (the algorithm is four lines and every copy is bit-frozen by a digest). The cost is that the corpus files are gated by scripts/check-* seals and a consolidation is a re-pin ceremony per crate. Recommendation: consolidate on conformance::SplitMix64 (already public) for the test/support copies, and leave the nine corpus.rs generators alone unless a corpus is being re-pinned anyway. rand_xoshiro adds no value over the in-tree type. S–M, low priority.

8. DISCUSS — ABI constants typed by hand in shipped JS

• Facts. COMMAND_RECORD_BYTES = 48 appears as a bare literal in /home/bl/misofm/engine/hosts/host-web/web/miso-engine-v1-audio-worklet.js:20 and /home/bl/misofm/engine/hosts/host-web/web/miso-engine-v1-audio-worklet-host.js:51 (both shipped) and in the deliberately independent test oracle hosts/host-web/tests/browser-v1/direct-oracle.mjs:16. The generator of truth is tools/parameter-metadata/src/abi_layout.rs (offset_of!, 650 lines), which exists because TypeScript SDK: @misofm/engine — typed control surface, dual runtime, agent-first #207 "counted five independent hand-written copies of the boot configuration table ... the fifth wrote a 192-byte struct's offsets into a 64-byte buffer and was silently producing garbage." The WASM sweep found no script that cross-checks the two shipped JS literals against abi_layout.rs/abi.ts (check-abi-layout-v1.py validates the JSON document; check-session-map-shape.py covers the source-map shape).
• Why no crate. The AudioWorklet global scope cannot import, so ts-rs/wasm-bindgen output could not be consumed there anyway; the fix is to have abi_layout.rs also emit a tiny miso-engine-v1-abi-constants.js prelude that build-web-audioworklet.sh prepends, or to add the two literals to check-session-map-shape.py's equality set. S.

---

KEEP list (deliberate, with the evidence that makes it deliberate)

• Vendored libm (crates/math/src/vendored/, 5.3k lines from rust-lang/libm 0.2.16): "Every target-conditional path, intrinsic fast path, force_eval! FP-flag statement and no_panic attribute has been removed, so the operation sequence is identical on x86_64, aarch64 and wasm32. That property is what gate M3 pins." The libm crate (448M downloads, same version) keeps those paths, so it would not give the same bits. Render-reachable. KEEP.
• SPSC ring / safe-Rust seqlock / plan exchange / disjoint arena (crates/engine/src/realtime/): Loom model instantiates the real ring (spsc.rs:14-17, 084 Audit: miso-engine-core (SIMD kernels, SPSC, plan lifetime) #84 phase B); header layout pinned by resource fixtures; observe.rs is deliberately unsafe-free so the realtime unsafe allowlist stays at two files; wasm no-atomics lowering inspected by check-wasm-realtime-atomics.sh. rtrb 0.4.0 (10.9M, alloc-free push/pop) could technically live in the render path, but it offers none of the retained-payload accounting, LocalRing, or generation tagging, and the swap removes no demonstrated error. KEEP.
• BTLV protocol (crates/protocol, 25k lines): a frozen wire identity ("MISO Control BTLV v1"), caller-buffer, alloc-free encode/decode, benchmarked against flatbuffers by design in tools/bench/src/protocol.rs. postcard/serde would change the bytes. KEEP.
• effect-package wire/package/state formats (MISOEFD1/MISOEPKG/MISOEFST, byte-offset tables documented in-file, CIDv1 over canonical bytes): contract identity; cid+multibase would replace 60 tested lines with a multiformats tree. KEEP.
• Session canonical writer, f32 spelling, preflight (crates/session/src/{canonical,value,json_preflight}.rs): SESSION_SCHEMA_V1.md:10 — "Canonical output is defined by the schema walk, not generic map order, RFC 8785/JCS, or a serde serializer." write_f32 uses std Display, which is already shortest-round-trip; ryu adds nothing. The preflight's cost belongs to the parser choice (finding 4). KEEP.
• RF64/WAVE decoder (crates/source/src/native_wave.rs): RIFF+RF64+ds64+WAVE_FORMAT_EXTENSIBLE, odd-chunk padding handled (line ~519), bounded metadata skip, generation-tagged seeks, frozen diagnostic codes. hound 3.5.1 (17.5M, last release 2023-09) has no RF64/ds64 and no streaming/seek contract; symphonia allocates. Tool-side WAV writers in tools/audit deliberately emit malformed containers (duplicate data, truncated RF64) that no writer crate can produce. KEEP.
• CRC-32C (crates/conformance/src/fixture.rs:185-197): 12 lines, Castagnoli polynomial, vector-tested; fixtures are capped at 1M frames so the bitwise loop is fine. Note that crc32fast is IEEE, not Castagnoli; the correct crate would be crc32c 0.6.8. KEEP.
• Graph schedule (crates/graph-compiler/src/schedule.rs): "Levels are emitted in ascending node-ID order and the sequential schedule is their concatenation -- the contract graph binding enforces (099 Audit: miso-engine-graph-compiler (level-order bug, plan lowering, cohort duplication) #99 F1)." petgraph::toposort emits no levels and orders by internal index. The linear-scan buffer colouring is the render arena's aliasing law. KEEP.
• Half-band / BS.1770 Annex-2 FIR / van Herk sliding minimum / time-constant coefficient forms (crates/lane/src/kernels/halfband.rs, crates/true-peak-limiter/src/lib.rs, crates/compressor/src/design.rs): frozen tap tables with citations, bit-identity proofs (soft-clip/tests/polyphase_identity.rs), and a documented, audited coefficient divergence that is not fixed because fixing it moves frozen digests. rubato/rustfft are the wrong tools for fixed coefficient tables. KEEP.
• Direct DFT oracle (crates/dsp-reference/src/spectrum.rs, 101 lines, capped at 4096 frames): an O(N²) f64 oracle whose value is independence from any FFT; rustfft dispatches SIMD at runtime and is not the same bits across targets, which is fine for a tolerance oracle but gains nothing here. KEEP.
• Benchmark harness (tools/bench-support/src/{timing,stats}.rs): AGENTS.md fixes "one warmup and two measured rounds ... do not tune or retry", and timing::timed panics if the timed body hashed (104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F1). criterion/divan measure the wrong thing by policy. KEEP.
• Bash mutation harnesses (30 scripts/test-*.sh, 5.7k lines): they mutate policy fixtures and expect the checker to go red; cargo-mutants mutates Rust source. No crate owns this. KEEP (the pattern is consistent; several checkers already fold their --self-test in).
• C header (crates/capi/include/miso_engine_v1.h, 255 lines): drift is gated three ways — offset_of! tests in abi.rs:427-463, _Static_assert(sizeof(...) == ..._SIZE) in crates/capi/tests/c/{abi_smoke.c,header_smoke.cpp}, and check-capi-abi.sh linking a native consumer against libcapi. cbindgen 0.29.4 (100M, MPL-2.0) would save typing, not close a gap, and would lose the hand-written thread-ownership contract comments. KEEP.
• WASM FFI and ABI generator (hosts/host-web/src/ffi.rs, tools/parameter-metadata/src/abi_layout.rs, scripts/check-abi-layout-v1.py): ffi.rs:1-11 records why no catch_unwind (abort-path bloat measured and removed); exports are u32/pointer/length only with no malloc surface, so wasm-bindgen glue has nothing to replace and would break the reproducible-artifact pin (fix: make the AudioWorklet artifact reproducible and pin it #310). The offset_of! generator is the post-incident fix for TypeScript SDK: @misofm/engine — typed control surface, dual runtime, agent-first #207. KEEP, with finding 8 as the one residual gap.
• JS-side primitives (hosts/host-web/web/): hand UTF-16→UTF-8 in the worklet because TextEncoder is "no more guaranteed in a WorkletGlobalScope" (miso-engine-v1-audio-worklet.js:298); incremental SHA-256 in stem-store/incremental-sha256.js because SubtleCrypto.digest is one-shot and stems are hundreds of MiB; shape validators now table-driven after Web host .d.ts omits observe() and the subscription-map types (#143 follow-up) #151 and held equal by check-command-reason-vocabulary.py. The SDK ships zero runtime npm dependencies by design; if that ever changes, @noble/hashes is the audited replacement for the SHA-256. KEEP.
• Error handling: the workspace has no thiserror and does not need it. Library crates use enums with const fn diagnostic() -> &'static str codes that are wire/contract identity (host-core, capi, session), and only ~8 Display+Error pairs exist (protocol 6, session 1, lane 2). tools/audit's 125 Result<_, String> sites are a style choice in a dev tool, not error potential. KEEP.
• Hex encoders and TSV manifests: bench_support::digest::hex nibble loop, graph-compiler/src/canonical.rs:366-373, ~10 format!("{byte:02x}") collectors; conformance/src/manifest.rs:30-60 and the audit manifests are 3-field TSV with strict validation. hex 0.4.3 (628M, last release 2021) and csv would add nothing. KEEP.
• Diagnostics code\tpath encoder (host-core/src/diagnostics.rs:89-115, "the only encoder in the workspace") and capi's FixedBytes char-boundary truncation: trivial and correct. KEEP.

Footnote: Cargo.lock carries two sha2 versions (0.11.0 direct; 0.10.9 via wasmtime/cranelift, tool-only). Harmless, but cargo tree -d will keep reporting it until wasmtime moves.

Suggested sequencing

1. Finding 1 + finding 2 together (half a day, one PR under a tooling issue): delete the private SHA-256, route the vectorization escaper through bench_support::json::escape, fold the two physical_core_count/format_f64 duplicates into bench-support, and widen check-bench-policy.sh's sole-owner regexes so neither can come back. Zero product risk, closes a live divergence from an audit the owners already accepted (104 Audit: tools/* benchmark, audit, and fixture crates and scripts/ validators #104 F4), and the test ledger from today already asks for the SHA-256 half.
2. Finding 4 (measurement first, then a ruling): build session against json-syntax 0.12.5 on a branch, run crates/session tests, the session_parse fuzz target for an hour, the Boot v2: single-verb engine boot — boot(document, options), self-configuration, parse metering (#239 Phase 1) #240 boot-transient budget test and the wasm size gate. Bring the numbers and the unsafe inventory to Sol as a dependency ruling. This is the only item that changes what ships in every artifact, and the cheap option is API-identical by the fork's own statement, so the measurement is small.
3. Finding 3 (a day, tooling issue): #[derive(Serialize)] models for the two SDK documents with serde_json preserve_order, decide the float spelling (keep number() via RawValue or accept ryu's), re-pin the two JSON assets and the generated TS, and while there emit the constants prelude from finding 8 so the last hand-typed ABI literals in shipped JS disappear.

Findings 5–7 are best done on touch rather than as their own issues: adopt lexopt when a tool's flags next change (start with wasm-gates), point fixture_builtins's substring extractors at its own JsonParser, and consolidate PRNG copies only when a corpus is being re-pinned anyway.

Method and coverage

Four read-only Explore sweeps (tooling; control-plane crates; render/DSP crates; WASM/JS/SDK glue) produced ~150 located items; every item in this report was then verified by reading the code, and crate facts were pulled from the crates.io API on 2026-09-04 (research/crates-io-meta.txt in the scratchpad) and from the local registry source for jstrict. Not read line-by-line: the 25 Python scripts beyond the ones cited, scripts/test-web-audioworklet.mjs (1.4k lines, a Node harness that monkey-patches AudioWorkletProcessor globals to run the real shipped worklet — a candidate for Playwright only if the owners want a real browser in CI), and tools/bench/src/floor.rs.

[tamashi095]

#381 landed: d38ffbe (PR #385). crates/session now parses with upstream json-syntax =0.12.5; jstrict is gone from every manifest, lockfile and source file. Wasm artifact 2,648,668 to 2,636,176 bytes. Verification surfaced a pre-existing parser bug reachable from untrusted input, filed as #387 (lands after this).

[tamashi095]

#380 landed: 65d83af (PR #386). Private SHA-256 in tools/bench deleted in favour of bench_support::digest::sha256_hex (bench identity digest unchanged); the vectorization report escaper now goes through bench_support::json::escape; check-bench-policy.sh refuses a second escaper or SHA-256 constant table outside bench-support, with 12 new red mutations; physical_core_count, Percentiles, microseconds, format_f64 have one home in bench-support; fixture_builtins reads JSONL fields through its own strict parser. Findings 1, 2, part of 6 from the Part 2 audit closed.

[tamashi095]

CI fallout from #385 fixed in 8792698 (PR #392): json-syntax's hashbrown 0.12 / ahash 0.7 lazily boxes 88 bytes of process-lifetime statics on the first object parse, which the capi lifecycle allocator oracle counted on whichever test thread got there first (only on the 4-vCPU runner). Test-only warm-up; shipped caps are explicit row sums and were never affected. Documented in docs/REALTIME_DEPENDENCY_POLICY.md.