Mímir v2 lenses

This manual describes every lens that exists on main today, in two repos. It is written from the code. Each claim names its file and line. To run the lenses, start with the user guide lens-guide.md; this file is the reference behind it.

• nornir lenses run over the code room and the warehouse. Their entry is answer(lens, reach, params) in nornir src/mimir_lens/mod.rs:198.
• graph lenses run offline over a Mímir v2 dump directory. The code is the nornir crate nornir-mimir-lens (crates/mimir-lens/, moved out of dwarves on 2026-11-05, see section 4 "Layout"); the doors are dwarves lens <name> / cargo lens <name>. The folds dwarves mimir zombie|risk|bloat and dwarves coverage read the same dump through the same crate; dwarves dupes stays in dwarves.

Path conventions. A bare path such as src/mimir_lens/trust.rs:141 is in nornir; the graph lenses and folds are in nornir too, under crates/mimir-lens/ (for example crates/mimir-lens/src/lenses/twins.rs:64). A path that starts with dw: is in dwarves, under crates/dwarves/: the CLI door only. Line numbers are for nornir main; the files of crates/mimir-lens/ moved verbatim from dwarves main 3b3b384 (2026-11-04), so their numbers did not change (the tests lost their CLI cases to dwarves tests/lens_cli.rs).

Related documents: README.md (the code graph, the producer, the room), tables.md (every table and column) and compiler-to-graph.md (how rustc's facts become the tables and the matrices every lens reads).

How each lens section reads. Every lens has the same parts:

• Math: the exact formulas the code computes, with every constant. Where the code and its comment or intent differ, the section says so.
• GraphBLAS steps: each product with its semiring as the code names it (GxB_ANY_PAIR_BOOL is the structural OR-AND reach, the same as LOR.LAND on booleans), or a plain statement that the step is not GraphBLAS.
• Dataflow: an ASCII picture from the tables to the output.
• Worked example: real Holger numbers where the plan or the goldens record them, otherwise a test fixture computed by hand.
• Run, output, limits and tests, with file:line references as extras.

The dataflow of every lens starts at the compiler:

rustc (mimir-driver, after_analysis)
  → code_nodes / code_edges / code_symbols (Arrow IPC per crate unit)
      → dwarves: Graph::from_dump → adjacency lists → grb::pattern matrices → lens products → Report
      → nornir:  consumer → lake → mimir-room per-edge-kind matrices → room_feed folds → envelope

compiler-to-graph.md describes each arrow, with the semirings and one fn traced from source to matrix entries.

Contents:

1. Quickstart: run the lenses on your workspace, with Rusternetes as the worked example
2. The two families and what they read
3. nornir lenses (answer, LENSES)
4. Graph lenses (nornir-mimir-lens, door dwarves lens …), including the study lenses taint, chokepoints, misplaced and dsm (4.9 to 4.12), the package-graph views (4.26, a renderer), the macro lenses (4.27 to 4.34) and fail-open (4.35)
5. The super lens verdict
6. The dwarves folds on the dump (zombie, risk, bloat, coverage, dupes)
7. Worked examples on Holger
8. Cost
9. What is not wired

1. Quickstart: run the lenses on your workspace

This path was run end to end on Rusternetes, on two hosts (section 1.6). It needs Linux x86_64, about 5 GB for the sources, and room for the dumps (5.5 GB and 3.8 GB on Rusternetes).

1.1 System packages

On Ubuntu:

sudo apt-get install -y build-essential clang cmake pkg-config protobuf-compiler \
  curl git git-lfs time libgraphblas-dev

1.2 Install the dump tool (nightly, nornir only)

mimir-driver is a rustc driver, so it is built against one pinned nightly. It is its own workspace and needs only the nornir checkout (crates/mimir-driver/Cargo.toml:12, :31).

rustup toolchain install nightly-2026-10-05 --profile minimal \
  --component rustc-dev,llvm-tools-preview,rust-src
git clone ssh://git@git.gunnar.rs:2222/nordisk/nornir
cd nornir/crates/mimir-driver      # this directory's rust-toolchain.toml picks the nightly
cargo install --locked --path .    # cargo-mimir-dump, mimir-driver, and two helpers

The cd matters: the toolchain comes from that directory. cargo-mimir-dump looks for mimir-driver beside itself, so keep the two binaries in one directory (crates/mimir-driver/src/bin/cargo-mimir-dump.rs:196-201). It runs the check under the pinned nightly by itself, so your workspace keeps its own toolchain.

1.3 Install dwarves (the 15 sibling repos)

From crates.io (2026-11-06): cargo +nightly-2026-10-05 install --locked cargo-mimir-dump and cargo install --locked dwarves-lens give the dump tool and the lens door with no sibling repos; see lens-guide.md "Quick start". The source build below is for the full forge.

A build cannot avoid the sibling repos today. crates/dwarves/Cargo.toml names them by path, and Cargo reads every path dependency, optional ones too. A lone dwarves clone stops with failed to read ../edda/crates/autonom/Cargo.toml. crates.io is no way out either: graphblas-sys and nornir-mimir-graph are publish = false, and the published dwarves has no lenses feature. So there are two ways:

• Copy the binaries. Build once on a host that has the siblings, then copy dwarves, cargo-lens, cargo-mimir-dump and mimir-driver to the same directory on your PATH. On a built host dwarves links only libgraphblas7, libgomp1, libc, libm and libgcc_s, so the target needs those two packages, plus the nightly of section 1.2 for the driver. Copying was checked with ldd only; no run was made on a third host.

• Build with the siblings. Put these beside dwarves in one directory, one git clone at a time. The code host limits parallel transfers.

  from	repos
  ssh://git@git.gunnar.rs:2222/nordisk/	dwarves, nornir, edda, Skidbladnir, facett, holger, skade, znippy, znippy-zoomies, gunnar, monetize
  ssh://git@git.gunnar.rs:2222/mikronova/	draupnir, funnel-core, tunnr, modgunn, openzl-sys-rs

  That is dwarves and 15 siblings, 4.8 GB in all. Then, from the dwarves checkout:

  cargo install --locked --force --root ~/lens-tools --path crates/dwarves \
    --no-default-features --features cli,lenses,mimir-fat
  export PATH=~/lens-tools/bin:$PATH
  

  • --no-default-features matters. default is the full tool with five binaries (11:40 against 6:21 on oden), and lenses and mimir-fat are not in it (dw:Cargo.toml:141, :329-333). The slim line ran every lens and fold of section 1.6.
  • --root keeps an existing ~/.cargo/bin/dwarves as it is. Without it, cargo install overwrites that binary.
  • --locked needs the siblings at commits that fit dwarves' lock. Section 1.6 gives a set that was proven together.

1.4 Dump and run

cd <your workspace>

# Dump 1: every crate with its dependencies. The graph lenses read this one.
cargo lens graph-package --local                 # writes target/dwarves/mimir

# Dump 2: your own crates only. The folds and cfg-sprawl read this one (see 1.5).
cargo mimir-dump --workspace-only --out target/dwarves/mimir-ws \
  --target-dir target/dwarves/mimir-target-ws --repo <name>

# Graph lenses. Each finds target/dwarves/mimir by itself.
cargo lens size --local --limit 0
cargo lens twins --local --limit 0
cargo lens cycles --local --limit 0
cargo lens dsm --local --limit 0
cargo lens misplaced --local --limit 0
cargo lens dispatch-erosion --local --src . --limit 0
cargo lens cfg-sprawl --local --mimir-dump target/dwarves/mimir-ws --limit 0

# The gate, then the super lens: one band per crate and module.
cargo lens gate-bypass --local --limit 0 \
  --sink 'Store#put()' --sink '[Store]put()' \
  --choke 'Gate#check()' --entry 'my-server handlers/'
cargo lens verdict --local --limit 0 \
  --sink 'Store#put()' --sink '[Store]put()' \
  --choke 'Gate#check()' --entry 'my-server handlers/'

# The folds, on the own-crates dump. <dir> holds only your checkout.
mkdir -p /tmp/empty-warehouse
dwarves mimir --local --wh target/dwarves/mimir-ws --checkouts <dir> --limit 100 zombie
dwarves mimir --local --wh target/dwarves/mimir-ws --checkouts <dir> --limit 100 risk
dwarves coverage --local --mimir-dump target/dwarves/mimir-ws \
  --warehouse /tmp/empty-warehouse --checkouts <dir>

What to watch:

• --local runs here and ignores $DWARVES_SERVER and $NORNIR_SERVER, which would otherwise reroute the verb (dw:src/cli.rs:92-95).

• --limit 0 prints every row. Text output stops at 50 rows while the headline counts all rows, so a top list from the default output can mislead.

• Sink patterns: name the trait AND the impls. A pattern is a substring of <crate> <short moniker>. Store#put() matches the trait's method only. A handler that calls impl Store for Arc<S> calls a separate node, spelled [Store]put(), and the dyn expansion runs only from trait to impl. On Rusternetes the trait pattern alone gave 14 write paths, one impl pattern 15, and all impls 201. An impl pattern also matches test impls such as CountingStorage.

• gate-bypass reads check-then-write as BYPASS. A path that calls the gate, returns and then writes is not mediated in the lens's model: the write must sit inside the gate's own frame. Servers that authorize inline therefore read BYPASS, and any non-zero gate term makes the unit RED in verdict. Read a door before you call it a missing check (section 1.6).

• dwarves coverage reads the host's default warehouse under ~/.nornir and takes the parent directory as its repo roster. The empty --warehouse and a --checkouts directory holding only your repo keep the answer from depending on the machine.

• An empty dump. cargo mimir-dump with a new --out on a warm --target-dir exits 0 and writes nothing, since cargo has nothing to recompile. The next lens then says no dump exists. Give each dump its own target dir, or remove target/dwarves and start over. Rerunning graph-package on the same out dir is safe.

• -p and --features on a --workspace-only dump (Gunnar re-compare row 12). With --workspace-only, -p X dumps only the named packages, not the whole workspace. With several -p, a package-prefixed feature (--features gunnar-server/metered) silently enables nothing: give the features unprefixed (-p gunnar-server -p gunnar-grpc --features metered). The Gunnar delivery dump was made that way:

  cargo mimir-dump --workspace-only -p gunnar-server-metered --features metered \
    --out target/dwarves/mimir-metered --target-dir target/dwarves/mimir-target-metered
  

  Check the result before you trust a count: the metered dump must hold account_room_at() (crates/gunnar-grpc/src/service/accounts.rs:323, behind #[cfg(feature = "metered")]), which cargo lens fail-open lists.

• One dump is one build. An impl behind a cfg the dump did not compile is invisible, so single-impl and dyn-to-enum judge that build only. Give the other build with --also-dump DIR (repeatable): the impl sets become the union by label (§4.5, §4.15).

1.5 Why two dumps

The graph lenses keep to the workspace's own code (origin = local) on a full dump. The folds do not yet, and neither does cfg-sprawl or the crate level of cycles. On a full dump risk ranks syn and num-bigint-dig first, zombie names 194 dependency crates, and cfg-sprawl reports 2,250 features in 292 crates instead of 46 in 9. So until that scope is fixed in dwarves, the folds and cfg-sprawl read a second dump made with --workspace-only.

Neither dump suits everything. A full dump peaks at about 8 GB per lens on Rusternetes. An own-crates dump costs less (5.4 to 5.8 GB) but loses facts about dependency types: dispatch-erosion falls from 34 to 23 foreign ladders, and verdict moves from 2 AMBER / 6 GREEN to 3 AMBER / 5 GREEN crates. The bench in section 8 used --workspace-only dumps.

1.6 Worked example: Rusternetes

Rusternetes 1f73ec89 (https://github.com/Ignalina/rusternetes), 9 crates. All 16 lenses and folds exit 0 on both hosts, with the same headlines. oden has 32 cores and ran at load 35 to 40 beside other work, with the default dwarves build unless marked slim. loki has 12 cores and was quiet, at nice 10, with the slim build. Its build rows had a warm sccache, so they are not cold numbers.

The clones plus everything above took roughly 15 minutes on loki; that figure is an estimate from log times. Every lens above is mostly the dump load (section 8). A rerun on warm tools and warm dumps takes about 4 minutes.

The findings:

Two figures need a caution. risk's real first row is the generated OUT_DIR/openapi.v2.rs at 43,268, because the fold does not yet treat OUT_DIR/ as generated. verdict says 1,950 of 2,545 fns are reached while coverage says 2,611 of 13,318: the two count different populations, and the difference is not settled.

The gate, read properly. The run used:

SINKS=(); for m in create update update_raw delete; do
  SINKS+=(--sink "Storage#$m()" --sink "[Storage]$m()"); done
cargo lens gate-bypass "${SINKS[@]}" --choke 'Authorizer#authorize()' \
  --entry 'rusternetes-api-server handlers/' --local --limit 0

The answer, 161 doors and NO, is not 161 missing checks. 155 of the 161 door fns call authorize themselves (computed from the CALLS edges; that shows the call exists, not its order). The other 6 were read by hand or through their callers, and all sit behind an authorize: priorityclass/patch and service/patch delegate to generic_patch, and four are helpers. No handler with a write and no authorize was found, which is not a proof. Rusternetes authorizes inline, then writes, and the lens counts that as BYPASS (section 1.4). That is also why verdict shows 59 RED modules.

The versions. This run predates schema 6, so its dump had the 1,024-block cap (compiler-to-graph.md). These commits were proven together:

1.7 What each step does

• cargo lens graph-package runs cargo metadata, then cargo-mimir-dump --out <out>/mimir --target-dir <out>/mimir-target --repo <dir>, then writes target/dwarves/graph-package.znippy (crates/mimir-lens/src/lens_graph.rs:622-791). --mimir-dump DIR reuses an existing dump instead. --mimir-bin or $DWARVES_MIMIR_DUMP names the dump binary.

• cargo lens X is the same command as dwarves lens X (dw:src/bin/cargo-lens.rs:1-5).

• Every graph lens looks for the dump in the given path, then <path>/dwarves/mimir, then <path>/target/dwarves/mimir (crates/mimir-lens/src/lenses/mod.rs:60-78).

• Shared flags of every graph lens (DumpLensArgs, dw:src/cli.rs:553-584):

  flag	default	meaning
  --mimir-dump DIR	./target/dwarves/mimir	the dump, or a workspace root holding one
  --crate NAME	every crate the dump defines	repeatable
  --include-tests	off	count test code too; generated/ paths are always left out
  --include-deps	off	report on the dependency crates of a full dump too; by default only the workspace's own code (origin = local) counts
  --src DIR	none	a checkout, for the text fallbacks
  --json	off	one JSON object with every row
  --limit N	50	rows printed; 0 = all. Headlines count every row, whatever the limit
  --fail-on-findings	off	exit 1 when the lens found anything

  A missing dump or a lens error exits 2 (dw:src/cli.rs:586-636).

• The nornir lenses are asked through a front door: the gRPC Mimir.* service (src/server_grpc.rs:786, one handler per lens from :3322), the MCP mimir_* tools (src/mcp_stdio.rs:1700-2314), or the dwarves CLI through dwarves::lens (dw:src/lens.rs). See section 3.1.

2. The two families and what they read

The only producer of the code graph is mimir-driver, run by cargo mimir-dump (see README.md §3). Both families read the same node and edge kinds: CONTAINS, CALLS, IMPLEMENTS, FOR_TYPE, GATED_BY, ENABLES, USES_TYPE, READS_FIELD, WRITES_FIELD (schema 6), TESTS, EXPANDS, TOUCHES_TABLE, CFG_SUCC, DEPENDS_ON, SYSCALLS, and the name-free MIR nodes mir_body / mir_block. READS_FIELD is every mention of a field (read or written); WRITES_FIELD is the writes (=, op=, &mut, a &mut auto-ref, a struct literal), so a read-only use is READS_FIELD ∧ ¬WRITES_FIELD (compiler-to-graph.md §3.1). The dwarves Graph indexes both (reads_field, writes_field and their reverses).

The honesty rule is the same in both. A fact the input does not carry is named with its producer. It is never printed as zero.

• nornir: evidence_note, lens_meta.gaps and lens_meta.state (src/mimir_lens/mod.rs:23-28).
• dwarves: needs <fact>: <producer> lines in every output mode (crates/mimir-lens/src/lenses/mod.rs:608-636).

3. nornir lenses

3.1 The entry and the lists

answer(lens, reach, params) (src/mimir_lens/mod.rs:198-219):

• subclone and group_twins go to their source folds (:201-206).
• A name not in LENSES is refused with invalid_argument and the known list (:207-210).
• A name in WAITING answers not_wired. WAITING is empty today (:185-186).
• anomaly reads the warehouse only (:215-217).
• Every other lens goes to room_feed::from_room (src/mimir_lens/room_feed.rs:486), which dispatches in room_feed/lenses.rs:19-63.

The lists in src/mimir_lens/mod.rs:

Common request fields: repo (default "" = every repo) and limit (0 = DEFAULT_LIMIT 50, :180). They are read by Query::new (src/mimir_lens/room_feed.rs:103-122). A missing number reads as 0, a flag as false.

Feature gates. Without code-room, every room-fed lens refuses with not_linked (room_feed.rs:496-499). Without vector, the clone and vector lenses and both source lenses refuse with not_linked (room_feed/lenses.rs:58-70, room_feed.rs:425, :457). vector is a default feature; code-room comes with server.

Front doors:

• gRPC. lens_answer (src/server_grpc.rs:786) returns a kept answer when it is ready, else queues the lens on the jera lenses lane and answers queued / running with a job id (src/mimir_lens/queued.rs:182). Handlers sit at server_grpc.rs:3322-3524 (generic_cost to data_reach).
• MCP. mimir_<lens> tools in src/mcp_stdio.rs (for example mimir_generic_cost :1700, mimir_data_reach :2314). With NORNIR_SERVER set a tool calls gRPC; otherwise it calls answer in process (lens_embedded, :5041-5048).
• dwarves. dwarves mimir bloat|zombie|risk asks nornir's lens through dwarves::lens when no local dump is given (dw:src/cli.rs:14995-15011). The CLI waits for a queued answer up to $DWARVES_LENS_WAIT seconds, default 120 (dwarves docs/v2/README.md §8).
• nornir CLI. nornir mimir analyze <op> (src/bin/nornir.rs:783) covers the clone lenses, undoc-api, name-collision, trust, reachable-vuln and symbol-identity (:789-987). It refuses to open the room's lake locally and asks for --server <url> (:6422, :6527).

3.2 The envelope and its states

Every answer is built by finish (room_feed.rs:332):

lens_meta.state:

The source lenses compute their own state (room_feed.rs:465-483).

Every caller and reach figure is a lower bound. The answers say so with the note CALLS_LOWER_BOUND (room_feed.rs:89), which names "operators, closures and fn pointers". Read against the driver, only the operators are missing:

• A call through a value (a closure, a Box<dyn Fn…>, a generic F: Fn…) is a CALLS edge to the Fn* trait method rustc records for the overloaded call, resolved to the impl when the type is concrete (crates/mimir-driver/src/walk.rs:1843-1852).
• A call through a fn pointer is a CALLS edge to Fn::call (:1853-1856). The fn that was turned into a value gets a CALLS edge from the body that names it (:1860-1869).
• A closure body is part of the fn that defines it, so its calls are edges of that fn (README.md §10.2, compiler-to-graph.md).
• An overloaded operator (a + b on an Add impl, Index, Deref) has no CALLS edge: the HIR walk handles Call, MethodCall and paths only (walk.rs:1828-1906; schema 6 added arms for field writes, not for operators). MIR still has the call terminator, so the MIR-based lenses (gate-bypass phase 2, taint, twins' shapes) see it.

So the figures are a lower bound because of the operators, and because a Fn* or Fn::call edge stops at the trait method unless a reader widens it (the system-boundary walk does; most lenses do not). The note's wording is older than the driver's value-call edges.

The GraphBLAS walks of the room live in nornir crates/mimir-graph/src/ops.rs:

• single reach is a BFS q⟨¬v⟩ = q ANY.PAIR A (vxm, :6-7, :55-95);
• reach_each / reach_sets batch every seed into one frontier matrix, F⟨¬V⟩ = F ANY.PAIR A (mxm, :668-699);
• reverse walks use the cached transpose (crates/mimir-room/src/query.rs:430-440).

Kept (incremental) answers:

• clone_inc.rs keeps the clone folds per workspace and plans Carry, Advance or Full; it must equal the full recompute (src/mimir_lens/clone_inc.rs:1, :114).
• reach_inc.rs keeps the walks of system_boundary, data_reach and reachable_vuln. NORNIR_REACH_INC=0 forces the reference walk (src/mimir_lens/reach_inc.rs:1, :73).

3.3 The lens table

Producers of the warehouse feeds (room_feed/lenses.rs:378, :458, :613, src/code_room/feeds.rs:13-17):

3.4 Lens by lens

The room's GraphBLAS operations

Every walk a nornir lens runs on the code room is one of the operations below. A is the boolean adjacency of one edge kind, or the union of several (A[i][j] = edge i → j, "i calls / uses / depends on j"). The node space is the room's ordinals 0..n. The lens sections below name the operation and point here for the recurrence.

One note on the main semiring. GxB_ANY_PAIR_BOOL multiplies with PAIR (1 wherever both operands hold an entry) and adds with ANY (any present entry). On a boolean pattern that is the structural OR-AND semiring (LOR.LAND): y[j] is true when some frontier node has an edge to j. No value is read.

The room's reach, walk_each and dependents_by return the walk WITHOUT its seeds (query.rs:352-353, :376-378, :413-415). ops::reach itself includes them.

Not every room read is a product. Room::edges extracts the (from, to) tuples of the per-kind matrix and filters them by two node bitmaps; it uses no semiring (crates/mimir-room/src/export.rs:187-214). Room::mask, Room::lookup (name search) and Room::sites are table reads.

Of these operations, bottleneck serves trust and propagate serves the role vectors. The lenses of this part use reach, reach_each, reach_sets, the cached transpose, the Jikes matrix, the within scope and edge reads.

generic_cost

Call. gRPC Mimir.GenericCost (src/server_grpc.rs:3316), MCP mimir_generic_cost (src/mcp_stdio.rs:1700), or dwarves mimir bloat without a local dump. Params repo, min_instantiations, limit. Roomless: it reads Build Thing filings, never the code room.

Math. Per filed artifact a (only the latest filing of each line, see below), per group g = (artifact, crate, generic):

instances of a   = { s ∈ symbol_sizes(a) : size(s) > 0, section(s) starts ".text",
                      and ( is_monomorphization(s)                       -- v0 name carries generic args
                            or |{ mangled names with base(s) }| ≥ 2 ) }  -- legacy: one hash per instance
base(s)          = demangled name without generics, trailing "::" trimmed
N_g              = number of instances in g
total_g          = Σ size over the instances of g
tax_g            = total_g − ⌊total_g / N_g⌋          (integer division, saturating)
kept             iff N_g ≥ max(min_instantiations, 2)
class_g          = glue          if base contains "drop_in_place" or "drop_glue"
                   trait-method  if base starts "::", contains "_::::", or its last segment is empty,
                                 or base contains " as " (a <T as Trait>::m method)
                   named         otherwise              -- the only actionable class
total_bytes(a)   = Σ size over ALL symbols of a (not the file size)
tax_bytes(a)     = Σ_g tax_g
tax_pct(a)       = 100 · tax_bytes(a) / total_bytes(a)  (0 when total is 0)
actionable(a)    = Σ tax_g over class named

Groups sort by tax_bytes descending, then symbol. Artifacts sort by tax_bytes descending. worst keeps the top limit groups; top_named in the JSON shows five named groups. (bloat.rs:49-58, :161-189, :193-249; room_feed/built.rs:170-203.)

A line is (repo, variant, file, target, sorted features) (binary_drift.rs:749-753). Two landings of one build with the same sha256 are one filing (built.rs:62-101). The latest filing of a line is the last by (rev, built_at, owner) (built.rs:99, :183).

The module doc says the feed is the code room's mono_instance nodes and INSTANCE_OF edges (bloat.rs:3-5). The code reads the symbol_sizes of the latest Build Thing filing instead (built.rs:184-185); no room is opened.

GraphBLAS steps. None. Every step is a scan or a BTreeMap group-by.

Dataflow.

bin_ingest_runs(@build-thing).ledger ──► Filing{repo,variant,file,target,features,sha256,rev}
        │ group by line, last by (rev, built_at, owner)
        ▼
symbol_sizes[sha256] ──► instances_of(): .text, size>0, mono or name shared ≥2
        │                         └─► total_bytes(a) = Σ all sizes
        ▼
group (artifact, crate, generic) ──► N, total, tax = total − ⌊total/N⌋, class
        ▼
artifacts[ repo, artifact, total_bytes, tax_bytes, tax_pct, actionable_tax_bytes, top_named ]

Worked example. Fixture bloat.rs:268: four instances of znippy::parse_stream (u8, u16, u32, u64), 100 B each, in an artifact whose symbols total 1,000 B.

N = 4, total = 4 · 100 = 400
tax = 400 − ⌊400 / 4⌋ = 400 − 100 = 300
tax_pct = 100 · 300 / 1000 = 30.0
class = named → actionable = 300
min_instantiations = 5 → floor max(5, 2) = 5 > 4 → no group, no artifact   (bloat.rs:283)
one instance only    → N = 1 < 2 → no group                                (bloat.rs:282)

Fixture bloat.rs:287: two instances of znippy::Codec::encode, 50 B each, marked as trait-impl methods. tax = 100 − ⌊100/2⌋ = 50, class trait-method, actionable 0. A real build (room_feed/built_tests.rs:149) instantiates widen six times (u8, u16, u32, u64, bool, char) and the lens reports instantiations = 6 for it (built_tests.rs:183).

On Holger, only the dwarves counterpart has a recorded number: the golden bloat row reads artifacts 0, total_tax_bytes 0 because that dump has no binary layer (crates/mimir-lens/tests/golden/holger-h32-9dbe5cbf.json). That is dwarves' fold over a dump, not this one.

Output. artifacts, total_tax_bytes, actionable_tax_bytes, source: "build", worst_artifacts[repo, artifact, total_bytes, tax_bytes, tax_pct, actionable_tax_bytes, top_named[symbol, crate, instantiations, tax_bytes]] (bloat.rs:116-134, built.rs:201).

Limits. Nothing filed gives the gap no_build, which says to run dwarves buildthing <repo> --variant <variant> (built.rs:43-48). A filing whose bytes were not analysed on this server reads ABSENT, not zero (built.rs:143-150). Only the latest filing per line is read.

Tests. bloat.rs:268, :287, :300; room_feed/built_tests.rs:149; room_feed/room_tests.rs:380.

zombie_features

Call. gRPC Mimir.ZombieFeatures (server_grpc.rs:3325), MCP mimir_zombie_features (mcp_stdio.rs:1731), or dwarves mimir zombie without a local dump. Params repo, limit. Room: every consumed repo.

Math. Keys are crate/feature (a feature belongs to one crate). For each repo r of the request:

declared(r) = { label(f) : f feature node of r, origin Local, defined }
built(r)    = { label(f) : CRATE node ─ENABLES→ f }                      -- the consumed build
            ∪ { d ∈ declared(r) : a file of r turns d on }               -- see "enablers"
enablers    = every Cargo.toml under the clone (depth ≤ 6; target, .git, node_modules,
              vendor skipped): [features] items (dep/feat and own names, not dep:),
              features = [..] on [dependencies], [dev-dependencies], [build-dependencies],
              [workspace.dependencies], [target.*.*]; .nornir/build-variants.toml variants
exempt(f)   = f is a [[bin]] required-feature (opt_in)
            or the feature NAME is in build-variants `offers` / `allow_unbuilt`

A gate is one GATED_BY edge item → feature, skipped when exempt. Per (repo, feature):

partial  = items with GATED_BY.partial = true          (counted, never judged)
negated  = own gates whose every mention is under not(…) (counted, never judged)
own      = own, non-negated gates (by site)
compiled_out = own gates whose item kind is cfg_gated_out
judged   = own gates that were compiled
inbound  = Σ over judged items of (CALLS + USES_TYPE site counts arriving at the item)
never_built = declared ∋ f  and  built ∌ f              (build space known)
unreached   = judged ≠ ∅  and  inbound = 0
direction   = both | never-built | unreached | (not a zombie)

A second pass adds every declared − built feature that has no gate at all as never-built, with the site text "declared in Cargo.toml; no crate was compiled with it, and no code is gated by it". Severe = never-built or both. Rows sort severe first, then gated_items descending, then repo, then feature. Totals are counted before the cut to limit. (zombie.rs:282-413; room_feed/lenses.rs:152-277.)

Three code facts a reviewer should know:

• inbound counts every caller, including another item gated by the same feature. A gated item reached only from its own feature's code reads as reached (lenses.rs:221-223).
• The room path sets build_space_known = true for every repo of the request (lenses.rs:168-170). build_space_unknown is therefore always empty there; only the unit test reaches it (zombie.rs:539).
• The exemption drops the gates only (lenses.rs:232-235). The declared-but-not-built pass does not consult it (zombie.rs:351-375). An opt-in feature that nothing enables therefore still reads never-built, with gated_items 0. The basis note at lenses.rs:267 says such features are "no zombie". The code and that note differ in this case.

GraphBLAS steps. None. All steps are masks and edge reads.

Dataflow.

code_nodes(feature) ─┬─ ENABLES from crate ──► built
                     ├─ defined ─────────────► declared
                     └─ GATED_BY ◄── items ──► own / partial / negated / compiled_out
items ◄── CALLS + USES_TYPE (site counts) ────► inbound
clone/**/Cargo.toml, .nornir/build-variants.toml ──► enablers ∪→ built ; opt_in, excused → exempt
Build Thing latest artifacts ──► LinkedBytes (path_key join) ──► bytes_in_binary
        ▼
never_built = declared ∖ built ; unreached = judged ≠ ∅ ∧ inbound = 0
        ▼
worst[ repo, feature, direction, gated_items, compiled_out_items, partial_items,
       negated_items, inbound_calls, bytes_in_binary, sites ]

bytes_in_binary = per item path (generics and <> erased), the largest total over the latest artifact of every line, for repos some analysed artifact was built from; else null (built.rs:276-340).

Worked example. Room fixture room_feed/room_tests.rs:190, repo shop, 4 features seen:

With the ENABLES edges removed (room_tests.rs:216), built = ∅, so all four are never-built and unused becomes never-built+unreached.

Unit fixture zombie.rs:478: korp/spark41 gates one compiled item with 0 inbound, korp/live one with 2. Both built. Result: one zombie, spark41, unreached.

The offline fold over a dump (dwarves mimir --wh <dump> zombie, crates/mimir-lens/src/mimir/zombie.rs) judges the same way. The adapter (coverage/v2.rs) marks each feature_gate_facts row with compiled_out (the item is a cfg_gated_out stub) and item_kind. Per (repo, feature) the item keys split into four sets. A key compiled in one unit is judged even when another unit compiled it out.

negated      = keys whose cfg names f only under not(…)     (feature_mentions)
compiled_out = keys present only as cfg_gated_out stubs
roots        = crate roots gated by #![cfg(…)]               (a target is run, never called)
judged       = every other key
unreached    = judged ≠ ∅ ∧ Σ inbound CALLS over judged = 0
not_judged   = features with gates and judged = ∅ (and not never-built), listed with
               the three counts and named in the evidence note: UNKNOWN, not clean

Worked example: on the Holger h32 dump, front gates 27 keys. 25 are cfg_gated_out stubs, because the dump built holger-server-lib without front: the 6 helpers and 2 tests in exposed/http.rs, the same 8 again in each of the two test crates that compile that module, and one test in what_is_open_is_the_rons.rs. The other 2 sit under not(feature = "front"): the crate tests/a_build_without_front_compiles.rs and its test. No key is judged, so front is NOT JUDGED, with 25 compiled out and 2 under not(…). It used to read "unreached 27": the stubs have no callers because rustc never compiled them. In the source, handle calls all six helpers when front is on (exposed/http.rs:1013-1091). Test fixture: tests/mimir_v2_dump.rs a_feature_the_dump_compiled_out_names_only_under_not_or_gates_a_crate_root_is_not_unreached.

The golden reads zombies 7, severe 7, features_seen 80 (all 7 never-built), with 25 features not judged (crates/mimir-lens/tests/golden/holger-h32-9dbe5cbf.json). Before the FRONT-ZOMBIE fix it read 25 zombies, of which 18 were unreached only because the dump compiled their code out or the fold read not(…) and crate-root gates as the feature's code.

Output. features_seen, repos_with_gates, build_space_unknown, zombies, severe, zombies_shown, resolution; rows repo, feature, direction, gated_items, compiled_out_items, partial_items, negated_items, inbound_calls, bytes_in_binary, sites (zombie.rs:95-115).

Limits. A cfg naming a feature with no GATED_BY edge is a gap (lenses.rs:251-262). cfg_attr predicates, macro $metavariable feature names and dependency gates of compiled-out items are lower bounds (lenses.rs:270-272). The feature excused set matches by feature name in every crate of the repo (zombie.rs:268-272).

Tests. zombie.rs:433, :445, :478, :488, :501, :510, :524, :531, :539; room_tests.rs:190, :216; built_tests.rs:243.

change_risk

Call. gRPC Mimir.ChangeRisk (server_grpc.rs:3334), MCP mimir_change_risk (mcp_stdio.rs:1761), or dwarves mimir risk without a local dump. Params repo, limit.

Math. Per file F of the request's repos, over the callables (fn, method) in F that are not tests (is_test, or inside a cfg that requires test):

callers(F)  = Σ_{f ∈ F} Σ_{e : CALLS → f} count(e)      -- sites from anywhere in the room, tests included
churn(F)    = git_heat_facts.commits_90d of (repo, file), latest snapshot; 0 if absent
cov(F)      = min(covered, functions) / functions        (0 when functions = 0)
covered     = line basis:  |{ f ∈ F : some coverage_fn row landing on f has
                                      regions_covered > 0 or lines_covered > 0 }|
              reach basis: |{ f ∈ F : f ∈ T }|
T           = reach(is_test nodes of the request, CALLS) ∪ { targets of TESTS from them }
risk(F)     = callers(F) · churn(F) · (1 − cov(F))

The basis is per repo: line when that repo's newest coverage_fn run exists (newest by (ts_micros, run_id)), else reach (lenses.rs:365-370, rows.rs:316-325). A coverage row lands on the innermost room function whose span holds its first line: among candidates with line ≤ row.line ≤ max(end_line, line), the largest start line, then the smallest end line (risk.rs:135-160). Files with risk = 0 are dropped after files_scored is counted. Rows sort by risk descending, then file (risk.rs:164-226). Reach is more generous than line coverage, so the reach basis under-reports risk; the answer says so (lenses.rs:383-388).

GraphBLAS steps.

Dataflow.

code_nodes(fn,method) ──► callables ──┬─ CALLS in-edges (Σ count) ──► callers(F)
                                      └─ ∈ T ? ──────────────────────► covered (reach)
code_nodes(is_test) ──reach CALLS (ANY.PAIR)──► T ∪ TESTS targets
coverage_fn (newest run per repo) ──span join──► covered (line)
git_heat_facts (latest) ──(repo,file)──► churn(F)
        ▼
risk(F) = callers · churn · (1 − covered/functions)  → drop 0 → sort desc
        ▼
worst[ repo, file, risk, downstream_callers, churn_90d, coverage_frac, coverage_basis, explain ]

Worked example. Room fixture room_feed/room_tests.rs:237, repo shop, no coverage_fn (reach basis), files_scored = 4:

The fourth file has risk 0 and is scored but not listed. The test pins the three rows and risk = 48.0 for the first (room_tests.rs:249-250).

Unit fixture risk.rs:266, heat commits_90d = 20: one fn, uncovered, 10 callers gives 10 · 20 · 1 = 200. Two fns, one covered, gives 10 · 20 · 0.5 = 100. Fully covered gives 0, so the file is scored (files_scored 1) and not listed.

On Holger, only the dwarves counterpart has recorded numbers: golden files_scored 616, units 324, without churn (crates/mimir-lens/tests/golden/holger-h32-9dbe5cbf.json; plan §D, "risk ranks without git heat").

Output. files_scored, units, coverage_basis, semver_available (false), model_attribution, changed_uncovered[repo, file, fn, line, commit]; rows repo, file, risk, downstream_callers, churn_90d, coverage_frac, coverage_basis (line | reach), explain (risk.rs:67-87, lenses.rs:405-407).

Limits. Without a coverage run the basis is reach and risk is under-reported (lenses.rs:383-388). semver_diffs has no producer (lenses.rs:390). A fn without a span belongs to no file and is not scored (lenses.rs:373-375). Every caller count is a lower bound (CALLS_LOWER_BOUND, room_feed.rs:89).

Tests. risk.rs:255, :266, :288; room_tests.rs:237; room_feed/feed_tests.rs:297, :341 (ignored: needs cargo-llvm-cov).

weak_tests

Call. gRPC Mimir.WeakTests (server_grpc.rs:3424), MCP mimir_weak_tests (mcp_stdio.rs:2050). Params repo, limit.

Math. Constants: MIN_RUNS = 3, MIN_VERSIONS = 2, PLACEBO_CHURN = 5 (weak.rs:18-26). A case "ran" unless its status is ignored or skipped (rows.rs:152-154). Its repo and code version come from its bench_runs row (version = commit, else version string), else from the case row itself (weak.rs:144-157, rows.rs:112-114). Per (repo, test_name):

runs     = |distinct run_id|       versions = |distinct non-empty code versions|
failures = cases with passed = false
churn    = Σ commits_90d over the DISTINCT files of
           { o ∈ reach_each(test node, CALLS) ∖ {test} : origin Local, defined }
symbols  = | that set |

verdict = OK (proven red)   if failures > 0
        = NO-DATA            else if runs < 3
        = NO-DATA            else if versions < 2
        = PLACEBO            else if churn ≥ 5
        = CANNOT-GO-RED      otherwise

Findings are PLACEBO and CANNOT-GO-RED. They sort PLACEBO first, then churn descending, runs descending, test name (weak.rs:184-243). PLACEBO_CHURN is a floor: the code compares with ≥, so the fifth commit counts, and the constant's doc says why (five commits in a quarter is the least churn that gave the test a real chance to go red; weak.rs, nornir 624abb34). The dwarves copy in crates/mimir-lens/src/coverage/weak.rs says the same (dwarves 847d752).

The test node is found by name: same repo, same leaf name, and the node's path equals the name or ends with ::name. Exactly one hit joins; none or several leave the test on run history alone (lenses.rs:626-638). With a repo filter only the worst list is cut to that repo (lenses.rs:669-674); the counters tests_seen, judgeable, placebos and the rest are folded over every repo in test_outcomes (lenses.rs:667).

GraphBLAS steps.

Dataflow.

test_outcomes ──ran()──► (repo, test_name) ◄── bench_runs (run_id → repo, version)
        │ runs, versions, failures
code_nodes(is_test) ──name join──► one test node ──reach_each CALLS (ANY.PAIR, mxm)──► reached
reached ∩ Local ∩ defined ──file──► git_heat_facts(latest).commits_90d ──Σ distinct files──► churn
        ▼
verdict rules (MIN_RUNS 3, MIN_VERSIONS 2, PLACEBO_CHURN 5)
        ▼
worst[ repo, test_name, verdict, runs, versions, failures, churn_commits_90d, reachable_symbols ]

Worked example. Unit fixture weak.rs:366: three runs of korp at versions 0.1.0, 0.1.1, 0.2.0; korp.hot and korp.cold pass in all three.

korp.hot : failures 0; runs 3 ≥ 3; versions 3 ≥ 2; churn 40 ≥ 5  → PLACEBO
korp.cold: failures 0; runs 3 ≥ 3; versions 3 ≥ 2; churn 1 < 5   → CANNOT-GO-RED
sorted: PLACEBO first → korp.hot, korp.cold; placebos = 1
the same churn keyed to repo skade → korp.hot has churn 0 → placebos = 0  (weak.rs:405-406)

Room fixture room_tests.rs:326, repo shop: tests_seen 3, judgeable 3, placebos 1, churn_joined 2. pay::charges_once reaches charge, audit, shell and libc_write (4 symbols), all in src/pay.rs (12 commits in 90 days): PLACEBO, churn 12. cart::tests::adds_up reaches add, total and open in src/cart.rs (2 commits): CANNOT-GO-RED, churn 2, symbols 3. ghost::never_compiled joins no test node: CANNOT-GO-RED on run history alone, churn 0, symbols 0.

Fixture weak.rs:331: adds_up passes in runs s1, s2 (commit c1) and s3 (c2), so runs 3 and versions 2: CANNOT-GO-RED. pay::charges_once fails once: OK. pay::slow is ignored and is no test seen.

Output. outcome_rows, tests_seen, judgeable, proven_red, insufficient, placebos, churn_joined; rows repo, test_name, verdict, runs, versions, failures, churn_commits_90d, reachable_symbols (weak.rs:113-130).

Limits. A repo without a filed test run is a gap (lenses.rs:611-619). Names that join no single #[test] node are counted and named (lenses.rs:659-666). The reach is a lower bound (lenses.rs:622-624).

Tests. weak.rs:331, :351, :366, :410; room_tests.rs:326; feed_tests.rs:216.

bench_gaps

Call. gRPC Mimir.BenchGaps (server_grpc.rs:3433), MCP mimir_bench_gaps (mcp_stdio.rs:2080). Params repo, limit.

Math. A module is the nearest Module or Crate ancestor of a callable (crates/mimir-room/src/attrs.rs:174-187). Per module m of repo r, over its non-test callables:

fan(m)    = Σ CALLS sites into its fns            churn(m) = Σ commits_90d over its files
cov(m)    = min(fns_covered, fns_total) / fns_total   (reach basis: fn ∈ T, as in change_risk)
hint(m)   = 1 if the module path (lowercase) contains one of the 23 PERF_MODULE_HINTS, else 0
max_fan   = max(1, max_m fan(m))                  max_churn = max(1, max_m churn(m))

score(m)  = 0.40 · fan(m)/max_fan + 0.25 · churn(m)/max_churn + 0.25 · (1 − cov(m)) + 0.10 · hint(m)

Coverage enters as 1 − cov: the less a module's fns are test-reached, the hotter the gap, and a module every test reaches is the last to need a bench (W_COVERAGE * (1.0 - cov), benchcov.rs; nornir 922c3714). Before that commit the code added + 0.25 · cov, so a better-tested module scored higher. The module doc says hot paths are ranked by "fan-in × churn × perf-name hint × test coverage" (benchcov.rs:4-6); the code computes the weighted sum above.

Test modules are no bench surface: a segment tests, test, *_tests, test_*, or ::benches in the path (benchcov.rs:113-118). The rest sort by score descending, then module, and are cut to limit BEFORE the gap is counted (benchcov.rs:207-214). So hot_paths = min(modules, limit).

arms(r)      = { result_name of bench_results whose run_id is a bench_runs row of r }
covers(a, m) = tokens(scenario(a)) ∩ tokens(m) ≠ ∅
               scenario(a) = text after the first '.', lowercased
               tokens(s)   = split on non-alphanumerics, length ≥ 3,
                             not a STOP_TOKEN (23 words), not a part of the repo name
benched(m)   = ∃ a ∈ arms(r) : covers(a, m)
gap          = HotPaths − Benched − Allowlist         (edda_autonom::compute_gap; allowlist = ∅)
never_benched(r) = no bench_runs row of r

(benchcov.rs:44-49, :122-164, :167-264; lenses.rs:438-511.) The top-level worst concatenates each repo's unbenched modules, repos with the most unbenched first, cut to limit (lenses.rs:491-502).

GraphBLAS steps.

Dataflow.

callables ─ CALLS Σ count ─► fan ; ∈ T ─► fns_covered ; span file ─► files
        │ group by module_of
git_heat_facts(latest, repo) ──Σ over files──► churn
        ▼
score = .40 fan/max + .25 churn/max + .25 (1−cov) + .10 hint ──► sort, cut to limit
bench_runs(repo) ⋈ bench_results ──► arms ──token match──► benched
        ▼
per_repo[ repo, hot_paths, benched, unbenched, bench_runs, bench_arms, never_benched,
          worst[ module, surface_id, fan_in, commits_90d, test_coverage, score, hint ] ]

Worked example. Unit fixture benchcov.rs:333, repo korp, heat 30 commits on the file of korp::hot:

modules (tests excluded): called fan 9 · hot churn 30 · covered cov 1 · quiet
(each module has one fn; only covered's fn is test-reached, so the others have cov 0)
max_fan = 9, max_churn = 30, no module name carries a hint
called  = 0.40 · 9/9 + 0.25 · (1 − 0)    = 0.65
hot     = 0.25 · 30/30 + 0.25 · (1 − 0)  = 0.50
quiet   = 0.25 · (1 − 0)                 = 0.25
covered = 0.25 · (1 − 1)                 = 0.00
order: called, hot, quiet, covered   (as asserted at benchcov.rs:342)

Unit fixture benchcov.rs:324: arm znippy.decode_mt → scenario decode_mt → tokens {decode} (mt is shorter than 3). Module znippy::decode → tokens {decode} (znippy is the repo). They intersect, so decode is benched; znippy::encode and znippy::caller are not.

Room fixture room_tests.rs:281, repo shop: shop::pay has fan 8 (the maximum), churn 12 (the maximum) and coverage 0.5, so its score is `0.40 + 0.25

• 0.25 · (1 − 0.5) = 0.775. With 1 − cov, the less-reached module is the hotter gap; the room test asserts the order shop::pay, shop, shop::cart, shop::util (room_tests.rs:290`). The fixture has 3 runs and 0 arms, so all 4 hot paths are unbenched.

Output. repos, per_repo[...] as above, worst (rows plus repo) (lenses.rs:474-509).

Limits. No bench run filed is a gap (lenses.rs:463-468). The allowlist is empty (lenses.rs:473). The arm match is by name tokens, not by what the bench calls.

Tests. benchcov.rs:295, :314, :324, :333; room_tests.rs:281; feed_tests.rs:259.

villa

Call. gRPC Mimir.Villa (server_grpc.rs:3442), MCP mimir_villa (mcp_stdio.rs:2155). Params repo, limit. Repo-scoped: with a repo it opens that repo's room alone.

Math. The impure items are nodes whose name is one of 13 IMPURE_NAMES and whose resolved path classify accepts (villa.rs:170, graph.rs:293-307):

classify(path, kind) =
  process          if path ends "process::Command::new"
  shell            if last segment ∈ {system, popen, execvp, execv, execve, execvpe,
                                       execl, execlp, execle, exec}
                      and (kind = ffi or root ∈ {libc, nix, rustix}
                           or (last = exec and path contains "process::"))
  process-control  if root = std and path ends "process::exit" or "process::abort"
  none             otherwise
process + a string literal in Command::new("…") on the site line or the next two
        → external-tool, known_tool = the literal         (no '\' and no '{' in it)

One finding per positioned CALLS site from a Local caller of the request's repos. When an edge counts more sites than it has positions, one extra finding is placed at the caller's own line (lenses.rs:124-133). Sort key: weight external-tool 3 > shell 2 > process 1 > process-control 0, then repo, file, line, symbol (villa.rs:62-69, :301-309). Severity: external-tool and shell high, process medium, process-control low (villa.rs:71-77).

The doc of Heresy::known_tool still speaks of a KNOWN_OFFENDERS list (villa.rs:92-95). No such list exists; the tool is the literal read at the call site (villa.rs:157-166, :257-263).

GraphBLAS steps. None.

Dataflow.

name lookup (new, exit, abort, system, exec*, popen) ──classify(path, kind)──► impure items
CALLS edges ─► to impure, from Local caller in repos ──► sites (file, line) per edge
clone/<repo>/<file> lines[line..line+2] ──"Command::new(\"…\")"──► binary
        ▼
kind ← process | shell | control ; process + literal → external-tool
        ▼
findings[ repo, symbol, loc, kind, severity, callee, known_tool, evidence_note ] ; by_kind

Worked example. Room fixture room_tests.rs:98, repo shop, 3 heresies:

Unit fixture villa.rs:386: a Command::new site in znippy whose line spells "osmium" becomes external-tool, known_tool = osmium, severity high.

Output. edges_seen (all CALLS edges of the room, from its stats, lenses.rs:83), heresies, repos_with_heresy, by_kind; rows repo, symbol, loc, file, line, kind, severity, callee, known_tool, evidence_note (villa.rs:120-149).

Limits. A binary held in a variable or built by format! is not named (villa.rs:157-166). Builder methods (spawn, output, arg) are never anchors, so one shell-out is one finding (villa.rs:198-200). A room without CALLS reads as a missing feed, not as "no heresy" (villa.rs:443).

Tests. villa.rs:344, :360, :375, :386, :401, :411, :431, :443, :451; room_tests.rs:98, :134, :157, :174; tests/mimir_villa_robot.rs:17.

churn

Call. gRPC Mimir.Churn (server_grpc.rs:3475), MCP mimir_churn (mcp_stdio.rs:2186). Params band (high default, low, band), cutoff_low, cutoff_high (both default 0), repo, limit. Repo-scoped.

Math. Every git_heat_facts generation forms one series per (repo, file), sorted by (ts_micros, snapshot_id) (change_series.rs:88-127). The filter reads the newest point p:

frequency = p.commits_90d
complexity(F) = | fn + method nodes of the room whose span lies in F |   (tests included)
hotspot = frequency · complexity                      (saturating)

high-pass : keep frequency ≥ cutoff_high   sort hotspot ↓, frequency ↓, repo, file
low-pass  : keep frequency ≤ cutoff_low    stable_but_changed = (p.commits_30d > 0)
                                           sort stable_but_changed first, commits_30d ↓,
                                                complexity ↓, repo, file
band-pass : keep cutoff_low ≤ frequency ≤ cutoff_high   sort as high-pass

(churn_filter.rs:150-228; lenses.rs:412-433.) Band::parse maps low, low-pass, lowpass, stable to low-pass, band, band-pass, bandpass to band-pass, and everything else to high-pass (churn_filter.rs:49-56). With the default cutoff 0 the high pass keeps every file.

The module doc says complexity is the count of fn items from symbol_facts (churn_filter.rs:20-21, :147). The code counts the room's fn and method nodes per span file (lenses.rs:415-422). That count includes test fns: the fixture's pay.rs holds 7 = 6 + its test (room_tests.rs:268), while change_risk excludes tests.

GraphBLAS steps. None.

Dataflow.

git_heat_facts (ALL snapshots) ──group (repo,file), sort ts──► series ──latest()──► p
code_nodes(fn,method) ──span file──► complexity(F)
        ▼
band filter on p.commits_90d ; hotspot = commits_90d · complexity ; low: commits_30d > 0
        ▼
worst[ repo, file, frequency, commits_total, commits_30d, complexity, hotspot,
       stable_but_changed, explain ]

Worked example. Room fixture room_tests.rs:263, repo shop, high pass, cutoff 0:

The test pins complexity and hotspot. The frequency column follows from them (84 / 7 = 12, and so on) and matches the churn that change_risk reads from the same fixture. With band low, cutoff_low 2, the files with commits_90d ≤ 2 pass: cart.rs (2) and util.rs (0).

Unit fixture churn_filter.rs:265, cutoff_high 10: hot (30 · 12 = 360) and warm (12 · 2 = 24) pass; cold (1) is filtered.

Output. band, cutoff_low, cutoff_high, nodes_seen, passed, stable_changes_flagged, model_attribution; rows as in the dataflow (churn_filter.rs:117-142).

Limits. An empty series names the git_heat feed; a repo filter with no row is a gap (room_feed.rs:381-397). A churned file with no function the room knows has complexity 0 (lenses.rs:426-429).

Tests. churn_filter.rs:265, :296, :327, :339; change_series.rs:179, :198, :210, :224; room_tests.rs:263.

anomaly

Call. gRPC Mimir.Anomaly (server_grpc.rs:3484), MCP mimir_anomaly (mcp_stdio.rs:2221). Params z_threshold (default 3.0; a value ≤ 0 keeps the default, room_feed.rs:366-369), repo, limit. Roomless: it reads git_heat_facts only.

Math. Constants: z_threshold 3.0, min_history 6, stable_baseline 0.5, ewma_alpha 0.4 (anomaly.rs:135, :154-163). Per file, the increments are the change counts per interval (change_series.rs:66-79):

x₀ = commits_total(p₀)                        -- the backfilled history of the first scan
x_k = max(0, commits_total(p_k) − commits_total(p_{k−1}))   for k ≥ 1
μ, σ = population mean and standard deviation   (σ = √(Σ(x−μ)²/n))
EWMA:  s₁ = x₁;  s_k = α·x_k + (1 − α)·s_{k−1},  α = 0.4
z(o; μ, σ) = (o − μ)/σ                 if σ > 1e-9
           = max(z_threshold, 4.0)     if σ ≤ 1e-9 and o > μ       -- saturated
           = 0                         otherwise
z_ewma     = (o − s)/σ  with s = the EWMA of the baseline, if σ > 1e-9;  else z

For kinds (a) and (b) a row needs z ≥ z_threshold, o > μ AND z_ewma ≥ z_threshold (anomaly.rs:181-205). A slow ramp lifts the EWMA with it, so its latest interval is far above the plain mean but not above the EWMA, and it does not fire. (Before nornir ca92f7b7 the EWMA was computed and printed but gated nothing.) The unit test a_slow_ramp_is_not_a_spike (anomaly.rs:473) uses increments 1, 2, 3, 4, 5, 6, 7 with z_threshold 1.5: the code comment records the latest interval as 2.1 σ above the plain mean of its history but only 1.4 σ above the EWMA, so it is not a spike.

The four kinds:

Breadth of a snapshot = the number of files of the repo whose increment at that snapshot is > 0. Its baseline includes the first snapshot, whose increments are backfill totals. Rows sort by z descending, then kind (stable-node-churn < spike < breadth-outlier < new-coupling), then subject. (anomaly.rs:166-271, :276-342, :347-400.)

Code-vs-doc differences:

• Params::min_history's doc says "≥ 3 ⇒ ≥ 2 baseline increments" (anomaly.rs:142-143). The default is 6 (MIN_HISTORY, :135).
• The breadth fold orders snapshots by the STRING "{ts}\u{1}{sid}" (anomaly.rs:296-301). That is numeric order only while every ts_micros has the same number of digits.
• The test comment says b, c and d "all fired at s3" (anomaly.rs:595). The fixture fires them at s6 (:571).

GraphBLAS steps. None.

Dataflow.

git_heat_facts (ALL snapshots) ──(repo,file) series──► increments x₀..x_{n−1}
        ├─ n ≥ 6: baseline x₁..x_{n−2}, observed x_{n−1} ──z──► stable-node-churn | spike
        ├─ per repo per snapshot: #files with x>0 ──z over snapshots──► breadth-outlier
        └─ quiet (μ ≤ 0.5) and fired (o > 0), ≥ 2 per repo ──pairs──► new-coupling (proxy)
        ▼
worst[ repo, subject, kind, baseline, observed, z, evidence_note ] ; insufficient_history

Worked example. Fixture anomaly.rs:430: src/core.rs has commits_total 5, 5, 5, 5, 5, 5, 25 over seven scans.

x = [5, 0, 0, 0, 0, 0, 20]                n = 7 ≥ 6
baseline = x₁..x₅ = [0, 0, 0, 0, 0]       μ = 0, σ = 0
observed = 20 > μ, σ = 0 → z = max(3.0, 4.0) = 4.0 ≥ 3.0
μ = 0 ≤ 0.5 → stable-node-churn

Fixture anomaly.rs:495: totals 5, 10, 15, 20, 25, 30, 70 give x = [5, 5, 5, 5, 5, 5, 40], baseline [5, 5, 5, 5, 5], μ = 5, σ = 0, observed 40 > 5, so z = 4.0. μ = 5 > 0.5, so the kind is spike.

Fixture anomaly.rs:552: file a moves at each of six snapshots; b, c, d hold 0 and jump to 5 at s6.

breadth per snapshot: s1..s5 = 1, s6 = 4
baseline [1,1,1,1,1] μ = 1, σ = 0; observed 4 > 1 → z = 4.0 → breadth-outlier
b, c, d: x = [0,0,0,0,0,5], baseline [0,0,0,0] μ = 0, observed 5 → z = 4.0 → stable-node-churn each
a: x = [1,1,1,1,1,1], observed 1 = μ → nothing
quiet and fired: b, c, d → new-coupling b~c, b~d, c~d at z = 3.0

Fixture anomaly.rs:533: four scans give 4 increments < 6, so nothing is judged and insufficient_history = 1.

The minimum of 6 is measured. On loki on 2026-10-16 (about 2.25 generations per file), min_history = 3 gave 50 alarms, all "baseline 0.00, churned 1, z 4.0" (anomaly.rs:130-134, :528-531).

Output. z_threshold, nodes_seen, insufficient_history, min_history, anomalies_found, model_attribution; rows repo, subject, kind, baseline, observed, z, evidence_note (anomaly.rs:105-128).

Limits. When no file has 6 scans, nothing is judged and the answer says "not enough history" as a gap (room_feed.rs:371-376). New coupling is a churn-correlation proxy: git_heat_facts holds no per-commit file set (change_series.rs:14-21).

Tests. anomaly.rs:430, :495, :518, :533, :552; room_tests.rs:62, :83.

world_impact

Call. gRPC Mimir.WorldImpact (server_grpc.rs:3493), MCP mimir_world_impact (mcp_stdio.rs:2253). Params repo, limit.

Math. Per repo with consumer seq s ≥ 2, the commit window s−1 → s. It is read from the READ-FAST zone when it can answer, else folded from two as-of rooms and Room::diff (lenses.rs:1220-1249, :1288-1371). The window is kept per (repo, seq), two per repo (world_impact.rs:141-154).

item(n)   = level Item, origin Local, defined
public(n) = effective_visibility ∈ {direct, reexported}
per crate c of the window:
  added   = |added item nodes|      added_public   = |… that are public|
  removed = |removed item nodes|    removed_public = |… that are public|
  changed = |item nodes whose payload hash differs|   (doc-only edits count)
  seeds(c) = monikers of the removed and changed items  (added items are no seed)
breaking  = removed_public > 0
bump      = major if breaking, else minor if added_public > 0, else patch
world_callers(c) = { repo(o) : o ∈ dependents(seeds(c)) } ∖ {own repo, repos starting '@'}
constellation(c) = BFS over dep_graph_edges (latest snapshot), crate names normalised (−→_, lowercase):
                   seeds = consumers_of_crate(c) ∪ dependents_of_repo(p) for p ∈ producers_of_crate(c);
                   step  = dependents_of_repo(repo)
world_impact = |world_callers| + |constellation|
sort: breaking first, world_impact ↓, |world_callers| ↓, world_repo, crate_name

(world_impact.rs:187-244, :260-332; lenses.rs:1250-1280.) The diff matches nodes by moniker in a merge of the two sorted moniker lists; equal monikers with different payload hashes are changed (crates/mimir-room/src/diff.rs:76-128).

GraphBLAS steps.

Dataflow.

code room seq s−1 → s ──(zone | as-of diff)──► added / removed / changed items per crate
        │ removed + changed monikers = seed set per crate
        ▼
W = (CALLS ∨ USES_TYPE ∨ IMPLEMENTS ∨ FOR_TYPE)ᵀ ∨ diag(impls)·CONTAINS
reach_sets(seed sets, W) ──repo of reached ∖ own ∖ '@*'──► world_callers
dep_graph_edges (latest) ──consumers ∪ producers' dependents, BFS──► constellation_dependents
        ▼
worst[ world_repo, crate_name, added_items, removed_items, changed_items, suggested_bump,
       breaking, world_callers, world_caller_count, constellation_dependents,
       constellation_count, world_impact, explain ]

Worked example. Room fixture room_tests.rs:606. Shop's seq 2 adds hello (pub), removes bye (pub(crate)) and removes refund (pub, called by web).

added = 1, removed = 2, changed = 0
removed_public = 1 (refund) > 0 → breaking, bump major
seeds = {bye, refund} → dependents reach web's caller → world_callers = [web]
dep_graph_edges missing → constellation = [] (named as a missing feed)
world_impact = 1 + 0 = 1 ; world_repo "shop@1→2"

Unit fixture world_impact.rs:412: edges app → lib via lib_c, lib → util via util_c; a change to crate util-c with no callers.

norm("util-c") = util_c
consumers_of_crate[util_c] = {lib} → seen {lib}
producers_of_crate[util_c] = {util}, dependents_of_repo[util] = {lib} → already seen
BFS: dependents_of_repo[lib] = {app} → seen {lib, app}; dependents_of_repo[app] = ∅
constellation = [app, lib], world_impact = 0 + 2 = 2

Fixture world_impact.rs:369: serde removes 3 public items and has 3 caller repos (breaking, major, impact 3). leaf adds 5 (minor, impact 0). serde ranks first.

Output. changes_seen, breaking_changes, model_attribution; rows as in the dataflow (world_impact.rs:88-113).

Limits. A repo needs two consumed commits (lenses.rs:1222-1225, :1273). Callers outside the workspace and published semver diffs have no producer; the answer always says so (lenses.rs:1276). A two-seq window folded on the fold path builds two uncached rooms; kept windows avoid that on later asks (room_tests.rs:633).

Tests. world_impact.rs:369, :394, :404, :412, :425, :433; room_tests.rs:606, :633, :650.

binary_drift

Call. gRPC Mimir.BinaryDrift (server_grpc.rs:3506), MCP mimir_binary_drift (mcp_stdio.rs:2284). Params repo, limit, history (default 1; gRPC and MCP do not pass it, so it is always 1 from those doors, built.rs:217). Roomless.

Math. Per line (repo, variant, file, target, sorted features), the filings oldest first. Runs of equal sha256 collapse to the last of the run (built.rs:224-233). Fewer than 2 distinct filings: the line is single. Otherwise the last history successive pairs (from, to) are diffed with nornir_introspect::diff::diff_reports of the two analyses (built.rs:242-251). For one pair:

explained_by = source     if from.commits ≠ to.commits      (any repo's commit)
             = toolchain  else if from.toolchain ≠ to.toolchain
             = nothing    otherwise
per changed symbol s, kind ∈ {symbol-added, symbol-removed, symbol-grew, symbol-shrunk}:
  first_party = crate(s) (− → _) equals the package, the repo, or the file name
  reach       = suspicious_tag(name(s)) if kind = symbol-added   (14 fragments:
                process-spawn, process-exit, exec, shell, network)
  class       = glue | runtime | derive | code        (by GLUE_MARKERS, RUNTIME_PREFIXES,
                                                        DERIVE_TRAITS on the erased name)
  severity    = high    if explained_by = nothing or reach present
              = medium  else if first_party
              = low     otherwise
rank = (severity 3/2/1, first_party, |delta_bytes|) descending, then symbol
unexplained = |{severity = high}|      explained = |changes| − unexplained
attested    = unexplained = 0 and at least one analysed pair

(binary_drift.rs:749-807, :811-821, :869-981.) Features are part of the line, so they never differ inside a pair. provenance_changed lists commits and toolchain; its doc also names builder … (binary_drift.rs:786-787), which the code does not compare. The JSON field repos_with_drift carries the number of LINES with drift (binary_drift.rs:1033, :948-950).

The module's source-versus-binary fold (report_from, fold_repo, binary_drift.rs:524-624) has no feed today: no room holds linked symbols, so the wire lens answers successive only (binary_drift.rs:57-64).

GraphBLAS steps. None.

Dataflow.

bin_ingest_runs(@build-thing) ──► filings per line (oldest first) ──collapse equal sha256──► distinct
        │ windows(2), last `history`
        ▼
symbol_sizes[from.sha256], symbol_sizes[to.sha256] ──diff_reports──► added / removed / grew / shrunk
provenance(from, to) ──► explained_by ∈ {source, toolchain, nothing}
        ▼
severity, class, reach, rank
        ▼
attested, attestation, steps[…], single, cant_catch,
findings/worst[ repo, variant, artifact, binary_symbol, demangled, kind, severity, crate, class,
                before, after, delta_bytes, first_party, explained_by, from/to_commit, from/to_sha ]

Worked example. Real build room_feed/built_tests.rs:200: the probe crate is built and filed twice; the second commit replaces the body of checksum.

sha256(first) ≠ sha256(second) → 2 distinct filings → 1 pair
commits differ → provenance_changed[0] = "commit binlens-probe …" → explained_by = source
checksum: crate binlens-probe = repo → first_party; not an added network/process reach
severity = medium (not "nothing", no reach, first party)
no high change → unexplained = 0, one analysed pair → attested = true
rank: the first-party change sorts above dependency churn (findings[0].first_party = true)

A single filing gives empty_gap with "filed once … ⚒ Build it again after a change" and attestation UNKNOWN (built_tests.rs:190-192). The test records no byte counts.

Output. As in the dataflow; also binary_symbols_seen, first_party_symbols, explained, unexplained, by_kind, edges_evaluated: false (binary_drift.rs:1003-1043).

Limits. One filing per line has nothing to compare (built.rs:254-258). Sizes, not bytes: a body change that keeps every size shows only as a different sha256 (built.rs:265). Binary call edges have no producer, so an injected call inside an unchanged symbol is not evaluated (built.rs:266). The full list is SUCCESSIVE_CANT_CATCH (binary_drift.rs:707-713).

Tests. room_feed/built_tests.rs:149, :200 (the successive fold); binary_drift.rs:1070, :1082, :1105, :1130, :1138, :1148, :1162, :1172, :1201 (the source-versus-binary fold).

data_reach

Call. gRPC Mimir.DataReach (server_grpc.rs:3518), MCP mimir_data_reach (mcp_stdio.rs:2314). Params repo, limit, class (syscall classes; gRPC and MCP do not pass it).

Math. code = every Local, defined node of the request's repos (lenses.rs:1074). One row per TOUCHES_TABLE edge f → table with f ∈ code:

reachers(f)   = sorted, deduplicated display paths of
                dependents_by(f, CALLS, within code) ∖ {f}    -- backward CALLS walk inside code
reach_breadth = |reachers(f)|                                -- the full count
public_entry  = f or some reacher has an effective visibility that is public API
sensitivity   = label of the FIRST of 14 SENSITIVE_PATTERNS whose substring the lowercased
                table name contains: pii, personnummer, person → pii; secret → secret;
                token, cred, password, passwd, apikey, api_key, vault, key_material
                → credential; saga, audit → audit-pii; else ""
writes        = access ∈ {write, both}
sort: sensitive first, writes first, reach_breadth ↓, public_entry first, (table, accessor_fn)
per table: readers = Σ [access ≠ write], writers = Σ [access ≠ read], sites = Σ site_count,
           reach = |{accessor_fn} ∪ reachers| over its rows
leak path = a row with sensitivity ≠ ""

A table name not known at compile time is no row: it goes to unresolved, sorted by site count (data_reach.rs:222-303). reachers lists at most 64 names; reach_breadth stays exact (data_reach.rs:57, :254-255). Edges without access read unknown (lenses.rs:1135-1152).

The module doc lists "key" among the sensitive name fragments (data_reach.rs:18-19). There is no bare key pattern; only apikey, api_key and key_material (data_reach.rs:39-54).

The walk has two paths. The reference path (NORNIR_REACH_INC=0) walks every toucher (lenses.rs:1099-1115). The default path is the kept walk reach_inc::table_reachers (lenses.rs:1116-1122). It fingerprints every code node by its CALLS successors inside code, its path and its API flag. It re-walks only the touchers that changed, that a changed node reaches now, or whose kept reachers hold a changed node. The others keep their reachers (reach_inc.rs:779-888). The two paths must give equal answers (reach_tests.rs:196).

GraphBLAS steps.

Dataflow.

code_edges(TOUCHES_TABLE) from code ──► (f, table | unresolved, access, sites, count)
A_CALLSᵀ ─mask_by(code)─► Aᵀ_code ──reach_each(touchers) ANY.PAIR──► reachers(f)
effective_visibility(f, reachers) ──► public_entry
table name ──SENSITIVE_PATTERNS──► sensitivity
        ▼
sort (sensitive, writes, breadth, public) ; per-table readers / writers / sites / reach
        ▼
worst[ table, sensitivity, accessor_fn, crate_name, repo, access, sites, site_count,
       reachers (≤ 64), reach_breadth, public_entry, explain ] ; tables ; unresolved ; syscalls

Worked example. Room fixture room_tests.rs:721, repo shop: 4 edges with a known table, 3 tables, 2 leak paths.

rank: audit (sensitive, write, 3) > charge (sensitive, write, 2)
      > dead (not sensitive, both = write) > open (not sensitive, read)
orders: readers = [both ≠ write] + [read ≠ write] = 2 ; writers = [both ≠ read] = 1
        sites = 2 ; reach = |{dead} ∪ {open, Cart::total, adds_up, checkout}| = 5
unresolved: shop::pay::shell, 2 sites (src/pay.rs:33, :35)

Unit fixture data_reach.rs:367: one table, three fns. append (write, reachers cli::run, srv::submit), query (read, cli::run, viz::pane), compact (both, none). readers = 0 + 1 + 1 = 2, writers = 1 + 0 + 1 = 2, sites 3, reach = |{append, cli::run, srv::submit, query, viz::pane, compact}| = 6.

Output. access_edges_seen, tables_seen, tables[table, sensitivity, readers, writers, sites, reach], sensitive_tables, leak_paths_seen, unresolved_edges, unresolved_sites, unresolved[…], model_attribution, syscalls, syscall_functions_reaching, syscall_functions_seen; rows as in the dataflow (data_reach.rs:187-218; lenses.rs:1175-1195).

Limits. Closures, fn pointers, trait impls the producer did not see, and table names inside SQL text are a lower bound (lenses.rs:1035-1036). A lake made before mimir-schema 4 cannot tell "touches no table" from "not yet written" (lenses.rs:1078-1088). Without effective_visibility, public_entry is false everywhere and named as a gap (lenses.rs:1123-1125). Folding the dependency universe for the syscall part cost 8.2 M nodes and 951 s on the lake copy on 2026-10-19; it is skipped when the lake holds no syscall node (lenses.rs:1168-1179).

Tests. data_reach.rs:330, :351, :367, :380, :397, :407; room_tests.rs:721, :765, :787; room_feed/reach_tests.rs:120, :196.

trust

• Call. gRPC Mimir.Trust, MCP mimir_trust, CLI nornir mimir analyze trust --server <url> --repo <repo> [--act-at 0.66] [--hold-at 0.33] [--limit N] [--svg]. Repo-scoped (REPO_SCOPED, src/mimir_lens/mod.rs:146). A parameter that is 0 or missing keeps the default (room_feed/lenses.rs:986-991).
• Finds. For every program function: act, hold or refuse. The verdict is the best call chain from the entry surface to the function, scored by its weakest hop. The weakest hop is named (trust.rs:1-46).

Dataflow.

code room (Mímir v2 tables)
  code_nodes  fn + method, minus is_test and #[cfg(test)] code ──► scope S (mask)        lenses.rs:865-866
  code_edges  CALLS  S → impure items (villa::IMPURE_NAMES)    ──► impure kinds per fn   lenses.rs:874-901
  code_edges  CALLS  from is_test nodes, plus TESTS            ──► covered set C         graph.rs:216-228
  code_edges  CALLS  S → S                                     ──► A (boolean n×n), entry set E
                                                                    │
  local trust ℓ(v) per fn ──► weight w(v) = round(1000·ℓ)+1 ──────┤
                                                                    ▼
                         ops::bottleneck(E, A⟨S⟩, w)  (MAX.FIRST, MIN)  ──► b(v)
                                                                    │
                     t(v) = (b(v) − 1)/1000  ──► Bounds::decide ──► act / hold / refuse
                     witness: Room::path (MIN.PLUS layers) + hops_from ──► weakest_hop, depth
                                                                    ▼
  output: act, hold, refuse, unreachable, worst[func, crate_name, decision,
          inherited_trust, local_trust, weakest_hop, reason, depth, explain]

Math.

Local trust of one function v (trust.rs:323-358). Let K(v) be the impurity kinds of the impure items v calls, T(v) its sensitive table touches, and fed = the scope holds at least one test node.

penalty(kind):  Shell = 0.8,  ExternalTool = 0.8,  Process = 0.5,  ProcessControl = 0.3     trust.rs:163-169
sens(access):   write = 0.5,  any other access = 0.25                                      trust.rs:172-174
untested:       0.2                                                                         trust.rs:177

ℓ₀ = 1 − max_{k ∈ K(v)} penalty(k)          (1.0 when K(v) is empty)
ℓ₁ = clamp₀¹( ℓ₀ − Σ_{(a,t) ∈ T(v), t sensitive} sens(a) )      each touch stacks
ℓ  = clamp₀¹( ℓ₁ − 0.2 )   if fed and v ∉ C,   else ℓ₁

So impurity takes the WORST penalty, while sensitive touches and the untested penalty SUBTRACT on top of it. The production lens never fills T(v) (access: Vec::new(), room_feed/lenses.rs:915), so ℓ₁ = ℓ₀ there, and the answer always carries the gap "the sensitive-data term of local trust is NOT applied" (lenses.rs:907).

The integer weight scale (trust.rs:182-196): w(v) = round(1000·ℓ(v)) + 1, so w ∈ [1, 1001]. The +1 keeps "reached with trust 0" (weight 1) apart from "not reached" (no entry). The way back is t = (w − 1)/1000.

The entry surface (lenses.rs:922-932): E = { v ∈ S : no u ∈ S, u ≠ v, has CALLS u → v }. When E is empty (a fully cyclic scope), E = S.

Inherited trust is the widest path (bottleneck) value, computed as a frontier fixpoint on GraphBLAS (crates/mimir-graph/src/ops.rs:329-403):

A′ = diag(m_S) · A · diag(m_S)                                    (mask_by, ops.rs:409-436)
b⁰ = w⟨E⟩              f⁰ = b⁰                                     (ops.rs:337)
repeat while nvals(f) > 0:
  c(j) = max_{i : A′(i,j)} f(i)              c = f ⊕.⊗ A′,  ⊕ = MAX, ⊗ = FIRST
  c    = min(c, w)                           eWiseMult (intersection)
  g    = (c > b)                             eWiseMult GT (where both exist)
  f    = c⟨g, replace⟩ ;  f⟨¬struct(b)⟩ = c  (risen values, then first-time values)
  b    = max(b, c)                           eWiseAdd (union)

fixpoint:  b(v) = max_{paths P: e ⇝ v, e ∈ E}  min_{u ∈ P} w(u)
           t(v) = (b(v) − 1)/1000,  or 0 with "unreachable" when v has no b(v)

The values only rise and are drawn from the finite set of weights, so the loop ends. The seed's own weight caps every path from it (the path includes both ends).

Decision (trust.rs:131-158): t ≥ act_at (0.66) ⇒ act; else t ≥ hold_at (0.33) ⇒ hold; else refuse. An unreached node counts in unreachable and in refuse (trust.rs:382-406).

Ranking (trust.rs:382-406): only non-act verdicts are listed, sorted by decision (refuse before hold), then t ascending, then function name, then index; cut at limit (default 50).

Weakest hop (lenses.rs:994-1015). For a listed node v with value b(v):

caps(v)     = { u : w(u) = b(v)  and  b(u) = b(v) }
at_least(v) = { u : b(u) ≥ b(v) }
weakest(v)  = v                       if v ∈ caps(v)
            = first node of Room::path(caps(v) → v, CALLS, within at_least(v))   otherwise
depth(v)    = Room::hops_from(E, CALLS, within S)(v)

The path is the shortest one; ties go to the smallest target ordinal, then the smallest predecessor ordinal (crates/mimir-room/src/path.rs:37-44).

The kept walk (trust.rs:479-780). The lens keeps the last walk per workspace and repo, keyed by moniker hash, and plans Carry (nothing the walk reads changed), Advance (locals rose, nodes or edges appeared: a raise pass; a local fell: re-walk its forward cone, or the whole graph when the cone holds over half the nodes, trust.rs:689-697), or Full (entry surface moved, a node or edge is gone, a key collides). Both cheap paths are pop-the-max Dijkstra over the same weights and must equal ops::bottleneck.

GraphBLAS steps. GxB_ANY_PAIR_BOOL on a boolean matrix is the structural OR-AND (LOR.LAND) reach.

Worked example (fixture a_pure_leaf_behind_a_shellout_hop_is_refused_not_acted, trust.rs:973-1001). The chain is app::main → app::spawn_shell → app::format_arg, and spawn_shell calls libc::system (an ffi node, so villa::classify gives Shell, villa.rs:212-217). No coverage input.

ℓ(main) = 1.0          w = 1001
ℓ(spawn_shell) = 1 − 0.8 = 0.2   w = 201
ℓ(format_arg) = 1.0    w = 1001
E = {main}  (nobody calls it)

b⁰ = {main: 1001}                       f = {main: 1001}
hop 1: c(spawn_shell) = 1001, min(1001, 201) = 201; new ⇒ f = {spawn_shell: 201}, b += 201
hop 2: c(format_arg) = 201,   min(201, 1001) = 201; new ⇒ f = {format_arg: 201},  b += 201
hop 3: format_arg has no callee ⇒ c empty ⇒ f empty ⇒ stop

t(format_arg) = (201 − 1)/1000 = 0.20 < 0.33 ⇒ refuse
caps = {u : w(u) = 201, b(u) = 201} = {spawn_shell} ⇒ weakest_hop = app::spawn_shell
depth = 2

The test asserts exactly this: local 1.0, inherited 0.2, refuse, weakest hop app::spawn_shell, depth 2. The sibling fixture max_over_paths_takes_the_cleaner_route (trust.rs:1021-1036) gives target two entries: clean_entry → target offers 1001 and dirty_entry → shell → target offers min(1001, 501, 1001) = 501 (Command::new is Process, 1 − 0.5 = 0.5). The max is 1001, so target is act and absent from the list. With coverage, an untested helper is 1 − 0.2 = 0.8 (trust.rs:1073-1083).

• Output. nodes_seen, entry_points, act, hold, refuse, unreachable, bounds, coverage_fed, evidence_note, feeds, and rows func, crate_name, decision, inherited_trust, local_trust, weakest_hop, reason, depth, explain (trust.rs:261-289). With svg=true, a card grid (verdict_svg.rs:61).
• Limits. The sensitive-data term is not applied (no TOUCHES_TABLE read). Without a test node, the untested penalty is dropped and the note says trust is an upper bound (trust.rs:452-457). CALLS is a lower bound (closures, fn pointers).
• Code vs comment. The existing manual says local trust "takes the worst penalty". The code takes the worst only among impurity kinds; sensitive touches and the untested penalty subtract on top (trust.rs:323-358).
• The external-tool hop. villa::classify returns Process for a Command::new. The trust feed then reads the call site from the consumed checkout (villa::binary_at, villa.rs:157); when the site spells its binary as a string literal, villa::named_tool upgrades the kind to ExternalTool (penalty 0.8, as villa ranks it; villa.rs:230, room_feed/lenses.rs:876-904). The answer carries a note with the count of such hops. Without a checkout, or with the binary in a variable, the hop keeps the process penalty 0.5. (Before nornir 600e22f0 the external-tool penalty could never fire.)
• Tests. trust.rs:933-1101 (semiring laws, weight scale, the decision fixtures), :1146-1375 (plan, incremental equals full over random mutations, scale, upper bound); room_feed/room_tests.rs:443, :475 (the room walk equals the reference walk), :536, :560, :585; tests/support/mcp_harness.rs:1340.

name_collision

• Call. gRPC Mimir.NameCollision, MCP mimir_name_collision, CLI nornir mimir analyze name-collision --server <url> [--repo R] [--limit N].
• Finds. How many CALLS edges land on a node id the fold had to merge, beside the leaf-name baseline a name matcher would have (name_collision.rs:1-23).

Dataflow.

code_nodes fn + method of the request ──► defs (repo, leaf name)          lenses.rs:772-774
code_edges CALLS from own (origin = Local) nodes ──► E (one row per from→to pair)
     per edge: callee endpoint_only? callee leaf name, callee id          lenses.rs:777-790
Room::duplicate_keys(within callables) ──► merged ids M (rows, owners)   symbols.rs:82
                                       │
   hash maps: leaf counts, inbound(m) ─┴─► conflation_pct, leaf_conflation_pct, worst[…]

Math (name_collision.rs:180-246, production inputs lenses.rs:768-811):

E               = CALLS (from, to) pairs whose source is own code     (distinct pairs, not sites)
edges_seen      = |E|
unresolved      = |{ e ∈ E : to(e) is endpoint_only }|
resolved        = edges_seen − unresolved
M               = ids with distinct_payloads > 1 or key_dup_rows > 0 (callables only)
inbound(m)      = |{ e ∈ E : to(e) = m }|
conflated       = Σ_{m ∈ M} inbound(m)
pinned          = resolved − conflated
conflation_pct  = 100 · conflated / resolved          (0 when resolved = 0)

defs            = callable definitions (repo filter applied)
colliders       = { name : |{ d ∈ defs : leaf(d) = name }| ≥ 2 }
leaf_conflated  = Σ_{name ∈ colliders} |{ e ∈ E : leaf(to(e)) = name }|
leaf_conflation_pct = 100 · leaf_conflated / edges_seen

Each merged id becomes a row with distinct_defs = max(rows, 2) (lenses.rs:801). Rows sort by cross_repo first, then conflated_edges descending, then distinct_defs descending, then name (name_collision.rs:224-232).

GraphBLAS steps.

Worked example (same_named_fns_are_pinned_and_only_a_merged_id_is_conflated, name_collision.rs:266-278). Definitions new (a), new (a), new (b), parse, helper; 10 CALLS edges: 6 to a new, 3 to parse, 1 to helper; one merged id a::cart::helper with 1 inbound edge.

callable_names = |{new, parse, helper}| = 3;   colliders = {new} (3 defs);   cross_repo_colliders = 1
resolved = 10 − 0 = 10;  conflated = 1;  pinned = 9
conflation_pct      = 100 · 1/10 = 10.0
leaf_conflation_pct = 100 · 6/10 = 60.0

The 50-point gap is what rustc-resolved ids bought.

• Output. callable_names, colliding_names, cross_repo_colliders, edges_seen, resolved_edges, pinned_edges, conflated_edges, unresolved_edges, conflation_pct, leaf_conflation_pct; rows name, distinct_defs, distinct_repos, conflated_edges, cross_repo, sites (≤ 6), explain (name_collision.rs:107-129).
• Limits. A room without CALLS reads as a missing feed, never "sound".
• Code vs comment. The module promises a CROSS-REPO class ("two repos disagree about one id"). The production lens fills repos with the defining repo only (lenses.rs:797-798), so distinct_repos is at most 1 and cross_repo is always false on a live room; only the unit tests reach the cross-repo ordering (name_collision.rs:280-286).
• Tests. name_collision.rs:266-311 (5 tests); room_tests.rs:399.

symbol_identity

• Call. gRPC Mimir.SymbolIdentity, MCP mimir_symbol_identity, CLI nornir mimir analyze symbol-identity --server <url> [--repo R] [--limit N].
• Finds. The merged ids of the request's own definitions, split by cause, and a one-word verdict on the one-definition-per-id invariant (symbol_identity.rs:1-27).

Dataflow.

code_nodes own definitions (g.local) ──► ids = |own|                       lenses.rs:820-821
Room::duplicate_keys(all) ──► per merged id: rows, distinct_payloads, key_dup_rows, owners
   keep: defining repo in the request and node ∈ own; else count "elsewhere"   lenses.rs:823-844
   spans ──► files (distinct span files), sites                         lenses.rs:757-763
                                  │
          classify ──► cause ──► by_cause, verdict, doubt_ratio, worst[…]

Math (symbol_identity.rs:178-257):

cause(k) = repeated_key_in_unit    if key_dup_rows(k) > 0
         = one_id_several_places   else if files(k) > 1
         = units_disagree          otherwise
ours(cause) ⇔ cause ∈ {repeated_key_in_unit, one_id_several_places}

rows_under_ambiguous = Σ_k rows(k)
definition_rows      = ids + Σ_k (rows(k) − 1)
doubt_ratio          = rows_under_ambiguous / definition_rows     (0 when definition_rows = 0)

verdict = unknown               if ids = 0
        = sound                 if no merged id
        = units_disagree_only   if no merged id is ours
        = unsound               otherwise

Rows sort by ours first, then definitions (= rows) descending, then repo, then symbol (symbol_identity.rs:227-235).

GraphBLAS steps. None. The lens reads the snapshot's dup list and the span table (symbols.rs:82-89, lenses.rs:757-763) and folds them with maps.

Worked example (a_key_repeated_in_one_unit_is_unsound_and_units_disagreeing_is_not, symbol_identity.rs:282-298). ids = 10; keys a helper(). (rows 2, key_dup_rows 0, one file) and a impl#[T]new(). (rows 3, key_dup_rows 2).

cause(helper) = units_disagree;  cause(new) = repeated_key_in_unit (ours)
rows_under_ambiguous = 2 + 3 = 5
definition_rows      = 10 + (2−1) + (3−1) = 13
doubt_ratio          = 5/13 = 0.3846
verdict              = unsound;   worst[0] = new (ours ranks first)

• Output. verdict, verdict_label, symbols_seen, ambiguous_symbols, definition_rows, rows_under_ambiguous, doubt_ratio, by_cause, repos_with_repeated_keys; rows repo, symbol, kind, cause, cause_label, definitions, files, sites (symbol_identity.rs:126-158).
• Limits. Merged ids of dependency stubs and binary-only nodes are counted in a note, not judged (lenses.rs:845-847).
• Tests. symbol_identity.rs:282-330 (5 tests); room_tests.rs:415.

reachable_vuln

• Call. gRPC Mimir.ReachableVuln, MCP mimir_reachable_vuln, CLI nornir mimir analyze reachable-vuln --server <url> [--repo R] [--limit N] [--svg].
• Finds. An advisory crate@version that a repo resolves: refuse when the repo's own code calls or names an item of that crate at that version, hold when it is only present. act is never emitted (reachable_vuln.rs:1-50).

Dataflow.

warehouse vuln_findings (crate, version, ids, summary)    ──► advisories map A         reachable_vuln.rs:203-217
warehouse sbom_components, latest (repo, name, version)   ──► candidates C = sbom ⋈ A  :220-236
code room CALLS ∪ USES_TYPE from own (origin = Local) nodes ──► U(repo, crate, version) lenses.rs:691-702
                                    │
            hash join on (norm crate, version) ──► verdict refuse/hold, call_sites, rank
                                    │
  for each row: ring room (universe folded in) ── reach over CALLS ∪ SYSCALLS ──► boundary{classes, syscalls, entries_called, path}

Math.

norm(c) = trim(c) with '-' → '_'                                     reachable_vuln.rs:36-38
A = { (norm(crate), trim(version)) ↦ (ids, summary) }   (a later row with the same key replaces an earlier one)
C = { (repo, norm(name), version) : row of latest sbom_components, (norm(name), version) ∈ A, repo filter }
U(r, c, v) = Σ count(e)  over e ∈ CALLS ∪ USES_TYPE,  from a Local node of repo r,
             to a node of crate c at version v,  skipping a Local target in the same repo r
call_sites = U(r, c, v)   (0 when absent)
verdict    = refuse  if call_sites > 0,   else hold

Rank (reachable_vuln.rs:268-283): refuse before hold; then "exploit" first, where exploit ⇔ the lowercased summary contains [public-exploit] or kev; then call_sites descending; then repo; then crate. Cut at limit.

The boundary of each listed finding (room_feed/boundary.rs:453-511): entries = callees of crate@version that the repo's own fns call; reach over CALLS ∪ SYSCALLS from entries; classes = the classes of the syscall nodes reached; one shortest path to the most severe class in the order network, process, file, system, ipc, signal, memory, event, time, random, then indirect (boundary.rs:446-447), prefixed by our calling function.

GraphBLAS steps.

Worked example (reachable_is_refused_present_but_unreachable_is_held, reachable_vuln.rs:314-335). vuln_findings: time 0.1.45 RUSTSEC-2020-0071. sbom_components: appA and appB both resolve time 0.1.45. Uses: U(appA, time, 0.1.45) = 1, U(appB, serde, 1.0.0) = 9.

findings_seen = 1;  C = {(appA, time, 0.1.45), (appB, time, 0.1.45)}
appA: call_sites = 1 > 0 ⇒ refuse
appB: call_sites = U(appB, time, 0.1.45) = 0 ⇒ hold      (serde's 9 uses do not count)
order: appA (refuse) before appB (hold)

A second fixture shows that a use of time 0.3.0 does not make time 0.1.45 reachable (reachable_vuln.rs:359-365). On the net fixture the hyperish finding's boundary is classes = ["network"] with the path fetch → get → … → syscall connect #42 (network) (room_feed/boundary_tests.rs:84-95).

• Output. findings_seen, components_seen, reachable_refuse, present_hold; rows repo, crate, version, advisory_ids, summary, reachable, call_sites, verdict, colour, explain, boundary (reachable_vuln.rs:146-166, lenses.rs:712-741).
• Limits. Reachable means a DIRECT edge from own code: a crate used only through another dependency reads hold (lenses.rs:704-707). An unfed vuln_findings (producer modgunn warehouse scan --persist) is a missing feed, never "clean".
• Code vs comment. The module calls the marker "a [public-exploit] / KEV marker". The code tests the substring kev anywhere in the lowercased summary (reachable_vuln.rs:268-271), so any word that contains those three letters also sorts first.
• Tests. reachable_vuln.rs:314-372 (5 tests); room_tests.rs:348; boundary_tests.rs:84; reach_tests.rs:138.

undoc_api

• Call. gRPC Mimir.UndocApi, MCP mimir_undoc_api, CLI nornir mimir analyze undoc-api --server <url> --repo R [--min-commits-90d N] [--limit N]. Repo-scoped.
• Finds. Public functions without a doc comment in files that many commits and authors change (undoc_api.rs:1-20).

Dataflow.

code_nodes fn + method (attrs effective_visibility, has_doc, doc_hidden; mimir-schema ≥ 2)
   minus tests, #[cfg(test)] code, methods of trait impls (IMPLEMENTS), #[doc(hidden)], spanless
   keep effective_visibility ∈ {direct, reexported}                    ──► api[]   lenses.rs:516-570
warehouse git_heat_facts (latest) (repo, file, commits_90d, commits_total, authors_total) ──► churn map
                     │
   join on (repo, file); floor on commits_90d ──► rank ──► worst[…]                undoc_api.rs:122-196

Math (undoc_api.rs:122-196):

floor = 2 if min_commits_90d ≤ 0, else min_commits_90d
churn(repo, file) = (max commits_90d, max commits_total, max authors_total) over its rows
pub_fns              = |api| after the repo filter
undocumented_pub_fns = |{ f : ¬has_doc(f) }|
finding f            ⇔ ¬has_doc(f)  ∧  churn(repo_f, file_f) exists  ∧  commits_90d ≥ floor
rank: commits_90d ↓, authors_total ↓, commits_total ↓, repo ↑, func ↑

Churn is a file property: every undocumented public function in a hot file inherits the file's heat.

GraphBLAS steps. None. One edge extraction (IMPLEMENTS sources, row scan, lenses.rs:529) and a hash join.

Worked example (only_undocumented_pub_fns_in_churny_files_rank_by_churn, undoc_api.rs:221-247). Four public fns; heat: hot.rs 40/120/5, warm.rs 6/20/2, cold.rs 1/3/1; floor 2.

pub_fns = 4;  undocumented = {hot_api, warm_api, cold_api} = 3   (documented_api has a doc)
hot_api:  40 ≥ 2 ✓   warm_api: 6 ≥ 2 ✓   cold_api: 1 < 2 ✗
churny_undocumented = 2;  order: hot_api (40) before warm_api (6)

• Output. pub_fns, undocumented_pub_fns, churny_undocumented, min_commits_90d; rows repo, func, file, line, commits_90d, commits_total, authors_total, explain (undoc_api.rs:79-97).
• Limits. A room without effective_visibility or has_doc names the gap (lenses.rs:520-524). A file with no heat row is not ranked.
• Tests. undoc_api.rs:221, :250; room_tests.rs:302.

system_boundary

• Call. gRPC Mimir.SystemBoundary (also the code-room door CodeRoom.Answer), MCP mimir_system_boundary. Params repo, class (comma list; an unknown class is invalid_argument, boundary.rs:400-408), limit. Repo-scoped and ring-on: the room has the dependency universe folded in (RING_ON, src/mimir_lens/mod.rs:133).
• Finds. Per repo, which classes of system call (network, process, file, system, ipc, signal, memory, event, time, random) its functions can reach, each function with one shortest path you can show (boundary.rs:1-19).

Dataflow.

ring room (own repo + std + dependencies, mimir_ingest::boundary written once per toolchain/target)
  code_nodes kind syscall (ty = class)                  ──► targets per class     boundary.rs:163-186
  code_nodes own ffi (link_name) ── libc_map::lookup ──► extra targets, call name boundary.rs:189-206
  code_nodes own fn + method (origin Local, defined)    ──► O (seeds)             boundary.rs:168-175
  A_W = A_CALLS ∨ A_SYSCALLS
                     │
  fwd  = reach(O, A_W)                        (ANY.PAIR BFS)
  per class κ:  hit_κ = targets_κ ∩ (fwd ∪ O)
                back_κ = dependents_by(hit_κ, A_W) (BFS on the transpose)
                fns_κ  = back_κ ∩ O
                border_κ = { f ∈ fns_κ : CALLS f → (back_κ ∪ hit_κ) \ O }
                rows: first per_class of fns_κ ordered (¬border, repo, path)
                      path = Room::path(f → hit_κ, A_W)   (MIN.PLUS layers)
                     ▼
  output: classes[class, functions, syscalls, from[rows]], functions_seen, functions_reaching,
          unmapped_own_ffi, worst

Math.

WALK = {CALLS, SYSCALLS}                                                  boundary.rs:34
per_class = clamp(limit, 1, ROWS_PER_CLASS = 12)                          boundary.rs:37, :421
functions_seen     = |O|
functions_reaching = |⋃_{κ asked} fns_κ|
classes sorted by |fns_κ| ↓, then class name                             boundary.rs:219
row order inside a class: border first, then repo, then display path     boundary.rs:264
uncertain(row) = the last hop is a SYSCALLS edge flagged partial, or the C map is not sure
hops(row)      = edges on the path (the C-map suffix of an own ffi adds a label, not a hop)
kernel_entry   = the first CALLS edge out of the syscall node (from the kernel BTF)
worst          = the classes' rows concatenated, cut at limit           boundary.rs:423

Path choice (crates/mimir-room/src/path.rs:37-44): fewest hops to any target of the class; among those the target with the smallest ordinal; at every hop back the predecessor with the smallest ordinal. The default path is the kept walk (reach_inc::boundary_sets, per-function class bit masks advanced over the room's delta, boundary.rs:211-216, reach_inc.rs:428). NORNIR_REACH_INC=0 forces the reference walk above; the tests hold the two equal.

GraphBLAS steps.

Worked example (fixture boundary_ws, room_feed/fixture.rs:926-1078, test room_feed/boundary_tests.rs:22-51). Own fns start, fetch, save, sum. Edges: start → fetch, fetch → hyperish::get, save → std::fs::write; get → TcpStream::connect → Socket::connect → libc connect (ffi); write → File::open_c → libc open64 (ffi). The boundary maps connect to the syscall connect (#42, network) and open64 to openat (#257, file).

O = {start, fetch, save, sum};  fwd ∋ syscall connect, syscall openat
network: hit = {connect}; back = {Socket::connect, TcpStream::connect, get, fetch, start}
         fns = {fetch, start} ⇒ functions = 2
         border: fetch → get (get ∈ onward) ✓;  start → fetch (own) ✗ ⇒ fetch first
         path(fetch) = fetch → get → TcpStream::connect → Socket::connect → libc connect → syscall connect
         hops = 5;  kernel_entry = __x64_sys_connect;  uncertain = false
file:    fns = {save} ⇒ functions = 1;  syscalls = ["openat"]
sum reaches nothing ⇒ functions_reaching = |{fetch, start, save}| = 3 of functions_seen = 4
class order: network (2) before file (1)

All of these figures are asserted by the test.

• Output. classes[{class, functions, syscalls, from[{class, function, repo, crate, at, syscall, path, hops, uncertain, kernel_entry, border}]}], functions_seen, functions_reaching, unmapped_own_ffi, worst (boundary.rs:84-143).
• Limits. No syscall node gives the gap NO_BOUNDARY (boundary.rs:48). A dependency dumped by a driver older than the fn-as-value CALLS edge misses those hops (boundary.rs:177). An own extern "C" symbol the C map does not know is listed in unmapped_own_ffi.
• Cost. Folding the universe for a lake the boundary never ran on was 8.2 M ring nodes in 951 s (lake copy, 2026-10-19); boundary_in_lake now answers "no boundary" from a node-stream scan (boundary.rs:50-82).
• Tests. room_feed/boundary_tests.rs:22-153 (8 tests); room_feed/reach_tests.rs:50-196 (9 tests, kept walk equals reference).

The clone lenses

Graph first (room_feed/graph_first.rs:1-21). The compiled graph is the primary index and answers alone with state complete. The embedding index (when vectors exist) adds its pairs beside the graph's with their cosine. Every finding carries source = graph, embedding or both (graph_first.rs:33-40), and every answer counts them in indexes (graph_first.rs:50-67). No vector is a note ("the embedding index added nothing"), never a refusal.

Shared rules of every clone lens:

• Population (room_feed/clones.rs:201-268). The fn and method nodes of the scope's repos that have text of their own (fnvec::room::function_nodes, src/vector/fnvec/room.rs:74), minus files under target/, absolute or OUT_DIR paths, vendor/, vendored/, third_party/, generated/, *.generated.rs, *.pb.rs, examples/, benches/ (clones.rs:1257-1277), minus trait-impl methods whose span is at most 3 lines (TRIVIAL_LINES, clones.rs:1292). A function in #[test], a mod tests, tests/ or a *_tests.rs is a test (clones.rs:1376); tests leave the pairs unless include_tests.
• Shapes come from fn_shape_events at the room's sequence number per repo (the clone_shapes feed, src/clone_signals/feed.rs). A missing shape is a gap for the shape lenses and a counted note for the graph-first ones (clones.rs:252-263).
• Mutual kNN (graph_first.rs:89-104): for scored pairs, top_k(a) = the k partners of a with the highest score (ties: the lower index); a pair (a,b) survives when b ∈ top_k(a) and a ∈ top_k(b). A hub that resembles everything pairs with nothing.
• Deliberate families leave the list and are counted: every member a SIMD / width variant (a body with target_feature or intrinsics, or a name part such as avx2, neon, scalar, clones.rs:89-97), and in semantic_twins two methods of one name on two types that take only self (clones.rs:1399-1408). A member whose body is ONE literal (json!{…} or a struct literal) drops the finding (clones.rs:1304-1374).
• Clone classes. structural_clones and semantic_twins collapse pairs into connected components by union-find (one finding per class, its best pair, class_size, ≤ 12 class_members, clones.rs:1431-1493).

Shared dataflow:

code room nodes fn + method ── filters ──► population P                         clones.rs:201
warehouse fn_shape_events (exact key, tokens, MinHash, simd) ──► shape(f)       clone_signals/store.rs
code room edges CONTAINS(param, ret) · USES_TYPE · READS_FIELD · CALLS out/in ──► features(f)   structure.rs:143
warehouse embeddings (raw, one vector per fn) / embeddings_norm (per exact key) ──► vectors (optional)
                         │
      exact / near / structural / role / name / cosine indexes ──► pairs ──► gates ──► findings{source}

The table of constants:

How to run (CLI ops under nornir mimir analyze, src/bin/nornir.rs:789-987): exact-clones, near-clones, structural-clones, role-neighbours, semantic-clones, same-intent, semantic-twins, duplicates (= similar_code), reimplements-shared, each with --server <url> [--repo R] [--limit N]; MCP mimir_<lens>; gRPC Mimir.<Lens>.

Tests for the family: room_feed/clone_tests.rs, room_feed/vector_tests.rs, room_feed/graph_first_tests.rs, room_feed/reuse_tests.rs, clone_signals/{norm,minhash,structure}.rs unit tests, tests/support/mcp_harness.rs:1331, :1394-1403.

exact_clones

• Finds. Groups of functions whose normalised bodies are identical: the Type-1 and Type-2 clones (consistent renames, other literals of the same kind, other layout and comments).

Dataflow.

function text (driver span at the commit) ──► proc-macro2 tokens (one lexer) ──► normalize ──► canonical text
SHA-256(canonical text) = exact key  (stored in fn_shape_events)             norm.rs:162-252
population P with shape, tokens ≥ 40, not test, one node per (repo, file, start, end)
     ──► group by exact key ──► groups with ≥ 2 members ──► rank ──► worst[…]     clones.rs:270-342

Math. The normalisation (src/clone_signals/norm.rs:131-252):

Numbers count first occurrences per role, so a consistent rename gives the same text. The text is laid out canonically: a new line after ;, { and }, four spaces per brace level, joint punctuation glued (norm.rs:211-250). Then:

exact(f)  = SHA-256(canonical text of f)            (vector/chunk.rs:111)
tokens(f) = number of normalised tokens (attributes and pub left out)
G_key     = { f ∈ P : shape(f), tokens(f) ≥ min_tokens (40), include_tests ∨ ¬test(f),
              first node per (repo, file, start_line, end_line) }
finding   ⇔ |G_key| ≥ 2
rank      = tokens(G) · (|G| − 1)  ↓,  then key ↑                           clones.rs:304
pairs     = Σ_G |G|(|G| − 1)/2

GraphBLAS steps. None. Hashing and a BTreeMap group-by.

Worked example (a_consistent_rename_reformatted_and_recommented_is_the_same_normalised_text, norm.rs:274-283). KILL is pub fn kill(pid: u32, table: &mut HashMap<u32, Proc>) -> Option<Proc> { let found = table.remove(&pid)?; found.stop_all(); Some(found) } with a comment. ERASE is the same code renamed (erase, id, registry, hit), reformatted, with a doc comment, #[inline] and pub(crate). By the rules above, kill/erase → F1 (after fn), pid/id → V1, table/registry → V2, Proc → T1, found/hit → V3, stop_all → F2 (before (), while u32, HashMap, Option, Some and .remove( stay. Both texts start fn F1 ( V1 : u32 and their exact keys are equal, which the test asserts. On the clone fixture, tally and summarize form one exact group and tally_more (one statement added) does not (room_feed/clone_tests.rs:57-68).

• Output. groups, pairs, groups_matching, deliberate_families, deliberate, worst[{signal: "exact", found_by, why, exact_key, tokens, size, members}] (clones.rs:308-342). Param min_tokens, include_tests.
• Limits. A text that does not tokenise has no shape. Names play no part: kill and delete with different bodies are no pair (clone_tests.rs:127-140).

near_clones

• Finds. Pairs of DISTINCT normalised bodies that share most of their token runs: Type-3 copies (a statement added, changed or dropped).

Dataflow.

exact groups (as exact_clones, tokens ≥ 40) ──► one MinHash signature per exact key (first member's)
   ──► 16 bands × 4 rows ──► buckets (≤ 200 members) ──► candidate pairs ──► estimate ≥ 0.80 ──► worst[…]
clones.rs:344-395, minhash.rs:36-101

Math (src/clone_signals/minhash.rs):

classes(f)  = per normalised token its role class hashed (V, F, T, D, L, M, a kept name, a punctuation, #s/#c/#n)
              FNV-1a 64 of the class string; numbers dropped (V1 and V2 are one class)     norm.rs:126-128, :252
shingle s   = fold over 5 consecutive classes: h ← mix(h ⊕ c), h₀ = 0x517cc1b727220a
mix         = splitmix64 finaliser                                                      minhash.rs:27-32
sig_p(f)    = min_{s ∈ shingles(f)} ( mix(s ⊕ p·0xa0761d6478bd642f) >> 32 ),   p = 0 … 63
estimate(a,b) = |{ p : sig_p(a) = sig_p(b) }| / 64        (an unbiased estimate of the shingle-set Jaccard J)
candidate   ⇔ ∃ band β ∈ 0…15 : sig[4β … 4β+3](a) = sig[4β … 4β+3](b),  and the bucket has ≤ 200 members
near pair   ⇔ candidate ∧ estimate ≥ 0.80   (so at least 52 of 64 minima equal: 52/64 = 0.8125, 51/64 = 0.797)
P(candidate | J = s) = 1 − (1 − s⁴)¹⁶

Pairs sort by estimate descending, then index (minhash.rs:100). A body shorter than 5 tokens has no signature.

GraphBLAS steps. None. Hash buckets per band.

Worked example (computed from the constants). The banding curve 1 − (1 − s⁴)¹⁶:

s = 0.8:  s⁴ = 0.4096;  1 − s⁴ = 0.5904;  0.5904¹⁶ = e^(16·ln 0.5904) = e^(16·(−0.52696)) = e^(−8.4313) = 0.000218
          P = 1 − 0.000218 = 0.99978
s = 0.5:  s⁴ = 0.0625;  0.9375¹⁶ = e^(16·(−0.064539)) = e^(−1.03262) = 0.35607;   P = 0.644
s = 0.3:  s⁴ = 0.0081;  0.9919¹⁶ = e^(16·(−0.0081330)) = e^(−0.130128) = 0.87798; P = 0.122

A true near copy at J = 0.8 is a candidate with near certainty; a J = 0.3 pair is a candidate one time in eight and is then refused by its estimate. On the clone fixture, tally and tally_more are a near pair found by "near: MinHash" (room_feed/clone_tests.rs:70-73); the unit test holds a one-token change in a 400-token text at an estimate ≥ 0.85 and an unrelated text < 0.2 (minhash.rs:113-129).

• Output. pairs, pairs_matching, deliberate_families, deliberate, worst[{signal: "near", found_by, why, jaccard_estimate, a[], b[]}]; a and b list every member of each exact group (clones.rs:352-395).
• Limits. A bucket over 200 bodies (a shape every small function has) is skipped and counted, so a pair that only meets in such buckets is lost (minhash.rs:79-82).
• Code vs comment. The module doc says J = 0.8 is a candidate "with probability 0.9996". The formula it states, 1 − (1 − 0.8⁴)¹⁶, gives 0.99978 (minhash.rs:9-12). The other two figures (0.64, 0.12) match.

structural_clones

• Finds. Pairs of functions that touch the same rare things (parameter and return types, types used, fields read, callees), names ignored.

Dataflow.

code room: CONTAINS → param (not self) / ret parts (ty) ──► p:<type>, r:<type>
           USES_TYPE (minus the impl's own self type via FOR_TYPE) ──► t:<stable id>
           READS_FIELD ──► f:<stable id>;   CALLS out ──► c:<stable id>        structure.rs:143-243
   ──► Features: sets[f], df, idf ──► postings of rare features ──► candidates ──► weighted Jaccard
   ──► gates (≤ 3 lines, MinHash < 0.3, wrapper) ──► literal drop ──► clone classes ──► worst[…]
clones.rs:405-500

Math (src/clone_signals/structure.rs):

N        = functions in the feature population (tests out unless include_tests)
df(x)    = functions carrying feature x (structural sets and the k: caller sets both count)
idf(x)   = ln(1 + N / df(x))                                                structure.rs:121-130
J_w(A,B) = Σ_{x ∈ A∩B} idf(x)  /  Σ_{x ∈ A∪B} idf(x)                        structure.rs:251-286
cap      = min(RARE_DF = 64, max(⌊N/2⌋, 2))
rare x   ⇔ 2 ≤ df(x) ≤ cap
candidates(a) = { b > a : sets(b) shares a rare x with sets(a) },  only rows with |sets| ≥ 3
pair     ⇔ J_w ≥ floor (STRUCT_FLOOR 0.5, param `structural`)  ∧  |A∩B| ≥ 2      structure.rs:327-385
lens gates (clones.rs:430-450):
  drop if either span ≤ 3 lines
  drop if both have shapes, exact keys differ, and MinHash estimate < 0.3   (STRUCT_BODY_FLOOR)
  drop if one side is ≤ 6 lines with ≤ 1 callee that the other side also calls (a wrapper)
order: J_w ↓, then (a, b) ↑; then one finding per clone class

Candidate generation is exact over the posting lists: every pair that shares a rare feature is scored, and a pair that shares none is never compared.

GraphBLAS steps.

Worked example (unrelated_names_sharing_a_rare_return_type_and_fields_are_structural_clones, structure.rs:747-770). 200 filler functions each have r:Result<()>, p:&str and their own c:own{i}. KILL has {r:MapLayout, t:MapLayout#, f:MapLayout#repos., f:MapLayout#plates., c:a, p:&str}; PERVERT the same with c:b. Fns 3 and 4 have {r:Result<()>, p:&str, c:x} and {…, c:y}.

N = 204
df: r:MapLayout = t:MapLayout# = f:repos = f:plates = 2;   c:a = c:b = c:x = c:y = 1
    p:&str = 204;   r:Result<()> = 202
idf(df=2)   = ln(1 + 204/2)   = ln 103   = 4.63473
idf(df=1)   = ln(1 + 204)     = ln 205   = 5.32301
idf(&str)   = ln(1 + 204/204) = ln 2     = 0.69315
idf(Result) = ln(1 + 204/202) = 0.69809

KILL × PERVERT: ∩ = 4 rare + p:&str = 4·4.63473 + 0.69315 = 19.23207
                ∪ = ∩ + c:a + c:b   = 19.23207 + 2·5.32301 = 29.87809
                J_w = 19.23207 / 29.87809 = 0.6437 ≥ 0.5,  shared = 5 ≥ 2  ⇒ pair (the test asserts ≥ 0.6)
fns 3 × 4:      ∩ = 0.69809 + 0.69315 = 1.39124;  ∪ = 1.39124 + 10.64602 = 12.03726
                J_w = 0.1156   (the test asserts < 0.2)
                cap = min(64, 102) = 64: Result (202), &str (204) are not rare and c:x, c:y have df 1,
                so 3 and 4 are never even compared.

The shared words list the rare features first: "both return MapLayout", "both read .MapLayout.repos", with &str last.

• Output. pairs, pairs_matching, pass{functions, features, rare_features, candidates, pairs, ms}, worst[{signal: "structural", found_by, why, score, shared, a, b, class_size, class_members}] (clones.rs:455-500).
• Limits. Two functions on one shared API with unrelated text are refused by the 0.3 body floor (clone_tests.rs:80-82).
• Tests. structure.rs:725-770; clone_tests.rs:57-85, :248-262.

role_neighbours

• Finds. Pairs of functions that play the same role in the code graph: the same kind of rare types, fields, callees and callers, whatever their names and bodies. No embedding is read.
• Engines. engine=wl is the default (the engine=wl section below); engine=fastrp selects the FastRP engine described first here.

Dataflow.

Features (as structural_clones, plus k:<caller> sets)                       structure.rs:143
role graph G: rows = functions, then every other endpoint of
   CALLS / USES_TYPE / READS_FIELD out of a function and CALLS into one; symmetric      structure.rs:434-462
 = D⁻¹·A (row-normalised, weight 1/deg)  on GraphBLAS FP64 CSR                   structure.rs:503-517
X0 (functions × 128) ── propagate ──► X1 = ·X0 ── propagate ──► X2 = ·X1     (per column, GrB_mxv)
role(f) = n( n(X0) + 1·n(X1) + 0.5·n(X2) )  ──► fn_role_vectors (kept, 2-hop ball recomputed)
   ──► has_role filter ──► cosine self-join (pair index ≥ 2,048 rows, else exact scan) ≥ 0.90 ──► worst[…]
clones.rs:554-733

Math (FastRP, Chen et al. CIKM 2019, as coded in structure.rs:400-596):

proj(x)  : h = FNV-1a64(key(x)); four times: h ← mix(h); dim = h mod 128; sign = +1 if bit 40 of h is 0, else −1
           (4 non-zeros; two draws on one dim add)                                       structure.rs:406-415
X0[f]    = n( Σ_{x ∈ sets(f) ∪ callers(f)} idf(x) · proj(x) )        n(v) = v/‖v‖₂ (0 stays 0)   :552-560
X0[u]    = 0 for every non-function row u (type, field, external callee)
Â(i,j)   = 1/deg(i)  for each neighbour j of i                                            :503-517
X1       = Â · X0,   X2 = Â · X1      (one GrB_mxv per dimension and step)                 :565-578
role(f)  = n( n(X0[f]) + W1·n(X1[f]) + W2·n(X2[f]) ),   W1 = 1.0,  W2 = 0.5                 :582-592
has_role(f) ⇔ |sets(f)| + |callers(f)| ≥ 3  ∧  ∃ x ∈ sets(f) ∪ callers(f) : df(x) > 1      clones.rs:574
pair (f,g) ⇔ has_role(f) ∧ has_role(g) ∧ role(f)·role(g) ≥ floor (0.90, param `cosine`)
order: cosine ↓, then (a, b) ↑

Because a type or field node starts at 0, X1 of a function carries only its neighbouring functions; two functions that use one struct meet at X2, through the struct's row (whose X1 is the mean of its users' X0). The vectors are L2-normalised, so the dot product is the cosine. When a kept role space exists, only the 2-hop ball of the changed functions is recomputed (structure.rs:672-681); inside the ball the result equals a full run.

GraphBLAS steps.

Worked example (functions_in_the_same_role_are_nearest_neighbours_and_a_lone_utility_is_not, structure.rs:805-826). KILL and PERVERT (unrelated names, different callees, the same rare return type and fields, the same callers) are each other's nearest neighbour with cosine > 0.8, and a lone utility has cosine < 0.3 to both; after one function changes, only its ball is recomputed and every row inside it equals a full run. The test records no exact floats. Two consequences follow from the formulas without any data: a function with an empty feature set and no function neighbour has role = 0 and pairs with nothing; and two functions with the same feature set and the same function neighbours have equal X0, X1 and X2, so their cosine is exactly 1.

• Output. pairs, pairs_matching, mode, recomputed, deliberate_families, deliberate, worst[{signal: "role", found_by, why, cosine, shared, a, b}] (clones.rs:686-733).
• Limits. Two-feature accessors have no role (clone_tests.rs:248-262).
• Code vs comment. The module doc calls X0 "the IDF-weighted sum of its features' projections". The code L2-normalises that sum before the propagation (structure.rs:559), so X1 is the mean of normalised neighbour vectors.
• Tests. structure.rs:805-830; clone_tests.rs:248, :832; graph_first_tests.rs:281.

engine=wl: role fingerprints (space role-wl-v1)

FastRP above is built from neighbour IDENTITIES, undirected and untyped: two functions are close when they touch the same nodes. That is proximity. The wl engine compares what the neighbours ARE, per edge kind and direction, wherever they are. It is the default engine (since 2026-11-05, after the comparison in ~/plan/handback/wl-role.md); engine=fastrp selects FastRP above, which stays the 3D code map's vector producer.

• Finds. Pairs of functions in the same role, in one component or in two with no shared node, and it keeps apart near-neighbours of different roles.
• Params. engine (wl, the default | fastrp), rounds (1..=4, default 2), score (the floor, default 0.60), kept: false (no stored label is read or written), test_helpers (default false: test helpers are out of the population; include_tests keeps them too).

Dataflow.

 room: nodes (kind, ty of param/ret parts, visibility, is_test, defined, repo)
       edges CALLS, USES_TYPE, READS_FIELD, WRITES_FIELD, TOUCHES_TABLE(access),
             CONTAINS, IMPLEMENTS, FOR_TYPE
   │  from_room: rows = functions, then what they touch; derived IMPL_OF, SELF_OF, HAS_FIELD
   ▼
 ℓ⁰ (n × u64, FNV-1a + splitmix)         A_κ boolean, one per kind; Aᵀ_κ cut by the hub/boundary rule
   │                                              │
   ▼                                              ▼
 for t = 0..T−1:  O_t = onehot(ℓ^t) ──► N_{κ,d,t} = A_{κ,d} ⊕.pair O_t ──► sort, hash rows ──► ℓ^{t+1}
   │
   ├─► fn_role_labels (ℓ⁰..ℓ^T + fp per stable id; only the T-hop ball of a change is recomputed)
   ▼
 F_T(v) tokens ──► df, idf, cut df > N/2 ──┬─► postings of rare tokens (df ≤ 64), probed by every token
                                            └─► prefix P_τ(v) in (df ↑, id ↑) order: postings of its
                                                common tokens, probed by the prefix ──► candidates (exact)
   ──► J = S / (‖w_v‖₁ + ‖w_w‖₁ − S) ≥ 0.60 on gatling fork-join ──► worst[{score, class, shared}]

Math (clone_signals/role_wl.rs, fixed hash mimir_graph::ops::stable_hash):

population P = own fns \ { f : is_test(f) ∨ test_like(f) }   unless test_helpers (or include_tests)
             test_like(f): a path segment tests / test / test_* / *_tests, a file under tests/,
             *tests.rs, */test.rs, benches/, test_*  (clones.rs test_like, Func::is_test)
item graph   V = P, then every endpoint of their channels; own ADTs, their fields; stubs
channels     κ ∈ {CALLS, USES_TYPE, READS_FIELD, WRITES_FIELD, TABLE_R, TABLE_W, HAS_FIELD, IMPL_OF, SELF_OF}
             d ∈ {out, in}; tag(κ, d) = 2κ + d
             CALLS into a noise callee (`?`, fmt, clone, drop …) and from a test fn are left out
IMPL_OF(m,tm) ⇔ ∃ im, tr: im —IMPLEMENTS→ tr ∧ im —CONTAINS→ m ∧ tr —CONTAINS→ tm ∧ name(m) = name(tm)
SELF_OF(m,T)  ⇔ ∃ im: im —CONTAINS→ m ∧ im —FOR_TYPE→ T

ℓ⁰(fn)    = H("fn" | item_kind | receiver | arity | sort⦃tclass(params)⦄ | tclass(ret) | bucket(#generics) | vis | is_test)
ℓ⁰(adt)   = H("adt" | kind | bucket(#fields) | bucket(#variants) | bucket(#generics) | vis)
ℓ⁰(field) = H("field" | tclass(ty) | vis)     ℓ⁰(table) = H("table")     ℓ⁰(trait) = H("trait" | vis)
ℓ⁰(stub)  = H(kind | "stub")                  a node outside the workspace
tclass(t) = ref-shape ⊕ head: bool, int, float, char, str, path, bytes, option<·>, result<·,err-class>,
            seq<·>, map, set, box<·>, dyn, impl, future<·>, fn-like, generic, assoc, tupleN, own, std, foreign,
            unit, never; nested classes cut at depth 2; err-class: own-err, dyn-err, io-err, str-err, unit-err, other-err
bucket(c) = 0 if c = 0, else ⌊log₂ c⌋ + 1

N_{κ,out}(v) = { u : A_κ(v,u) }
N_{κ,in}(v)  = { u : A_κ(u,v) }  if v is in the workspace and in_deg_κ(v) ≤ D_hub (256), else ∅
c_{κ,d}(v,l) = | { u ∈ N_{κ,d}(v) : ℓ^t(u) = l } |
ℓ^{t+1}(v)   = H( ℓ^t(v), sort⦃ (tag(κ,d), l, bucket(c_{κ,d}(v,l))) ⦄ )

F_T(v)    = ⦃(t, self, ℓ^t(v)) : t = 0..T⦄ ⊎ ⦃(t, κ, d, ℓ^t(u)) with count c : t = 0..T−1, u ∈ N_{κ,d}(v)⦄
df(k)     = own functions whose F_T holds k;  a token with df(k) > max(N/2, 2) is cut
idf(k)    = ln(1 + N / df(k));   w_v(k) = idf(k) · c_v(k)
S(v,w)    = Σ_k min(w_v(k), w_w(k));   J(v,w) = S / (‖w_v‖₁ + ‖w_w‖₁ − S)
has_role(v) ⇔ Σ_{κ,d} |N_{κ,d}(v)| ≥ 3        (round-0 neighbours)
cand(v,w) ⇔ ∃ k ∈ F_T(v) ∩ F_T(w): 2 ≤ df(k) ≤ min(64, N/2)          (a rare token)
            ∨ ∃ k ∈ P_τ(v) ∩ P_τ(w)                                   (a prefix token)
P_τ(v)    = the shortest head of v's tokens in the global order (df ↑, then id ↑)
            whose remaining weight is below τ·‖w_v‖₁
pair(v,w) ⇔ has_role(v) ∧ has_role(w) ∧ cand(v,w) ∧ J(v,w) ≥ τ (0.60)
class     = exact if ℓ^T(v) = ℓ^T(w), else graded
order     : J ↓, then (a, b) ↑
fp(v)     = H(ℓ⁰(v), sort⦃(tag, H(stable id of u))⦄ over the followed edges)

The prefix rule is what makes the join exact (prefix filtering, Chaudhuri et al. 2006; Bayardo et al. 2007, here for weighted multisets). From J ≥ τ:

S ≥ τ·(‖w_v‖₁ + ‖w_w‖₁ − S) ≥ τ·‖w_v‖₁        (as ‖w_w‖₁ ≥ S); the same for w

Say v's prefix ends first in the global order. A token of P_τ(v) that w holds lies before the end of P_τ(w), so it is in P_τ(w). If the prefixes share nothing, every token v shares with w lies in v's suffix, so S ≤ w(suffix(v)) < τ·‖w_v‖₁, a contradiction. Every pair above the bar therefore shares a prefix token. The rare postings stay (a rare token in a prefix is found by them); only the COMMON tokens of a prefix get a second posting list, probed by the prefix alone. The bar is taken a hair low (τ·(1 − 10⁻⁶)) because J is f64 and compared after the cast to f32.

Worked example (a_pair_that_shares_only_common_tokens_is_still_a_candidate): 400 rows over 24 tokens, every df > 64, so no token is rare and the old rule compared no pair (0 of the scan's 2,126 at τ = 0.60). A row with weights (df ↑) 2.0, 1.5, 1.0, 0.5 has ‖w‖₁ = 5.0 and the bar 0.6·5.0 = 3.0: after the first token 3.0 remains (not below the bar), after the second 1.5 does, so the prefix is its first two tokens. With the prefix rule the join equals the scan at τ = 0.3, 0.6 and 0.9.

Measured (build-1, release, role_compare on the replayed lakes; lost = pairs of the exact all-pairs scan at τ = 0.60 the join does not return):

The 13 Gunnar pairs at T = 2 were lost neither by depth nor by a label collapse nor by the τ cut: each pair's ONLY shared token is a common one, "both are called by a fn(&str, &str, option, option, own, own) -> own" ×49 with df 120 > 64 (the test-server boot copies that all call init_tracing, ServeConfig::ephemeral, Grant::server, AuthTable::bootstrap_admin and the Server::*_addr getters), so no rare token opened them. All 13 survive the filters: the Gunnar answer moves 2,143 → 2,156 pairs (exact 1,506 unchanged), golden re-pinned. Read by hand they are WEAK (a shared caller, not a shared role: init_tracing against an address getter); they sit at J = 0.65-0.72, inside the band the τ calibration already scored 17/19. Holger's answers do not move (answer hashes unchanged), so the 50/50 hand-checked pairs hold. T = 3 is no fix: the rare rule loses none at T = 3, but T = 3 moves every answer (Holger 1,091 → 1,055 pairs, Gunnar 2,143 → 1,545) and adds a hop to the incremental ball, for a gap that is in the candidate rule, not in the labels.

The counts are bucketed in the hash (seven callers and eight are one bucket apart at most) and raw in J, so the grade is kept where it is read. In-edges stop at the workspace boundary and at hubs: Vec::push keeps one label for the whole room, and a caller's change never reaches through it to its other callers. A dyn call is an edge to Trait#m (compiler-to-graph.md); the impl methods reach it by IMPL_OF, a 2-hop route (f → tm ← m), so a trait with 40 impls does not multiply its callers' edges by 40.

GraphBLAS steps.

Step 7 runs on the CPU: the sum over a row's tokens is then in token order, so a score is the same bits on every run. Step 7′ is the GraphBLAS form of the same intersection, kept for the shared crate and tested against it.

Worked example (two_components_of_one_shape_get_one_label_per_position, the_jaccard_is_weighted_by_rarity_and_counts, role_wl.rs; fixture fixture/roles.rs). Two components with no shared node:

main_a → load_a → read_a, parse_a;  load_a, parse_a USES_TYPE CfgA
main_b → load_b → read_b, parse_b;  load_b, parse_b USES_TYPE CfgB

round 0   ℓ⁰(load_a) = ℓ⁰(load_b): the signature fn(&path) -> result<own,own-err>, type names gone.
          FastRP has r:Result<CfgA, ErrA> against r:Result<CfgB, ErrB>, and c:/t: ids that differ.
round 1   tokens of load_a: (out CALLS, ℓ⁰(read), 1), (out CALLS, ℓ⁰(parse), 1),
          (in CALLS, ℓ⁰(main), 1), (out USES_TYPE, ℓ⁰(adt), 1); load_b has the same four.
          So ℓ¹(load_a) = ℓ¹(load_b).
round 2   the same at ℓ¹, so ℓ²(load_a) = ℓ²(load_b): class exact, J = 1.

read_a has the same ℓ⁰ shape class as nothing else in the room and only one caller: J(load_a, read_a) shares no self token and no neighbour token above the first round, so it stays under 0.5. Fixture route and parse_head share their caller, the type and the field; their ℓ⁰ and most round-0 tokens are equal, but route's eight callees make ℓ¹ and ℓ² differ and add tokens the leaf does not have, so J falls under the floor. FastRP pairs them.

Test helpers out by default (lane LENS-POLISH, 2026-11-05). A helper in tests/ or a mod tests is code nobody ships, and its copies across test files are the same role by construction: with helpers in, 932 of Holger's 1,091 pairs and 1,952 of Gunnar's 2,143 had a test helper on both sides. Measured on the replayed lakes (release, role_compare asks wl-helpers-in / wl-helpers-out; 25 pairs drawn uniformly from each answer and read blind from source; "weak" = a constructor against its builder, or a shared caller only):

The production pairs that leave with the helpers are mostly pairs whose evidence was a shared TEST caller (8 of Holger's 10, 61 of Gunnar's 64, among them all 13 pairs the exact join recovered, init_tracing against Server::grpc_addr): weak by the same reading. With the helpers out, the answer is the production roles, at least as precise, and an order of magnitude shorter; test_helpers=true gives the old answer.

Kept state. fn_role_labels holds ℓ⁰..ℓ^T and fp per stable id. Rows whose fp moved and their T-hop ball over the followed channels are recomputed; every row when that is a quarter of them or nothing is kept (refine_ball; equal to a full run, a test). The pairs are carried only while every function's token multiset holds. idf is population-wide, so J is not pairwise: any change is the full join, which costs less than the labels.

• Output. engine, space ("role-wl-v1" | "fastrp-v1"), rounds, pairs, pairs_exact, pairs_matching, mode, recomputed, changed, stored, distinct_labels, pass, deliberate_families, deliberate, worst[{signal: "role", found_by, why, score, class, shared, a, b}]. FastRP keeps cosine and adds score (= the cosine) and class (graded). J is no cosine, so a wl finding carries none.
• Limits. CALLS is a lower bound (operators, closures, fn pointers). The ty strings are short names, so Error is one class whichever Error it is. Stubs have one label per kind (the universe's labels are phase B). The join is exact (the prefix rule above); role_compare checks it against the scan (lost_by_posting_lists = 0).
• Tests. role_wl.rs (type classes, labels, hub rule, ball); role_wl_tests.rs (the planted twins, the dyn impls, the near-neighbours, posting lists, incremental); crates/mimir-graph/tests/wl.rs (the CPU oracle, the pinned hash).
• Goldens. src/mimir_lens/room_feed/golden/role-*.json (Holger h32/next 9dbe5cbf, Gunnar 5a2d1da1, Holger fix2 schema 6): counts, labels per round and a fixed answer hash per engine. Check: replay the dump (clone_tests::lake_from_dumps), then LENS_DUMP_BUILDS=<lake>/builds ROLE_OUT=<dir> ROLE_GOLDEN=<file> cargo test --release --lib role_compare -- --ignored.

semantic_clones

• Finds. Clones by behaviour, held by the graph: signal 1 (exact or near body) OR signal 2 (structural). The model over the NORMALISED body (names removed) confirms a graph pair or adds a pair alone through gates.

Dataflow.

population (graph first) ──► exact groups (tokens ≥ 40) ──► near pairs (MinHash, as near_clones)
                         ──► features ──► structural pairs ≥ 0.5 (kept candidate set)
          map every pair onto (exact key a, exact key b) ──► agree{near?, structural?}
warehouse embeddings_norm (one vector per exact key, the newest green run's profile)
          ──► cosine self-join ≥ 0.90 (pair index, or exact scan ≤ 20,000 rows) ──► emb_pairs
agree pairs: + cosine            emb-only pairs: family gate, cross-crate, mutual kNN k = 8
          ──► exact groups first, then pairs by weight ↓ ──► worst[{source}]
clones.rs:766-1140

Math (clones.rs:766-1140):

graph findings:
  every exact group with ≥ 2 members              source = both if its key has a vector (cosine 1), else graph
  agree(a,b) for keys a ≠ b:  near(a,b) = MinHash estimate ≥ 0.80   and/or
                              struct(a,b) = best J_w ≥ 0.5 over member pairs
  c(a,b)   = v_a · v_b  when both keys have vectors of one length
  confirmed ⇔ c ≥ floor (NORM_FLOOR 0.90, param `cosine`)     source = both if confirmed, else graph
  weight   = c if present, else max(near, struct)
embedding-only findings: (a,b) ∈ emb_pairs \ agree with
  usable(key) = members with no twin exclusion (test, trait-impl method, constructor returning Self,
                span < 5 lines, tokens < 20), unless include_all
  usable(a) ≠ ∅ ∧ usable(b) ≠ ∅ ∧ ∃ members in different crates ∧ (a,b) ∈ mutual kNN (k = 8 by cosine)
  weight = c,  source = embedding
order: exact groups (key order) first, then the rest by weight ↓

GraphBLAS steps. None for the pair logic (hash groups, LSH buckets, posting lists, SIMD dot products). The features are edge extractions (structure.rs:143-243); the family sets read IMPLEMENTS and CONTAINS edges (clones.rs:1547-1587).

Worked example (the_normalised_model_finds_the_renamed_copy_and_semantic_clones_states_its_signals, room_feed/clone_tests.rs:92-125). tally and summarize are one normalised body, so they share ONE vector in embeddings_norm. The raw model, which reads the names, puts their cosine below 0.95 (asserted). semantic_clones lists the pair from the exact group with found_by = "exact: the same normalised body" and "normalised model: cosine 1.000 (one vector)", source both. Without any vector it answers complete from the graph alone (graph_first_tests.rs:183), and an embedding pair of a test, a one-liner or two functions of one crate is never added (graph_first_tests.rs:330).

• Output. findings, rule, indexes, embedding_refused, functions_without_shape, deliberate_families, deliberate, worst (clones.rs:1131-1139).
• Limits. Over 20,000 normalised vectors at a floor below 0.80 the embedding index is not joined and the note says so (clones.rs:940-945).

same_intent

• Finds. Functions whose names and texts read alike (two delete-like functions), names included on purpose. Every answer says name_driven: true. It is not a clone finding (clones.rs:1142-1229).

Dataflow.

code room fn nodes + param nodes ──► name words (own name + parameter names) ──► name Features
   ──► name_pairs: rare words (2 ≤ df ≤ cap), ≥ 2 words per fn, J_w ≥ 0.5, ≥ 2 shared   graph_first.rs:106-216
warehouse embeddings (raw model, one vector per fn) ──► kept cosine join ≥ floor        vectors.rs:871-934
   union ──► detect_clusters: precision filters, same-chunk refusal, same kind,
             structural_agreement ≤ 0.35, partition guard ──► mutual kNN k = 8 + Louvain ──► clusters
mimir_clones.rs:820-1028;  relabel (name_driven, SIMD family) clones.rs:1142-1229

Math.

words(ident) = split on non-alphanumerics and lower→Upper boundaries, lower-cased, digits kept,
               words of length 1 and "self" dropped, deduplicated                    graph_first.rs:108-128
name features(f) = { n:<w> : w ∈ words(name(f)) ∪ ⋃_p words(param_name(p)) }
name pair  ⇔ |feat| ≥ 2 on both sides ∧ share a word with 2 ≤ df ≤ min(64, max(⌊N/2⌋, 2))
             ∧ J_w ≥ 0.5 (NAME_FLOOR) ∧ shared ≥ 2                                  graph_first.rs:179-216
emb pair   ⇔ cos(raw_f, raw_g) ≥ floor;  floor = 0.882 when the space is jina-v2-base-code (recorded),
             else 0.80, or param `cosine`                                           vectors.rs:827-841
kept edge  ⇔ both rows pass the filters ∧ not one chunk ∧ same kind class
             ∧ structural_agreement ≤ 0.35
             ∧ ¬(cos ≥ 0.92 ∧ structural_agreement ≥ 0.5)    (similar_code's territory) mimir_clones.rs:862-897
structural_agreement = 0.6·J(sig tokens) + 0.4·J(callees)   (sig only when both call nothing;
                       callees only when a signature is missing)                    mimir_analyze.rs:622-637
clusters   = Louvain communities of the mutual-kNN (k = 8, by edge weight = cos, else graph score) edges
cluster score = mean(edge weight) · size;  clusters over 50 members leave the ranked list

GraphBLAS steps. None. Word features and postings (hash maps), a SIMD cosine join, mutual kNN and Louvain in plain Rust (mimir_clones.rs:1029-1084).

Worked example (name_pairs_need_two_shared_rare_words, graph_first.rs:238-251). Rows: bump_alpha(xs, by), bump_beta(xs, by), workspace_root(), repo_root(), and eight other{i}_thing{i}().

N = 12;  cap = min(64, max(6, 2)) = 6
words: 0 {alpha, bump, by, xs}   1 {beta, bump, by, xs}   2 {root, workspace}   3 {repo, root}
df: bump = by = xs = root = 2;  alpha = beta = workspace = repo = 1;  other_i, thing_i = 1
idf(df=2) = ln(1 + 12/2) = ln 7 = 1.94591;   idf(df=1) = ln 13 = 2.56495
(0,1): ∩ = {bump, by, xs} = 3·1.94591 = 5.83773;  ∪ = 5.83773 + 2·2.56495 = 10.96763
       J_w = 0.5323 ≥ 0.5, shared 3 ≥ 2  ⇒ pair
(2,3): ∩ = {root} = 1.94591;  ∪ = 1.94591 + 2·2.56495 = 7.07581;  J_w = 0.275, shared 1  ⇒ no pair

The test asserts that (0, 1) is the only pair.

• Output. the SemanticCloneReport fields (cluster_count_total, cluster_count_matching, clusters_shown, pair_count, thresholds, filters, clusters), plus kind: "same_intent", name_driven: true, indexes, vectors, knn, deliberate (vectors.rs:940-1001, clones.rs:1142-1229).
• Code vs comment. The existing manual's table says the graph index is "name-word Jaccard ≥ 0.5". The code weights each word by its rarity (idf = ln(1 + N/df)) and needs two shared words (graph_first.rs:200-212). The signature tokens of structural_agreement are whitespace tokens of fn name(p: T, …), so the function and parameter names are part of them (vectors.rs:97-101, mimir_analyze.rs:611-615).
• Tests. graph_first.rs:222-251; graph_first_tests.rs:139, :158; vector_tests.rs:275; clone_tests.rs:841.

semantic_twins

• Finds. Type-3 copies and Type-4 twins (one idea written twice), v1's gates on v2's per-function vectors, graph first (clones.rs:1695-1708).

Dataflow.

population (graph first) ── same lines once ── twin exclusions (unless include_all) ──► kept K
   features(K) ──► graph pairs J_w ≥ 0.5 (kept per population fingerprint) ──► graph mutual kNN (k = 8, by J_w)
warehouse embeddings (raw, one vector per fn) ──► cosine join ≥ min(0.92, 0.882) (space `twins`)
   ──► embedding mutual kNN (k = 8, by cosine)
union of both ──► per pair: c, s = J_w, body = MinHash / 1.0 ──► copy / twin gates
   ──► families, literal drop ──► relabel by body ──► drop same-file twins ──► classes ──► worst[…]
clones.rs:1709-2045

Math (clones.rs:1740-1988):

exclusion(f) = test or fixture | method of an `impl Trait for Type` | returns Self
             | span < 5 lines | tokens < 20                                         clones.rs:1524-1545
floor_e  = min(copy_floor 0.92, twin_floor 0.882)       (params `copy_cosine`, `cosine`)
pairs_e  = { (a,b) : v_a·v_b ≥ floor_e }
pairs_g  = structural pairs of K at J_w ≥ 0.5
per pair in pairs_e ∪ pairs_g:
  c    = cosine (from the join, or computed when both have vectors)
  s    = J_w(a, b)
  body = 1 if exact keys equal; MinHash estimate if both have shapes; none otherwise
  gate 1  body ≥ 0.80                                ⇒ copy,  rank = (c or s) · body
  gate 2  c_e ≥ 0.92 ∧ s ≥ 0.50                      ⇒ copy,  rank = c · s
  gate 3  c_e ≥ 0.882 ∧ s ≤ 0.35, body known, mutual_e(a,b) ⇒ twin, rank = c · (1 − s)
  gate 4  (a,b) ∈ pairs_g, body known, mutual_g(a,b)        ⇒ twin, rank = s · (1 − body)
  else "between"           (c_e = a cosine from the embedding join only)
list = twins by rank ↓, then copies by rank ↓
relabel (when body is known): copy ⇔ body ≥ COPY_BODY (0.5) ∨ the gates said copy; else twin   kind_by_body, clones.rs:1687, :1961
drop a twin whose two members are in one repo and one file                           clones.rs:1965-1969
then one finding per clone class (unless `pairs`), cut at limit

The 0.882 floor is v1's calibration: the 80th percentile of hard negatives (same signature, another body) over 3,222 nornir functions, ROC-AUC 0.920, for jina-embeddings-v2-base-code only (clones.rs:1236-1238, src/mimir_calibrate.rs:1416-1430). In another space the note says to read it as a heuristic.

GraphBLAS steps. None for the gates. Features and family sets are edge extractions (structure.rs:143, clones.rs:1547-1587); the joins are SIMD dot products or posting lists; classes are union-find.

Worked example. On the clone fixture bump_alpha and bump_beta are the same normalised body on two types: body = 1.0 ≥ 0.80, so gate 1 makes them a copy, clone_type 3, whatever their structural score; every reported twin has body_similarity < 0.8 (room_feed/clone_tests.rs:226-240). With the recorded real jina vectors (vector_tests.rs:396-411), local_data_offset × 2 has cosine 0.9276 ≥ 0.92 (gate 2 when s ≥ 0.50) and bench_vs_miniz / bench_inflate 0.9158, which is under 0.92 and over 0.882: it can only be a twin, and only if s ≤ 0.35, the pair is mutual and its bodies are known.

• Output. pairs, groups, twins, copies, deliberate_by_family, thresholds{copy_cosine, copy_structural_floor, twin_cosine, twin_structural_ceiling, twin_body_ceiling, mutual_k, min_lines, graph_structural_floor}, excluded, candidates, graph_candidates, functions_without_shape, indexes, worst[{kind, clone_type, found_by, why, structural, body_similarity, members, source, cosine, class_size, class_members}], evidence_note with the theory text (clones.rs:2021-2044).
• Code vs comment. The doc comment, the evidence note and THEORY say a copy is "cosine ≥ 0.92 AND structural ≥ 0.50, or MinHash ≥ 0.80" and a twin is "MinHash < 0.80". After the gates, the body audit only UPGRADES: a pair whose bodies share ≥ COPY_BODY = 0.5 of their normalised token runs is a copy whatever the gates said, and a copy from the gates stays a copy (kind_by_body, clones.rs:1687; nornir 9943fd4c). So a gate-3 or gate-4 twin with 0.5 ≤ body < 0.8 is reported as a copy, which differs from the doc's "MinHash < 0.80" twin rule. (Before 9943fd4c the audit could also demote a gate-2 copy to a twin.) Twins inside one file are dropped, which the doc comment does not mention.
• Tests. clone_tests.rs:226, :849, :860, :909, :922, and the_body_share_only_upgrades_a_pair_to_a_copy; graph_first_tests.rs:227, :255.

similar_code

• Finds. Copied-not-moved code: function pairs in different crates whose vectors AND literal structure agree, clustered, with a keep / kill / repoint recommendation (room_feed/vectors.rs:677-822).

Dataflow.

code room fn nodes + param nodes + CALLS ──► SymbolVec rows (signature "fn name(self, p: T…)", callees)
warehouse embeddings (raw, one per fn) ──► kept cosine join ≥ 0.92 ──► gate_pairs ──► embedding edges
features ──► graph pairs J_w ≥ 0.5 (kept) ──► gate_pairs ──► graph edges (cosine added when both have vectors)
   drop pairs where one side CALLS the other
   ──► union-find clusters ──► canonical pick ──► rank ──► trivial-family suppression ──► worst[…]
vectors.rs:681-822, mimir_analyze.rs:801-1050

Math (src/mimir_analyze.rs:575-1050):

gate_pairs (a,b):
  refuse when both rows were cut from the same lines (same chunk hash)
  refuse when cross_scope_only (default) and crate(a) = crate(b)       (param same_crate lifts it)
  structural_agreement(a,b) = 0.6·J(sig_a, sig_b) + 0.4·J(callees_a, callees_b)
        where J = plain set Jaccard (two empty sets ⇒ 0), sig tokens = whitespace tokens;
        = J(sig) when both call nothing;  = J(callees) when a signature is missing
  keep ⇔ structural_agreement ≥ 0.5  (param `structural`)
embedding edge ⇔ cos ≥ 0.92 (param `cosine`) ∧ gate;   graph edge ⇔ J_w ≥ 0.5 ∧ gate
edge weight   = cos if finite, else the graph score
cluster       = union-find component of the edges
centrality(m) = mean over other members of cos (or structural_agreement when a vector is missing)
canonical     = a member in {edda, skidbladnir, znippy-zoomies, facett}, else the most central; ties by id
disposition   = keep (canonical), repoint (others, when the canonical is in a shared home), kill (else)
score         = mean(edge weight) · size;  order: score ↓, size ↓, canonical ↑

GraphBLAS steps. None for the pairs (SIMD dot products through the pair index or the full scan, posting lists, union-find). The wrapper drop reads CALLS rows (out_pairs, vectors.rs:725-733).

Worked example (real recorded vectors, jina-v2-base-code, room_feed/vector_tests.rs:396-436; ljar and lzip-parallel are one program copied into two crates):

The test asserts cluster_count = 3. The usable band is 0.012 wide here.

• Output. kind: "duplicates", cluster_count, cluster_count_matching, clusters_shown, pair_count, same_chunk_pairs, suppressed_trivial_clusters, suppressed_trivial, thresholds, vectors, indexes, knn, worst[clusters with members{disposition, centrality}, pairs{a, b, cosine, graph_score, same_crate}, source]; with calibration=true the threshold instrument (vectors.rs:792-821, :398-490).
• Code vs comment. The structural agreement is described as "signature + callee set". The signature string contains the function name and the parameter names (fn name(p: T, …), vectors.rs:97-101), and its tokens are split on whitespace, so a name is glued to its neighbour token (name(p:); names therefore count in this gate.
• Tests. vector_tests.rs:211, :319, :415; graph_first_tests.rs:92, :111.

reimplements_shared

• Finds. A crate A that depends on a library B and holds a copy of a B function: replace A's function with a call to B's (room_feed/reuse.rs:1-15). It folds no pairs of its own.

Dataflow.

kept answers: semantic_twins (pairs = true, limit 1e6) + similar_code (limit 1e6)  ──► pairs + evidence
code room: crate of each fn (parent chain) ── DEPENDS_ON reach per crate ──► imports(A → B)
           CALLS rows (wrapper), fan_in(CALLS) (callers), CONTAINS param/ret (fit),
           effective_visibility + file of B (public library side)
checkout: A's own Cargo.toml [dependencies] (+ target deps), non-optional ──► tier
           ──► score ──► one finding per replaced fn ──► direct tier first ──► worst[…]
reuse.rs:230-476

Math (reuse.rs:148-476):

similarity(pair) = the first present of cosine, avg_cosine, body_similarity, graph_score, structural,
                   clamped to [0,1]                                                 reuse.rs:156
left out: either side test code;  one crate or one package;  no DEPENDS_ON path either way;
          A already CALLS B;  only similar_code names the pair (no semantic_twins evidence);
          B not a public fn of a library target (not bin/, main.rs, tests/, excluded paths);
          no copy evidence and max body_similarity < 0.3 (TWIN_BODY_FLOOR)
direction: A → B when DEPENDS_ON reaches B's crate (or its package) from A's crate
tier     = Direct if B's package is a normal, non-optional dependency of A's own manifest, else AddDependency
fit      = drop_in if param and return types are equal, else adapter; partial when both bodies read
           the same ALL_CAPS own static
score    = similarity · (1 + ln(1 + callers(A_fn))) · min(lines(A_fn), 30) · (1 if Direct else 0.5)   reuse.rs:392
order    = Direct tier first, then score ↓;  one finding per A function, other libraries under `also`

callers is the in-degree of A's function over CALLS (Room::fan_in, reuse.rs:296).

GraphBLAS steps.

Worked example. The fixture writes parse_header three times (alpha, beta, gamma) and makes gamma depend on alpha (room_feed/reuse_tests.rs:1-50). The answer has exactly one finding: replace gamma::parse_header, use alpha::parse_header, tier already_imports (gamma's own manifest names alpha), fit drop_in (same parameters). beta depends on neither, so its copy is a twin, not a finding. Without shapes, semantic_twins has no copy and the pair is left out as "only similar_code's cluster" (reuse_tests.rs:57-66). The rank factors, from the formula:

callers c:      0     1      10     100
1 + ln(1 + c):  1.000 1.693  3.398  5.615
lines L:        min(L, 30)  — a 200-line copy weighs as 30
tier:           × 1 (already imports)   × 0.5 (add a dependency first)

• Output. findings, functions, already_imports, add_dependency, pairs_kept, drop_in, pairs_read, left_out, worst[{tier, replace, use_instead, library, fit, partial, own_statics, signature, use_instead_public, action, why, evidence, gain{lines, callers}, similarity, score, also}] (reuse.rs:396-476).
• Code vs comment. The evidence note says "Ranked by similarity × lines × (1 + callers)". The code ranks by similarity · (1 + ln(1 + callers)) · min(lines, 30), halves the add-dependency tier, and sorts the direct tier first (reuse.rs:392, :440).
• Tests. room_feed/reuse_tests.rs (6 tests).

subclone

What it finds. Duplicated regions that are smaller than the item they sit in: a run of tokens shared by two different functions whose other code differs. A chunk-keyed detector (one hash or one vector per item) cannot state such a run at any threshold, because the enclosing items differ (src/mimir_subclone.rs:1-21). The lens folds source text, not a warehouse table and not the graph. The code room supplies only the item spans (src/mimir_lens/subclone.rs:8-24).

Run it.

• MCP: mimir_subclone {repo, limit} (in process, src/mcp_stdio.rs:2124-2147; limit 0 → 50, :364-369).
• gRPC: Mimir.Subclone(LensQuery{repo, limit}) goes through lens_answer and the jera lenses queue, on the source lane LENS_LANES − 1 (src/server_grpc.rs:3451-3460, :6955-6961).
• In process: mimir_lens::answer("subclone", reach, {"repo": …}) (src/mimir_lens/mod.rs:201-203).
• repo is required. repo = "" refuses with scope_required: true, lens_meta.state = invalid_argument, and lists the repos that have a checkout (subclone.rs:203-206, :233-256; room_feed.rs:472).
• Environment knobs (src/mimir_subclone.rs:289-304, parsed at :352-397): NORNIR_SUBCLONE_NORMALIZE (0/false/off/no or 1/true/on/yes), NORNIR_SUBCLONE_MIN_LINES (R2), NORNIR_SUBCLONE_MIN_TOKENS (R1), NORNIR_SUBCLONE_OVERLAP (fraction 0..1). A value that does not parse is named in the note as ⚠ IGNORED and the default stays (:325-341).
• Volume instrument (reads the live tree, ignored by default): cargo test -p nornir --lib subclone_volume -- --ignored --nocapture (subclone.rs:470-512).

Corpus. The checkout at <ws>/git/<repo>, the sibling of the warehouse root (subclone.rs:121-126). Every .rs file with a src path component at any depth. Directories target, .git, vendor, node_modules are skipped. tests/, examples/, benches/ and a top-level build.rs are out (subclone.rs:85, :150-191; test :436-468). Unreadable files are skipped, not read as empty (:146-149).

Math

1. Tokens (the alphabet). Each file is lexed with proc-macro2 (src/mimir_subclone.rs:456-510). With normalisation ON (the default, normalize_identifiers: true, :266):

With NORNIR_SUBCLONE_NORMALIZE=0 identifiers and literals stay verbatim (:475, :487). Comments and whitespace are gone by construction. Each token keeps its 1-based source line. A file that does not tokenise is counted in files_unparsed, never partially guessed (:451-461, :822).

The symbol id is the 32-bit FNV-1a of the symbol text, sym_id(s) with offset 0x811c9dc5 and prime 0x01000193 (:1111-1118). This makes ids equal across files without a shared interner (:796-813).

The module doc says "every literal by KIND". The code classifies a byte character literal b'x' as #s, because the rule looks only at the first byte (:481-485); the FlatTok lexer of the clone signals classes it as a character (:576-580).

2. k-grams and winnowing. Constants (src/mimir_subclone.rs:141-174):

k = KGRAM_TOKENS     = 25          (k-gram length, tokens)
t = GUARANTEE_TOKENS = 60          (guarantee threshold, tokens)
w = WINNOW_WINDOW    = t − k + 1 = 36   (window, in k-grams)

For a file of n tokens x₀ … x₍ₙ₋₁₎:

gᵢ = FNV1a64( le_bytes(id(xᵢ)) ‖ … ‖ le_bytes(id(x₍ᵢ₊ₖ₋₁₎)) ),   i = 0 … n−k
     offset 0xcbf29ce484222325, prime 0x100000001b3            (:597-606)

if n − k + 1 ≤ w:   select the single (gᵢ, i) with the least gᵢ,
                    ties → the largest i                         (:619-625)
else for each window s = 0 … (n−k+1) − w:
     best(s) = argmin_{j∈[s, s+w)} gⱼ, ties → the rightmost j   (:628-634)
     emit (g_best, best) unless best equals the previous emit   (:636-639)

The guarantee (Schleimer, Wilkerson and Aiken 2003): any shared run of at least w + k − 1 = 36 + 25 − 1 = 60 tokens contains one whole window, so it selects at least one common fingerprint and is found. A run shorter than k = 25 tokens has no k-gram and can never match (:28-33, guarantee_tokens() :274-276). The expected density is 2/(w+1) = 2/37 ≈ 5.4 % of the k-grams (:154-157).

3. Seeds (phase B). An inverted index fingerprint → [(file, k-gram index)] over all selected fingerprints (:827-833). A bucket is dropped when:

• its occurrences lie in fewer than 2 distinct files and cross_file_only (default true) (:839-841);
• it has fewer than 2 occurrences (:842-844);
• it has more than max_bucket = 50 occurrences: skipped and counted in buckets_skipped (:845-848, :264).

The single-file test runs before the size test, so a big bucket inside one file is not counted as skipped.

4. Extension (phase C). For every pair of occurrences in a kept bucket from two different files, extend first checks the k tokens are really equal (a hash collision returns None), then grows the match one token at a time to the left and to the right while the ids agree (:1137-1157). The run has len = e − s + 1 tokens, the same on both sides. Gates (:869-882, defaults :249-268):

R1:  len ≥ min_run_tokens = 60          (= GUARANTEE_TOKENS)
R2:  lines(site) = end_line − start_line + 1 ≥ min_run_lines = 20, at BOTH sites

A run that fails is counted in runs_rejected. A kept run is keyed by run_hash = FNV-1a 64 over its token ids (:1121-1131), so the same run reached from many seeds lands in one group. Each key collects the set of sites (file, start_line, end_line, len).

5. Groups (phase D). Per run key (:889-965):

• A site contained in another site of the same group (same file, start ≤, end ≥, more tokens) is dropped (:899-906). A group needs ≥ 2 sites left.
• enclosing = the innermost item span that contains the site's start line (largest depth, then fewest lines; src/vector/spans.rs:54-59). sub_item = true when that item starts before the run or ends after it (:920-923).
• R6, callable body (require_callable: true): every site must overlap (i.start ≤ s.end ∧ s.start ≤ i.end) a span of kind fn or method, else the group is dropped and counted in groups_non_callable. If any site's file has no spans, R6 cannot judge: the group is kept and counted in groups_r6_unjudged (:931-951).
• lines = the lower median of the site heights, hs[(|hs|−1)/2]; tokens = the lower median of the site token counts (:952-962).
• idiom = sites > max_sites = 12 (kept, counted in idiom_groups).
• damage = lines × (sites − 1) (:960).

6. Subsumption, R5 (phase E). Sort groups by tokens desc, then damage desc, then key. Walk in that order and drop a group when every site of it lies inside some site (same file, t.start ≤ s.start ∧ t.end ≥ s.end) of an already kept group. Re-sort the survivors by damage desc, then key (:967-997). groups_before_subsumption keeps the count before.

7. Findings, the headline (phase F). A finding is a connected component of groups linked by an overlapping site (cluster_findings, :1029-1108):

intervals = { (file, start, end, group) for every site }, sorted by (file, start, end)
per file: walk with a running high-water end h;
          if start_j ≤ h  → union(group of previous interval, group_j); h = max(h, end_j)
          else            → h = end_j

This is union-find with path halving; it yields the transitive closure of "two sites in one file share at least one line". Per component: lead = its highest-damage group (groups are damage-sorted, so the first member), sites = Σ sites of the members, files = the distinct files, lines and damage = the lead's (not a sum, :722-729). Findings are sorted by damage desc, then key (:1106). The lens shows the first limit findings in worst; findings_total always gives the full count.

8. The overlap threshold (item granularity, not used by the lens). pair_items is a comparison instrument (:1532-1626). Candidates are leaf fn/method spans. An item's signature A is the set of winnowed fingerprints whose whole k-gram (first and last token line) lies inside the item. Two items in different files pair when

overlap(A, B) = |A ∩ B| / max(|A|, |B|)  ≥  floor = OVERLAP_FLOOR = 0.70     (:1511-1517, :174)

Only candidates sharing a fingerprint are compared, through an inverted index that skips buckets over max_bucket (:1590-1602). max in the denominator (SourcererCC) never scores lower than Jaccard's |A ∪ B|.

detect never reads overlap_floor, and no lens calls pair_items. So NORNIR_SUBCLONE_OVERLAP changes only the echoed options and the environment line, never the answer. The lens module doc says the overlap threshold is "NOT exposed" (subclone.rs:52-58); the code reads it from the environment anyway (src/mimir_subclone.rs:300, :386-394).

GraphBLAS steps

None. Lexing, winnowing, the inverted index, the extension and the union-find are plain Rust over vectors and hash maps. The fan-out over files is gatling_map_balanced, largest source first (src/mimir_subclone.rs:797-818). The code room is read only for the item spans of each file (room.nodes_in_file, room_feed/lenses.rs:1395-1432), which is a node lookup, not a matrix product.

Dataflow

 <ws>/git/<repo>/**/src/**/*.rs ──rust_sources──► (path, text)        subclone.rs:144-191
 code room nodes_in_file(repo, path) ──item_spans──► ItemSpan[] | None  room_feed/lenses.rs:1396-1432
            │
            ▼  phase A (gatling, per file)
 proc-macro2 lex → shape tokens (i, #s/#c/#n, keywords, punct) → sym_id → winnow(k=25, w=36)
            │
            ▼  phase B
 index: fingerprint → [(file, k-gram idx)]   (drop: 1 file, <2 occ, >50 occ = counted)
            │
            ▼  phase C
 extend each cross-file seed pair → run (len, lines)  R1 len ≥ 60, R2 ≥ 20 lines  → runs{run_hash → sites}
            │
            ▼  phase D                       phase E               phase F
 groups (contained sites dropped, R6, median lines, damage) → R5 subsumption → overlap components = findings
            │
            ▼
 envelope: findings_total, groups, groups_before_subsumption, groups_non_callable,
           groups_r6_unjudged, files_without_spans, idiom_groups, buckets_skipped,
           runs_rejected, guarantee_tokens, options, environment, worst[≤ limit]

Worked example 1: winnowing by hand at k = 25, w = 36

Input: the body of the test winnow_selects_the_same_fingerprints_wherever_a_run_appears (src/mimir_subclone.rs:1371):

fn f() { let a = 1; let b = 2; let c = a + b; let d = c * 3; let e = d - 1; let g = e / 2; }

Normalised tokens (rule of step 1):

fn i ( ) {                       5
let i = #n ;   let i = #n ;      5 + 5
let i = i + i ;                  7
let i = i * #n ;                 7
let i = i - #n ;                 7
let i = i / #n ;                 7
}                                1
                         n  =   44 tokens

Arithmetic with the code's constants:

• k-grams: n − k + 1 = 44 − 25 + 1 = 20.
• 20 ≤ w = 36, so the "fewer k-grams than one window" branch applies (:619-625): exactly one fingerprint is kept, the least of the 20 k-gram hashes, ties to the rightmost.
• Replaying sym_id and kgram_hash exactly as written (:597-606, :1111-1118) on these 44 symbols, the least of the 20 hashes is g₁₇ = 0x0106862aad6f4550. The selection is [(0x0106862aad6f4550, 17)].
• The body is 44 tokens, under the 60-token guarantee and under R1 (60). Even if another file shared this whole body, phase C would reject the run (len 44 < 60) and count it in runs_rejected.

The window rule itself is visible with the test's small values k = 6, w = 4 (:1376). The same 44 tokens give 44 − 6 + 1 = 39 k-grams and 39 − 4 + 1 = 36 windows. The first windows, with the hashes from the same replay (first 4 hex digits shown, comparison on the full 64 bits):

k-gram i :   0     1     2     3     4     5     6     7     8
g_i      : d9b2  f8fc  5637  71c5  000a  2947  2513  5f7e  b402
window 0 = g0..g3 → min 5637 at i=2   → emit (5637…, 2)
window 1 = g1..g4 → min 000a at i=4   → emit (000a…, 4)
window 2 = g2..g5 → min 000a at i=4   → same index, not emitted again
window 3 = g3..g6 → min 000a at i=4   → not emitted
window 4 = g4..g7 → min 000a at i=4   → not emitted
window 5 = g5..g8 → min 2513 at i=6   → emit (2513…, 6)

Across all 36 windows this keeps 18 fingerprints of 39 k-grams. With a prefix fn pad() { let z = 9; } (11 tokens) every k-gram inside the body is the same hash at index i + 11, so the same fingerprints are selected. That is the property the test asserts (f1 ⊆ f2, :1377-1379).

Worked example 2: the recorded volumes

All numbers are the code's own records (src/mimir_subclone.rs:56-82, subclone.rs:27-31, :89-112, src/mimir_subclone.rs:226-228, :1636-1641).

Arithmetic on these records:

• Groups to findings on nornir: 195 / 65 = 3.0 groups per region. R5 and phase F remove no group; they only merge restatements.
• The overlap curve: (1057 − 1001) / 1057 = 5.3 % from 0.70 to 0.80, and (1057 − 979) / 1057 = 7.4 % from 0.70 to 0.90. The code calls this "8 %"; the records give 7.4 %. This flatness is why the threshold is not the knob.
• Normalisation: 680 / 150 = 4.53, the "4.5×" of the docs. On findings, 65 / 23 = 2.8×.
• R6 removes 394 − 191 = 203 groups, the use-block class.
• The default_limit page: a run with limit = 25 shows 25 of the 70 lens findings. The lens doc says 25 is the default_limit in LENSES (subclone.rs:110-112); the code has no such entry. subclone is not in LENSES (it is in SOURCE_LENSES, src/mimir_lens/mod.rs:178), and a missing limit reads as DEFAULT_LIMIT = 50 (room_feed.rs:103-105, mod.rs:181) or 50 through MCP (mcp_stdio.rs:364-369).
• Damage of the verified top find, mimir.rs:332-434 ↔ viz/diagram.rs:222-325 (src/mimir_subclone.rs:91-104), taken as a two-site group with exactly these spans: heights 103 and 104 lines, lines = hs[(2−1)/2] = hs[0] = 103, damage = 103 × (2 − 1) = 103. With Type-2 OFF the detector states only a 36-line fragment (mimir.rs:344-379) of this pair; the test normalisation_off_loses_the_verified_top_find holds that line (:1737).

Output fields

Scanned answer (subclone.rs:383-411): kind, scanned, scope_required, repo, source_root, files_scanned, files_unparsed, tokens_total, findings_total, groups, groups_before_subsumption, groups_non_callable, groups_r6_unjudged, files_without_spans, idiom_groups, buckets_skipped, runs_rejected, guarantee_tokens, options, environment, span_source, worst, feeds, evidence_note.

Each worst row (:294-330): key, lead_file, files, file_count, sites, lines, damage, restated_by (member groups), location (the lead group's first site, file:start-end), sub_item, explain.

States (room_feed.rs:465-480): refusal = invalid_argument; no checkout or no .rs file = scanned: false, feed <source tree> missing, note NO SOURCE TREE (subclone.rs:259-281); scanned and clean = empty_fact with "clean READING"; any of files_without_spans, files_unparsed, buckets_skipped > 0 = partial / empty_gap, and the note says the counts are a lower bound (subclone.rs:347-381).

Limits and needs

• One repo per ask; no workspace scope (by design, subclone.rs:33-38).
• A contiguous token run only. A copy interleaved with unrelated lines breaks into pieces shorter than the gates and is not found (src/mimir_groupclone.rs:6-15, test :1235). group_twins covers that case.
• Spans come from the room. A file the room has no span for is still scanned, but its sites get no enclosing, and R6 leaves its groups unjudged (counted).
• Needs the vector feature; without code-room it runs with no spans (room_feed.rs:404-427).

Tests

src/mimir_lens/subclone.rs:415-578 (corpus, sibling root, volume instrument, refusal, absent vs empty tree); src/mimir_subclone.rs:1275-1425 (planted block found, rename, retuned constant, unrelated files, short run rejected, same-file repeat, winnow position independence :1366, winnow discards :1382, hash collision :1395, guarantee :1405, unparseable file :1417); R6 :1441, :1481; normalisation :1645, :1737; findings one_region_restated_by_two_groups_is_one_finding :1768, two_unrelated_duplications_stay_two_findings :1801; environment :1845, :1864; room spans src/mimir_lens/room_feed/room_tests.rs:682; one-lexer rule tests/no_second_parser.rs:151-164.

group_twins

What it finds. The same group of statements inside two different functions of one repo, also when the copy is interleaved with unrelated statements and its locals are renamed, and the same group twice inside one function (src/mimir_lens/group_twins.rs:1-30). Two indexes answer side by side; each row says which found it (source: graph, embedding, both, text):

• the graph (src/mimir_groupclone_graph.rs), primary and complete on its own: compiled facts from the code room, no model, no vector;
• the embedding index (src/mimir_groupclone.rs), optional: the checkout cut into def-use groups, paired on one normalised body or on group vectors in embeddings_groups.

Run it.

• gRPC: Mimir.GroupTwins(LensQuery{repo, limit}), queued on the source lane (src/server_grpc.rs:3462-3471, :6955).
• In process: mimir_lens::answer("group_twins", reach, {"repo": …, "limit": …, "model_profile": …}) (src/mimir_lens/mod.rs:204-206). model_profile picks the vector space; "" means the newest green function-embedding run's space (group_twins.rs:89-99).
• repo = "" refuses and lists the repos with a checkout (group_twins.rs:179-181, :203-220).
• Environment knobs (src/mimir_groupclone_graph.rs:218-240): MIMIR_GT_MIN_BLOCKS, MIMIR_GT_MIN_WEIGHT, MIMIR_GT_BUDGET_MS, MIMIR_GT_MIN_SRC_LINES, MIMIR_GT_MIN_CALLEES, MIMIR_GT_THREADS; and MIMIR_MIR_SIDE_CAP_MB (default 2048) for the MIR side (room_feed/lenses.rs:1448-1459).

Math: the graph index

1. Population and facts. gather (src/mimir_groupclone_graph.rs:983-1109) reads two node masks from the room: all = every defined, non-test fn or method of the room; mine = those of repo (:986-988). For every node of all it reads these edges and turns each site into a name-free key on a source line (facts_of, :470-491):

The stable moniker leaves the version out, so a dependency bump moves no key (:476, test :1364). Only facts inside the function's own span count; one key per line once (:487-489). For a function outside repo the facts carry line 0 and count only for rarity (:1008-1011).

A fact line is (line, sorted distinct keys) (lines_of, :598-611). This is the finest unit: sites carry a line, no column and no order within a line (:20-24).

MIR granularity. A function of repo whose MIR blocks the MIR side holds is cut by basic block instead (:1053-1099, mir_facts_of :424-467). Units are the blocks in source order (first line, then body order). Keys per block:

b:<block fingerprint>               the whole block (statements, terminator, callee, local types)
s:<fnv64(canonical statement)>      each statement, locals renumbered
c:<callee stable moniker>           the call terminator's callee
e:<fp_x>><fp_y>                     each CFG_SUCC edge x→y, on the source block x

The module doc lists the first three; the code also adds the e: edge key (:449-452). Functions of the two granularities are never paired with each other (:681). Functions outside repo with fingerprints only contribute their b: keys to the rarity (:1061-1063, :1085-1087).

2. Rarity. Over the population P (every function of all, N = |P|; :1100-1107, Rarity::of :569-580):

df(k)   = |{ f ∈ P : k ∈ keys(f) }|          (a key never seen counts as df 1)
idf(k)  = ln(1 + N / df(k))                    (:585-587)
rare(k) ⇔ df(k) ≤ RARE_DF = 64  ∧  df(k) ≤ max(⌊N/2⌋, 2)     (:591-594)
W(S)    = Σ_{k∈S} idf(k)

The module doc gives the rare rule as df ≤ RARE_DF; the code adds the second condition (at most half the population).

3. Eligibility and candidates. A function is eligible when its ident does not contain ::_:: (derive expansions), it has at least min_units units and at least MIN_GROUP_KEYS = 4 distinct keys (:661-663). min_units = MIN_GROUP_LINES = 3 for fact lines and max(MIN_GROUP_BLOCKS = 8, 3) = 8 for MIR (:294-300). Candidates come only from posting lists of rare keys (:670-675):

cand(a, b) = |{ k rare : k ∈ keys(a) ∩ keys(b) }|,  a < b, different monikers, same granularity

Candidates are judged in order of cand desc, then (a, b) (:689-690). At most MAX_CANDIDATES = 60,000 are judged, and the judging stops at the BUDGET_MS = 45,000 ms wall clock; the rest is counted in candidates_unjudged with bounded_by (:691-698, :778-783). The fan-out is gatling with GRAPH_WORKERS = 6 (:151, :777).

4. The group of a pair (a, b) (judge, :704-775):

shared  = keys(a) ∩ keys(b)
for each run_a in runs( lines of a with a key in shared, MAX_GAP = 3 ):
    ka     = keys(run_a) ∩ shared
    run_b  = argmax over runs( lines of b with a key in ka, 3 ) of W(keys(run) ∩ ka)
             (tie → the run that starts first)
    ga     = lines of run_a with a key in keys(run_b)          trim A
    gb     = lines of run_b with a key in keys(ga)             trim B
    MIR: ga, gb ← the largest CFG_SUCC-connected part (tie → the earlier one)   (:840-876)

runs(marked, g) splits a sorted index list where two consecutive marked indices are more than g + 1 apart, so at most MAX_GAP = 3 unmarked fact lines (the interleaved noise) may sit between two members (:614-623; test :1561: runs([0,1,5,6,20], 3) = [[0,1,5,6],[20]]).

5. Score, order and gates. With Sa = keys(ga), Sb = keys(gb), qa, qb = the ordered key sequences (lines in order, keys sorted inside a line):

score   = W(Sa ∩ Sb) / W(Sa ∪ Sb)                     IDF-weighted Jaccard   (:739-741)
exact   ⇔ shape(ga) = shape(gb)   (the per-line key lists are equal, line for line)  (:743)
kgrams(q) = { FNV1a64 of each window of KGRAM = 2 consecutive keys }          (:637-651)
shared_k = |kgrams(qa) ∩ kgrams(qb)|
rare    = { k ∈ Sa ∩ Sb : rare(k) }

The pair is a twin when all of these hold (:735-751):

|ga| ≥ min_units ∧ |gb| ≥ min_units ∧ |Sa| ≥ 4 ∧ |Sb| ≥ 4
rare ≠ ∅
shared_k ≥ MIN_SHARED_KGRAMS = 2
exact ∨ score ≥ SCORE_FLOOR = 0.6
W(Sa ∩ Sb) ≥ min_weight   (0 for fact lines, MIN_GROUP_WEIGHT = 40.0 for MIR)
substantive(…)            (always true for fact lines; the MIR boilerplate gates below)

The reported score is 1.0 when exact, else score (:753).

MIR boilerplate gates (substantive, :246-286), each per side: distinct source lines ≥ MIN_GROUP_SRC_LINES = 4; lines more than 2 away from the item's first and last line ≥ MIN_INTERIOR_LINES = 3; not the same file and span under two monikers; cover = distinct group lines in the span ÷ span lines, with min(ca, cb) ≥ MIN_COVER_BOTH = 0.3 and max(ca, cb) ≥ MIN_COVER_ONE = 0.5; shared c: keys whose crate is not in BOILERPLATE_CRATES (core, alloc, std, serde, serde_json, clap, clap_builder) ≥ MIN_GROUP_CALLEES = 4 (:122-153).

6. The same group twice in one function (self_twins, :886-962). For a body with 2·min_units ≤ n ≤ SELF_SCAN_MAX_UNITS = 800 units, for each offset d = min_units … n−1, every maximal stretch of positions p with unit(p) = unit(p + d) gives a pair of non-overlapping runs of length k = min(stretch, d), kept when k ≥ min_units, both runs are CFG-connected (MIR), and the gates hold (≥ 4 keys, a rare key, ≥ 2 k-grams in the run, the weight, substantive). These are exact only, score 1.0, same_function. They run before the cross pairs, so a spent budget cannot starve them (:664-667, test :1224).

7. Ranking. Twins sort by score desc, rare_shared desc, shared_kgrams desc, then the first group line of side a and of side b (:792-800). shared_words = the labels of the 4 shared keys with the highest idf (:754-758). A group's key is SHA-256 of its key sequence joined by newlines (:833).

Math: the embedding index (optional)

Input: the checkout (subclone::rust_sources), each leaf fn/method span cut out (fnvec::cut) and segmented (group_twins.rs:45-72, :110-128).

• Segmentation (src/mimir_groupclone.rs:439-531). Statements join by def-use, through union-find in statement order: a statement joins the group that owns a name it reads or writes; it then owns the names it writes. The signature owns nothing. A closing brace joins its header; a header with no def-use link of its own joins the dominant group of its block. Noise that shares no name stays in its own group.
• Normalisation. The group's tokens go through clone_signals::norm::normalize_tokens (names → numbered roles per group, literals → kinds, visibility gone). The exact key is SHA-256 of the normalised text, which is also the vector key in embeddings_groups (:41-52). k-grams: FNV-1a 64 over windows of KGRAM = 8 role classes (:534-550).
• Gates (pair, :617-730):

eligible  ⇔ norm.tokens ≥ MIN_GROUP_TOKENS = 30                         (:628)
candidate ⇔ a shared 8-gram bucket of ≤ MAX_BUCKET = 100 groups, different functions  (:653-664)
df(g8)    = number of DISTINCT normalised bodies holding the 8-gram
pair      ⇔ |shared 8-grams| ≥ 2 ∧ |{ g8 shared : df(g8) ≤ RARE_DF = 2 }| ≥ 1      (:681-686)
cosine    = 1.0                       if the exact keys are equal
          = Σᵢ vaᵢ · vbᵢ              if both vectors exist with equal length  (:692)
          → counted in candidates_unjudged otherwise
twin      ⇔ cosine ≥ cosine_floor

The code takes the plain dot product. It equals the cosine only when the stored vectors are unit length; the module does not normalise them.

• The floor. COSINE_FLOOR = 0.90 (fixture value) unless the model profile has a recorded row. One row exists: jina-v2-base-code, floor 0.967 = μ_pos − 1·σ_pos, ROC-AUC 0.997, recall 93.6 %, hard-negative survival 0.6 % (:795-858; chosen in group_twins.rs:135-147).
• Ranking. cosine desc, shared_kgrams desc, then positions (:715-721).

Merge (group_twins.rs:312-410). Graph rows come first. An index twin whose two group lines fall inside the item spans of a graph row's two functions is agreement: its line is added to that row's found_by, and when it is not exact the row's source becomes both and its cosine the embedding cosine. Any other index twin is added after the graph rows (source text or embedding). worst = the first limit rows of graph rows then added rows.

On a graph row the field cosine carries the graph score, an IDF-weighted Jaccard, and cosine_from: "graph_score" says so (group_twins.rs:342-348). Likewise GraphOptions.cosine_floor carries the score floor; no cosine is computed in the graph index (src/mimir_groupclone_graph.rs:155-158).

GraphBLAS steps

Everything else is not GraphBLAS. The node masks are a column scan of the room's node table (crates/mimir-room/src/query.rs:704-710). Site lines, spans and MIR blocks are lookups. Rarity is a hash count. The candidate generation is posting lists in a hash map. The run cut, the trim and the score are set operations in Rust. The MIR connectivity is a small union-find over the group's CFG edges (:840-876). The embedding index uses no graph at all.

Dataflow

 mimir-driver dump ─► code room (lake) ───────────────────────────────────────────┐
   mask: fn|method, defined, non-test   (all repos → P, repo → mine)              │
   GrB_Matrix_extract rows of CALLS / READS_FIELD / TOUCHES_TABLE / CONTAINS       │
   sites (line per call / field / table), local parts (ty)                        │
   MirSide: mir_block payloads beside the room, ≤ MIMIR_MIR_SIDE_CAP_MB = 2048 MiB│
        │                                                                          │
        ▼ gather                                                                   │
 CompiledFn[mine]: fact lines {c:, f:, t:, l:}  or  MIR blocks {b:, s:, c:, e:}     │
 Rarity over P: df, idf = ln(1 + N/df), rare                                       │
        │                                                                          │
        ▼ pair (gatling, ≤ 60,000 candidates, ≤ 45 s)                               │
 rare-key postings → candidates → runs (gap ≤ 3) → trim → score / exact / 2-grams   │
 + self_twins (repeats in one body)  → GraphTwin[] sorted by score, rare, k-grams   │
        │                                                                          │
        │        <ws>/git/<repo> src trees + room item spans  (optional index)     │
        │          → fnvec::cut → segment (def-use) → normalize → 8-grams           │
        │          → embeddings_groups vectors (model space) → pair → GroupTwin[]  │
        ▼                                                                          │
 envelope: graph rows, then index rows added / agreeing → worst[≤ limit] ◄─────────┘
   functions, granularity, functions_mir, functions_without_span, graph_unread,
   candidates, graph_candidates_unjudged, twins_total, twins_graph,
   twins_embedding_added, twins_embedding_agreed, vectors_read, options,
   embedding{…}, floor_basis, feeds, evidence_note

Worked example: the near-copy fixture computed by hand

Fixture: a_near_copy_pairs_on_the_score_and_common_keys_never_open_a_pair (src/mimir_groupclone_graph.rs:1347-1361), with the gates small() (:1117-1119; for fact lines these equal the defaults: 3 lines, 4 keys, gap 3, floor 0.6, 2-grams, 2 shared, weight 0).

Functions (raw :1234-1262, planted :1265-1275, background :1288-1296):

near_a (lines 11-17)            near_b (lines 41-47)
11  l:Vec<(String,u64)>          same
12  l:u64                        same
13  c:ledger_open  f:entries     same
14  c:weigh_entry  l:u64         same
15  c:u64::wrapping_mul f:seed   same
16  c:Vec::push                  same
17  c:sort_by_weight f:entries   c:sort_unstable_by_weight f:entries   ← the one swapped callee
control: {c:Vec::push l:u64} {c:u64::wrapping_mul} {c:Vec::push} {c:String::len l:u64}
bg0..bg29: {c:Vec::push l:u64} {c:step_i} {l:u64 c:Vec::push} {c:String::len}

The local names (a_acc, b_acc, …) are dropped, so both planted copies give the same l: keys. Population N = 33. Document frequencies and idf (ln(1 + 33/df)):

Candidates: (near_a, near_b) share 6 rare keys; (near_a, control) and (near_b, control) share one (c:u64::wrapping_mul). The step_i keys are unique, so no background pair is a candidate. candidates = 3.

Pair (near_a, near_b). shared = 8 keys (all but the two sort callees). Every line of A holds a shared key, so run_a = lines 11-17; the same on B. The trim keeps all 7 lines on both sides (line 17 holds f:entries). Sa ∩ Sb = 8 keys, Sa ∪ Sb = 10 keys.

W(Sa ∩ Sb) = 5·2.8622 + 2.4849 + 2·0.6931 = 18.1822
W(Sa ∪ Sb) = 18.1822 + 2·3.5264          = 25.2349
score      = 18.1822 / 25.2349            = 0.7205   ≥ 0.6
exact      = false (line 17 differs)
sequence A = Lvec Lu64 c_lo f_e c_we Lu64 c_wm f_s c_push c_sort f_e   (11 keys, 10 2-grams)
shared_k   = 10 − 2 = 8   (only the two 2-grams around the swapped callee differ)
rare       = 6 shared rare keys

All gates pass: one twin, score 0.7205, exact: false, shared_kgrams: 8, rare_shared: 6. The code comment records "0.72" for this case (:104-107).

Pair (near_a, control). shared = {l:u64, c:u64::wrapping_mul, c:Vec::push}. Marked lines of A: 12, 14, 15, 16 (one run). All four lines of control are marked. After the trim, Sa = {l:u64, c:weigh_entry, c:u64::wrapping_mul, f:seed, c:Vec::push} (5 keys) and Sb = {c:Vec::push, l:u64, c:u64::wrapping_mul, c:String::len} (4 keys).

W(Sa ∩ Sb) = 0.6931 + 2.4849 + 0.6931                 = 3.8712
W(Sa ∪ Sb) = 3.8712 + 2·2.8622 + 0.7249               = 10.3205
score      = 3.8712 / 10.3205                         = 0.3751   < 0.6
2-grams A  = (Lu64,c_we) (c_we,Lu64) (Lu64,c_wm) (c_wm,f_s) (f_s,c_push)
2-grams C  = (c_push,Lu64) (Lu64,c_wm) (c_wm,c_push) (c_push,c_len) (c_len,Lu64)
shared_k   = 1   < 2

It has one rare shared key, so it fails on the k-grams and on the score. The code records "0.38" for this control (:104-107). The test asserts exactly one twin and that control is in none (:1356-1360).

The interleaved case (:1307-1327). B's copy gets a log line and an unrelated call inserted after its 2nd and 4th planted lines, and its locals renamed. B's run is lines 41-49, the noise lines 43 and 46 carry no shared key and are trimmed. Both groups then have the same 7 per-line key lists, so the pair is exact, score 1.0, group_lines A = 11-17 and B = 41, 42, 44, 45, 47, 48, 49, and both sides have one SHA-256 key.

Worked example: recorded numbers

From the code's records (src/mimir_groupclone_graph.rs:111-147, src/mimir_groupclone.rs:795-858):

• MIR blocks made one repo's candidates 197,545 (nornir on dwarf, 186 s); hence the 60,000 cap.
• nornir answered 27,837 MIR groups at 3 blocks, against 3,486 by fact line; hence MIN_GROUP_BLOCKS = 8.
• Of 23 hand-checked nornir MIR findings, 16 were derive code and 3 were two-line idioms; hence MIN_GROUP_SRC_LINES = 4. A third check (15 of 390) found shared prologues with cover 0.04-0.28, while real copies covered ≥ 0.59 of one side and ≥ 0.38 of the other; hence the cover gates 0.5 / 0.3.
• Embedding space calibration on nornir/src: 6,701 functions, 6,282 groups of ≥ 30 normalised tokens; positives μ 0.9900, σ 0.0234; floor 0.9900 − 0.0234 = 0.9666 ≈ 0.967. Survivors on the corpus: floor 0.90 → 657 twins (286 by vector), 0.95 → 417 (46), 0.967 → 383 (12); 371 exact-key twins do not depend on the floor.

Output fields

Top level: see the dataflow box (group_twins.rs:487-528). Each worst row: granularity, cosine, cosine_from (graph_score, embedding, text_exact), score, source, exact, shared_kgrams, rare_shared, shared (top words), found_by, why (says "interleaved" when fact lines not in the group sit inside its span), a and b (repo, file, line, end_line, ident, item_span, group_lines as ranges like 41-42,44-45, tokens, key, moniker, and for MIR group_blocks), location (:340-367, :246-290).

States (room_feed.rs:465-480): refusal = invalid_argument; no graph and no tree = scanned: false, NO COMPILED GRAPH … and NO SOURCE TREE (group_twins.rs:223-244); graph unread but tree present = partial, note ⚠ MISSING: the compiled graph was not read … a LOWER bound; candidates unjudged = ⚠ BOUNDED (:438-443); functions without a span = ⚠ MISSING … (a LOWER bound) (:450-452).

Limits and needs

• One repo per ask; rarity is over the whole room.
• The graph needs a code room with CALLS, READS_FIELD, TOUCHES_TABLE sites and local parts. MIR granularity needs the room's MIR bodies and the MIR side payloads beside it; a function without them keeps fact lines.
• A line carries no column and no order inside it; a site inside a macro expansion has no position (src/mimir_groupclone_graph.rs:20-24).
• Facts are what the compiler resolved: control flow and literals are not keys at fact-line granularity. Two groups that call the same functions in the same line order with different arithmetic look alike there.
• The embedding index needs the checkout, the room's item spans, and vectors in embeddings_groups for one model space. With none of these it adds nothing, and the lens is still complete on the graph.
• Needs the vector feature (room_feed.rs:434-462).

Tests

Lens: src/mimir_lens/group_twins.rs:531-794 (refusal, not scanned, graph without tree :623, no graph = lower bound :632, text-exact without graph :721, ranges :782, source root :790). Graph: src/mimir_groupclone_graph.rs:1126-1565, including interleaved :1307, local names :1332, near copy :1347, dependency bump :1364, MIR block pair :1407, granularities never mix :1443, repeats in one function :1465, :1492, :1224, connected MIR fragment :1515, bounded pairing :1542, runs :1561, MIR boilerplate gates :1126, :1185, worker parity :1199. Embedding index: src/mimir_groupclone.rs:1002-1260, including the oracles :1066-1119, constants :1156, recorded space :1203, and winnowing_is_blind_to_the_interleaved_copy_and_this_module_is_not :1235.

subclone, group_twins and dwarves twins: which to use

What each finds that the others miss.

• subclone alone sees a copied block of text inside two otherwise different functions, including code the compiler resolves to nothing specific: arithmetic, literals, control flow, string building, match arms. It also sees code outside compiled configurations, since it reads text. It misses an interleaved copy (the run breaks into pieces under k), a copy whose statements were reordered, and twins with different text.
• group_twins alone sees an interleaved or reordered-by-call-syntax copy inside a function: a.f(x) and T::f(&a, x) are one resolved callee, renamed locals move no key, and up to 3 noise lines may sit between members. It also reports the same group twice inside one body. It misses copies that share no rare compiled fact (pure arithmetic), and functions that are twins only as a whole.
• dwarves twins alone sees whole-function twins that share no text and no statement group: the same outside API reached through different helpers (sha2 ≈ ring digest), the same MIR shape under different names, NEAR shapes that differ by one branch, inlined twins, and DIVERGENT pairs (same name and signature, a different body). It works across crates and on dependencies. It does not locate a shared fragment inside two larger functions.

When to use which.

• "Which block of code was pasted into two places?" → subclone on the repo.
• "Is the same sequence of calls and field writes done in two functions, maybe with logging or renames in between?" → group_twins on the repo.
• "Which functions across crates do the same job, or claim to do it and do not (DIVERGENT)?" → dwarves twins on the dump. On Holger at the defaults it finds 327 groups, 41 STRONG, 71 DIVERGENT pairs (section 7.3).

Shared and different.

• Shared: group_twins and dwarves twins both read compiled facts written by mimir-driver (resolved CALLS, MIR blocks and CFG_SUCC): the room is folded from the same dump that dwarves loads. All three are deliberately name-free for locals and literals. subclone and the embedding index of group_twins use the one allowed lexer, proc-macro2 (tests/no_second_parser.rs:151-164), and share the checkout resolution and corpus rule (subclone::source_root, rust_sources). Both nornir lenses refuse repo = "".
• Different: subclone is text-based and exact after normalisation; group_twins is fact-based and weighted by rarity over the room; dwarves twins is graph-based on GraphBLAS over a whole dump and compares whole functions. The idf formulas differ (ln(1 + N/df) in nornir, max(ln(n/df), 0.05) in dwarves), and so do the rarity bounds (df ≤ 64 and ≤ N/2 in group_twins; ≤ rare_max 12 fns in dwarves).

4. Graph lenses (nornir-mimir-lens; door: dwarves lens)

Layout. Since 2026-11-05 (lane LENS-MOVE, owner order) every lens, graph, loader and cache line lives in nornir, in the crate nornir-mimir-lens (library mimir_lens, crates/mimir-lens/, beside mimir-graph):

Features: lenses, mimir-fat, coverage-fat, lens-graph, graph-cache-graphar (the same names dwarves had). dwarves re-exports the modules (dwarves::lenses, dwarves::coverage, dwarves::mimir, ...), so its callers did not change; it keeps argument parsing, data-source selection (local dump, --wh, server) and printing. The history of the moved files came along (git log crates/mimir-lens in nornir).

All of them read one dump through Graph::load (crates/mimir-lens/src/lenses/mod.rs:124). The index holds CONTAINS parents and children, CALLS with site counts, the dyn Trait expansion (a trait method → the same-named method of every impl, via IMPLEMENTS and CONTAINS), FOR_TYPE, EXPANDS, CFG_SUCC and the MIR blocks of each fn.

Scope (crates/mimir-lens/src/lenses/mod.rs:713-737): a node counts when it is defined in the dump, in the scoped crates, the workspace's own code, not under generated/, not written by a derive macro (EXPANDS), and not test code unless --include-tests. Own code means the node's origin is local, or absent in an old dump (is_local, :420-424). A full dump (cargo mimir-dump without --workspace-only) carries every dependency crate too. Those crates count only with --include-deps, or when --crate names them (:719). Before this rule, twins on a full Holger dump counted 181,922 fns and 10,907 groups of tokio, serde and other dependencies (plan §D round 9). Test code = an is_test node, a tests/*.rs crate, a file under tests/, or a cfg(test) ancestor (:369-393).

LENSES (crates/mimir-lens/src/lenses/mod.rs:695-709): gate-bypass, size, twins, dispatch-erosion, cycles, single-impl, error-shape, cfg-sprawl, verdict, and the four study lenses taint, chokepoints, misplaced and dsm (sections 4.9 to 4.12). The verdict folds the first eight (it recomputes the single-impl, error-shape and cfg-sprawl terms inline, section 5). It does not fold the study lenses.

The GraphBLAS wrapper is crates/mimir-lens/src/lenses/grb.rs. It calls GrB_mxm with these semirings:

4.0 The load: the parallel reader, the exact graph cache, one load for many lenses

(Lane graph-fast, 2026-11-04, dwarves branch graph-fast/loader-cache; the dw: lines of this section are that branch's.) Every lens starts with Graph::load(dump) (crates/mimir-lens/src/lenses/mod.rs:223). The load has two paths that end in the same function, so a cached graph IS the fresh graph:

                       dump dir (*.nodes.arrow, *.edges.arrow; schema in each file's metadata)
                                   │
                key = blake3( LOADER_VERSION ‖ Σ_files sorted ( |name| ‖ name ‖ blake3(bytes) ) )
                                   │                          (cache.rs:124, files hashed in parallel)
              ┌──────── snapshot <cache>/<key>.gar exists? ────────┐
              │ no                                                  │ yes
              ▼                                                     ▼
  FRESH (v2.rs:291 read_with)                           CACHED (cache_graphar.rs:329)
  1 IPC read, per file, biggest first ─ gatling          vertex chunks ∥ (kind, partition) chunks ─ gatling
  2 bins = ⋃ bin targets of the raw id column            nodes = vertices 0..n, refs = n..n+m
  3 rows decoded per ≤ 2^15 rows of a batch,             edges[seq] = (id(src), id(dst), kind, props)
    columns downcast once, ids built normalised          ends[seq]  = (src < n ? src : NONE, …)
  4 dedupe sharded by hash(key) % 64                                   │
  5 IdIndex + ends resolved ∥                                          │
              │            write the snapshot (temp dir + rename) │    │
              └──────────────────────────┬─────────────────────────────┘
                                         ▼
                      Graph::from_resolved / from_parts (mod.rs:267, :275)
            parent, children, calls/callers, call_count, dyn expansion, field maps,
            mir_blocks_of, cfg_succ, edges_by_kind, edge_kinds, node_kinds

Exactness. Each step keeps the serial reader's answer, not an approximation of it:

Tested in crates/mimir-lens/tests/graph_cache.rs: the fast reader = the reference reader (read_with_reference, the old row-at-a-time code) on a fixture with stub rows, a bin= segment, a test crate, a dangling edge end, repeated edges, LargeUtf8 and UInt64 columns, two batches and an empty file; the cached graph = the fresh graph field by field (both snapshot formats); a changed file = a new key and the old snapshot removed; a cut snapshot is rebuilt; validate_graph_dir finds no error in the GraphAr snapshot; and the same checks on the pinned Holger dump (ignored test).

The snapshot (crates/mimir-lens/src/lenses/cache_graphar.rs) is an Apache GraphAr gar/v1 graph written with nordisk/graph-ar, Arrow IPC chunks:

Default place: <dump>/.graph-cache/<key>.gar; DWARVES_GRAPH_CACHE=<dir> moves it, =off reads the Arrow files every time; DWARVES_GRAPH_CACHE_FORMAT=dwgc uses the custom one-file snapshot instead (cache.rs: varint rows in 2^14-row blocks plus the end table). The two measured close on Holger with graph-ar bade573: median cached load 0.96 s / 2.0 GB against 1.04 s / 2.6 GB, first run with the write 3.6 s against 2.7 s. The rule for a close result is GraphAr: it is a standard that FalkorDB (via knut) and Spark read, and it holds 0.5 GB less.

One load, many lenses. dwarves lens all (plan and held graph: crates/mimir-lens/src/lenses/all.rs; door: dw:src/cli.rs lens_all_cmd) builds each lens's argv and parses it with the same RepoLens parser as the verb, on one graph held in a process static (:624, never dropped, so the process skips freeing it at exit); dwarves lens batch --plan <jsonl> (:882) runs any list of lens lines, one load per dump, each line's answer byte for byte the verb's. DWARVES_LOAD_TRACE=1 prints each load step and each lens's compute time.

The default set (all.rs DEFAULT, plan_src; lane LENS-POLISH, 2026-11-05): every graph lens with no required input, 20 on one graph: size, twins, dispatch-erosion, cycles, single-impl, error-shape, cfg-sprawl, dsm, misplaced, taint, verdict, then the plan-H lenses taxonomy-drift (H9), dyn-to-enum (H1), foreign-helper-sprawl (H3), late-validation (H4: --entry = the gate entries when given, else the roots), asymmetric-seam (H5), deferred-init-sprawl (H10), typestate-candidate (H2), pipeline-subclass-leak (H7), monolithic-router (H8). The ones that need an input ride on it: history-comments (B4) on --src, gate-bypass on --sink + --choke, chokepoints on --entry + --sink, runtime-guard-erosion (H6) on --sink. reach-set (B10: its --entry is the target set, not a filter) and export-refactor-envelope (H11: a finding of another report) run only by name.

plan_src(L, sinks, chokes, entries, sources, src) =
  L                                                             if L ≠ ∅ (a repeat runs once)
  [gate-bypass | sinks ≠ ∅ ∧ chokes ≠ ∅] ++ DEFAULT ++ [history-comments | src]
    ++ [chokepoints | entries ≠ ∅ ∧ sinks ≠ ∅] ++ [runtime-guard-erosion | sinks ≠ ∅]   otherwise
plan(…) = plan_src(…, src = false)

Every lens of the plan reads the one held graph (loaded), so a lens added to the set costs its compute only. Bench (build-1, release door, graph cache warm, the box under a load of 40-50 from other lanes; timeit wall / peak RSS, median of three runs alternated with the old plan): Holger lens all --mimir-dump holger-s6 6.7 s / 2.73 GB (11 lenses) → 7.5 s / 2.75 GB (20 lenses). The nine new lenses cost 1.0 s together (DWARVES_LOAD_TRACE: dyn-to-enum 265 ms, monolithic-router 183, pipeline-subclass-leak 150, taxonomy-drift 149, typestate-candidate 140, late-validation 67, foreign-helper-sprawl 46, deferred-init-sprawl 28, asymmetric-seam 13); the RSS is the held graph. With the gate inputs and --src (24 lenses, history-comments 70 ms of them): 9.4 s / 2.4 GB.

The CLI uses mimalloc (dw:src/main.rs:18): the decode allocates millions of small Strings on every core, and glibc's arenas made the cache decode 2.0 s against 0.4 s.

4.1 gate-bypass

The question. Does the gate (the choke) sit on every path from a request entry to a write into a store (a sink)? This is complete mediation. The lens answers it twice: first on the fn call graph (plain BFS), then, when the dump carries MIR, context-sensitively on the block-level interprocedural CFG (ICFG), where a path must return to the call site it came from.

Run. cargo lens gate-bypass --sink PAT… (--choke PAT… | --spec FILE) [--entry PAT…] (dw:src/cli.rs:277-292). --sink is required, and --choke unless --spec names the gate (below). A pattern is a substring of the label <crate> <short moniker> (crates/mimir-lens/src/lenses/mod.rs:299, :447). A pattern that matches no fn is an error, not an empty answer (crates/mimir-lens/src/lenses/gate_bypass.rs:122-135, :156-162).

Name the trait AND its impls as sinks (Store#put() and [Store]put()). An impl method is its own node, and the dyn expansion runs from trait to impl only, so a trait pattern alone under-reports: 14 write paths against 201 on Rusternetes (section 1.4). An impl pattern also matches test impls.

cargo lens gate-bypass --crate holger-server-lib \
  --sink 'RepositoryBackendTrait#put()' --choke 'impl#[IntakeChain]' \
  --entry 'exposed/http/handle()'

From the compiler to the graph

• fn nodes and CALLS. cargo mimir-dump (the nornir mimir-driver) writes code_nodes / code_edges (*.nodes.arrow / *.edges.arrow). The lens reads CALLS, IMPLEMENTS, CONTAINS, EXPANDS and CFG_SUCC from them (Graph::load, crates/mimir-lens/src/lenses/mod.rs:124, edge switch :143-170).
• MIR blocks. For every fn, method and closure of a workspace crate the driver takes rustc's mir_promoted body (built MIR, before drop elaboration and optimisation; crates/mimir-driver/src/walk/mir.rs:63-100). Closures and async bodies are separate MIR bodies under the same typeck root; the driver writes their blocks under the root fn with the prefix cK. (walk/mir.rs:642-674). Each non-cleanup block becomes one mir_block node named bbN or bbcK.N (walk/mir.rs:680, :737). Its ty payload holds the terminator text, for a call call <callee moniker>⟨args⟩->_n@line:col (grammar: crates/mimir-lens/src/lenses/mir.rs:1-11).
• CFG_SUCC. One edge per normal-flow successor of the terminator; cleanup (unwind) blocks are no successors (walk/mir.rs:546-548). For a Call the return target is a successor (walk/mir.rs:484), so CFG_SUCC already holds the edge call block → its continuation. This matters below.
• The cap. Since schema 6 there is none: the driver writes every non-cleanup block of each body (Holger's exposed/http/handle(), 12,016 blocks, 9,926 of them in its coroutine, is whole). A cap exists only on request (MIMIR_MIR_BLOCKS, cargo mimir-dump --mir-blocks N), and then a capped body's CFG_SUCC stays inside its written blocks. Up to schema 5 the driver wrote the first 1,024 blocks and dropped the rest, so a long body's later call blocks were missing from the ICFG. The lens's needs text (crates/mimir-lens/src/lenses/gate_bypass.rs:397, "writes no mir_block for a body over its cap") describes neither; only a fn with no bb0 at all lands in doors_without_mir.

Phase 1: the sets on the fn graph (plain BFS, not GraphBLAS)

Let F be the fn and method nodes of the dump. scope(f) is the common dwarves scope: defined in the dump, in the --crate set, own code (origin = local) unless --include-deps, not under generated/, not written by a derive (EXPANDS), not test code unless --include-tests (crates/mimir-lens/src/lenses/mod.rs:729-736).

The dyn expansion (crates/mimir-lens/src/lenses/mod.rs:188-218). For every trait t and every impl i with i IMPLEMENTS t, a fn child tm of t and a fn child m of i with the same name give one edge:

DYN  = { (tm, m) : tm ∈ CONTAINS(t), m ∈ CONTAINS(i), (i, t) ∈ IMPLEMENTS, name(tm) = name(m) }
H    = CALLS ∪ DYN                          (the forward graph of the walk)
pred(v) = callers(v) ∪ dyn_sources(v)       (gate_bypass.rs:103-106)

A call to a trait method thus reaches every impl's method of that name. This over-approximates on purpose: for a gate, a missed edge would hide a bypass.

The sets (crates/mimir-lens/src/lenses/gate_bypass.rs:125-191):

S  = { f ∈ F : label(f) contains a --sink pattern }                         sinks
C  = { v : label(v) contains a --choke pattern }                             chokes (any node kind; only fns are walked)
E  = { f ∈ F : label(f) contains an --entry pattern }                        with --entry
E  = { f ∈ F : scope(f), f not a trait method, callers(f) = ∅, dyn_sources(f) = ∅ }   without --entry (roots)
E′ = E ∖ S                                                                   (is_entry, :175)
D  = { (f, s) : s ∈ S, (f, s) ∈ CALLS, f ∈ F, f ∉ S, scope(f) }              doors (:177-190)
T  = { v : ¬include_tests ∧ (test_code(v) ∨ generated(v)) }                  (:191)

A door is a pair, so one fn calling two sinks is two doors. Only direct CALLS make a door: a fn that reaches a sink only through DYN is not a door.

For a blocked set B, let Anc_B(f) be the nodes u with a path u = v₀ → v₁ → … → v_k = f in H where every vᵢ with i < k is not in B. The reverse BFS (reverse_bfs, :82-117) computes the shortest such path to the first entry it dequeues. The door itself is never tested against B. The two blocked sets are:

B_strict = C ∪ S ∪ T        (:204)
B_loose  =     S ∪ T        (:216)

The classes of a door (f, s) (:193-232):

gate-door     f ∈ C
BYPASS        f ∉ C  ∧ ( E′ ∩ Anc_B_strict(f) ∖ {f} ≠ ∅  ∨  f ∈ E′ )
through-gate  f ∉ C  ∧ ¬BYPASS ∧ E′ ∩ Anc_B_loose(f) ∖ {f} ≠ ∅
latent        otherwise  (a pub API, a test-only caller, or dead code)

A BYPASS row carries the path entry → … → f → s; a door that is itself an entry carries [f, s]. Rows are sorted by class (BYPASS, through-gate, gate-door, latent), then door label, then sink label (:233-239). The headline counts rows (write paths) and distinct BYPASS door fns (:248-260). This phase is breadth-first search over adjacency lists (VecDeque), not a GraphBLAS product.

Phase 2: the ICFG (crates/mimir-lens/src/lenses/icfg.rs)

The fn set of the ICFG is Φ = {f ∈ F : scope(f)} ∪ S ∪ C ∪ E ∪ ⋃_{s∈S} dyn_targets(s) (crates/mimir-lens/src/lenses/gate_bypass.rs:342-351). Its blocks are the mir_block rows of the fns in Φ (icfg.rs:61-91). succ(c) is the CFG_SUCC successors of block c inside the ICFG. ret is the set of blocks whose terminator is return (:136). entry(f) is f's bb0; a fn without blocks has no entry and is opaque (it returns at once, :54-55).

V      = { blocks of the fns in Φ }                                    n = |V|
Intra  = { (b, b′) : (b, b′) ∈ CFG_SUCC, b, b′ ∈ V, b is not an in-set call }   (:97-145)
       ∪ { (bb0(f), bbcK.0(f)) : every nested body K of f }              (:80-87)
in-set call: term(b) = call|tailcall g′, label(g′) ∈ Φ, and some g ∈ {g′} ∪ dyn_targets(g′) has blocks
succ(c) = the CFG_SUCC successors of c in V (kept for every call block c, :146)
Calls  = { (c, g) : term(c) = call|tailcall g′, label(g′) ∈ Φ, g ∈ {g′} ∪ dyn_targets(g′) }   (:136-142)
Call   = { (c, entry(g)) : (c, g) ∈ Calls, g not opaque }                (descend_edges, :182-187)
Return = { (r, s) : (c, g) ∈ Calls, r ∈ ret ∩ blocks(g), s ∈ succ(c) }   (return_edges, :190-207)

The edge bb0 → bbcK.0 is how an async fn or a closure body is entered: bb0 of an async fn only builds the coroutine, and its body lives in the bbc1.* blocks. A callee whose label is not in Φ gives no Calls entry at all; the walk still steps over that block through Intra. The fall-through after a call INTO the set is not an Intra edge: it exists only as a matched edge, once the callee is proven to return (icfg.rs:136-146).

The Dyck grammar. Label each Call edge out of call block c with (_c and each Return edge into succ(c) with )_c; Intra edges carry no label. A path is realizable when its label word is in the language of partially matched parentheses:

M → M M | (_c M )_c | ε | intra          (matched: every return goes back to its own call site)
P → M | P (_c M                          (pending calls allowed, as when a walk descends and never returns)

Entries are roots (nobody calls them in the walk), so unmatched ) never occur on a realizable path from an entry. The insensitive walk accepts any word over the three edge kinds, so it also accepts (_c₁ … )_c₂: enter a helper from one call site and "return" into another.

The summary formulation the code uses (matched_edges, icfg.rs:212-261). Each matched (_c M )_c is replaced by one summary edge c → succ(c):

Summary₀ = ∅
Matched_k = { (c, s) : (c, g) ∈ Calls, s ∈ succ(c), g opaque ∨ g ∈ Summary_k }
A_k       = pattern(Intra ∪ Matched_k)
Summary_{k+1} = Summary_k ∪ { g : (entry(g) · A_k*) ∩ ret ≠ ∅ }
stop when Summary_{k+1} = Summary_k, or after round 64 (`rounds >= 64`, :256)

The summaries are computed on the unmasked graph.

What the matching does. Because the fall-through c → succ(c) after an in-set call exists only as a matched edge, a path continues after a call only when the callee can reach one of its return blocks. A callee that never returns (a panic-only body, unreachable) blocks the path after it, in both walks. The matched walk then differs from the insensitive walk only by Return: the insensitive walk can enter a helper from one call site and "return" into the successor of another. (Before dwarves f36754d, succ_of was also written into Intra, so Matched ⊆ Intra and the summary rounds added nothing; the walk was realizable only because Return was left out, and it stepped over callees that never return.)

Phase 2: the masked reach and the doors

Let k ∈ {0,1}ⁿ be the keep vector: k[b] = 0 for every block of a fn in C ∩ F, else 1 (rows_of, icfg.rs:172-179). x = Σ_{e∈E′} e_{entry(e)} is the seed vector (entries without blocks give no seed, :271-275).

A_ins = pattern(Intra ∪ Call ∪ Return)                (doors_reached, icfg.rs:408-410)
A_mat = pattern(Intra ∪ Matched ∪ Call)               (:412-414)
A′    = diag(k) · A · diag(k)                         (mask_by: drop every edge into or out of a choke block)
v₀ = q₀ = x
q_{t+1}⟨¬v_t, struct, replace⟩ = q_t ANY.PAIR A′      (one BFS level)
v_{t+1}⟨q_{t+1}, struct⟩ = true
v = v_t when q_t is empty  (no hop limit)              (ops::reach, crates/mimir-graph/src/ops.rs:103-110, bfs :49-98)

ANY.PAIR on bool is the structural OR-AND (LOR.LAND) product: an entry is true when any predecessor in the frontier has an edge. A seed in a choke block stays in v, but it has no out-edges after the mask.

The ICFG doors (icfg.rs:418-433):

D_icfg = { (fn(c), g) : (c, g) ∈ Calls, g ∈ S, fn(c) ∉ C }
reached_ins(f, g) = ∃ c ∈ blocks(f) : (c, g) ∈ Calls ∧ v_ins[c]
reached_mat(f, g) = ∃ c ∈ blocks(f) : (c, g) ∈ Calls ∧ v_mat[c]
doors_insensitive_walk   = |{ (f, g) ∈ D_icfg : reached_ins }|
doors_matched_walk       = |{ (f, g) ∈ D_icfg : reached_mat }|
impossible_paths_dropped = doors_insensitive_walk − doors_matched_walk   (saturating, gate_bypass.rs:356)

D_icfg is not D. It does not drop a sink fn that calls a sink, and it does not test scope (both are filtered in Phase 1, gate_bypass.rs:185, but not in icfg.rs:419-427). The block walk also blocks neither sinks nor test code, while the fn-level BFS does (B_strict). For each matched door the evidence path is a plain BFS over A_mat without the choke blocks, folded to fns (path_to, icfg.rs:298-352).

Complete mediation, as coded (gate_bypass.rs:357, :377-388, :439-440):

doors_without_mir = { f : (f, s) is a Phase-1 BYPASS row, entry(f) undefined }
complete_mediation ⇔ ¬∃ e ∈ E′, (f, g) ∈ D_icfg : x_e ⇝ c over A′_mat   (no realizable path e ⇝ sink call avoiding C)
                    ∧ doors_without_mir = ∅
complete_mediation_blockwalk ⇔ the first conjunct alone

Read formally: no word of the language P labels a path from an entry block to a sink call block that avoids every choke block. A path counts as mediated only when the sink call sits inside a choke fn's own blocks (its frame): a path that calls the choke, returns, and then writes is a bypass. Under that reading, doors_insensitive − doors_matched are the doors reached only by an impossible call/return word.

GraphBLAS steps

Dataflow

 code_nodes (fn, method, trait, impl, mir_block + ty)      code_edges (CALLS, IMPLEMENTS, CONTAINS, CFG_SUCC)
        │                                                          │
        └──────────────► Graph::load (mod.rs:115) ◄────────────────┘
                 callers / calls · dyn_targets / dyn_sources (IMPLEMENTS + CONTAINS, same name)
                 cfg_succ · mir_blocks_of
                              │
     --sink / --choke / --entry patterns ──► S, C, E′, D (gate_bypass.rs:125-191)
                              │
      ┌───────────────────────┴───────────────────────────┐
      ▼ Phase 1 (BFS)                                      ▼ Phase 2 (only when mir_block nodes exist)
 reverse BFS over pred = callers ∪ dyn_sources       Icfg::build over Φ: V, Intra (+bb0→bbcK.0), Calls (dyn-expanded)
 blocked C∪S∪T, then S∪T                                  │            │                 │
      │                                              Call (→bb0)  Return (ret→succ(c))  Matched (summaries,
      ▼                                                   │            │                 reach_each, ANY.PAIR)
 rows {class, door, sink, entry, path}                    │            │                 │
 bypass, through_gate, gate_doors, latent                 ├── A_ins = I ∨ C ∨ R          A_mat = I ∨ M ∨ C ──┤
                                                          ▼  mask_by(¬choke blocks)  ▼
                                                     ops::reach from entry bb0s (ANY.PAIR, vxm)
                                                          │
                                                     sink call blocks reached ──► doors_insensitive_walk, doors_matched_walk,
                                                                                   impossible_paths_dropped, CFPQ-BYPASS / dropped rows
                                                     Phase-1 BYPASS doors without bb0 ──► doors_without_mir
                                                                                   ──► complete_mediation

Worked example 1: the fixture, by hand

Fixture graph() in crates/mimir-lens/tests/graph_lenses.rs:340-396, test gate_bypass_prints_the_door_an_entry_reaches_without_the_gate (crates/mimir-lens/tests/graph_lenses.rs:646-683). Sinks Store#put(), choke gate_ingest, entries http_handle() and mirror_run().

CALLS: http_handle → gate_ingest → Store#put, mirror_run → Store#put, mirror_run → log, restore → Store#put, restore → log, t_restore (test) → restore, Disk::put → fs_write. Store#put has one impl method, so DYN = {(Store#put, Disk::put)}.

Phase 1. S = {Store#put} (the label of Disk::put is app impl#[Disk][Store]put()., which does not contain Store#put()). D = {(gate_ingest, put), (mirror_run, put), (restore, put)}.

So bypass 1, gate_doors 1, latent 1, through_gate 0, as the test asserts.

Phase 2. The blocks of the five fns that matter (other fixture fns add blocks that no entry reaches):

http_handle  h0 = bb0: return     hc0 = bbc1.0: call gate_ingest    hc1 = bbc1.1: return
gate_ingest  g0 = bb0: call Store#put    g1 = bb1: return                     (choke)
mirror_run   m0 = bb0: call Store#put    m1 = bb1: call log    m2 = bb2: return
restore      r0 = bb0: call log          r1 = bb1: call Store#put    r2 = bb2: return
log          l0 = bb0: return
Store#put, Disk::put: no blocks (opaque)

Calls  = (hc0, gate_ingest), (g0, put), (g0, Disk::put), (m0, put), (m0, Disk::put),
         (m1, log), (r0, log), (r1, put), (r1, Disk::put)
in-set calls (the callee has blocks): hc0 (gate_ingest), m1 (log), r0 (log)
Intra  = h0→hc0 (closure entry), g0→g1, m0→m1, r1→r2      (no fall-through after hc0, m1, r0)
Call   = hc0→g0, m1→l0, r0→l0                     (put and Disk::put are opaque)
Return = g1→hc1, l0→m2, l0→r1                     (log returns to BOTH call sites' successors)
Round 1 (Summary = ∅): Matched = calls to opaque callees: g0→g1, m0→m1, r1→r2
  reach from each entry: h0 is a return → http_handle; g0→g1 → gate_ingest; l0 → log
  mirror_run (m0→m1, stuck) and restore (r0, stuck) do not reach a return yet
Round 2: Matched adds hc0→hc1, m1→m2, r0→r1 → mirror_run and restore now reach a return
Round 3: nothing new → stop, rounds = 3   (computed by hand from the rule above)
Mask: k = 0 on g0, g1 → drops hc0→g0, g0→g1, g1→hc1 (the matched hc0→hc1 stays: the gate returns)
Seeds: h0, m0

The two walks:

insensitive  A′ = I ∨ C ∨ R :  h0 → hc0 ;  m0 → m1 → l0 → { m2, r1 } ;  r1 → r2
             sink call blocks reached: m0 (mirror_run, put), r1 (restore, put)  → 2
matched      A′ = I ∨ M ∨ C :  h0 → hc0 → hc1 ;  m0 → m1 → { m2, l0 }   (l0 has no out-edge)
             sink call blocks reached: m0                                    → 1

The word of the dropped path is m0 · m1 (_m1 l0 )_r0 r1: it enters log from the call site m1 and returns to the successor of the call site r0. The parentheses do not match, so it is not in P. impossible_paths_dropped = 2 − 1 = 1. g0 is not a door of the walk because gate_ingest ∈ C. The matched walk reaches the door mirror_run, so complete_mediation is false and the text says CFPQ-BYPASS app mirror_run(). and dropped app restore()., as asserted at crates/mimir-lens/tests/graph_lenses.rs:672-682.

Worked example 2: Holger before and after R1

Before: h32/next 9dbe5cbf (plan §D rounds 5 and 6, §E.2; golden gate-bypass in crates/mimir-lens/tests/golden/holger-h32-9dbe5cbf.json). Sinks: RepositoryBackendTrait::{put, put_from_reader, handle_http2_upload, handle_http2_request_bytes} and dyn ….write_from_reader. Choke: impl#[IntakeChain]. Entries: the HTTP handle, the gRPC services, JobRunner::run, mirror run_cycle / run_pair, replication, the import door, migration and offsite restore.

• Phase 1: 21 doors = 13 BYPASS rows (through 11 distinct door fns) + 4 gate-doors (ingest_pulled, ingest_pushed, npm_publish, cargo_publish, all inside IntakeChain) + 0 through-gate + 4 latent (Holger::put, LocalHolger::put, ProxyBackend::{put, put_from_reader}). Check: 13 + 4 + 0 + 4 = 21.
• Phase 2 on holger-server-lib: cfpq_blocks 194,731, cfpq_intra_edges 199,569, cfpq_call_edges 11,386, cfpq_return_edges 30,354, cfpq_rounds 2, cfpq_matched_edges 10,230. Insensitive 19 doors, matched 13, dropped 19 − 13 = 6: Holger::put, LocalHolger::put, ProxyBackend::{fetch, put, put_from_reader} and SignedIndexes::handle_http2_request_bytes are reached only through a return into another call site. doors_without_mir 0, so complete mediation: NO (the matched walk reaches 13). The intra-edge, matched-edge and round counts were recorded before dwarves f36754d (which took the fall-through after in-set calls out of Intra). That commit reports the Holger doors unchanged: 13 matched. The golden row pins the door counts, not the edge counts.
• One door, as the plan records it. offsite::restore, reached from the named entry offsite::restore_latest. The fn-level row is BYPASS offsite::restore, path offsite::restore_latest → … → offsite::restore → <sink>; the plan records the entry and the door, not the intermediate fns or which of the five sinks the row names. The door is also among the 13 doors of the matched walk, so the path is realizable with calls and returns matched. The review listed the offsite restore as a raw write; the lens shows it as BYPASS because restore_latest was passed as an entry (plan §E.2). A second recorded door of the same shape is mirror_cycle::run_pair_skipping, reached from the entry run_pair.
• The async doors were found only after the coroutine bodies (bbcN.0) were entered from bb0 (dwarves 6f881c0). Before that fix the matched walk reached 3 doors, not 13 (plan handback lens-build).

After: Holger main with the R1 Admitted gate (plan §D round 9; holger main 91768f29 / bb80377b → 8fd5d586, the holger-refactor lane's dump). Chokes: impl#[IntakeChain], admitted/impl#[Admitted], admitted/impl#[Gate]. Sinks: put, put_from_reader, handle_http2_upload, dyn ….write_from_reader.

• Phase 1: 0 BYPASS, 3 gate-doors, 2 latent (ProxyBackend::{put, put_from_reader}).
• Phase 2: matched 0, insensitive 2, dropped 2 − 0 = 2. With 0 BYPASS rows, doors_without_mir = ∅ holds by definition. Complete mediation: YES.
• With handle_http2_request_bytes as a sink too, 4 fn-level doors stay (exposed/http/handle, ChainView and SignedIndexes handle_http2_request_bytes, IndexSigner::answer), and the matched walk reaches 3 of them. That verb serves the whole collected request and writes only on PUT, DELETE or PATCH. The method is a runtime value, so the lens cannot call that door mediated. Splitting the verb is a Holger change.

Output

Summary (crates/mimir-lens/src/lenses/gate_bypass.rs:261-289, :358-389, :440): sinks, choke_fns, entries, doors, bypass, through_gate, gate_doors, latent, dyn_expansions (= Σ |dyn_targets|), then complete_mediation_blockwalk, cfpq_blocks, cfpq_intra_edges, cfpq_call_edges (= |Call|), cfpq_return_edges, cfpq_matched_edges, cfpq_rounds, doors_insensitive_walk, doors_matched_walk, impossible_paths_dropped, entries_with_blocks, doors_without_mir, entries_without_mir, complete_mediation. Findings: {class, door, door_loc, sink, entry, path, path_locs} with class BYPASS, through-gate, gate-door or latent (:318-329); then {class: CFPQ-BYPASS | dropped, door, door_loc, sink, path}, matched rows first, then by door and sink label (:400-438).

Limits and needs

• A runtime if (a config toggle such as Holger's *_refusal()) is not a graph edge, so a door guarded only by a toggle reads open.
• The dyn expansion and the bb0 → bbcK.0 edges over-approximate (the safe side, :331-333, icfg.rs:82-84).
• Roots mode (no --entry) is wrong for a server: its roots sit in hyper and tonic (on Holger it gave 6 bypass rows; plan handback lens-build).
• needs lines: IMPLEMENTS edges (:158-163), CALLS edges (:164-169), mir_block nodes (the whole Phase 2 is skipped without them, :353-359), and MIR facts for each BYPASS door without a bb0 (:408-417). Each names cargo mimir-dump.

Tests

crates/mimir-lens/tests/graph_lenses.rs: the_graph_indexes_calls_contains_and_the_dyn_expansion (:628), gate_bypass_prints_the_door_an_entry_reaches_without_the_gate (:646; insensitive 2, matched 1, dropped 1, mediation false), gate_bypass_says_yes_to_complete_mediation_when_every_door_is_the_gate (:686), gate_bypass_expands_a_dyn_call_to_every_impl (:701; path mirror_run → Store#put → Disk::put → fs_write), gate_bypass_refuses_a_pattern_that_matches_nothing (:726), the_matched_walk_does_not_fall_through_a_callee_that_never_returns (:986: boot calls never (bb0 unreachable) and then the sink; fn-level bypass 1, matched walk 0, insensitive walk 0). MIR parsing: crates/mimir-lens/src/lenses/mir.rs:216, :228. The Holger numbers are pinned in crates/mimir-lens/tests/golden/holger-h32-9dbe5cbf.json (gate-bypass).

4.2 twins

twins finds groups of fns that do the same thing. It needs no embeddings. It builds six kinds of pair edge (api, name+sig, shape, NEAR, inlined, DIVERGENT) from four matrices, joins them into connected components, and reports each component as a group. A group whose edges come from two or more classes is STRONG. The code is crates/mimir-lens/src/lenses/twins.rs, the products are in crates/mimir-lens/src/lenses/grb.rs, and the knobs are in crates/mimir-lens/src/lens_defaults.rs.

Run

cargo lens twins [--hops N] [--sim X] [--rare-max N] [--wl-rounds N] \
  [--min-blocks N] [--near X] [--min-apis N] [--name SUBSTR] \
  [--mimir-dump DIR] [--crate NAME…] [--include-tests] [--include-deps] [--json] [--limit N]
# the golden runs (crates/mimir-lens/tests/golden_holger.rs:124-156):
dwarves lens twins --mimir-dump DIR --json --limit 0
dwarves lens twins --mimir-dump DIR --json --limit 0 --name normalize_name --min-blocks 4

The flags are in dw:src/cli.rs:306-338. The CLI's default_value_t and TwinsArgs::default() both read one table, so they cannot drift apart (crates/mimir-lens/src/lens_defaults.rs:1-18, crates/mimir-lens/src/lenses/twins.rs:64-79). verdict runs twins with TwinsArgs::default() and its own scope (crates/mimir-lens/src/lenses/verdict.rs:258-264).

Round 9 of the plan made this one table. Before it, the CLI said rare_max 50, min_blocks 4, which gave 562 groups and 118 STRONG on Holger (plan §D rounds 6 and 9). At the defaults the golden reads 327 groups and 41 STRONG under the STRONG rule of dwarves 27eaa1d (78 under the old rule).

Reads (from the compiler to the graph)

The driver (cargo mimir-dump) writes Mímir v2 *.nodes.arrow and *.edges.arrow. Graph::from_dump indexes them (crates/mimir-lens/src/lenses/mod.rs:130-252). twins uses these facts:

A mir_block payload is name-free text (crates/mimir-lens/src/lenses/mir.rs:1-11):

<fp 16 hex> ␞ <terminator>@l:c ␞ <stmt>@l:c ␟ … ␞ <local>:<ty> ␟ … ␞ <a>><b>,…
terminator of a call:  call <callee moniker>⟨<args>⟩-><dest local>@l:c

parse_block needs a 16-hex fingerprint, else the block is unparsable (mir.rs:69-100). term_kind is the leading word of the terminator (call, switch, return, goto …; mir.rs:118-124). callee is the moniker between call / tailcall and ⟨ (mir.rs:127-134). has_const_str_arg is true when an argument is k:&str or k:&&str (mir.rs:145-148). strip_pos drops a trailing @line:col (mir.rs:103-114).

The fn set. A row is an fn or method that Scope::holds (defined in the dump, in the scoped crates, origin = local unless --include-deps or --crate, not generated/, not derive-written, not test code unless --include-tests; mod.rs:716-724), that is not a trait method declaration (is_trait_method, mod.rs:363-365), and whose name contains --name when given (twins.rs:550-554). n is the size of this set. --name changes the math, not only the output: n, A, L and every IDF weight are computed over the filtered set.

Math

1. API reach (the api class). For rows f, g (twins.rs:564-582):

A[f][g] = 1  iff  CALLS f → g and g is in the fn set              (n × n)
L[f][c] = 1  iff  CALLS f → x, x not in the fn set, x not noise,
              and api_family(label(x)) = column c                 (n × apis)
R = (I + A + A² + … + Aᵏ)·L        on the boolean semiring, k = hops

label(x) is <crate> <short moniker> (mod.rs:290-292). A callee outside the fn set includes a trait method declaration, a dependency fn, and an own fn excluded by scope or by --name. A callee is noise when its short moniker starts with one of 22 prefixes (is_noise_callee, twins.rs:82-108): ops/try_trait/, fmt/, hint/must_use, convert/, ops/deref/, clone/Clone#clone, ops/drop/, borrow/, ops/function/, iter/traits/collect/IntoIterator#into_iter, option/impl#[Option<T>], result/impl#[Result<T, E>], string/impl#[String][Deref], str/impl#[str]as_bytes, slice/impl#[[T]]len, string/impl#[String]as_str, ops/arith/, cmp/, panicking/, mem/drop, alloc/, ptr/.

API-family folding (API_FAMILIES, 48 rows, twins.rs:112-161; api_family, :164-176). The first row whose prefix starts the label wins. The column is then <family>::<tail>, where tail is the text after the last /, ], # or space, with trailing (). removed. A label with no matching row is its own column. So sha2 digest/impl#[D][Digest]update(). and ring digest/impl#[Context]update(). are both digest::update, and hex encode(). is hex::encode (unit test twins.rs:1186-1201). The families are:

The method name is kept, so digest::update ≠ digest::finalize. Two unrelated methods of one family with the same last segment share a column.

reach_k (crates/mimir-lens/src/lenses/grb.rs:144-155) computes R without the identity matrix: R ← L; C ← L; repeat k times { C ← A·C; if nnz(C) = 0 stop; R ← R ∨ C }. A·C is GxB_ANY_PAIR_BOOL; on bool that is the structural OR-AND (LOR.LAND) product, so R[f][c] = 1 iff f reaches API c through at most k own helpers. The loop stops early when a power is empty.

Document frequency and IDF (twins.rs:597-608, idf_cosine :276-329):

df(c)     = |{ f : R[f][c] = 1 }|               (column count of R)
|R_f|     = |{ c : R[f][c] = 1 }|               ("per_fn": every API f reaches)
w(c)      = max( ln(n / df(c)), 0.05 )   if df(c) > 0, else 0
rare(c)   ⇔ 2 ≤ df(c) ≤ rare_max                (df = 1 is never rare)

ln is the natural log and n the size of the fn set. The floor is IDF_FLOOR = 0.05 (twins.rs:272, :304). It applies when df(c) > n·e^(−0.05) ≈ 0.951·n. Without it a column every fn has would weigh ln(1) = 0 and drop out of every norm; with it, that column stays a weak column. Before idf_cosine counts df, it dedupes the (row, column) entries, so each column counts once per fn (twins.rs:285-290).

Mask and cosine. R_rare is R restricted to the rare columns.

M        = R_rare · R_rareᵀ                      (pairs that share ≥ 1 rare API)
W[f][c]  = w(c)  where R[f][c] = 1                (the IDF-weighted pattern)
S⟨M⟩     = W · Wᵀ                                S[i][j] = Σ_c w(c)² · R[i][c] · R[j][c]
‖w_i‖²   = Σ_c w(c)² · R[i][c]
cos(i,j) = S[i][j] / (‖w_i‖ · ‖w_j‖)            for i < j with ‖w_i‖·‖w_j‖ > 0

The mask chooses which pairs to compute. The cosine itself runs over every column, common APIs included. The IDF weight enters squared, as in a TF-IDF cosine with binary term frequencies.

api edge (twins.rs:617-639): for i < j,

cos(i,j) ≥ sim  ∧  |R_i| ≥ min_apis  ∧  |R_j| ≥ min_apis
                ∧  |rare(i) ∩ rare(j)| ≥ 2
score = cos(i,j);  evidence = "cos 0.xx, rare API shared: <first 3>"

The code comment says why the last test is there: "one rare API in common is a coincidence, two are a recipe" (twins.rs:628).

2. Type matrix (the name+sig class) (twins.rs:650-730). For each fn with at least one param or ret child:

T[f]["p:" + norm_ty(param ty)] = 1      for each param child
T[f]["r:" + norm_ty(ret ty)]   = 1      ("r:()" when there is no ret child)
sig_of(f) = "(p₁, p₂, …) -> r"           (display text, params in child order)

norm_ty deletes every space and every lifetime (' plus the identifier chars after it): &'a mut Vec<u8> → &mutVec<u8> (twins.rs:193-213, test :1200).

stem(name) (twins.rs:179-190): lowercase; strip each suffix of _impl, _inner, _once, _v2, _v3, _2, _3 once, in that order; then pop trailing ASCII digits while the length is above 1; then trim trailing _. sanitize_seg2 → sanitize_seg, tls_roots_impl → tls_roots, sha256_hex_v2 → sha256_hex (test :1178-1183). Digit popping also turns sha256 into sha and base64 into base, which the length rule below then drops.

The stem mask (twins.rs:683-707) pairs every i < j with the same stem, after leaving out: trait-impl methods (is_trait_impl_method, mod.rs:415-418), fns without a type row, stems shorter than 4 chars, the 17 CONSTRUCTORS stems (new, default, from, into, fmt, with, build, builder, get, set, of, run, name, parse, read, open, load), and stem groups of one or more than 2,000. The same idf_cosine then runs on T (n = the whole fn set, df over the T entries).

name+sig edge:  same stem  ∧  cos_T(i,j) ≥ sim;   score = cos_T;  evidence = "<stem> <sig>"

The module doc says that a name+sig edge together with an api edge "strengthens the pair" (twins.rs:13-14). The code has no such step; the two edges only count as two classes of the group.

A fn with two params of the same printed type sends one column twice. The entries are deduped first (twins.rs:285-290), so the column is one entry of W and one term of the norm, and the type cosine stays in [0, 1]. The unit test the_type_cosine_never_passes_one_when_a_param_type_repeats pins this (twins.rs, tests module). Before dwarves 27eaa1d the duplicate made W hold 2w against a norm of 2w², and the cosine could exceed 1.

3. The PDG (build_pdg, twins.rs:345-438). One node per MIR block of every fn in the set, blocks in name order (bb0 first, so bs[0] is the entry block).

• Control edges B_c[u][v] = 1 iff CFG_SUCC u → v and both blocks belong to the same fn (:399-407).
• Data edges B_d[u][v] = 1 iff u ≠ v, same fn, and some local _n is in defs(u) and in uses(v) (writer → reader, :408-424). This is flow-insensitive: any writer links to any reader of the same local, in either block order. There is no reaching-definitions step.

defs_uses (twins.rs:442-492) reads every statement and the terminator, each with strip_pos applied:

split s at its first '='; if the text after it does not start with '=':
    lhs = before, rhs = after          else  lhs = none, rhs = s (the whole text)
defs ∋ n   if lhs.trim() is "_n"
defs ∋ n   if s contains "->" and the text after the LAST "->" starts with "_n"
uses ∋ n   for every "_n" in rhs whose '_' is at the start or after a non-alphanumeric byte

A call terminator has no =, so its whole text is the right side, and its destination ->_n is both a def and a use of the same block. An unparsable payload gets the label hash("?") and no defs, uses or callee (:365-372).

Initial labels (twins.rs:373-385):

callee(b) = api_family( <3rd space-separated token of the moniker> + " " + short_id(moniker) )
            ("" when the terminator is not a call)
ℓ⁰(b)     = hstr( term_kind(b) + "|" + callee(b) + "|" + ("k" if has_const_str_arg else "") )

hstr and h64 are Rust's DefaultHasher over a str or a [u64] (:215-225). Only label equality matters, never the value. The block fingerprint fp, statements, locals and switch targets are not hashed into ℓ⁰. callee_of(b) is the same family string, but None for a noise callee (:386-393); a fn has a real call when one of its blocks has callee_of ≠ None (:752-758).

The module doc says the labels are name-free. That holds for locals and literals, but a call to one of the workspace's own fns hashes its full label (app gate_ingest().), so the callee's name is in ℓ⁰. Noise callees are hashed into ℓ⁰ too; noise only decides the real-call test.

WL rounds (wl, twins.rs:497-546). For t = 0 … h−1:

onehot⁽ᵗ⁾[b][λ] = 1  iff  ℓ⁽ᵗ⁾(b) = λ                       (blocks × distinct labels)
N_κ = B_κ · onehot⁽ᵗ⁾        κ ∈ {c = 1, d = 2},  GxB_PLUS_PAIR_UINT64
      N_κ[v][λ] = |{ x : B_κ[v][x] = 1 ∧ ℓ⁽ᵗ⁾(x) = λ }|      (out-neighbours only)
H(v) = sort{ h64([κ, λ, N_κ[v][λ]]) : κ ∈ {1,2}, N_κ[v][λ] > 0 }
ℓ⁽ᵗ⁺¹⁾(v) = h64([ℓ⁽ᵗ⁾(v)] ++ H(v))

The histogram counts out-neighbours only (successors and readers). A block's predecessors do not change its label. The CCGraph reference in the module doc uses the same product.

Shape signature (twins.rs:759-767). Only fns with |blocks| ≥ min_blocks and a real call get one (these are fns_with_mir):

sig(f) = h64( sort[ ℓ⁽ʰ⁾(b) : b ∈ blocks(f) ] )

This is the multiset of the final round's labels only. Earlier rounds are not kept. shape edge: sig(i) = sig(j), every pair inside one hash bucket; score 1.0 (:770-789).

NEAR, multiset Jaccard (twins.rs:790-846). Over the fns with a sig:

Wc[f][λ] = |{ b ∈ blocks(f) : ℓ⁽ʰ⁾(b) = λ }|      (u64 counts),   |f| = Σ_λ Wc[f][λ]
C = Wc · Wcᵀ  on GxB_PLUS_MIN_UINT64:   C[i][j] = Σ_λ min(Wc[i][λ], Wc[j][λ])
J(i,j) = C[i][j] / (|i| + |j| − C[i][j])
NEAR edge:  i < j  ∧  J(i,j) ≥ near  ∧  sig(i) ≠ sig(j);   score = J

Σmax is not a second product. It is Σ_λ max(a_λ, b_λ) = |i| + |j| − Σ_λ min(a_λ, b_λ). The product runs without a mask; GraphBLAS stores an entry only for pairs that share a label. The module doc speaks of "Jaccard of the label sets" (twins.rs:21); the code uses label multisets.

Inlined (twins.rs:848-912). Not GraphBLAS; hash maps over the final labels.

small fns s:  min_blocks ≤ |s| ≤ 4·min_blocks  ∧  s has a real call
entry(s)    = ℓ⁽ʰ⁾(bs[0])                         (the first block by name)
hosts(λ)    = { fns with any block labelled λ }    (s itself included)
inlined edge (s, H)  when a block of H has label entry(s), and
   |hosts(entry(s))| ≤ 4               (more than 4 hosts = an idiom, skipped)
   H ≠ s  ∧  |H| > |s|
   ∀λ: Wc[s][λ] ≤ Wc[H][λ]             (the whole multiset of s sits in H)
score = 0.9;  each (s, H) once

The host needs MIR blocks but neither min_blocks nor a real call of its own.

DIVERGENT, the B-7 twin-rules class (twins.rs:915-942). For each name+sig edge (a, b):

DIVERGENT edge  iff  sig(a) and sig(b) exist  ∧  sig(a) ≠ sig(b)  ∧  (a,b) is not a NEAR edge
score = 1.0

So both fns need min_blocks blocks and a real call. A name+sig pair where either side is too small or has no MIR is neither proven same nor proven different.

5. Components and groups (twins.rs:944-1004). The twin graph has every edge except inlined. grb::components builds its pattern and calls ops::components (nornir crates/mimir-graph/src/ops.rs:511-592): S = A ∨ Aᵀ (GrB_Matrix_eWiseAdd, GrB_LOR), then label propagation t = S ·(MIN.SECOND) labels until no label drops, with one pointer jump labels(i) = min(labels(i), labels(labels(i))) per round. The label is the smallest row index in the component.

• A non-inlined edge (a, b) puts a and b into group label(a).
• An inlined edge (s, H) puts s and H into group label(s). If s has no other edge, that is a new two-member group. If H is in another group, H is listed in both.
• A group's edges ("mine") are the edges with label(a) = group, plus inlined edges with label(H) = group. So an inlined edge also adds the class inlined to the host's group.
• classes = the set of edge classes in "mine". near = the number of NEAR edges, best = the maximum score, evidence = "<class> <a> ↔ <b>: <why>", sorted and deduped.
• STRONG ⇔ |classes ∩ {api, name+sig, shape, NEAR}| ≥ 2 (is_strong, twins.rs:254-260). Two INDEPENDENT classes must agree. DIVERGENT is derived from name+sig (the same pair, a different body), and inlined is containment, so neither is a second vote. (Before dwarves 27eaa1d the rule was |classes| ≥ 2 over all six classes, so every DIVERGENT group was STRONG.)

Sort order (twins.rs:1005-1020), descending unless noted:

1. has a NEAR edge;
2. has a DIVERGENT edge;
3. number of classes;
4. number of members;
5. best score;
6. label of the first (smallest) member, ascending.

BLOB (MAX_GROUP = 60, twins.rs:1081-1101). A group with more than 60 members prints as BLOB ×N in C crates [classes] with the hint "raise --sim / --min-blocks or use --name", and its JSON is {size, crates, classes, blob: true}. It still counts in groups, groups_strong and fns_with_twin.

GraphBLAS steps