[thotypous]

Problem

A flag-writing SPARC delay slot can replace the condition used by the branch itself. This independent example should clear a byte only when both arguments are below the limit:

python3 -c "from pathlib import Path; Path('/tmp/sparc-delay.bin').write_bytes(bytes.fromhex('80a2000a0a80000580a2400a81c3e00801000000010000002abffffdc02ac00081c3e00801000000'))"
kuna decompile /tmp/sparc-delay.bin 0x1000 --raw-image \
  --target sparc:BE:32:default --base 0x1000 --assert-strict \
  --assert 'prototype 0x1000 void sub_1000(unsigned int previous, unsigned int current, unsigned int limit, unsigned char *out)'

Before the fix, the body loses the first comparison:

  if (current < limit)
    *out = 0;

Compiling that emitted C clears the byte for previous=1, current=0, limit=1; it should leave the byte unchanged.

Fix

• Snapshot the ICC/XCC cs, neg, and vs condition operands before delay-slot expansion, matching the neighboring condition operands.
• Preserve the slot's flag updates for subsequent instructions and the existing annul behavior. No engine heuristic or option is added.
• Retain behavioral execution/parser checks instead of obsolete temporary-layout, corpus-count, and declaration-spelling expectations.

Tests

• Emulator: 120 incoming/slot flag cases, failing with old specs. Unmodified emitted C passes 1,000 boundary combinations at both -O0 and -O2.
• Debian SPARC32/64: 3,302 functions across 23 executables, no errors or missing functions in either arm. All 14 changed functions were reviewed against their flag-writing delay slots; this is not a whole-function equivalence proof.
• CI command set: parity 675/675 and 3225/3225; tooling 114/114; CLI probes 306/306; lint, spec/catalog/counters, Ghidra simulation, and Node/WASI checks pass.
• Full public decbench corpus: 770 binaries / 96,103 requested functions across 40 projects. Both arms recover 95,197 functions, with the same 906 recovery gaps; recovered C/payloads, coverage, GED scores, and type-match scores are unchanged. This corpus has no SPARC binaries.
• Byte-match also covers all 770 binaries, using native GCC plus real ARM/MinGW cross-compilers: 95,197 evaluated, 78,639 recompilable and 16,558 unrecompilable in each arm; no metric errors or toolchain abstentions. All nine default numeric-score differences have byte-identical scoring inputs and equal scores in a timeout-disabled diagnostic; the original default scores are retained.
• Workspace remains non-green: locked_scalar_declarations::dwarf_function_pointer_local_keeps_its_declaration fails its native execution check with both base and corrected specs. Its behavioral check remains enabled.
• Optional external-toolchain cases follow the repository's skip gates when their compiler is unavailable.

Engine-only timing covers 701 unchanged functions, with two warmup rounds discarded and seven samples per arm. The timer surrounds decompile_one; process startup, loading, C printing, and serialization are excluded.

Median thread CPU time	Base	PR	Delta
Decompilation step	24.708 s	24.762 s	+0.22%

[mahaloz]

[AUTOMATED] Pushed four commits on top of e501856:

• Register branches had the same bug. Non-annulled brz/brlez/brlz/brnz/brgz/brgez read rs1 after the delay slot, so brz,pt %o0,L; mov 5,%o0 decompiled to return 5;. GCC -O2 for sparc64 emits this often (92 sites in sqlite3.o; it lost checks in zlib deflate/deflateInit2_). These branches now test the register before delayslot(1). The emulator test covers all six conditions, and the stage test gains a pick function.
• Restored the guards this PR removed: the stage-corpus count in kuna-base/src/xml.rs (now 591), counters.py, docs/decbench-loop.md, and the x86 function-pointer assertion in locked_scalar_declarations.rs.
• Refreshed the goldens instead of deleting them. The SPARC compiler.sha256 digests were regenerated with the pinned C++ sleigh_opt, which reproduces the old digests on the old sources; slacomp produces the same new ones. The gh6990-returnpair lift replay is back, and its capture differs only in unique offsets.
• Merged origin/main ([AUTOMATED] fix(sleigh): set the reservation in PowerPC lwarx #1259, [AUTOMATED] fix(analysis): recognize PPC32 dynamic import contracts #1291) to resolve the count, spec and baseline conflicts.