fix: harden lifting name allocation and signature arity guard

Prevent variable name collisions when lifting creates virtual vars by
checking existing names before allocating. Extract CompactSignature
dispatch helper in AuxVarEliminator to deduplicate platform-specific
compaction logic. Add arity guard in RunPrepareCoeffModel to block
coefficient interpolation on malformed signatures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kyle-elliott-tob

lib/core/AuxVarEliminator.cpp

@@ -166,6 +166,19 @@ namespace cobra {
 
 #endif // COBRA_SVE2
 
+        std::vector< uint64_t > CompactSignature(
+            const std::vector< uint64_t > &sig, uint64_t live_mask, uint32_t num_vars
+        ) {
+#if COBRA_X86
+            if (has_bmi2()) { return CompactSignatureHw(sig, live_mask, num_vars); }
+            return CompactSignatureSoft(sig, live_mask, num_vars);
+#elif COBRA_SVE2
+            return CompactSignatureSve2(sig, live_mask, num_vars);
+#else
+            return CompactSignatureSoft(sig, live_mask, num_vars);
+#endif
+        }
+
     } // namespace
 
     EliminationResult EliminateAuxVars(
@@ -182,22 +195,8 @@ namespace cobra {
 
         const uint64_t kLiveMask = DetectLiveMask(sig, kNumVars);
 
-        // Compact the signature vector in a single pass
-        std::vector< uint64_t > reduced;
-#if COBRA_X86
-        if (has_bmi2()) {
-            reduced = CompactSignatureHw(sig, kLiveMask, kNumVars);
-        } else {
-            reduced = CompactSignatureSoft(sig, kLiveMask, kNumVars);
-        }
-#elif COBRA_SVE2
-        reduced = CompactSignatureSve2(sig, kLiveMask, kNumVars);
-#else
-        reduced = CompactSignatureSoft(sig, kLiveMask, kNumVars);
-#endif
-
         EliminationResult result;
-        result.reduced_sig = std::move(reduced);
+        result.reduced_sig = CompactSignature(sig, kLiveMask, kNumVars);
         for (uint32_t v = 0; v < kNumVars; ++v) {
             if ((kLiveMask & (1ULL << v)) != 0u) {
                 result.real_vars.push_back(vars[v]);
@@ -252,7 +251,7 @@ namespace cobra {
         std::sort(result.real_vars.begin(), result.real_vars.end(), by_original_index);
         std::sort(result.spurious_vars.begin(), result.spurious_vars.end(), by_original_index);
 
-        result.reduced_sig = CompactSignatureSoft(sig, live_mask, kNumVars);
+        result.reduced_sig = CompactSignature(sig, live_mask, kNumVars);
 
         return result;
     }

lib/core/LiftingPasses.cpp

@@ -9,6 +9,7 @@
 #include <algorithm>
 #include <functional>
 #include <unordered_map>
+#include <unordered_set>
 
 namespace cobra {
 
@@ -120,6 +121,24 @@ namespace cobra {
             uint32_t virtual_index;
         };
 
+        std::vector< std::string > AllocateFreshVirtualNames(
+            const std::vector< std::string > &existing_vars, const std::string &prefix,
+            size_t count
+        ) {
+            std::unordered_set< std::string > used(existing_vars.begin(), existing_vars.end());
+            std::vector< std::string > names;
+            names.reserve(count);
+
+            size_t next_suffix = 0;
+            while (names.size() < count) {
+                auto candidate = prefix + std::to_string(next_suffix++);
+                if (!used.insert(candidate).second) { continue; }
+                names.push_back(std::move(candidate));
+            }
+
+            return names;
+        }
+
         std::vector< DeduplicatedAtom > DeduplicateAtoms(
             const std::vector< LiftCandidate > &candidates, uint32_t first_virtual_index
         ) {
@@ -363,9 +382,11 @@ namespace cobra {
 
         // Build extended variable list: original vars + virtual vars.
         std::vector< std::string > outer_vars = vars;
-        for (size_t i = 0; i < atoms.size(); ++i) {
-            outer_vars.push_back("v" + std::to_string(i));
-        }
+        auto virtual_names = AllocateFreshVirtualNames(vars, "v", atoms.size());
+        outer_vars.insert(
+            outer_vars.end(), std::make_move_iterator(virtual_names.begin()),
+            std::make_move_iterator(virtual_names.end())
+        );
 
         // Build bindings.
         std::vector< LiftedBinding > bindings;
@@ -524,9 +545,11 @@ namespace cobra {
 
         // Build extended variable list: original vars + virtual vars.
         std::vector< std::string > outer_vars = vars;
-        for (size_t i = 0; i < selected.size(); ++i) {
-            outer_vars.push_back("r" + std::to_string(i));
-        }
+        auto virtual_names = AllocateFreshVirtualNames(vars, "r", selected.size());
+        outer_vars.insert(
+            outer_vars.end(), std::make_move_iterator(virtual_names.begin()),
+            std::make_move_iterator(virtual_names.end())
+        );
 
         // Build bindings — use atoms (which have copies of
         // rendered strings) instead of selected for subtree access.

lib/core/SignaturePasses.cpp

@@ -1054,6 +1054,27 @@ namespace cobra {
         const auto &sub_ctx     = sig_payload.ctx;
         const auto &sig         = sub_ctx.elimination.reduced_sig;
         const auto num_vars     = static_cast< uint32_t >(sub_ctx.real_vars.size());
+        const auto expected_len = size_t{ 1 } << num_vars;
+
+        if (sig.size() != expected_len) {
+            return Ok(
+                PassResult{
+                    .decision    = PassDecision::kBlocked,
+                    .disposition = ItemDisposition::kRetainCurrent,
+                    .reason =
+                        ReasonDetail{
+                            .top = {
+                                .code = {
+                                    ReasonCategory::kGuardFailed,
+                                    ReasonDomain::kSignature,
+                                },
+                                .message =
+                                    "Reduced signature arity does not match the active variable set",
+                            },
+                        },
+                }
+            );
+        }
 
         auto coeffs = InterpolateCoefficients(sig, num_vars, ctx.bitwidth);
 

test/core/test_lifting_passes.cpp

@@ -96,6 +96,34 @@ TEST(ArithmeticAtomLifter, CarriesParentLocalSolveContext) {
     EXPECT_EQ((*skel->original_ctx.evaluator)(std::vector< uint64_t >{ 3, 5 }), 1u);
 }
 
+TEST(ArithmeticAtomLifter, UsesFreshVirtualNamesAgainstExistingLocals) {
+    auto expr =
+        Expr::BitwiseAnd(Expr::Mul(Expr::Variable(0), Expr::Variable(0)), Expr::Variable(1));
+    auto cls = ClassifyStructural(*expr);
+
+    Options opts{ .bitwidth = 64, .max_vars = 16 };
+    auto ctx = MakeLiftCtx(opts, { "x" });
+
+    WorkItem item;
+    item.payload = AstPayload{
+        .expr           = std::move(expr),
+        .classification = cls,
+        .provenance     = Provenance::kRewritten,
+        .solve_ctx      = AstSolveContext{ .vars = { "x", "v0" } },
+    };
+    item.features.classification = cls;
+    item.features.provenance     = Provenance::kRewritten;
+
+    auto result = RunLiftArithmeticAtoms(item, ctx);
+    ASSERT_TRUE(result.has_value());
+    auto &pr = result.value();
+    ASSERT_EQ(pr.decision, PassDecision::kAdvance);
+
+    auto *skel = std::get_if< LiftedSkeletonPayload >(&pr.next[0].payload);
+    ASSERT_NE(skel, nullptr);
+    EXPECT_EQ(skel->outer_ctx.vars, (std::vector< std::string >{ "x", "v0", "v1" }));
+}
+
 // x & y -- no arithmetic atoms
 TEST(ArithmeticAtomLifter, NoAtomsReturnsNotApplicable) {
     auto expr = Expr::BitwiseAnd(Expr::Variable(0), Expr::Variable(1));
@@ -192,6 +220,35 @@ TEST(RepeatedSubexprLifter, LiftsLargeRepeatedSubtrees) {
     EXPECT_EQ(skel->bindings[0].kind, LiftedValueKind::kRepeatedSubexpression);
 }
 
+TEST(RepeatedSubexprLifter, UsesFreshVirtualNamesAgainstExistingLocals) {
+    auto repeated = []() {
+        return Expr::Mul(
+            Expr::Add(Expr::Variable(0), Expr::Variable(2)),
+            Expr::Add(Expr::Variable(0), Expr::Variable(2))
+        );
+    };
+    auto expr = Expr::BitwiseXor(repeated(), repeated());
+    Options opts{ .bitwidth = 64, .max_vars = 16 };
+    auto ctx = MakeLiftCtx(opts, { "b" });
+
+    WorkItem item;
+    item.payload = AstPayload{
+        .expr       = std::move(expr),
+        .provenance = Provenance::kRewritten,
+        .solve_ctx  = AstSolveContext{ .vars = { "b", "r1", "r0" } },
+    };
+    item.features.provenance = Provenance::kRewritten;
+
+    auto result = RunLiftRepeatedSubexpressions(item, ctx);
+    ASSERT_TRUE(result.has_value());
+    auto &pr = result.value();
+    ASSERT_EQ(pr.decision, PassDecision::kAdvance);
+
+    auto *skel = std::get_if< LiftedSkeletonPayload >(&pr.next[0].payload);
+    ASSERT_NE(skel, nullptr);
+    EXPECT_EQ(skel->outer_ctx.vars, (std::vector< std::string >{ "b", "r1", "r0", "r2" }));
+}
+
 TEST(RepeatedSubexprLifter, MaximalNonOverlapping) {
     // outer = Mul(Add(x,y), Add(x,y)) — appears 2x
     // inner = Add(x,y) — appears 4x but size < 4