Validate latest PR40 assembly discovery batch

[cpunion]

Fork-only Draft staging for xgo-dev/plan9asm#40. The upstream-connected branch is unchanged. Promotion still requires current-head CI, an audited complete assembly ledger, and review of exclusions.

Discovery funnel

Stage	Count
Contiguous official Go Module Index records	18,758,534
Unique module paths recorded	965,347
Successfully inspected retained exact versions	952,900
Assembly-bearing exact versions queued	6,067
Original assembly files inventoried	78,961
Inspection failures retained for retry	16,390

The 215 validated ranges cover 2025-10-01T00:00:00Z through 2026-09-22T22:43:08Z. This is neither the complete historical index nor its current head. A reliable global unique-module denominator is unavailable; no global coverage percentage is claimed.

Keep the highest inspected version independently per (module path, Go-semver major) line. v0/v1 can coexist, while /v2 and /v3 are independent paths. Normalization never rewinds covered ranges. ledger/ is immutable inspection/cursor input, including negative results; assembly-ledger/ is derived compilation evidence, not a second scan copy.

Published repair batch

The repaired public head is 47ea649d. Development and external-module tests use actual Go 1.27.1 and LLVM 22.1.8; no alternate LLVM fallback is allowed.

• Strict private ARM64 SP-frame stores and bounded frame reads retain original and normalized proofs. Unknown writes, pointer escapes and unbalanced caller-LR effects still fail.
• Typed ARM CPSR flags, actual Go/LLVM/QEMU execution and negative status-register effects.
• Go-compatible included-tokenizer EOF behavior, bounded include/source diagnostics, and canonical positive diagnostic line/column fields. The bounded diagnostic sample does not truncate the retained raw tool output or hide later infrastructure errors.
• Go-selected *_test.s files remain ordinary assembly when their actual Go package role says so. Empty selected siblings retain their real source bytes and actual Go/CPP/LLVM proofs.
• Explicit typed ARM64 Go-funcval input carriers. This is a translator-side contract, not an invented hidden argument; the dependent llgo compiler must supply and verify the actual producer/layout.
• The full raw ARM64 SM3 Advanced SIMD family: PARTW1/W2, SS1, TT1A/B and TT2A/B. Raw masks, lanes, source-before-destination aliases, vectors and NZCV preservation have independent Go/LLVM/runtime oracles. The software lowering does not require host SM3 instructions.

Current-head local checks

Check	Result
Every non-root package in root ./...	Passed; corpus full suite 437.441 seconds
SM3/active-include focused root checks	Passed, 120.317 seconds
Nested cmd/plan9asm full suite	Passed, 2.095 seconds
Nested cmd/plan9asmll full suite	Passed, 248.011 seconds
Five-architecture official opcode/form gate	Passed without changing baselines
Priority scheduling tests and actionlint	Passed
Complete root suite	All 32 exhaustive partitions finished at frozen 47ea649d: 3,335 root passes, 35 existing skips and 7 failures; no missing roots. Five linker-environment failures passed a separate same-source LLVM/lld 22 rerun; two genuine ARM64 frame-contract failures remain. This is not a full-suite pass
Strict compile benchmark	Failed at original reflect.makeFuncStub on linux/386; dynamic caller-frame contract remains unfinished
Current-head remote CI and 64-shard corpus	Required, not yet passed

The official gate's supported/context split is explicit. Zero unsupported classifications does not mean every contextual runtime entry has compiled or executed.

Architecture	Observed forms	Supported	Requires function context	Unsupported	Parse errors
386	57	50	7	0	0
amd64	6,740	6,734	6	0	0
arm	499	455	44	0	0
arm64	2,048	1,977	71	0	0
wasm	120	0	120	0	0

All 98 required ARM64 opcodes available in this toolchain are encoder-defined, observed and lowerable. Opcode-table classifications, operand-form coverage, object compilation and runtime execution remain distinct measures.

Original-library repair witnesses

These frozen exact-source runs prove the respective fixes, not a substituted current-head aggregate. Ordinary Go/source exclusions remain visible.

Exact module	Frozen fix source	Full default target replay
github.com/Kany2t/gmsm-@v0.40.2	45f9e6d7	All 11 targets completed; 175 translated file/target scopes, no candidate/translation failures. Twelve separately recorded original-source ABI exclusions remain
github.com/dominikh/avo@v0.0.0-20260314015840-88ad9c81f33f	ff488337	396 file/target scopes: 131 translated scopes producing 134 object parts, plus 265 actual-Go source exclusions; no candidate failure

SM3 checks include 1,638,400 decoder encodings, independent LLVM-MC encodings and 105 alias partitions. Actual Go WORD and independently calculated LLVM/C results passed 26,880 comparisons on both Darwin/ARM64 and Linux/ARM64 under pinned QEMU 10.2.3; all four NZCV flags are checked. Full corpus tests after strict diagnostic-column hardening passed at frozen 520860ff (614.921 seconds).

Ledger and completion gates

The committed published-head queue remains 6,067 pending, complete=false, verified=false. Matching reports from fork CI run 36942816488 have been imported by the automatic writer in a separate source-frozen worktree. The strict reader verified all six completed priority shard reports (5, 29, 36, 38, 39 and 42):

Current-source derived validation	Exact versions
Actual Go/CPP/LLVM object proofs passed	438
Source-inapplicable, concrete scoped Go diagnostics retained	91
Failed, retained for repair	81
Exact invalid source, separately evidenced skip	2
Exact superseded version, separately evidenced skip	1
Pending matching complete reports	5,454
Total assembly-bearing versions	6,067

These six reports contain 7,290 translated scopes. All six shards fail because their failing candidates are retained; 58 required reports are missing. The full fork run has now finished with failure: priority and strict aggregate gates failed, and downstream skipped jobs did not pass. This derived ledger has not yet been committed, and neither partial coverage nor source N/A is a pass. Reports from the PR merge ref retain their actual revision and tool hashes; their full source-content fingerprint exactly matches published 47ea649d. Previous source's successful reports remain historical evidence, never relabeled as new passes. Missing empty-sibling source bytes in an old proof were rejected rather than synthesized.

Fresh schema-10 reports must cover all 64 shards with identical source, scan ledger, Go/LLVM and tool-binary identities. Actual file/target/profile/custom-tag, package-role, source/CPP and LLVM-object proofs are retained by the v2 writer. Each candidate must end as an actual tested pass or a narrow, evidenced, reviewed skip; any pending or failed candidate blocks completion. Provisional native-layout/JIT exclusions remain separate and require review.

The policy and six previously failing shards (5, 29, 36, 38, 39, 42) run first. Downstream jobs require their success; a skipped job is not a pass. No matrix concurrency cap is imposed, and the strict aggregate still fails for missing/failed reports.

Actual third-party Go+assembly compilation, linking and execution belong to the dependent cpunion/llgo#259. Its next local batch resolves the actual public 47ea649d pseudo-version and includes an authenticated typed R26 closure-entry producer. A fresh checkout compiler passed actual Darwin/ARM64 CRC32, huff0 and websocket execution with normal assembly selection and build cache disabled; purego remains a genuine failure. Windows path repair passed native Go 1.27.0 and 1.27.1 regressions after both versions reproduced the original GOROOT/junction failure. These are bounded local/isolated CI results, not full compiler CI success or broad issue closure. The previous complete dependent CI run finished with failures and is preserved.

The next plan9asm batch is developed separately from this frozen source. It contains reviewed raw ARM64 private-frame and typed ARM raw-condition repairs, and a real caller-FP-alias guard with original Go execution evidence. A package/profile scope repair is undergoing whole-library replay: full Go-selected assembly registration stays distinct from individual translation units, so source-rejected siblings cannot conceal missing Go/CPP/LLVM proofs. None of these later-source results upgrades the published ledger.