| # System and experiment architecture | |
| ## Data flow | |
| Paired vulnerable/fixed C/C++ functions are normalized, deduplicated and frozen into random, chronological and repository-disjoint split manifests. Vulnerable-side patch statements (L1), expanded context (L2), and bounded backward def-use traces form annotation targets. Teacher-generated structured outputs are filtered and converted into Contract v2 for SFT. SFT failure diagnostics led to a label-only learnability control; no further SFT variants followed the failed v3 gate. | |
| The RL policy is Qwen3-4B base plus one live LoRA adapter. GRPO reward components R1–R5 evaluate generated rollouts against frozen cached targets; tools are not rerun per rollout. Production reward and balanced-reward E4b are separate registered experiments. Their behavior and discrimination endpoints are reported separately. | |
| Evaluation uses threshold-free row scores and pair-cluster confidence intervals on chronological VALID. Classical reconstruction is fit on TRAIN and checked on VALID. The final one-pass TEST evaluation covered only the registered four systems and is closed. Human audit cards and the completed LLM-judge audit are separate evidence streams. | |
| ## Architecture diagram | |
|  | |
| See the figure source index for all captions and source paths. | |
| ## Critical boundaries | |
| - TEST is consumed and sealed; this archive performs no additional TEST read or inference. | |
| - Step 399 is inference-only; no step-400 checkpoint or VALID evaluation exists. | |
| - E3's registered early stop limited it to seed 42; seeds 43/44 and ablations are unavailable. | |
| - Oracle slicing is a ground-truth-location upper bound, not an inference-time system. | |
| - R3 on TEST is unavailable because no vulnerable TEST row has an eligible cached graph; it is N/A, not zero. | |