translator: expand multi-architecture instruction coverage and independent tests

[cpunion]

Scope: translator and independent instruction tests

This Draft PR expands Go Plan 9 instruction/form coverage across 386, amd64,
arm, arm64 and wasm. It retains typed instruction-family lowering, guarded
ABI/source observations, official Go assembler/decoder tests, standard-library
compilation, independent semantic regressions and LLVM 22 object/runtime gates.

External discovery, ledgers and third-party compatibility tests have moved to
llgo-compat/plan9asm#1.
That PR owns the scan funnel, inventory and external coverage status. This PR
does not include those datasets or depend on external corpus jobs.

Split and preservation

• Move the discovery/corpus commands, external manifests, ledgers, scripts and
  CI to the independent repository. Preserve every transferred ledger byte,
  cursor, retry and historical outcome; migration does not invent passes.
• Expose the existing gotoolprofile implementation for the translator CLI and
  independent harness, without duplicating the translator.
• Retain official scanners/oracles, both translator CLIs, instruction fixtures,
  benchmarks and cross-runtime tests.
• Retarget exhaustive module owner 1 to gotoolprofile, preserving actual
  package/root inventories, disjoint partitions and mandatory aggregation.
• Remove approximately 1.07 million external-data/harness lines from the
  integrated repair tree. Additional instruction repairs remain in this PR.

Latest CI repair batch

• Bind Windows source-PC paths, executable names, original-byte SysV calls,
  stream/file identity checks and the CMPXCHG fault observer to their actual
  platform behavior. The observer rejects setup errors, ordinary nonzero exits,
  timeouts and cleanup failures instead of accepting them as instruction faults.
• Select complete Go-version-specific DATA, SEH, cache-copy and ARM64 diagnostic
  schemas. Keep producer hashes and mutation rejection intact.
• Separate bounded proof lifetimes from individual command budgets, and run SDK
  API reentry checks in owned, bounded child processes.
• Load each original SSE kernel's MXCSR profile immediately before its tested
  instruction. A reproduced Go 1.22 heap-sampling mismatch is fixed without
  masking state differences; 50 repeated checks pass on that repair snapshot.
• Provision pinned QEMU in every Linux root lane. Run the two complete Windows
  CLI suites in independent jobs so a root timeout cannot suppress either one.

Verification

LLVM 22 is required; missing tools are failures. Reports retain their exact
frozen revision and scope rather than relabeling old results as full-CI passes.
The Go test receipts below are from frozen code revision 0527ded5; the final
workflow/documentation follow-up is checked separately.

Check	Result / scope
CI scheduling regressions and actionlint	Pass; 12 scheduling tests
Go 1.27 CMPXCHG, process lifecycle and CI-policy checks	Pass, 43.100 s
Go 1.20 focused compatibility checks	Pass, 6.103 s
Root-module go vet	Pass
cmd/plan9asm complete Go 1.27 suite	Pass, 0.998 s
cmd/plan9asmll complete Go 1.27 suite	Pass, 1028.540 s
Three previously failing numerical/source race roots	Pass on Darwin/arm64, 686.625 s; not a Linux-race certificate
CMPXCHG Linux-container observer checks	Pass, 12.039 s; Rosetta diagnostic, not native Linux certification
ARM64 decoder-family gate	Pass: 703 actual-Go accepted cases, 91 Go-rejected decoder-only cases, complete selected inventory

The current five-architecture Go 1.27.2 observed-form classification gate
passes without baseline changes in this repair batch:

Architecture	Observed forms	Supported	Needs context	Unsupported	Parse errors
386	57	48	9	0	0
amd64	6,736	6,688	48	0	0
arm	499	455	44	0	0
arm64	2,048	1,979	69	0	0
wasm	120	0	120	0	0

These are classifications, not complete operand-grammar, ABI or runtime
coverage. Context is not a compilation pass. The earlier decoder-baseline
failure listed in this PR body is no longer the current gate outcome.

Remaining failures — keep Draft

The completed pre-repair CI run
at 432796c7 has 98 successful, 49 failed and 1 cancelled jobs, including
aggregates. The repair batch requires fresh CI; those historical failures
remain failures.

• The strict standard-library benchmark still reports 164/185 compiled files,
  with 21 failures. These include runtime/reflect entry and caller-frame
  contracts, TLS/hidden registers, mutable AES storage and a CGO source boundary.
  No baseline or skip converts them to passes.
• Windows' full main-module direct suite still needs bounded partitioning;
  isolating the nested CLI jobs does not fix the root suite's timeout.
• Native Windows execution and required native Linux semantics need current-head
  CI. Rosetta/container execution and object compilation do not replace them.
• Full CI, review and the remaining runtime/benchmark gates must pass before
  marking this contribution ready.

External assembly verification and LLGo compile/link/execute compatibility keep
their separate ownership and completion gates in the corresponding repositories.

[codecov]

Codecov Report

❌ Patch coverage is 87.39496% with 195 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
amd64_go_downloaded_frame_source.go	17.85%	46 Missing ⚠️
amd64_go_downloaded_frame_imports.go	46.03%	34 Missing ⚠️
amd64_go_frame_source.go	82.52%	18 Missing ⚠️
amd64_go_frame_data.go	86.45%	13 Missing ⚠️
amd64_packed_conversion_effects.go	84.12%	10 Missing ⚠️
amd64_fixed_local_transport.go	90.14%	7 Missing ⚠️
amd64_fixed_local_data.go	89.65%	6 Missing ⚠️
amd64_lower_vcomi.go	88.23%	6 Missing ⚠️
amd64_byte_shuffle_forms.go	84.37%	5 Missing ⚠️
amd64_comi_forms.go	93.75%	5 Missing ⚠️
... and 21 more

📢 Thoughts on this report? Let us know!

[fennoai]

Review summary

Large PR (~175k insertions across 518 files). The bulk is generated discovery testdata (testdata/discovery/ledger/**) and highly repetitive AMD64/ARM instruction-lowering tables, both of which I skimmed rather than reviewed line-by-line. I focused on the high-signal changes: the new discovery/scan tooling (cmd/plan9asmcorpus/discovery.go, cmd/plan9asmdiscover, cmd/plan9asmll, cmd/plan9asmscan), internal/discoverymeta, and the core translate/parser changes.

Overall this is solid, defensively-written code: file handles are consistently closed on error paths, zip extraction blocks zip-slip (proxy-prefix + path.Clean + filepath.Rel + O_EXCL), external commands use fixed argv with escaped module paths, and remote fetches are size-bounded. Doc/AGENTS.md claims (flags, scripts, committed manifest counts, test names) were verified accurate.

One inline correctness/consistency finding below, plus a few non-blocking notes.

Non-blocking notes:

• Exponential build-tag search — cmd/plan9asmcorpus/discovery.go (findDiscoveryBuildTags). The search iterates 1 << len(customTags) masks, each doing filesystem-backed ctx.MatchFile calls, and the outer wantedCount loop re-walks the mask space ~len(customTags)+1 times. With the 16-tag cap this is bounded but can reach millions of MatchFile calls for a package near the limit. Usually fine (tags are typically 0–2); consider iterating masks once (prioritizing by popcount) if large-tag modules become common.

• Symlink escape in local include expansion — cmd/plan9asmll/main.go (pathWithinRoot / expandAsmIncludes). Containment is checked lexically via filepath.Rel; a #include target that is a symlink pointing outside the source root would pass the check and be read (no filepath.EvalSymlinks). Blast radius is contained (read-only, inlined into a discarded IR artifact, ephemeral CI against public modules; the zip extractor already rejects non-regular files), so this is defense-in-depth only. Resolving symlinks before the containment check would close the gap.

• Readability — cmd/plan9asmll/main.go:988 (and :1023). op == "JMP" || op == "B" || op == "RET" && len(ins.Args) == 1 relies on && binding tighter than ||. The current behavior is correct, but explicit parentheses around (op == "RET" && len(ins.Args) == 1) would guard against a future || term silently changing the grouping.

[cpunion]

Pushed the six-commit repair batch through cpunion to 24851df2, after run 38211857025 completed (120 success, 29 failure, 1 cancelled). This PR remains draft; this is not an all-CI-green claim.

Repairs:

• Align QEMU/Node installation order across all Linux module owners and completion jobs. Actual failed artifacts differed in PATH; strict environment/source comparisons remain intact.
• Remove the required fixture gate's undeclared ripgrep dependency, make Windows CLI coverage use explicit Bash with a nonempty-profile check, and enable the intended generic-alias representation in the Go 1.24–1.26 oracle.
• Give Windows original-Go/C oracle executables their required suffix, with an actual Windows PE cross-build regression.
• Split race root scheduling into 16 parts while retaining the same 32 shards, two workers, complete inventory, strict aggregation and timeout budgets.
• Reuse one unchanged SDK source for caller-only mutation tests and avoid verifying it twice per bind. All 17 negative controls, permanent-revocation checks and the final positive control remain required.
• Label failed subtool-directory resolution by GOROOT/GOTOOLDIR/GOCACHE. This is diagnostic only, not a Windows-path fix.

Verification:

Frozen scope	Result
24851df2: complete cmd/plan9asm	Pass, 0.940 s
24851df2: complete cmd/plan9asmll	Pass, 1000.869 s
24851df2: CI policy and actual root partition/union guards	Pass, 0.715 s / 138.257 s
24851df2: scheduling tests, actionlint, shell syntax	Pass
Code bytes committed as 75db11da: focused Go 1.20/current suites and current root vet	Pass
Same code snapshot: Linux/amd64 container SDK mutation test with -race	Pass, 802.933 s; prior 1200 s failure retained
Actual Go 1.24.13 / 1.25.14 / 1.26.9 alias/policy regressions	Pass

Native Windows verification remains pending. Remaining known failures include Windows feature/CPP path resolution, the full Windows root suite's deadline, unresolved SDK macros in the macOS standard-library scanner, and 21 real benchmark compilation failures involving runtime/reflect/ABI/storage contracts. The benchmark remains 164/185 in the completed old run; no failures were relabeled as passes or skipped. The Linux container race receipt is source/lifecycle verification, not native x86 ISA certification under Rosetta.