[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GQCMPJ4F7F5TV16S9E4QW0":3,"skill-same:01M6GQCMPJ4F7F5TV16S9E4QW0":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6GQCMPJ4F7F5TV16S9E4QW0","tvm-fift-hypothesis-proving",null,"Prove or reject TON TVM opcode, crash, gas-accounting, memory, CPU, debug, and RUNVM\u002FRUNVMX resource hypotheses with Fift\u002FAsm.fif probes. Use when testing suspected TVM instruction underpricing, native crashes, exponential resource growth, or runvm behavior in a local TON checkout.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"tvm","hypothesis","tvm fift hypothesis proving","accounting","when","prove","ton","with","native","CPU","checkout","local","testing","crash","use","growth","gas","behavior","debug","memory","2026-11-10 10:12:30",false,"---\nname: tvm-fift-hypothesis-proving\ndescription: Prove or reject TON TVM opcode, crash, gas-accounting, memory, CPU, debug, and RUNVM\u002FRUNVMX resource hypotheses with Fift\u002FAsm.fif probes. Use when testing suspected TVM instruction underpricing, native crashes, exponential resource growth, or runvm behavior in a local TON checkout.\n---\n\n# TVM Fift Hypothesis Proving\n\nUse this skill when the job is to turn a suspected TVM resource, crash, or gas-accounting issue into a minimal executable Fift probe and classify the result.\n\nTypical triggers:\n\n- \"this opcode crashes TVM\"\n- \"this opcode allocates memory without gas\"\n- \"this instruction is exponential\"\n- \"this gas charge is too low\"\n- \"`RUNVM` or `RUNVMX` can reset accounting\"\n- \"debug output, stack dumps, or Fift tooling can be abused\"\n\nIf the hypothesis needs validator networking, block production, account state, or transaction replay, use a local-network triage skill instead or combine both workflows.\n\n## Entry Model\n\nFift is a stack language. Values are pushed first, words consume values from the top of the stack, and `.s` prints the current Fift stack. The top of the printed stack is the last item.\n\nTVM assembler syntax is also stack-shaped:\n\n- Start assembler probes with `\"Asm.fif\" include`.\n- Put TVM code inside `\u003C{ ... }>s` when you want a code slice suitable for `runvmcode` or `gasrunvmcode`.\n- Arguments already on the Fift stack become the initial TVM stack.\n- `gasrunvmcode` takes a code slice and a gas limit, then returns TVM result values, the exit code, and gas consumed.\n\nUseful public references:\n\n- Fift introduction: https:\u002F\u002Fton.org\u002Ffiftbase.pdf\n- TVM description: https:\u002F\u002Fton.org\u002Ftvm.pdf\n- In the TON repo, inspect `doc\u002Ffiftbase.tex`, `crypto\u002Ffift\u002Flib\u002FFift.fif`, `crypto\u002Ffift\u002Flib\u002FAsm.fif`, `crypto\u002Ffift\u002Fwords.cpp`, `crypto\u002Fvm\u002Fcontops.cpp`, and the opcode implementation under `crypto\u002Fvm\u002F`.\n\n## Quick Start\n\nCreate `probe.fif` in a TON checkout:\n\n```fift\n\"Asm.fif\" include\n\n2 3 \u003C{ ADD DUP MUL }>s 1000000 gasrunvmcode .s cr\n```\n\nRun it:\n\n```bash\nbuild\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif\n```\n\nThe TVM program is three opcodes:\n\n1. `ADD` turns `2 3` into `5`.\n2. `DUP` duplicates `5`.\n3. `MUL` returns `25`.\n\nThe stack line has this shape:\n\n```text\n25 0 \u003Cgas>\n```\n\n`25` is the TVM result, `0` is the TVM exit code, and `\u003Cgas>` is the gas consumed by this build and global version. With a too-small gas limit, expect an out-of-gas exit such as:\n\n```text\n\u003Cexception-parameter> -14 \u003Cgas>\n```\n\nDo not hard-code one gas number across versions. Record the build, global version, exact probe, exit code, and measured gas.\n\n## Workflow\n\n1. Ground the hypothesis in current code.\n   Locate the assembler mnemonic and C++ executor with `rg`.\n   Identify where gas is charged, where cells or stack entries are allocated, whether the operation is version-gated, and whether the surface is consensus execution, get-method\u002Fliteserver, Fift tooling, debug-only code, or host-library code outside TVM.\n\n2. Build the smallest executable probe.\n   Start with one opcode or a tiny opcode sequence.\n   Keep the first run small enough to finish quickly.\n   Scale one parameter at a time.\n   Prefer `gasrunvmcode` or explicit `runvmx` modes when the returned gas matters.\n\n3. Measure host resources separately from TVM gas.\n   Use `\u002Fusr\u002Fbin\u002Ftime -v` for RSS and CPU.\n   Use `timeout` for suspected hangs.\n   Redirect huge debug output to a file or `\u002Fdev\u002Fnull`.\n   Record stack output, exit code, gas, max RSS, user\u002Fsystem time, elapsed time, and the scale parameter.\n\n4. Compare against a charged baseline.\n   For cells, compare `BTOS` or `HASHBU` paths against `ENDC`, `ENDC CTOS`, or `ENDC HASHCU`.\n   For debug\u002Foutput claims, compare gas at construction time against host output bytes or RSS.\n   For `RUNVM`, distinguish a stack supplied by Fift from a stack built inside TVM and paid by TVM gas.\n\n5. Classify the result.\n   Confirm only when a bounded PoC demonstrates a production-reachable path where TVM gas stays flat or much lower than host memory, CPU, output, or crypto work, and the code path explains why.\n   Downrank findings that require Fift debug flags, `DUMP*`, stack trace, `.s`, `.dump`, or `(dump)` unless a production host enables the same sink on untrusted contract output.\n   Reject hypotheses with durable negative facts: bounded tuple length, bounded dictionary key depth, memoized cell DAG traversal, explicit linear gas, paid stack movement, or version-gated historical fixes.\n\n6. Preserve reusable conclusions in the requested public artifact.\n   Keep private provenance, local report filenames, absolute local paths, and raw huge outputs out of public skill content and public reports.\n   Write down exact rejection reasons so future triage can skip known false positives quickly.\n\n## Command Patterns\n\nRun a one-off probe:\n\n```bash\nbuild\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif\n```\n\nMeasure RSS and CPU:\n\n```bash\n\u002Fusr\u002Fbin\u002Ftime -v build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif >\u002Ftmp\u002Fprobe.out 2>\u002Ftmp\u002Fprobe.time\n```\n\nBound a suspected hang or crash:\n\n```bash\ntimeout 10s \u002Fusr\u002Fbin\u002Ftime -v build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif >\u002Ftmp\u002Fprobe.out 2>\u002Ftmp\u002Fprobe.time\necho \"status=$?\"\n```\n\nScale a parameter cautiously:\n\n```bash\nfor n in 8 12 16 20; do\n  sed \"s\u002F@N@\u002F$n\u002F\" probe.template.fif >\u002Ftmp\u002Fprobe.fif\n  \u002Fusr\u002Fbin\u002Ftime -f \"N=$n rss_kb=%M user_s=%U sys_s=%S elapsed_s=%e\" \\\n    build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s \u002Ftmp\u002Fprobe.fif >\u002Ftmp\u002Fprobe.$n.out\ndone\n```\n\nWhen defining Fift macros that emit assembler bytes, raw bytes are often safer than calling assembler words outside assembler context:\n\n```fift\nx{D8} s,     \u002F\u002F EXECUTE\nx{5C} s,     \u002F\u002F 2DUP\nx{ECFF} s,   \u002F\u002F SETCONTARGS 15,-1\n```\n\n## Fift runvm Words\n\nThe Fift host word `runvmx` pops a mode from the Fift stack. `crypto\u002Ffift\u002Flib\u002FFift.fif` defines convenient wrappers:\n\n- `runvmcode`, `gasrunvmcode`, `gas2runvmcode`\n  Run a code slice. `gas*` variants take a gas limit and return gas consumed.\n  `gas2*` variants also pop a hard gas limit.\n\n- `runvmdict`, `gasrunvmdict`, `gas2runvmdict`\n  Run with `c3` initialized from the code and an implicit zero argument.\n\n- `runvm`, `gasrunvm`, `gas2runvm`\n  Run with `c3` initialized from the code and `c4` persistent data loaded from the stack and returned.\n\n- `runvmctx`, `gasrunvmctx`, `gas2runvmctx`\n  Also load `c7` smart-contract context.\n\n- `runvmctxact`, `gasrunvmctxact`, `gas2runvmctxact`\n  Also return `c5` actions.\n\n- `runvmctxactq`, `gasrunvmctxactq`\n  Quiet context\u002Faction variants that avoid the default operation log bit used by the non-quiet wrappers.\n\nFift `runvmx` mode bits in `crypto\u002Ffift\u002Fwords.cpp` are:\n\n```text\n+1    set c3 to code\n+2    push implicit 0 before running code\n+4    load c4 from stack and return final c4\n+8    load gas limit from stack and return consumed gas\n+16   load c7 from stack\n+32   return c5 actions\n+64   log VM ops to stderr\n+128  pop hard gas limit from stack\n+256  enable stack trace\n+512  enable debug instructions\n+1024 load global_version from stack\n```\n\nFor explicit mode use, a gas-returning code-only run is:\n\n```fift\n2 3 \u003C{ ADD }>s 1000000 0x48 runvmx .s cr\n```\n\nThe TVM opcodes `RUNVM` and `RUNVMX` are different from the Fift host word `runvmx`. Their mode bits live in `crypto\u002Fvm\u002Fcontops.cpp`:\n\n```text\n+1    set c3 to code\n+2    push implicit 0; only works with +1\n+4    load c4 from stack and return final c4\n+8    load gas limit from stack and return consumed gas\n+16   load c7 from stack\n+32   return c5 actions\n+64   pop hard gas limit from stack\n+128  isolated gas consumption: separate visited cells and reset cheap counters\n+256  pop N and return exactly N values on success\n```\n\nDo not mix these two mode tables. Fift `+256` means stack trace; TVM `RUNVM` `+256` means exact return count.\n\n## Crash Hypotheses\n\nTreat a crash as a native process failure, such as SIGSEGV, SIGABRT, failed `CHECK`, or another unhandled host failure. A TVM exception, an out-of-gas result, an invalid-opcode result, or a Fift `abort\"` is not a crash.\n\nCrash triage steps:\n\n1. Run the smallest probe without Fift stack trace, debug instructions, post-run `.s` dumps of huge values, or verbose VM logs.\n2. Bound the run with `timeout`.\n3. Capture exit status and stderr. Typical shell statuses are `124` for timeout, `134` for abort, and `139` for segfault.\n4. If the process really crashes, rerun under a debugger or sanitizer build only after the minimal non-debug PoC is stable.\n5. Classify as tooling-only if the crash requires Fift display, dump, trace, or debug-only paths instead of ordinary TVM execution.\n\nUseful rejection: \"the program returned exit code `-14`\" means out of gas, not native crash.\n\n## Exponential Resource Hypotheses\n\nA real exponential finding needs both measurements and code support. Do not infer exponential behavior from one slow run.\n\nMeasure at least four scale points. Keep all other variables fixed and record:\n\n```text\nN gas max_rss_kb user_s sys_s elapsed_s exit_code output_bytes\n```\n\nConfirm only if resource growth substantially outpaces gas and the implementation lacks a cap or memoization. Common caps and guards:\n\n- TVM cells are limited to 1023 bits and 4 refs.\n- Dictionary keys are capped at `DictionaryBase::max_key_bits = 1023`; most dictionary opcodes follow one key path, not the whole tree.\n- `CDATASIZE*` and `SDATASIZE*` use visited-cell accounting, so shared DAGs are counted physically, not logically, when the code path uses that storage-stat walker.\n- Tuples are bounded by length 255; tuple operations charge tuple gas and become interesting mainly when fed into recursive display, serialization, or debug sinks.\n- Stack movement and continuation calls commonly charge for stack depth beyond the free depth.\n\nA host-only exponential sink can still matter for tools, liteservers, or indexers, but do not describe it as consensus TVM gas abuse unless ordinary contract execution reaches it.\n\n## Incorrect Gas Hypotheses\n\n## Common False Positives\n\n`BTOS` is cheap by design. In current code it pops a builder, finalizes it with `finalize_novm()`, and returns a slice view with `NoVm()`. It does not run the normal `ENDC` cell-create accounting. The important bounds are that a builder is one TVM cell, so it is capped at 1023 bits and 4 refs, and repeated use still pays the opcodes needed to build, keep, move, hash, serialize, or commit values. A report that only says \"`BTOS` is cheaper than `ENDC CTOS`\" is not enough. Look for unbounded transient memory growth per gas unit on a production path.\n\nThe first 10 Ed25519 `CHKSIGNU` or `CHKSIGNS` calls are intentionally cheap. `register_chksgn_call()` tracks a per-VM counter, records the first 10 as free gas, and charges `chksgn_gas_price` after that. This is not by itself a bug.\n\n`RUNVM` does not let a contract multiply the first-10-CHKSGN allowance for free. By default, child VMs inherit and return the parent's `chksgn_counter` and `free_gas_consumed`. With TVM `RUNVM` mode `+128`, the child uses isolated gas and resets cheap counters, but the parent first consumes accumulated free gas before resetting. A valid bypass must demonstrate more than the intended allowance in one production execution without that accounting catching up.\n\nFift debug and dump paths are usually not consensus issues. Findings that require Fift `runvmx` mode `+256`, mode `+512`, debug opcodes, stack trace, `.s`, `.dump`, `(dump)`, or large post-run display are tooling\u002Fdebug findings unless a production service exposes the same sink to untrusted input.\n\nHistorical nested-continuation free-gas reports need a current-version bypass. Continuation nested-jump native recursion and free nested jump gas are historical for current `global_version >= 9`.\n\n## Evidence Standard\n\nA useful result includes:\n\n- TON commit or build identity\n- global version used\n- exact Fift probe\n- exact command\n- stack output\n- exit code\n- gas consumed\n- max RSS and CPU time when resource use is part of the claim\n- scale table for non-constant hypotheses\n- source lines for the charge, allocation, traversal, or reset behavior\n- classification: confirmed, rejected, tooling-only, version-gated, or needs network-level repro\n","# TVM Fift Hypothesis Proving\n\nUse this skill when the job is to turn a suspected TVM resource, crash, or gas-accounting issue into a minimal executable Fift probe and classify the result.\n\nTypical triggers:\n\n- \"this opcode crashes TVM\"\n- \"this opcode allocates memory without gas\"\n- \"this instruction is exponential\"\n- \"this gas charge is too low\"\n- \"`RUNVM` or `RUNVMX` can reset accounting\"\n- \"debug output, stack dumps, or Fift tooling can be abused\"\n\nIf the hypothesis needs validator networking, block production, account state, or transaction replay, use a local-network triage skill instead or combine both workflows.\n\n## Entry Model\n\nFift is a stack language. Values are pushed first, words consume values from the top of the stack, and `.s` prints the current Fift stack. The top of the printed stack is the last item.\n\nTVM assembler syntax is also stack-shaped:\n\n- Start assembler probes with `\"Asm.fif\" include`.\n- Put TVM code inside `\u003C{ ... }>s` when you want a code slice suitable for `runvmcode` or `gasrunvmcode`.\n- Arguments already on the Fift stack become the initial TVM stack.\n- `gasrunvmcode` takes a code slice and a gas limit, then returns TVM result values, the exit code, and gas consumed.\n\nUseful public references:\n\n- Fift introduction: https:\u002F\u002Fton.org\u002Ffiftbase.pdf\n- TVM description: https:\u002F\u002Fton.org\u002Ftvm.pdf\n- In the TON repo, inspect `doc\u002Ffiftbase.tex`, `crypto\u002Ffift\u002Flib\u002FFift.fif`, `crypto\u002Ffift\u002Flib\u002FAsm.fif`, `crypto\u002Ffift\u002Fwords.cpp`, `crypto\u002Fvm\u002Fcontops.cpp`, and the opcode implementation under `crypto\u002Fvm\u002F`.\n\n## Quick Start\n\nCreate `probe.fif` in a TON checkout:\n\n```fift\n\"Asm.fif\" include\n\n2 3 \u003C{ ADD DUP MUL }>s 1000000 gasrunvmcode .s cr\n```\n\nRun it:\n\n```bash\nbuild\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif\n```\n\nThe TVM program is three opcodes:\n\n1. `ADD` turns `2 3` into `5`.\n2. `DUP` duplicates `5`.\n3. `MUL` returns `25`.\n\nThe stack line has this shape:\n\n```text\n25 0 \u003Cgas>\n```\n\n`25` is the TVM result, `0` is the TVM exit code, and `\u003Cgas>` is the gas consumed by this build and global version. With a too-small gas limit, expect an out-of-gas exit such as:\n\n```text\n\u003Cexception-parameter> -14 \u003Cgas>\n```\n\nDo not hard-code one gas number across versions. Record the build, global version, exact probe, exit code, and measured gas.\n\n## Workflow\n\n1. Ground the hypothesis in current code.\n   Locate the assembler mnemonic and C++ executor with `rg`.\n   Identify where gas is charged, where cells or stack entries are allocated, whether the operation is version-gated, and whether the surface is consensus execution, get-method\u002Fliteserver, Fift tooling, debug-only code, or host-library code outside TVM.\n\n2. Build the smallest executable probe.\n   Start with one opcode or a tiny opcode sequence.\n   Keep the first run small enough to finish quickly.\n   Scale one parameter at a time.\n   Prefer `gasrunvmcode` or explicit `runvmx` modes when the returned gas matters.\n\n3. Measure host resources separately from TVM gas.\n   Use `\u002Fusr\u002Fbin\u002Ftime -v` for RSS and CPU.\n   Use `timeout` for suspected hangs.\n   Redirect huge debug output to a file or `\u002Fdev\u002Fnull`.\n   Record stack output, exit code, gas, max RSS, user\u002Fsystem time, elapsed time, and the scale parameter.\n\n4. Compare against a charged baseline.\n   For cells, compare `BTOS` or `HASHBU` paths against `ENDC`, `ENDC CTOS`, or `ENDC HASHCU`.\n   For debug\u002Foutput claims, compare gas at construction time against host output bytes or RSS.\n   For `RUNVM`, distinguish a stack supplied by Fift from a stack built inside TVM and paid by TVM gas.\n\n5. Classify the result.\n   Confirm only when a bounded PoC demonstrates a production-reachable path where TVM gas stays flat or much lower than host memory, CPU, output, or crypto work, and the code path explains why.\n   Downrank findings that require Fift debug flags, `DUMP*`, stack trace, `.s`, `.dump`, or `(dump)` unless a production host enables the same sink on untrusted contract output.\n   Reject hypotheses with durable negative facts: bounded tuple length, bounded dictionary key depth, memoized cell DAG traversal, explicit linear gas, paid stack movement, or version-gated historical fixes.\n\n6. Preserve reusable conclusions in the requested public artifact.\n   Keep private provenance, local report filenames, absolute local paths, and raw huge outputs out of public skill content and public reports.\n   Write down exact rejection reasons so future triage can skip known false positives quickly.\n\n## Command Patterns\n\nRun a one-off probe:\n\n```bash\nbuild\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif\n```\n\nMeasure RSS and CPU:\n\n```bash\n\u002Fusr\u002Fbin\u002Ftime -v build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif >\u002Ftmp\u002Fprobe.out 2>\u002Ftmp\u002Fprobe.time\n```\n\nBound a suspected hang or crash:\n\n```bash\ntimeout 10s \u002Fusr\u002Fbin\u002Ftime -v build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s probe.fif >\u002Ftmp\u002Fprobe.out 2>\u002Ftmp\u002Fprobe.time\necho \"status=$?\"\n```\n\nScale a parameter cautiously:\n\n```bash\nfor n in 8 12 16 20; do\n  sed \"s\u002F@N@\u002F$n\u002F\" probe.template.fif >\u002Ftmp\u002Fprobe.fif\n  \u002Fusr\u002Fbin\u002Ftime -f \"N=$n rss_kb=%M user_s=%U sys_s=%S elapsed_s=%e\" \\\n    build\u002Fcrypto\u002Ffift -Icrypto\u002Ffift\u002Flib -s \u002Ftmp\u002Fprobe.fif >\u002Ftmp\u002Fprobe.$n.out\ndone\n```\n\nWhen defining Fift macros that emit assembler bytes, raw bytes are often safer than calling assembler words outside assembler context:\n\n```fift\nx{D8} s,     \u002F\u002F EXECUTE\nx{5C} s,     \u002F\u002F 2DUP\nx{ECFF} s,   \u002F\u002F SETCONTARGS 15,-1\n```\n\n## Fift runvm Words\n\nThe Fift host word `runvmx` pops a mode from the Fift stack. `crypto\u002Ffift\u002Flib\u002FFift.fif` defines convenient wrappers:\n\n- `runvmcode`, `gasrunvmcode`, `gas2runvmcode`\n  Run a code slice. `gas*` variants take a gas limit and return gas consumed.\n  `gas2*` variants also pop a hard gas limit.\n\n- `runvmdict`, `gasrunvmdict`, `gas2runvmdict`\n  Run with `c3` initialized from the code and an implicit zero argument.\n\n- `runvm`, `gasrunvm`, `gas2runvm`\n  Run with `c3` initialized from the code and `c4` persistent data loaded from the stack and returned.\n\n- `runvmctx`, `gasrunvmctx`, `gas2runvmctx`\n  Also load `c7` smart-contract context.\n\n- `runvmctxact`, `gasrunvmctxact`, `gas2runvmctxact`\n  Also return `c5` actions.\n\n- `runvmctxactq`, `gasrunvmctxactq`\n  Quiet context\u002Faction variants that avoid the default operation log bit used by the non-quiet wrappers.\n\nFift `runvmx` mode bits in `crypto\u002Ffift\u002Fwords.cpp` are:\n\n```text\n+1    set c3 to code\n+2    push implicit 0 before running code\n+4    load c4 from stack and return final c4\n+8    load gas limit from stack and return consumed gas\n+16   load c7 from stack\n+32   return c5 actions\n+64   log VM ops to stderr\n+128  pop hard gas limit from stack\n+256  enable stack trace\n+512  enable debug instructions\n+1024 load global_version from stack\n```\n\nFor explicit mode use, a gas-returning code-only run is:\n\n```fift\n2 3 \u003C{ ADD }>s 1000000 0x48 runvmx .s cr\n```\n\nThe TVM opcodes `RUNVM` and `RUNVMX` are different from the Fift host word `runvmx`. Their mode bits live in `crypto\u002Fvm\u002Fcontops.cpp`:\n\n```text\n+1    set c3 to code\n+2    push implicit 0; only works with +1\n+4    load c4 from stack and return final c4\n+8    load gas limit from stack and return consumed gas\n+16   load c7 from stack\n+32   return c5 actions\n+64   pop hard gas limit from stack\n+128  isolated gas consumption: separate visited cells and reset cheap counters\n+256  pop N and return exactly N values on success\n```\n\nDo not mix these two mode tables. Fift `+256` means stack trace; TVM `RUNVM` `+256` means exact return count.\n\n## Crash Hypotheses\n\nTreat a crash as a native process failure, such as SIGSEGV, SIGABRT, failed `CHECK`, or another unhandled host failure. A TVM exception, an out-of-gas result, an invalid-opcode result, or a Fift `abort\"` is not a crash.\n\nCrash triage steps:\n\n1. Run the smallest probe without Fift stack trace, debug instructions, post-run `.s` dumps of huge values, or verbose VM logs.\n2. Bound the run with `timeout`.\n3. Capture exit status and stderr. Typical shell statuses are `124` for timeout, `134` for abort, and `139` for segfault.\n4. If the process really crashes, rerun under a debugger or sanitizer build only after the minimal non-debug PoC is stable.\n5. Classify as tooling-only if the crash requires Fift display, dump, trace, or debug-only paths instead of ordinary TVM execution.\n\nUseful rejection: \"the program returned exit code `-14`\" means out of gas, not native crash.\n\n## Exponential Resource Hypotheses\n\nA real exponential finding needs both measurements and code support. Do not infer exponential behavior from one slow run.\n\nMeasure at least four scale points. Keep all other variables fixed and record:\n\n```text\nN gas max_rss_kb user_s sys_s elapsed_s exit_code output_bytes\n```\n\nConfirm only if resource growth substantially outpaces gas and the implementation lacks a cap or memoization. Common caps and guards:\n\n- TVM cells are limited to 1023 bits and 4 refs.\n- Dictionary keys are capped at `DictionaryBase::max_key_bits = 1023`; most dictionary opcodes follow one key path, not the whole tree.\n- `CDATASIZE*` and `SDATASIZE*` use visited-cell accounting, so shared DAGs are counted physically, not logically, when the code path uses that storage-stat walker.\n- Tuples are bounded by length 255; tuple operations charge tuple gas and become interesting mainly when fed into recursive display, serialization, or debug sinks.\n- Stack movement and continuation calls commonly charge for stack depth beyond the free depth.\n\nA host-only exponential sink can still matter for tools, liteservers, or indexers, but do not describe it as consensus TVM gas abuse unless ordinary contract execution reaches it.\n\n## Incorrect Gas Hypotheses\n\n## Common False Positives\n\n`BTOS` is cheap by design. In current code it pops a builder, finalizes it with `finalize_novm()`, and returns a slice view with `NoVm()`. It does not run the normal `ENDC` cell-create accounting. The important bounds are that a builder is one TVM cell, so it is capped at 1023 bits and 4 refs, and repeated use still pays the opcodes needed to build, keep, move, hash, serialize, or commit values. A report that only says \"`BTOS` is cheaper than `ENDC CTOS`\" is not enough. Look for unbounded transient memory growth per gas unit on a production path.\n\nThe first 10 Ed25519 `CHKSIGNU` or `CHKSIGNS` calls are intentionally cheap. `register_chksgn_call()` tracks a per-VM counter, records the first 10 as free gas, and charges `chksgn_gas_price` after that. This is not by itself a bug.\n\n`RUNVM` does not let a contract multiply the first-10-CHKSGN allowance for free. By default, child VMs inherit and return the parent's `chksgn_counter` and `free_gas_consumed`. With TVM `RUNVM` mode `+128`, the child uses isolated gas and resets cheap counters, but the parent first consumes accumulated free gas before resetting. A valid bypass must demonstrate more than the intended allowance in one production execution without that accounting catching up.\n\nFift debug and dump paths are usually not consensus issues. Findings that require Fift `runvmx` mode `+256`, mode `+512`, debug opcodes, stack trace, `.s`, `.dump`, `(dump)`, or large post-run display are tooling\u002Fdebug findings unless a production service exposes the same sink to untrusted input.\n\nHistorical nested-continuation free-gas reports need a current-version bypass. Continuation nested-jump native recursion and free nested jump gas are historical for current `global_version >= 9`.\n\n## Evidence Standard\n\nA useful result includes:\n\n- TON commit or build identity\n- global version used\n- exact Fift probe\n- exact command\n- stack output\n- exit code\n- gas consumed\n- max RSS and CPU time when resource use is part of the claim\n- scale table for non-constant hypotheses\n- source lines for the charge, allocation, traversal, or reset behavior\n- classification: confirmed, rejected, tooling-only, version-gated, or needs network-level repro\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-15 02:28:10",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill tvm-fift-hypothesis-proving",{"tool":59,"command":60},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill tvm-fift-hypothesis-proving",{"tool":62,"command":63},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill tvm-fift-hypothesis-proving","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving\u002FSKILL.md",true,[67,73,77],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"agents\u002Fopenai.yaml","REFERENCE","参考文档",269,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving\u002Fagents\u002Fopenai.yaml",{"path":74,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":75,"sourceHtmlUrl":76},"SOURCE.md",375,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving\u002FSOURCE.md",{"path":78,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":79,"sourceHtmlUrl":80},"TRUST.auto.yaml",2173,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fton-blockchain-tvm-fift-hypothesis-proving\u002FTRUST.auto.yaml",[82,111,134,152,165,175],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":87,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":39},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":116,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":39},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[120,121,122,123,124,125,126,127,128,129,130,131,132,133],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":138,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[142,121,143,144,145,146,147,131,130,129,148,149,150,125,151,124,123],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":156,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":39},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[160,161,122,162,163,132,130,164,128,127,125,124],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":166,"name":167,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":168,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":39},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[172,173,174],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":179,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[183,184,185,186,187,188,189,33,190,191,192],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]