[k-yoshimi]

Fixes the pre-existing read past the FPCOMM profile arrays in fp_get_state reported in #245 (found by the Codex review of #242).

Problem

RNT/RWT/RTT/RJT/RPCT/RPWT keep the extents of the last fp_prep (fp_allocate_ntg2 in fp/fpcomm.f90), while NRMAX / NSAMAX are the current namelist values. fp_set_param on either count clears g_prepared without reallocating, so between that call and the next fp_run, fp_get_state copied nsa = 1..NSAMAX, nr = 1..NRMAX out of smaller arrays. The library is built with -O3 and no run-time checks, so the read was silent garbage (an abort under -fcheck=all). #242's early refusal in fp_run added one more way to be left in that window.

Fix (option a of the issue)

fp_get_state copies MIN(NRMAX, SIZE(RNT,1)) x MIN(NSAMAX, SIZE(RNT,2)) (and ntg_last bounded by SIZE(RNT,3)) and reports the copied extents in state%nrmax / state%nsamax, so the [nsamax][nrmax] slice is always data that exists: a lowered count truncates the snapshot at once, a raised one stays capped at the old allocation until the next run. Unchanged: the pre-first-run path (nothing allocated: namelist counts, zero profiles) and the rc=3 refusal above FP_MAX_NRMAX. The C ABI layout is unchanged; no consumer (fplib/state.py, fp_mcp, totlib/pipeline.py, extract_fp_metrics.py, fpregress.f90) indexes beyond the reported counts.

Tests

python/fplib/tests/test_state_extents.py (9 cases, one per case, no subTest): NSAMAX / NRMAX raised without a run (the two reads past the arrays), NRMAX / NSAMAX lowered, NRMAX raised then run (the bound follows the reallocation), NRMAX above the cap still rc=3, fp_run(0), a second handle in the same process reading before its first run (per-process arrays, counts reset by fp_init: a 1 x 1 slice of the old data), and the pre-first-run snapshot; all six profile arrays are checked. The assertions are on the reported extents and copied values, so they hold with or without bounds checking.

Verified once with fp_api.o compiled with DFLAGS (-fcheck=all): develop's fp_api.f90 fails the two raised-count cases, this branch passes. Local run with the CI flags (--forked --timeout=120 --timeout-method=signal): fplib + fp_mcp + totlib = 278 passed, 1 pre-existing macOS/py3.10 failure (ExceptionGroup), 18 pre-existing skips.

Docs

docs/fp-library/architecture.md (the "do not call fp_get_state in that window" note from #242 replaced by the new contract, incl. the per-process allocation), docs/sphinx/modules/fp/{en,ja}/state.md.

Review

In-house review + Codex (codex-rescue) + ai-review-cycle Codex pass on the diff: no HIGH; one MED (docs named a nonexistent fp_get_param) and the wording LOWs are fixed in this commit; the extra test cases they asked for are included.

Note for #233: its insertion after the profile loop should merge cleanly (pure insertion, 8 unchanged lines below the last changed line); its own P*T loops already bound by SIZE, which is the pattern this PR adopts for the profiles.

Refs: #245, #242, #233, #143.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TA2KahTs3qLMZL6yjSsWwT

---

Note

Medium Risk
Changes C ABI snapshot semantics for fp_get_state when mesh/species counts disagree with allocation; callers that assumed nrmax/nsamax always matched namelist values could misread results, though the fix prevents silent OOB reads.

Overview
Fixes fp_get_state reading past allocated FPCOMM profile arrays when NRMAX or NSAMAX change via fp_set_param before the next fp_run (#245). The copy loops now use MIN(current count, allocated SIZE) on each axis, set state.nrmax / state.nsamax to the copied extents, and cap the time index the same way—so returned [nsamax][nrmax] data is always in-bounds (truncate on lower counts, cap on raised counts until reallocation).

Unchanged behavior is documented and tested: pre-first-run namelist counts with zero profiles, rc=3 above FP_MAX_NRMAX, and per-process array lifetime (second handle may see a truncated slice of prior data). Docs in architecture.md and Sphinx state.md (EN/JA) replace the old “do not call fp_get_state in that window” note with this contract. New python/fplib/tests/test_state_extents.py covers raised/lowered counts, post-run reallocation, zero-step run, and edge cases.

^{Reviewed by Cursor Bugbot for commit f7d8c2d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[k-yoshimi]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f7d8c2d. Configure here.}

[cursor]

Pre-run state test depends on order

Medium Severity

test_before_first_run_reports_namelist_counts_and_zeros expects namelist NRMAX and all-zero profiles, which holds only while RNT is unallocated. fp_finalize keeps those arrays, and earlier tests in this module allocate them. In pytest's default single-process order the snapshot is the previous run's leading slice, so the extent and zero checks fail. --forked hides that.

 

^{Reviewed by Cursor Bugbot for commit f7d8c2d. Configure here.}