FA-42971 / Borrow checking / Open access
Storage death preserves leaf facts into a reused slot · case 01
Storage death preserves leaf facts into a reused slot.
ROOT CAUSE
The static analyzer mishandles storage dead: storage death preserves leaf facts into a reused slot.
VERIFIED REPAIR
Apply the specified transfer or inference rule at this site: live.clear(); out.append([]).
Unsuccessful approach: The partial repair uses live.intersection_update(allowed); out.append([]), which still violates the stipulated analysis contract.
Case contract
Static path initialization lattice for a record with declared leaf names. Commands init/move/read/whole/assign/drop/reset/copy/merge/available. init and assign initialize one leaf. move consumes only initialized named leaf and reports success; read tests one; whole tests all. drop consumes all and reports previously initialized names. reset clears; copy tests without consumption. merge intersects current initialized leaves with supplied branch leaves. available returns sorted initialized names. Unknown leaves never initialize. Return one result per command. This is definite-initialization analysis, not runtime borrowing.
Why this case matters
A finite offline static-analysis model of ownership and borrowing; it does not execute the analyzed program.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(leaves, ops):
allowed=set(leaves); live=set(); out=[]
for op,arg in ops:
if op=='init':
live.update(set(arg)&allowed); out.append(sorted(live))
elif op=='move':
ok=arg in live
if ok: live.remove(arg)
out.append(ok)
elif op=='read': out.append(arg in live)
elif op=='whole': out.append(live==allowed)
elif op=='assign':
if arg in allowed: live.add(arg)
out.append(sorted(live))
elif op=='drop':
out.append(sorted(live)); live.clear()
elif op=='reset':
out.append([])
elif op=='copy': out.append(arg in live)
elif op=='merge':
live.intersection_update(arg); out.append(sorted(live))
elif op=='available': out.append(sorted(live))
return out
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
x='v'+str(N)
check('unknown init',solve(['a'],[('init',['a',x])]),[['a']])
check('last move',solve(['a'],[('init',['a']),('move','a'),('read','a')]),[['a'],True,False])
check('uninitialized sibling',solve(['a','b'],[('init',['a']),('read','b')]),[['a'],False])
check('empty whole',solve([], [('whole',None)]),[True])
check('partial whole',solve(['a','b'],[('init',['a']),('whole',None)]),[['a'],False])
check('reassign empty',solve(['a'],[('assign','a'),('read','a')]),[['a'],True])
check('drop clears',solve(['a'],[('init',['a']),('drop',None),('read','a')]),[['a'],['a'],False])
check('storage reset',solve(['a'],[('init',['a']),('reset',None),('read','a')]),[['a'],[],False])
check('copy preserves',solve(['a'],[('init',['a']),('copy','a'),('read','a')]),[['a'],True,True])
check('join intersection',solve(['a','b'],[('init',['a']),('merge',['b']),('available',None)]),[['a'],[],[]])
check('available subset',solve(['a','b'],[('init',['a']),('available',None)]),[['a'],['a']])
check('variant leaf',solve([x],[('init',[x]),('move',x),('available',None)]),[[x],True,[]])
check('record arity',solve(list(range(N+1)),[('init',list(range(N+1))),('move',N),('available',None)]),[list(range(N+1)),True,list(range(N))])
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| unknown init | [['a']] | [['a']] | Passed |
| last move | [['a'], True, False] | [['a'], True, False] | Passed |
| uninitialized sibling | [['a'], False] | [['a'], False] | Passed |
| empty whole | [True] | [True] | Passed |
| partial whole | [['a'], False] | [['a'], False] | Passed |
| reassign empty | [['a'], True] | [['a'], True] | Passed |
| drop clears | [['a'], ['a'], False] | [['a'], ['a'], False] | Passed |
| storage reset | [['a'], [], True] | [['a'], [], False] | Failed |
| copy preserves | [['a'], True, True] | [['a'], True, True] | Passed |
| join intersection | [['a'], [], []] | [['a'], [], []] | Passed |
| available subset | [['a'], ['a']] | [['a'], ['a']] | Passed |
| variant leaf | [['v1'], True, []] | [['v1'], True, []] | Passed |
| record arity | [[0, 1], True, [0]] | [[0, 1], True, [0]] | Passed |
SHA-256 / c532edefad7f74cabdd38b455e097e264cfedf69c6887dd09d65288e46546208
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(leaves, ops):
allowed=set(leaves); live=set(); out=[]
for op,arg in ops:
if op=='init':
live.update(set(arg)&allowed); out.append(sorted(live))
elif op=='move':
ok=arg in live
if ok: live.remove(arg)
out.append(ok)
elif op=='read': out.append(arg in live)
elif op=='whole': out.append(live==allowed)
elif op=='assign':
if arg in allowed: live.add(arg)
out.append(sorted(live))
elif op=='drop':
out.append(sorted(live)); live.clear()
elif op=='reset':
live.intersection_update(allowed); out.append([])
elif op=='copy': out.append(arg in live)
elif op=='merge':
live.intersection_update(arg); out.append(sorted(live))
elif op=='available': out.append(sorted(live))
return out
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
x='v'+str(N)
check('unknown init',solve(['a'],[('init',['a',x])]),[['a']])
check('last move',solve(['a'],[('init',['a']),('move','a'),('read','a')]),[['a'],True,False])
check('uninitialized sibling',solve(['a','b'],[('init',['a']),('read','b')]),[['a'],False])
check('empty whole',solve([], [('whole',None)]),[True])
check('partial whole',solve(['a','b'],[('init',['a']),('whole',None)]),[['a'],False])
check('reassign empty',solve(['a'],[('assign','a'),('read','a')]),[['a'],True])
check('drop clears',solve(['a'],[('init',['a']),('drop',None),('read','a')]),[['a'],['a'],False])
check('storage reset',solve(['a'],[('init',['a']),('reset',None),('read','a')]),[['a'],[],False])
check('copy preserves',solve(['a'],[('init',['a']),('copy','a'),('read','a')]),[['a'],True,True])
check('join intersection',solve(['a','b'],[('init',['a']),('merge',['b']),('available',None)]),[['a'],[],[]])
check('available subset',solve(['a','b'],[('init',['a']),('available',None)]),[['a'],['a']])
check('variant leaf',solve([x],[('init',[x]),('move',x),('available',None)]),[[x],True,[]])
check('record arity',solve(list(range(N+1)),[('init',list(range(N+1))),('move',N),('available',None)]),[list(range(N+1)),True,list(range(N))])
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| unknown init | [['a']] | [['a']] | Passed |
| last move | [['a'], True, False] | [['a'], True, False] | Passed |
| uninitialized sibling | [['a'], False] | [['a'], False] | Passed |
| empty whole | [True] | [True] | Passed |
| partial whole | [['a'], False] | [['a'], False] | Passed |
| reassign empty | [['a'], True] | [['a'], True] | Passed |
| drop clears | [['a'], ['a'], False] | [['a'], ['a'], False] | Passed |
| storage reset | [['a'], [], True] | [['a'], [], False] | Failed |
| copy preserves | [['a'], True, True] | [['a'], True, True] | Passed |
| join intersection | [['a'], [], []] | [['a'], [], []] | Passed |
| available subset | [['a'], ['a']] | [['a'], ['a']] | Passed |
| variant leaf | [['v1'], True, []] | [['v1'], True, []] | Passed |
| record arity | [[0, 1], True, [0]] | [[0, 1], True, [0]] | Passed |
SHA-256 / e25b0b145609158107ed0bc3fa0a65e3d2f9d50dd49b394cc204ed062c9b9523
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(leaves, ops):
allowed=set(leaves); live=set(); out=[]
for op,arg in ops:
if op=='init':
live.update(set(arg)&allowed); out.append(sorted(live))
elif op=='move':
ok=arg in live
if ok: live.remove(arg)
out.append(ok)
elif op=='read': out.append(arg in live)
elif op=='whole': out.append(live==allowed)
elif op=='assign':
if arg in allowed: live.add(arg)
out.append(sorted(live))
elif op=='drop':
out.append(sorted(live)); live.clear()
elif op=='reset':
live.clear(); out.append([])
elif op=='copy': out.append(arg in live)
elif op=='merge':
live.intersection_update(arg); out.append(sorted(live))
elif op=='available': out.append(sorted(live))
return out
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
x='v'+str(N)
check('unknown init',solve(['a'],[('init',['a',x])]),[['a']])
check('last move',solve(['a'],[('init',['a']),('move','a'),('read','a')]),[['a'],True,False])
check('uninitialized sibling',solve(['a','b'],[('init',['a']),('read','b')]),[['a'],False])
check('empty whole',solve([], [('whole',None)]),[True])
check('partial whole',solve(['a','b'],[('init',['a']),('whole',None)]),[['a'],False])
check('reassign empty',solve(['a'],[('assign','a'),('read','a')]),[['a'],True])
check('drop clears',solve(['a'],[('init',['a']),('drop',None),('read','a')]),[['a'],['a'],False])
check('storage reset',solve(['a'],[('init',['a']),('reset',None),('read','a')]),[['a'],[],False])
check('copy preserves',solve(['a'],[('init',['a']),('copy','a'),('read','a')]),[['a'],True,True])
check('join intersection',solve(['a','b'],[('init',['a']),('merge',['b']),('available',None)]),[['a'],[],[]])
check('available subset',solve(['a','b'],[('init',['a']),('available',None)]),[['a'],['a']])
check('variant leaf',solve([x],[('init',[x]),('move',x),('available',None)]),[[x],True,[]])
check('record arity',solve(list(range(N+1)),[('init',list(range(N+1))),('move',N),('available',None)]),[list(range(N+1)),True,list(range(N))])
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| unknown init | [['a']] | [['a']] | Passed |
| last move | [['a'], True, False] | [['a'], True, False] | Passed |
| uninitialized sibling | [['a'], False] | [['a'], False] | Passed |
| empty whole | [True] | [True] | Passed |
| partial whole | [['a'], False] | [['a'], False] | Passed |
| reassign empty | [['a'], True] | [['a'], True] | Passed |
| drop clears | [['a'], ['a'], False] | [['a'], ['a'], False] | Passed |
| storage reset | [['a'], [], False] | [['a'], [], False] | Passed |
| copy preserves | [['a'], True, True] | [['a'], True, True] | Passed |
| join intersection | [['a'], [], []] | [['a'], [], []] | Passed |
| available subset | [['a'], ['a']] | [['a'], ['a']] | Passed |
| variant leaf | [['v1'], True, []] | [['v1'], True, []] | Passed |
| record arity | [[0, 1], True, [0]] | [[0, 1], True, [0]] | Passed |
SHA-256 / 387a35b8e885bbc7a8a218ef7169356754c561fb33ef9e719085fa119ba50c48
Verification & scope
The explicitly stated toy language is the complete scope; this is not a production compiler or a claim about Rust semantics. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:43:57.232198+00:00.
Case digest / 1b9952acfc5f21b452928c5fc6e32f8739f036aae019698b0ef2bce1f2b8287c