# Optimization pass: demand-driven sink slicing (2026-05-25)

## Area map

The working backlog is in `docs/internal/perf-audit/optimization-backlog.md`. The first
implemented slice is **demand-driven sink slicing**: detectors can now tell the
walker whether a statement subtree contains a detector-relevant sink before the
walker pays full symbolic encoding cost for pure non-sink expression statements.

Safety rule for this slice: still encode declarations, writes, calls, `new`, and
`delete`, because those can feed later sinks or mutate detector state. Only pure
non-sink expression statements are skipped.

## Implemented

- Added `SafetyObserver::shouldEncodeForObserver(const clang::Stmt*)`.
- Added detector-specific sink-shape recognizers for:
  - null deref: deref/member/subscript/call shapes
  - div-by-zero: `/`, `%`, calls
  - int overflow: signed integer arithmetic, calls
  - oob/uaf: array subscripts and modeled libc/string sinks
- Added walker-side conservative side-effect guard so slicing is
  precision-neutral for stateful expressions.

## Validation

```sh
meson test -C build/release fold:null_deref fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
meson test -C build/release --print-errorlogs
git diff --check
```

Results:

- Focused detector suite: 4/4 passed.
- Full suite: 49/49 passed.
- Whitespace check: passed.

## Benchmarks

### Synthetic micro: control nesting

```sh
python3 bench/run_micro_opt.py --case control-nesting --size 4 --repeats 5 --out-dir /tmp/fold-micro-slice-r5
```

Result medians:

- Findings: unchanged for this gate (`fold.null-deref`: 1 proved finding).
- `total_wall_ms`: 54 ms.
- `null-deref.wall_ms`: 46 ms.
- `null-deref.walker_ms`: 44 ms.
- `null-deref.control_walk_ms`: 36 ms.
- `z3_queries`: 1, `z3_timeouts`: 0.

### Yams wide20 security preset

```sh
python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 --out-dir /tmp/fold-security-slice-smoke
```

Result:

- Return code: 0.
- Findings: 0.
- External elapsed: 117.1 s.
- Scan total wall: 117.0 s across 20 TUs / 4,983 functions.

### Curl security preset

```sh
python3 bench/run_security_targets.py --preset curl-security --repeats 1 --out-dir /tmp/fold-curl-slice-smoke
```

Result:

- Return code: 1.
- External elapsed: 577.2 s.
- Scan total wall: 577.1 s across 306 TUs / 2,339 functions.
- SARIF results: 2,463 total entries (`null-deref`: 2,171, `int-overflow`: 188,
  `oob-access`: 91, `div-by-zero`: 13). This preset counts SARIF notes as well
  as warnings, so use it for trend comparison rather than as a TP/FP number
  without post-processing levels.