plans: tie native memory rulings to resumable roadmap milestones

[briansrls]

Why

Memory work will be intermittent. The direction and settled decisions need to survive a pause and point to actual work with a bounded exit. The revised analysis still had calendar estimates, referred to a D15 that did not exist, and was disconnected from the roadmap; this PR summary also still advertised the discarded year-long program.

What changes

• Add D15 to the existing gunbc.plans.demand_engine_program authority. Preserve settled R2, R5, scoped R4/R3 and practical R1, and attach open R6–R12 only to the cuts that need them.

• Add five primary outcome milestones under demand-engine, each carrying an outcome, acceptance control, next slice, dated state and stopping point. The bounded census follow-up tasks are listed below:

  Roadmap member	Bounded outcome
  native-memory-parse	Land Price the parse memo below the cost floor: the production door admits no store #13577 → Delete the v2 packrat parse memo carrier (R2, stacked on #13577) #13582, retaining the discriminating terminal/occurrence/span regression.
  native-memory-envelope	Native mains enforce one shared execution/retention grant, with typed refusal and measured overhead. Select the exact must-complete workload first.
  native-memory-cli-retention	Remove one unnecessary retained population while preserving the total census and required declaration, diagnostic and provenance information.
  native-memory-driver-retention	Close every reader of one selected payload family and demonstrate actual backing-storage release.
  native-memory-useful-run	One named native workload completes successfully within 1 GiB under default policy, with reuse and pressure and no local capacity bypass.

• Record only the established new prerequisite: useful run → envelope. Add a retention dependency when the selected workload demonstrates it. Independent accounting and dead-data release do not wait for the full M1.b–M5 sequence.

• Replace calendar commitments with handbacks: landed revision, bounded evidence, remaining uncertainty and the next concrete action. Additional tiers, identities and value-grain work retain evidence triggers and existing program ownership.

• No separate plan document (operator direction, and the 2026-10-07 plans bankruptcy in Bankrupt docs/plans: delete hand-written plans, keep DESIGN-linked and generated ones #13550). Planning items live only in the roadmap members; design detail lives in D15, which now also carries the design constraints the analysis established and the deferred full-program target with its home authorities. The dated measurements are this description's receipt (below). Dangling phase references are removed, and the parked P8 recommendation to thread the parse memo is retired.

• Regenerate docs/plans/demand-engine-program.md and ROADMAP.md from their source authorities. No runtime behavior changes.

Census follow-up — current handback, 2026-10-09

Reviewed the consolidated census against main 2a519d27f6f77db2a20696a2ffc4f540dbd88f40. Compile-stage memo deletion is now explicitly ruled under D15/R2. Four bounded tasks and seven existing-owner notes preserve the implementation handback:

Task	Next bounded action
native-memory-demand-nature	#13611, ca19fc47: CI green; two Running-state conflict interactions still need correction. Repeated-Fresh execution stays a separate open cut.
seed-pure-call-binding	#13614, 6367a862: reproduced on main, withdrawn in the PR, runtime review sound. Finish the remaining plan-text correction and final CI; keep the retained eval-frame memo with its existing owner.
native-memory-inert-carriers	#13615, 0b92d40e: bounded deletion reviewed and approved, including the now-unused admission door. Preserve live consumers and surviving ladder rules; qualify the final main-based head after #13577 → #13582.
native-memory-preparation	One producer per cut: carry prepared grammar/target/entry facts and delete the redundant construction or growing memo without widening demanded scope or changing refusal/row order.

Corrections retained in the owner notes:

• Orchestration prepared rows are live. The floor reach memo already performs one closure walk per entry, and formal-production recursion already carries its index internally; target the remaining repeated preparation boundaries.
• The live-read G2 initializer defect remains, but no manifest/touched_by consumer was found on the current required-floor route. Repair or refuse incomplete selection before any reactivation.
• The effective seed build-cache path includes resolved toolchain, admitted environment values and Cargo configuration before marker lookup. Unrealized names the missing v2-owned process realization. Uncapped/manual disk retention and absent warm-content verification remain separate debt.
• Frozen cross-claim producer/input populations retain M1.b/M5 ownership. Typecheck store work stays with C2: typecheck materialization through the local store #13482/store: held-session op + O(1) named hold-slot reads #13569.

Validation for this follow-up: source review and independent scope reviews; both complete baseline projections matched byte-for-byte before source-derived regeneration; existing criteria, acceptance records and all dependency edges are preserved; git diff --check passes. No runtime counterexample, compiler, floor or native-cache test was executed in this workspace. The four tasks remain unaccepted and not dispatch-ready; there is no runtime code change or new dependency edge.

Review handback — 2026-10-09

The three implementation PRs are open and unmerged. Their exact reviewed heads and remaining actions are now linked in the existing roadmap members. The two-file follow-up changes only roadmap_authority.dag and its generated ROADMAP.md; D15 remains the design authority.

• demand engine: a request under a different nature is a durable key conflict #13611: nature_eq and own-key conflict persistence are correct. Source review finds two defects at the existing supplied-DemandRunning test boundary: an own-key conflict releases an occupied seat before completion; conflicting an available prerequisite replaces a running dependent's state, whose completion then fails to release its seat and overwrites its prerequisite refusal. Preserve physical production ownership until completion and retain the applicable refusal. These are source-derived API traces, not observed native overcommit: no current production writer sets Running. Exact-head CI 37881800770 is green. The repeated same-key Fresh/unenveloped-WorldRead execution gap remains separately open.
• seed interpreter: withdraw the spelling-admitted, label-blind PureCallMemo #13614: keep PureCallMemo deleted. The author executed the swapped-label failure on main and the fixed pass; the three new claims retain swapped-label, unrostered-spelling and identical-repeat controls. The supplied unknown-label call is rejected by direct_call_shape_diags before execution, so the earlier accepted-source warmed-invalid-label requirement is corrected. EvalCallMemo may still serve before call_function binds, but checks stored argument labels and values first. Reconcile the remaining live-memo/content-key statements in fail_closed_lockdown_body and the PR description's broader before-binding claim. Wall-time impact remains unmeasured; no new benchmark or seed-wide purity gate is added.
• Delete unused memo and preparation carriers (native-memory-inert-carriers) #13615: keep admitted_prescription_in and its two controls deleted with their last production caller. The 32 surviving ladder claims prove the ladder's own fixture subjects; they are not represented as replacements for the deleted door controls. Actual operational consumers still owe fail-closed admission on their real paths. Source review verifies the live-data boundaries, all eight new removal rows, and the preexisting bad removal on head, parent and main. The other three differential failures and the local lane outcome remain author-reported; red5's cause is unresolved. Keep the deleted witness absent when resolving Fix every T? == T site the whole-population census found #13549.
• Landing: seed interpreter: withdraw the spelling-admitted, label-blind PureCallMemo #13614 and the nature fix are independent of the parser stack. Delete unused memo and preparation carriers (native-memory-inert-carriers) #13615 remains draft until the Price the parse memo below the cost floor: the production door admits no store #13577 → Delete the v2 packrat parse memo carrier (R2, stacked on #13577) #13582 stack is integrated and its final main-based head receives an eligible CI event; retargeting alone is not a run. No implementation milestone is marked accepted by these notes. native-memory-preparation remains one producer per PR, with an explicit pause after each bounded cut.

Validation of this roadmap edit: the entire committed baseline projection reproduced byte-for-byte before source-derived rendering; all 233 declared nodes, 15 live acceptance receipts, 138 dependency edges and derived closing tasks are unchanged. Four dated notes are appended without rewriting their history. The only criteria changes are the precise next slices/refusal controls and visible PR links described above. git diff --check passes. No compiler or runtime tests were run in this workspace.

Current parser handback

#13577 at f0e5e776 has green PR CI; it and #13582 remain unmerged at this review snapshot. #13582 is a draft stacked on it. The terminal-specific span check is committed (427b080e5d); it fails when two terminals' spans are swapped. #13582 still needs CI on its final head after the retarget to main. The extra red5 refusal also reproduced on the parent; its cause remains unresolved. Compile-stage memo work remains a separate PR and is now ruled deleted, tracked by native-memory-inert-carriers.

No must-complete 1 GiB workload or successful run is asserted by this planning change. Envelope adherence, typed refusal and useful success are separate acceptance questions.

Validation

• git diff --check passes.
• Temporary source evaluators reproduced both entire unmodified committed projections byte-for-byte before rendering the changes. The helpers remain outside the repository change.
• Roadmap checks preserve all existing acceptance receipts and derived closing tasks; the five new nodes are unaccepted and not dispatch-ready, and the only new edge is the one stated above.
• Independent source/diff review found no blocking decision-preservation or scope issue.
• Follow-up commit f314b025df: projections regenerated with a gunbc built from this branch (tools.generated_artifact_gate main_wet). The regeneration changed exactly ROADMAP.md and docs/plans/demand-engine-program.md. Roadmap witnesses were not run locally; required CI is the landing gate.

The design is in the demand-engine program (D15) and the work is in the roadmap.

Receipt: dated measurements (2026-10-08, srv2 aarch64)

D15 and native-memory-parse cite this section. The numbers are historical observations taken at main 6d82ac7721 / c48092a621, using measurement-only edits to a copy of the emitted native-CLI crate. They are re-derived by the probes listed below, not maintained here.

Parse memo on vs off (memo off = materialization_allows_memo_store returns false) over all of dag + src/v2, 7,932 files whose parse is accepted:

Observation	Memo on	Memo off
Tree-structure digest	equal on all 7,932 files	(reference)
Census refusals	2,032	134
Refused only with the memo	1,898 files, all normalize_reason_minted_occurrence_duplicated	—
Nodes resolving to a different source span	1,011,967 of 84,098,594 (1.2%), in 4,795 files	(reference)
Total parse time	1,146 s	934 s
Lookups / hits	16,491,677 / 112,337 (0.68%)	—

• Hits: 3 of 86 productions ever hit, and dag_production_pattern accounts for 112,327 of the hits.
• Concrete span case: SeamBeta in dag/test/fixture/cross_shard_seam/importee.dag (bytes 173..181) resolves to a derived parser event when the memo is on.
• Memory: body_lowering_fold.dag takes 28.0 s / 1.61 GiB with the memo and 23.9 s / 0.53 GiB without.
• Slow tail: 103 files parse more than 1.5× slower without the memo, +7 s in total. The cause is unexplained.

Native CLI cross-file retention: on root dag/extdeps (1,028 files, 8.5 MB) the peak is 4.81 GiB as is, and 1.40 GiB with no merged span index and no per-file trees. This is attribution only; that probe drops spans, so it does not preserve semantics. emit --entry std.integer over the full roots reached 15.7 GiB at a 900 s timeout with no output.

Probes:

1. Build the generation-one binary with gunbc test //gunbc/instruments:v2-native-cli.
2. Copy the emitted crate while cargo is still building, edit one site, and run cargo build --release --offline.
3. Measure each variant with /usr/bin/time -f "%e %M" <bin> emit --entry nope.x --source-root <root>. A bogus entry costs the same as a real one, because the census runs first.
4. Compare variants with per-file digests that hash the tree with and without each node's resolved span.
5. For attribution, perf record -e page-faults --call-graph dwarf placed about 60% of new heap pages under span_index_record.

🤖 Generated with Claude Code

[gunbai-bot]

Closed without folding in the v1 closeout bankruptcy (#13641). A plans-only draft; the plans bankruptcy (#13550) applies. Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604