diff --git a/README.md b/README.md
index cbaf276..f7a5d29 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,7 @@ fixture, the third from fuzzing edits and replaying ten crates' git histories.
 - [`docs/ur-queries.md`](docs/ur-queries.md): the bugs' patterns, and closed bugs' patterns, as Ur queries over rustc's source
 - [`docs/shadow-mode.md`](docs/shadow-mode.md): checking reuse inside rustc, and what exists today
 - [`docs/untracked-reads.md`](docs/untracked-reads.md): reporting reads of untracked state inside rustc
+- [`docs/props.md`](docs/props.md): MIR validation, optimization levels and the new trait solver on the same corpus
 - [`docs/plan.md`](docs/plan.md): the plan the work followed, with the properties
 
 ## An instrumented compiler
diff --git a/docs/hunt.md b/docs/hunt.md
index 91a813e..0393e65 100644
--- a/docs/hunt.md
+++ b/docs/hunt.md
@@ -31,7 +31,7 @@ with `-Zthreads=8`. `rustc/check.sh wide` runs the ordinary checks.
 | 5 | six untracked options change results incremental compilation reuses; with `-Zno-leak-check`, a rebuild accepts a program a clean build rejects | **looks new**; the first three found by a query written from a closed bug and an option audit ([`ur-queries.md`](ur-queries.md)), `-Zno-leak-check`, `-C extra-filename` and `-Zfuture-incompat-test` by reporting untracked reads ([`untracked-reads.md`](untracked-reads.md)); report drafted |
 | 6 | reused object code keeps the previous checksum of an edited source file in its debuginfo, and with `-Zembed-source` the previous file; with optimizations, ThinLTO symbol names then differ from a clean build | **looks new**; found by the fuzzer at `-Copt-level=2`; root cause found, since 1.44 (#69718); report drafted and a regression test (`hunt/tests/incr-debuginfo-embedded-source`, failing: no fix) |
 | 7 | warnings from inline assembly are not shown again when an incremental rebuild reuses the codegen unit | **looks new**; found while checking reused codegen units ([`shadow-mode.md`](shadow-mode.md)); on 1.60.0 through the nightly; report drafted ([draft](hunt/issue-asm-warnings-reused-cgu.md)) and a regression test (`hunt/tests/incr-asm-warning-reused`, failing: no fix) |
-| 8 | with `-Zmir-opt-level=3` and debuginfo, an incremental rebuild encodes an allocation twice where a clean build encodes it once | **looks new**; found by the fuzzer at `-Zmir-opt-level=4` and named by the reuse check, reduced to three lines; on 1.60.0 through the nightly; report drafted ([draft](hunt/issue-inlined-alloc-identity.md)), no fix |
+| 8 | with `-Zmir-opt-level=3`, an incremental rebuild encodes an allocation from inlined `core` MIR twice where a clean build encodes it once | **looks new**; found by the fuzzer at `-Zmir-opt-level=4` and named by the reuse check, reduced to one line; on 1.60.0 through the nightly; report drafted ([draft](hunt/issue-inlined-alloc-identity.md)), no fix |
 
 Findings 1 and 2 are single-threaded: an ordinary `cargo build`, an edit, another
 `cargo build`, and the metadata differs from a clean build of the edited source. Both come
diff --git a/docs/hunt/issue-inlined-alloc-identity.md b/docs/hunt/issue-inlined-alloc-identity.md
index c669810..e1d9ef5 100644
--- a/docs/hunt/issue-inlined-alloc-identity.md
+++ b/docs/hunt/issue-inlined-alloc-identity.md
@@ -1,4 +1,4 @@
-# With `-Zmir-opt-level=3` and debuginfo, an incremental rebuild encodes an allocation twice where a clean build encodes it once
+# With `-Zmir-opt-level=3`, an incremental rebuild encodes an allocation from inlined `core` MIR twice where a clean build encodes it once
 
 <!-- Draft issue for rust-lang/rust. Seen on 1.60.0 through nightly-2026-10-06. Related to the
 string-literal case in hunt/issue-literal-dedup.md: an allocation shared in a clean session is
@@ -10,48 +10,69 @@ rebuild's metadata has one more entry in its allocation table.
 ### Reproduction
 
 ```sh
-cat > lib.rs <<'EOF'
-pub fn first_n<const N: usize>(v: &[u8]) -> Option<[u8; N]> {
-    v.get(..N)?.try_into().ok()
-}
-EOF
-F="--edition 2021 --crate-type lib --crate-name x --emit=metadata,link -Zmir-opt-level=3 -Cdebuginfo=2"
+echo 'pub fn f<T>(v: &[T]) -> Option<&[T]> { v.get(..3) }' > lib.rs
+F="--edition 2021 --crate-type lib --crate-name x --emit=metadata,link -Zmir-opt-level=3"
 rustc $F -C incremental=incr  --out-dir rebuilt lib.rs
-cat >> lib.rs <<'EOF'
-pub fn first_m<const N: usize>(v: &[u8]) -> Option<[u8; N]> {
-    v.get(..N)?.try_into().ok()
-}
-EOF
+echo 'pub fn g<T>(v: &[T]) -> Option<&[T]> { v.get(..3) }' >> lib.rs
 rustc $F -C incremental=incr  --out-dir rebuilt lib.rs
 rustc $F -C incremental=clean --out-dir clean   lib.rs
 cmp rebuilt/libx.rmeta clean/libx.rmeta   # differ
 ```
 
 I expected the two to be identical. With `-Zmeta-stats`, the whole difference is in
-`interpret-alloc-index` (18 bytes on a larger crate). Two clean builds agree; without
-`-Cdebuginfo=2`, or at `-Zmir-opt-level=2` and below (so also at `-Copt-level=3`), the rebuild
-agrees with the clean build. It reproduces on 1.60.0, 1.65.0, 1.70.0, 1.75.0, 1.80.0, 1.85.0,
-1.90.0 and `nightly-2026-10-06` (with `RUSTC_BOOTSTRAP=1` on stable).
+`interpret-alloc-index`: the rebuild's metadata has an extra allocation. Two clean builds agree.
+
+| variation | result |
+|---|---|
+| as above, on `nightly-2026-10-06` | differs |
+| `-Zmir-opt-level=2`, or `-Copt-level=3` alone | same |
+| `-Zmir-opt-level=3 -Zinline-mir=no` | same |
+| the same result from a generic local `#[inline]` helper instead of `get` (`if v.len() >= 3 { Some(&v[..3]) } else { None }`) | same |
+| non-generic (`v: &[u8]`) | same |
+
+An earlier form of the reproduction (`v.get(..N)?.try_into().ok()` with a const parameter and
+`-Cdebuginfo=2`) also differs on 1.60.0, 1.65.0, 1.70.0, 1.75.0, 1.80.0, 1.85.0 and 1.90.0
+(with `RUSTC_BOOTSTRAP=1`).
 
 ### What differs
 
-The optimized MIR of `first_n` at this level has a constant `Option::<&[u8]>::None` held in a
-16-byte allocation (`_4 = const Option::<&[u8]>::None;` with `--emit=mir`). In a clean session
-`first_n` and `first_m` refer to the same allocation, so the metadata encodes it once. In the
-rebuild, `first_n` is green and its optimized MIR is decoded from the incremental cache, where
-its allocations were encoded as plain memory; decoding gives it a new `AllocId`, while
-`first_m`, computed fresh, refers to the shared one. Metadata then encodes both.
-
-Where the shared allocation comes from I have not confirmed. Interning a constant for
-propagation does not deduplicate (`intern_with_temp_alloc`), so the sharing more likely comes
-from MIR inlined from `core` (here `<[u8]>::get`): allocations decoded from a crate's metadata
-are decoded once per session and shared by every function that inlines that MIR, but the
-incremental cache stores a copy, not a reference to the upstream crate's allocation. That would
-also explain why debuginfo matters (the constant appears in inlined debuginfo) and why only
-`-Zmir-opt-level=3` and above (more inlining).
+At this level `f`'s optimized MIR returns a constant held in an allocation, because `T` is
+generic and the value cannot be a scalar:
+
+```text
+_0 = const Indirect { alloc_id: alloc1, offset: Size(0 bytes) }: Option<&[T]>;
+```
+
+In a clean session `f` and `g` refer to the same allocation, so the metadata encodes it once.
+In the rebuild, `f` is green and its optimized MIR is decoded from the incremental cache,
+where the allocation was encoded as plain memory; decoding gives it a new `AllocId`, while
+`g`, computed fresh, refers to the shared one. Metadata then encodes both.
+
+The sharing comes from inlining: the constant arrives with the MIR of
+`<[T]>::get` and its `SliceIndex` impl, inlined from `core`. Allocations decoded from a crate's
+metadata are decoded once per session and shared by every function that inlines that MIR, but
+the incremental cache stores a copy rather than a reference to `core`'s allocation. This fits
+every variation above: no inlining, no difference; a generic local helper (whose MIR is not
+decoded from another crate), no difference; a non-generic function (where the value is a
+scalar), no difference.
+
+A change to the incremental cache confirms it
+([`upstream-alloc-reference.patch`](upstream-alloc-reference.patch), experimental): when an
+allocation that was decoded from another crate's metadata is written to the cache, it is
+written as that crate's stable id and the allocation's index there, with its contents, and
+decoding it gives the same `AllocId` as decoding that crate's allocation (if the contents
+agree). With it, both reproductions above build the same incrementally as clean.
+
+It does not fix everything the fuzzer found: one of its cases on the test workspace, at
+`-Zmir-opt-level=4`, still has an extra allocation with the change, so there is at least one
+more source (perhaps MIR inlined from a function of the same crate, whose own MIR came from
+the cache). With the change, the reuse check also reports a string constant whose cached and
+fresh encodings differ, which may be the change's own doing. Not investigated further.
 
 The string-literal case ([report](issue-literal-dedup.md)) is the same kind of loss: an
-allocation shared by deduplication is not shared again after a round trip through the cache.
+allocation shared in a clean session is not shared again after a round trip through the cache.
+A fix along the same lines would encode, in the incremental cache, an allocation that came
+from another crate's metadata as a reference to it rather than as a copy.
 
 ### How it was found
 
@@ -65,4 +86,4 @@ rustc-verify-reuse: allocation shared differently: query `optimized_mir` for Def
   allocation: memory, 16 bytes, align 8, [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
 ```
 
-The test workspace was then reduced automatically to the three lines above.
+The test workspace was then reduced automatically, and by hand to the one line above.
diff --git a/docs/hunt/repro.sh b/docs/hunt/repro.sh
index c3aee97..dbd520c 100755
--- a/docs/hunt/repro.sh
+++ b/docs/hunt/repro.sh
@@ -81,12 +81,12 @@ r1=$("$rustc" --crate-type lib -Cincremental="$d/i11" --out-dir "$d/nl" "$d/nl/l
 r2=$("$rustc" --crate-type lib -Cincremental="$d/i12" --out-dir "$d/nl" "$d/nl/lib.rs" > /dev/null 2>&1; echo $?)
 if [ "$r1" = "$r2" ]; then echo same; else echo "DIFFER (the rebuild exits $r1, a clean build $r2)"; fi
 
-echo -n "inlined-alloc, -Zmir-opt-level=3 with debuginfo, a duplicated generic fn, incremental vs clean: "
+echo -n "inlined-alloc, -Zmir-opt-level=3, a generic fn duplicated, incremental vs clean: "
 mkdir -p "$d/ia"
-printf 'pub fn first_n<const N: usize>(v: &[u8]) -> Option<[u8; N]> {\n    v.get(..N)?.try_into().ok()\n}\n' > "$d/ia/lib.rs"
-iaf="--edition 2021 --crate-type lib --crate-name x --emit=metadata,link -Zmir-opt-level=3 -Cdebuginfo=2"
+echo 'pub fn f<T>(v: &[T]) -> Option<&[T]> { v.get(..3) }' > "$d/ia/lib.rs"
+iaf="--edition 2021 --crate-type lib --crate-name x --emit=metadata,link -Zmir-opt-level=3"
 "$rustc" $iaf -Cincremental="$d/i13" --out-dir "$d/ia/o1" "$d/ia/lib.rs" 2> /dev/null
-printf 'pub fn first_m<const N: usize>(v: &[u8]) -> Option<[u8; N]> {\n    v.get(..N)?.try_into().ok()\n}\n' >> "$d/ia/lib.rs"
+echo 'pub fn g<T>(v: &[T]) -> Option<&[T]> { v.get(..3) }' >> "$d/ia/lib.rs"
 "$rustc" $iaf -Cincremental="$d/i13" --out-dir "$d/ia/o1" "$d/ia/lib.rs" 2> /dev/null
 "$rustc" $iaf -Cincremental="$d/i14" --out-dir "$d/ia/o2" "$d/ia/lib.rs" 2> /dev/null
 cmp -s "$d/ia/o1/libx.rmeta" "$d/ia/o2/libx.rmeta" && echo same || echo DIFFER
diff --git a/docs/hunt/upstream-alloc-reference.patch b/docs/hunt/upstream-alloc-reference.patch
new file mode 100644
index 0000000..18e44c5
--- /dev/null
+++ b/docs/hunt/upstream-alloc-reference.patch
@@ -0,0 +1,148 @@
+--- a/compiler/rustc_middle/src/mir/interpret/mod.rs
++++ b/compiler/rustc_middle/src/mir/interpret/mod.rs
+@@ -18,7 +18,7 @@
+ use rustc_data_structures::sharded::ShardedHashMap;
+ use rustc_data_structures::sync::{AtomicU64, Lock};
+ use rustc_hir::def::DefKind;
+-use rustc_hir::def_id::{DefId, LocalDefId};
++use rustc_hir::def_id::{DefId, LocalDefId, StableCrateId};
+ use rustc_macros::{StableHash, TyDecodable, TyEncodable, TypeFoldable, TypeVisitable};
+ use rustc_serialize::{Decodable, Encodable};
+ use rustc_span::bug;
+@@ -103,6 +103,11 @@
+     /// must be deduplicated again when decoded: otherwise the same allocation decoded from the
+     /// incremental cache and created afresh would get two `AllocId`s.
+     DedupAlloc,
++    /// In the incremental cache: memory decoded from another crate's metadata, by that crate's
++    /// stable id and the allocation's index there, followed by its contents. Decoding it
++    /// gives the same `AllocId` as decoding that crate's allocation, as a fresh computation
++    /// that inlined MIR from that crate would refer to.
++    Upstream,
+ }
+ 
+ pub fn specialized_encode_alloc_id<'tcx, E: TyEncoder<'tcx>>(
+@@ -115,7 +120,16 @@
+             trace!("encoding {:?} with {:#?}", alloc_id, alloc);
+             let deduplicated = tcx.alloc_map.dedup.lock().get(&(GlobalAlloc::Memory(alloc), CTFE_ALLOC_SALT))
+                 == Some(&alloc_id);
+-            if deduplicated {
++            let upstream = if E::CLEAR_CROSS_CRATE {
++                None
++            } else {
++                tcx.alloc_map.upstream_of.lock().get(&alloc_id).copied()
++            };
++            if let Some((krate, index)) = upstream {
++                AllocDiscriminant::Upstream.encode(encoder);
++                krate.encode(encoder);
++                index.encode(encoder);
++            } else if deduplicated {
+                 AllocDiscriminant::DedupAlloc.encode(encoder);
+             } else {
+                 AllocDiscriminant::Alloc.encode(encoder);
+@@ -161,6 +175,9 @@
+     decoding_state: Vec<Lock<State>>,
+     // The offsets of each allocation in the data stream.
+     data_offsets: Vec<u64>,
++    // For a crate's metadata, the crate's stable id: its allocations are recorded by it and
++    // their index, so that the incremental cache can refer to them.
++    upstream: Option<StableCrateId>,
+ }
+ 
+ impl AllocDecodingState {
+@@ -173,7 +190,12 @@
+         let decoding_state =
+             std::iter::repeat_with(|| Lock::new(State::Empty)).take(data_offsets.len()).collect();
+ 
+-        Self { decoding_state, data_offsets }
++        Self { decoding_state, data_offsets, upstream: None }
++    }
++
++    /// The decoding state for the allocations in `krate`'s metadata.
++    pub fn new_upstream(data_offsets: Vec<u64>, krate: StableCrateId) -> Self {
++        Self { upstream: Some(krate), ..Self::new(data_offsets) }
+     }
+ }
+ 
+@@ -224,7 +246,30 @@
+                 trace!("creating memory alloc ID");
+                 let alloc = <ConstAllocation<'tcx> as Decodable<_>>::decode(decoder);
+                 trace!("decoded alloc {:?}", alloc);
+-                decoder.interner().reserve_and_set_memory_alloc(alloc)
++                let tcx = decoder.interner();
++                // An allocation of a crate's metadata that the incremental cache already
++                // decoded, by reference, gets the same `AllocId` if its contents agree.
++                let known = self.state.upstream.and_then(|krate| {
++                    let id = *tcx.alloc_map.upstream.lock().get(&(krate, idx as u32))?;
++                    (tcx.try_get_global_alloc(id) == Some(GlobalAlloc::Memory(alloc))).then_some(id)
++                });
++                known.unwrap_or_else(|| tcx.reserve_and_set_memory_alloc(alloc))
++            }
++            AllocDiscriminant::Upstream => {
++                trace!("creating memory alloc ID from another crate's metadata");
++                let krate = StableCrateId::decode(decoder);
++                let index = u32::decode(decoder);
++                let alloc = <ConstAllocation<'tcx> as Decodable<_>>::decode(decoder);
++                let tcx = decoder.interner();
++                let known = tcx.alloc_map.upstream.lock().get(&(krate, index)).copied().filter(
++                    |&id| tcx.try_get_global_alloc(id) == Some(GlobalAlloc::Memory(alloc)),
++                );
++                known.unwrap_or_else(|| {
++                    let id = tcx.reserve_and_set_memory_alloc(alloc);
++                    tcx.alloc_map.upstream.lock().insert((krate, index), id);
++                    tcx.alloc_map.upstream_of.lock().insert(id, (krate, index));
++                    id
++                })
+             }
+             AllocDiscriminant::DedupAlloc => {
+                 trace!("creating deduplicated memory alloc ID");
+@@ -259,6 +304,14 @@
+             }
+         });
+ 
++        if let Some(krate) = self.state.upstream
++            && let Some(GlobalAlloc::Memory(_)) = decoder.interner().try_get_global_alloc(alloc_id)
++        {
++            let tcx = decoder.interner();
++            tcx.alloc_map.upstream.lock().entry((krate, idx as u32)).or_insert(alloc_id);
++            tcx.alloc_map.upstream_of.lock().entry(alloc_id).or_insert((krate, idx as u32));
++        }
++
+         *entry = State::Done(alloc_id);
+ 
+         alloc_id
+@@ -442,6 +495,11 @@
+     /// the actual guarantees.
+     dedup: Lock<FxHashMap<(GlobalAlloc<'tcx>, usize), AllocId>>,
+ 
++    /// Memory decoded from another crate's metadata, by that crate's stable id and the
++    /// allocation's index there, in both directions (see `AllocDiscriminant::Upstream`).
++    upstream: Lock<FxHashMap<(StableCrateId, u32), AllocId>>,
++    upstream_of: Lock<FxHashMap<AllocId, (StableCrateId, u32)>>,
++
+     /// The `AllocId` to assign to the next requested ID.
+     /// Always incremented; never gets smaller.
+     next_id: AtomicU64,
+@@ -452,6 +510,8 @@
+         AllocMap {
+             to_alloc: Default::default(),
+             dedup: Default::default(),
++            upstream: Default::default(),
++            upstream_of: Default::default(),
+             next_id: AtomicU64::new(1),
+         }
+     }
+--- a/compiler/rustc_metadata/src/rmeta/decoder.rs
++++ b/compiler/rustc_metadata/src/rmeta/decoder.rs
+@@ -1969,8 +1969,10 @@
+             .decode(&blob)
+             .map(|trait_impls| (trait_impls.trait_id, trait_impls.impls))
+             .collect();
+-        let alloc_decoding_state =
+-            AllocDecodingState::new(root.interpret_alloc_index.decode(&blob).collect());
++        let alloc_decoding_state = AllocDecodingState::new_upstream(
++            root.interpret_alloc_index.decode(&blob).collect(),
++            root.stable_crate_id,
++        );
+ 
+         // Pre-decode the DefPathHash->DefIndex table. This is a cheap operation
+         // that does not copy any data. It just does some data verification.
diff --git a/docs/props.md b/docs/props.md
new file mode 100644
index 0000000..6cd5d2f
--- /dev/null
+++ b/docs/props.md
@@ -0,0 +1,81 @@
+# More properties on the same corpus
+
+The fixtures, the fuzzer and the ten replayed crates can check more than incremental against
+clean. Three properties from [the survey](properties.md), each a flag or two on the same
+builds, all on the compiler with the three fixes and the reuse check
+(`~/mirth-work/rustc-verify5`). Scripts in `~/mirth-work/props/`.
+
+## MIR validation at every optimization level
+
+`fixtures/sink` and the ten crates at their latest commits, all targets, clean builds with
+`-Zvalidate-mir` at `-Zmir-opt-level=0` to `4`, each with `-Copt-level=0` and `3`: 110 builds.
+None failed validation or crashed. (`-Zvalidate-mir` is untracked, so these are not
+incremental builds: a reused body would not be validated again.)
+
+The fuzzer with `-Zvalidate-mir -Zmir-opt-level=4` on `fixtures/sink` (520 edits) did not
+fail validation either, but it found [finding 8](hunt.md): at `-Zmir-opt-level=3` and above,
+an incremental rebuild encodes an allocation from MIR inlined from `core` twice. Every
+difference of that run that was replayed (four) goes away with `-Zinline-mir=no`.
+
+## The same tests at `-Copt-level=0` and `-Copt-level=3`
+
+Each crate's test suite at both levels, with debug assertions and overflow checks on for both,
+so that only optimization differs. A test whose result differs would be a candidate
+miscompilation.
+
+| crate | tests | differ |
+|---|---:|---:|
+| anyhow | 69 | 0 |
+| bitflags | 80 | 0 |
+| hashbrown | 114 | 0 |
+| indexmap | 192 | 0 |
+| itertools | 371 | 0 |
+| memchr | 167 | 0 |
+| regex | 698 | 0 |
+| smallvec | 82 | 0 |
+| serde | 399 | 0 |
+| thiserror | 67 | 0 |
+
+2,239 tests, none differing; `fixtures/sink`'s 60 runtime checks pass at both levels with
+identical output. (Doctests fail at both levels alike: Cargo runs the toolchain's `rustdoc`,
+which cannot find the crates the instrumented compiler built, `error[E0463]`. So do the
+`trybuild` compile-fail suites, which compare diagnostics with recorded text.)
+
+## The old and new trait solvers
+
+Every crate, all targets, compiles with and without `-Znext-solver=globally`, with no errors
+either way. Comparing the metadata is not meaningful as done here: the flag changes Cargo's
+hashes, so each file differs in its name and crate hash.
+
+The behaviour is compared instead: each crate's tests under the new solver, at
+`-Copt-level=0` with debug assertions, against the old solver's results from the run above.
+All 2,239 tests give the same result, and the failures that come from the setup (doctests,
+compile-fail suites) are the same errors the same number of times under both solvers.
+
+## Threads
+
+With [`hunt/threads-def-order-stopgap.patch`](hunt/threads-def-order-stopgap.patch) working
+around #162202, the fuzzer on the unmodified `fixtures/sink` with `-Zthreads=8` compared 644
+incremental rebuilds with clean builds and found no difference.
+
+## More flags through the fuzzer
+
+`fixtures/sink` (with `sink_core::extras`), two workers, 60 edits each, every check on, one
+run per flag set: about 100 rebuilds compared with clean builds each.
+
+| flags | result |
+|---|---|
+| `-Copt-level=1`; `=2`; `=3 -Ccodegen-units=1` | nothing |
+| `-Cdebuginfo=0`; `-Copt-level=2 -Cdebuginfo=line-tables-only` | nothing |
+| `-Zinline-mir=yes` | nothing |
+| `-Copt-level=2 -Zinline-mir=yes -Zinline-mir-threshold=200` | no difference in output, but the reuse check's sharing report of finding 8 (19 times): the same lost sharing, here not reaching the metadata |
+| `-Zcross-crate-inline-threshold=always`; `-Zshare-generics=no`; `-Cprefer-dynamic` | nothing |
+| `-Cpanic=abort -Copt-level=2`; `-Ctarget-cpu=native`; `-Ctarget-feature=+avx2,+bmi2` | nothing |
+| `-Cforce-frame-pointers=yes`; `-Coverflow-checks=off -Cdebug-assertions=off` | nothing |
+| `-Zmir-opt-level=2`; `-Csymbol-mangling-version=v0` | nothing |
+| `-Ccodegen-units=2`; `=64` | nothing (two codegen-unit reports, the known end-of-file pattern) |
+| `-Crelocation-model=static` | does not link the fixture's dylib and proc macro: not tested |
+
+So the two flags that found bugs earlier (`-Copt-level=2` before the debuginfo stopgap, and
+`-Zmir-opt-level=4`) were the productive ones; with findings 6 and 8 accounted for, the other
+common flags find nothing more on this fixture.
diff --git a/docs/scale.md b/docs/scale.md
index b1b635e..15ae618 100644
--- a/docs/scale.md
+++ b/docs/scale.md
@@ -111,7 +111,13 @@ directory without `CACHEDIR.TAG`.
 - `sink-mid`, using all three kinds of proc macro and the exported macros, with nested
   modules and restricted visibility, re-exports, and generic code dependents instantiate;
 - `sink-dy`, built as a dylib too;
-- `sink`, a binary that exercises everything and checks 60 results, so a miscompile fails.
+- `sink`, a binary that exercises everything and checks 66 results, so a miscompile fails.
+
+Later, `sink_core::extras` added what the edit fuzzer cannot create on its own: statics
+holding references and nested allocations, `include_str!`/`include_bytes!`, a `#[path]`
+module, `#[no_mangle]` and `#[used]`, `cfg_attr`, `Any`, a glob re-export, an exported macro
+using `$crate`, a proc macro with a `mixed_site` binding, and a generic `#[inline]` function
+that `sink-mid` inlines from the metadata.
 
 `rustc/fuzz.py --rustc <rustc> --fixture fixtures/sink --work <dir> [--workers N]`
 
diff --git a/docs/untracked-reads.md b/docs/untracked-reads.md
index 7a97a40..b39f44b 100644
--- a/docs/untracked-reads.md
+++ b/docs/untracked-reads.md
@@ -93,6 +93,23 @@ Environment variables and files are read almost only before the first query (opt
 parsing, crate loading) or while linking, which happens again on every build; the few
 exceptions (a manifest for GPU offload, the Apple deployment target) were not hooked.
 
+## Top-level options and other session state
+
+The `Options` struct's own untracked fields (`--extern`, `-L`, the sysroot, `-Z threads` as
+`jobs`, the diagnostic width and others) get the same accessors, and 80 reads were rewritten
+to them; reads of a proc macro's quoted spans are reported too. Over `fixtures/sink` and the
+ten crates, built normally and with `-Zthreads=4`, inside reusable tasks:
+
+| read | where | verdict |
+|---|---|---|
+| `jobs` | the query system, in every query | benign: decides whether to check the cache before starting a query on a parallel front end |
+| `incremental` | MIR inlining, cross-crate inlinability, partitioning, metadata | benign: only whether incremental compilation is on, which cannot change between two incremental sessions |
+| `cli_forced_codegen_units`, `cli_forced_local_thinlto_off` | the number of codegen units | benign: partitioning is redone every session (and changing `-C codegen-units` gave the same output in the option audit) |
+| proc macro quoted spans | `Metadata` | covered: positions in the proc-macro crate's own files, which the source-file fingerprint of the stale-metadata fix tracks |
+
+Nothing new. The compiler patches are kept locally (`~/mirth-work/patches`), not in this
+repository: they are LLM-generated test instruments, not meant for contribution.
+
 ## Source text
 
 Spans are tracked by position, not by the text they cover. `SourceMap::span_to_source`, under
diff --git a/fixtures/sink/core/src/extras.rs b/fixtures/sink/core/src/extras.rs
new file mode 100644
index 0000000..7501e4f
--- /dev/null
+++ b/fixtures/sink/core/src/extras.rs
@@ -0,0 +1,51 @@
+//! What the edit fuzzer cannot create on its own: statics holding references and nested
+//! allocations, included files, a `#[path]` module, linkage attributes, `Any`, `cfg_attr`,
+//! and a generic `#[inline]` function whose MIR dependents inline from the metadata.
+
+use core::any::Any;
+
+#[path = "extras_inner.rs"]
+pub mod inner;
+
+pub static WORDS: &[&str] = &["alpha", "beta", "gamma"];
+pub static NESTED: &[&[u8]] = &[b"ab", b"cde", &[1, 2, 3]];
+pub const TABLE: &[(u8, &str)] = &[(1, "one"), (2, "two")];
+pub static DATA: &str = include_str!("extras.txt");
+pub static BYTES: &[u8] = include_bytes!("extras.txt");
+
+#[unsafe(no_mangle)]
+pub extern "C" fn sink_extras_add(a: u32, b: u32) -> u32 {
+    a.wrapping_add(b)
+}
+
+#[used]
+static KEEP: [u8; 4] = *b"sink";
+
+#[cfg_attr(feature = "extra", inline)]
+pub fn lookup(n: u8) -> Option<&'static str> {
+    TABLE.iter().find(|(k, _)| *k == n).map(|(_, v)| *v)
+}
+
+pub fn kind(x: &dyn Any) -> &'static str {
+    if x.is::<u32>() {
+        "u32"
+    } else if x.is::<&str>() {
+        "str"
+    } else {
+        "other"
+    }
+}
+
+/// Generic and inlined across crates: dependents read its MIR from the metadata.
+#[inline]
+pub fn window<T: Copy>(v: &[T], n: usize) -> Option<&[T]> {
+    v.get(..n)
+}
+
+/// Exported, and refers back to this crate through `$crate`.
+#[macro_export]
+macro_rules! words_len {
+    () => {
+        $crate::extras::WORDS.len()
+    };
+}
diff --git a/fixtures/sink/core/src/extras.txt b/fixtures/sink/core/src/extras.txt
new file mode 100644
index 0000000..3189ded
--- /dev/null
+++ b/fixtures/sink/core/src/extras.txt
@@ -0,0 +1 @@
+included text
diff --git a/fixtures/sink/core/src/extras_inner.rs b/fixtures/sink/core/src/extras_inner.rs
new file mode 100644
index 0000000..e7d9d4c
--- /dev/null
+++ b/fixtures/sink/core/src/extras_inner.rs
@@ -0,0 +1,7 @@
+//! A module found through `#[path]`.
+
+pub fn twice(x: u32) -> u32 {
+    x * 2
+}
+
+pub use super::lookup as find;
diff --git a/fixtures/sink/core/src/lib.rs b/fixtures/sink/core/src/lib.rs
index e0cf785..f97bef7 100644
--- a/fixtures/sink/core/src/lib.rs
+++ b/fixtures/sink/core/src/lib.rs
@@ -9,12 +9,14 @@ pub mod algo;
 pub mod asyncs;
 pub mod consts;
 pub mod errors;
+pub mod extras;
 pub mod memory;
 pub mod shapes;
 #[macro_use]
 mod macros;
 
 pub use shapes::{Area, Circle, Shape, Square};
+pub use extras::inner::*;
 
 include!(concat!(env!("OUT_DIR"), "/generated.rs"));
 
diff --git a/fixtures/sink/macros/src/lib.rs b/fixtures/sink/macros/src/lib.rs
index 4137339..670a11b 100644
--- a/fixtures/sink/macros/src/lib.rs
+++ b/fixtures/sink/macros/src/lib.rs
@@ -78,3 +78,21 @@ pub fn squares(input: TokenStream) -> TokenStream {
     let _ = Ident::new("unused", Span::call_site());
     TokenStream::from(TokenTree::Group(group))
 }
+
+/// `plus_one!(e)` is `{ let tmp = e; tmp + 1 }`, with `tmp` at `Span::mixed_site()`, so it
+/// cannot capture or be captured by a `tmp` at the call site.
+#[proc_macro]
+pub fn plus_one(input: TokenStream) -> TokenStream {
+    let tmp = Ident::new("tmp", Span::mixed_site());
+    let mut body: Vec<TokenTree> = vec![
+        TokenTree::Ident(Ident::new("let", Span::call_site())),
+        TokenTree::Ident(tmp.clone()),
+        TokenTree::Punct(Punct::new('=', Spacing::Alone)),
+    ];
+    body.extend(input);
+    body.push(TokenTree::Punct(Punct::new(';', Spacing::Alone)));
+    body.push(TokenTree::Ident(tmp));
+    body.push(TokenTree::Punct(Punct::new('+', Spacing::Alone)));
+    body.push(TokenTree::Literal(Literal::u32_unsuffixed(1)));
+    TokenTree::Group(Group::new(Delimiter::Brace, body.into_iter().collect())).into()
+}
diff --git a/fixtures/sink/mid/src/lib.rs b/fixtures/sink/mid/src/lib.rs
index beade37..d56a106 100644
--- a/fixtures/sink/mid/src/lib.rs
+++ b/fixtures/sink/mid/src/lib.rs
@@ -113,3 +113,17 @@ pub fn labels(squares: &[Square]) -> Vec<String> {
 pub fn colours() -> Vec<(&'static str, &'static str)> {
     [Colour::Red, Colour::Green, Colour::Blue].iter().map(|c| (Colour::NAME, c.tag())).collect()
 }
+
+/// Inlines `sink_core::extras::window` from the metadata.
+pub fn first_two<T: Copy>(v: &[T]) -> Option<&[T]> {
+    sink_core::extras::window(v, 2)
+}
+
+pub fn words() -> usize {
+    sink_core::words_len!()
+}
+
+/// A `mixed_site` binding from a function-like proc macro.
+pub fn hygienic(x: u32) -> u32 {
+    sink_macros::plus_one!(x)
+}
diff --git a/fixtures/sink/src/main.rs b/fixtures/sink/src/main.rs
index 3da1c57..a20086e 100644
--- a/fixtures/sink/src/main.rs
+++ b/fixtures/sink/src/main.rs
@@ -28,6 +28,12 @@ fn main() {
     check("index", V2 { x: 3.0, y: 4.0 }[1] == 4.0);
     check("gat", vec![1, 2, 3].first_matching(|x| **x > 1) == Some(&2));
     check("rpitit", sink_mid::labels(&[sq]) == vec!["square 2".to_string()]);
+    check("statics", sink_core::extras::WORDS[1] == "beta" && sink_core::extras::NESTED[2] == [1, 2, 3]);
+    check("include", sink_core::extras::DATA.trim() == "included text" && sink_core::extras::BYTES.len() == 14);
+    check("no_mangle", sink_core::extras::sink_extras_add(2, 3) == 5);
+    check("path mod", sink_core::extras::inner::twice(4) == 8 && sink_core::find(2) == Some("two"));
+    check("any", sink_core::extras::kind(&5u32) == "u32" && sink_core::extras::kind(&"x") == "str");
+    check("inline across crates", sink_mid::first_two(&[1, 2, 3]) == Some(&[1, 2][..]) && sink_mid::words() == 3 && sink_mid::hygienic(4) == 5);
     check("hrtb", shapes::apply_to_all(&["ab".into(), "cde".into()], |s| s.trim()) == vec![2, 3]);
 
     check("pipeline", algo::Pipeline::new().then(|x: i32| x + 1).then(|x| x * 10).run(1) == 20);
diff --git a/rustc/fuzz.py b/rustc/fuzz.py
index 3b2fe25..332058c 100755
--- a/rustc/fuzz.py
+++ b/rustc/fuzz.py
@@ -60,6 +60,7 @@
 p.add_argument("--timeout", type=int, default=180, help="seconds before a build counts as hung")
 p.add_argument("--p5-builds", type=int, default=1,
                help="clean builds made again when anything differs, to tell nondeterminism from P6")
+p.add_argument("--min-free-gb", type=int, default=20, help="stop when the disk has less free")
 p.add_argument("--check", action="store_true",
                help="cargo check instead of cargo build: metadata only, no code or binaries")
 p.add_argument("--no-verify-reuse", action="store_true",
@@ -435,6 +436,9 @@ def report(kind, detail, inc, clean, extra=None):
         return stats
     started = time.time()
     while stats["edits"] < args.edits and not (WORK / "STOP").exists():
+        if shutil.disk_usage(WORK).free < args.min_free_gb * 2**30:
+            print(f"worker {k}: less than {args.min_free_gb} GB free, stopping", flush=True)
+            break
         if len([h for h in history if h["kept"]]) >= args.reset and not reset():
             break
         n = stats["edits"]
diff --git a/rustc/regen-patches.sh b/rustc/regen-patches.sh
index 7cb1409..3f02646 100755
--- a/rustc/regen-patches.sh
+++ b/rustc/regen-patches.sh
@@ -2,7 +2,7 @@
 # Regenerate docs/hunt/{verify-reuse,report-untracked}.patch from ~/mirth-work/rust, which has
 # applied: verify-reuse, the three fixes, report-untracked, and the two stopgaps.
 set -e
-H=$HOME/mirth/docs/hunt; RUST=$HOME/mirth-work/rust; T=$CLAUDE_JOB_DIR/tmp/regen
+H=$HOME/mirth-work/patches; RUST=$HOME/mirth-work/rust; T=$CLAUDE_JOB_DIR/tmp/regen
 cd $RUST; git worktree remove --force $T 2>/dev/null || true; git worktree prune
 V="compiler/rustc_codegen_llvm/src/back/llvm_backend.rs compiler/rustc_codegen_llvm/src/base.rs compiler/rustc_codegen_llvm/src/llvm/ffi.rs compiler/rustc_codegen_ssa/src/base.rs compiler/rustc_codegen_ssa/src/traits/backend.rs compiler/rustc_incremental/src/persist/save.rs compiler/rustc_metadata/src/rmeta/encoder.rs compiler/rustc_middle/src/hooks.rs compiler/rustc_middle/src/query/on_disk_cache.rs compiler/rustc_query_impl/src/incremental.rs compiler/rustc_query_impl/src/lib.rs"
 # 1. the reuse check alone, relative to the pinned commit