Historical repository record migrated on 2026-10-10. Original repository path: docs/experiments/benchmarks/coupled-completion-plan.md Original SHA-256: 84053110e6fce00e2cd2743d45d2072d0d0848d36051ac114c01735fe453429f Stated outcomes, measured revisions, failures and limits remain historical. Local raw evidence is private and is not uploaded. Relative links and the data-drive prefix were normalized.

Coupled labs: completion preparation

Status: evaluated and prepared for implementation, 2026-10-07. Owner requested result evaluation and preparation to complete the experiments with elevated permissions. Previous run remains authoritative for its results. This preparation runs only resource reconciliation and documentation validation; no further native performance cell, semantic revision or qualification is represented as executed. Three standing lab PIs reviewed bounded source tasks; root owns synthesis and serial workload admission. Estimated preparation agent allowance: 1500 tokens per PI plus 1500 coordinator reserve, not measured billing.

Evaluation and disposition

Experiment	Evidence-supported conclusion	Completion action
C4 attribute cost	Rich attributes add about15.9MB requested bytes and2.27–2.41x first-page CPU; borrowing saves about4.19MB in either population. Observer admission failed.	Close the diagnostic with phase causality inconclusive. Do not repeat timing until an improved observer or independent mechanism can discriminate causes.
Q4 descriptor reuse	48 exact chains; one plain pair CPU−3.16%, counted allocations−1.06%, tiny preflight CPU worse. Initial snapshot build excluded.	Close the screen without nomination; no confirmation/adoption campaign.
O6 partial availability	Historical fixture removes a projection but asks the oracle to exclude whole records. It cannot grade surviving metadata. Raw-table loss may expose a separate product defect.	Resolve the availability model explicitly, then test and correct the relevant implementation.
O7 pruning	Exact historical whole-table ledgers with different physical groups; reported read counts are footer estimates. Soundness and complete window answers were not established.	Obtain native group identity/bounds and independent complete-query evidence before choosing a prospective acceptance criterion.
C5 workers/run bytes	Actual worker config exists; run byte cap is fixed16MiB. Existing service harness does not guarantee concurrent builders under query demand.	Implement the narrow selector and a controlled pending-journal fixture, then run feasible cells after O6/O7.
O8 collection overlap	Runtime serializes collection and delivery; no ownership-safe overlap candidate exists yet. Fixed offers alone cannot demonstrate a capacity gain.	Implement one in-flight delivery and at most one next durable Batch, verify ownership/failure transitions, then compare fixed-offer latency.

The largest new lead is attribute-associated work, not descriptor acquisition. A follow-on hypothesis is to validate every required in-window attribute map but materialize owned strings only for surviving rows. C4 does not establish that parsing is the dominant cause; this is a separate future investigation, not added to the completion queue. See query review.

Concrete decision sequence

1. Operations: availability decision and fixture. Recommend preserving independently known retained metadata when a requested projection is missing, while reporting incomplete rows. Keep the whole-record oracle behavior. Draft a separately scoped companion availability checker and fixture routing; derive expected metadata from producer input, never the native answer. Exercise Scan/Walk, all signals, complete pagination, raw/projection/gaps/Manifest loss, optional filter fallback and expired continuation. Reproduce the suspected raw-table completeness defect before fixing it. Do not introduce an expensive full raw decode/checksum per query without measuring that trade-off.
2. Operations + capacity: pruning soundness. Add a native per-group identity, min/max and actual-visit ledger, with a producer-derived independent reference. Cover equal timestamps across group boundaries, late records, large rows and empty windows with false-positive group admission. The checker must reject omitted matching groups and narrowed bounds. Preserve the historical C2 physical-equality failure. A prospective exact-answer/conservative-bound rule is recommended only if that evidence supports it; changing the registered criterion requires a separate explained trust-boundary change.
3. Capacity: controlled C5 mechanism. Add an experiment-only strict8/16/32MiB selector at bounded::build_sealed/build_with_limit, default16MiB. Keep8MiB output chunks, compression and merge ordering fixed. Prove all selected values are exercised and reject invalid values. Compare bounded variants for exact final bytes/rows, stable ties, spill cleanup and publication/reclaim behavior. The limit is a per-signal resident estimate with an oversized-row exception, not a whole-builder memory cap. Capture actual concurrent builder activity.
4. Operations: controlled O8 mechanism. Main runtime owns Spool, cursors, sequence allocation, metric history and ACK persistence. One bounded worker owns immutable request N and its sender snapshot; main can commit at most N+1 during the ACK wait. Do not send N+1 before N's outcome is processed. Retry bytes remain exact; full Spool, failed append, config/pause, worker failure, cancellation and stop/reopen need deterministic controls. Initial prototype covers logs/metrics; concurrent trace admission is outside this first screen.
5. Root: measured service screens. Freeze actual binaries, seeded bytes, commands, offered schedule, query schedule and metric definitions after those mechanisms exist. Run baseline first and verify offered demand, real sealing, containment and evidence growth. Admit subsequent cells from measured costs. Record nulls and failed bounds as results; no requirement to discover a winner.

Detailed ownership/source/test maps: operations, capacity, query. The larger450s/cell capacity proposal is a planning alternative: the smaller coordinator allocation below takes precedence until measured preflight permits it.

Completion run budget and profiles

After readiness audit01, recorded frontier use is9725.213723/14400seconds, leaving4674.786277seconds before documentation validation. No clock or resource budget was reset by elevated permissions. Proposed bounded allocation:

Work	Maximum recorded seconds	Stage
O6/O7 fixtures, diagnostics and regression	800	recovery/verification as appropriate
C5 build controls and frozen binaries	300	preparation/verification
C5 no-query control, four query grid cells, one32MiB holdout	1800 total;300/cell	capacity
O8 ownership controls, build and dev/small baseline-candidate screen	900 total	recovery/preparation
Final checks, reconciliation and failure reserve	600	verification/preparation
Total	4400	existing frontier only

These are prospective ceilings, not six invented executable commands or a promise that all cells fit. Full requested deadline must fit the actual remaining stage allowance before dispatch; observed failure/archive growth can stop a cell. No repeated confirmation fits this allocation by assumption. A screen can finish with an inconclusive/no-nomination result. If the intended native service cell cannot fit, record it deferred with measured reason instead of shortening a frozen cell midway or shifting job prefixes to escape accounting.

C5 uses the established small profile first:20 nodes,1000/3000/1000 aggregate logs/s, deterministic900-byte bodies,15s metrics,45/45/45s prospective phases, 1 fixed Walk request/s; compare workers{1,2} x sort-run{8,16MiB}. One-worker16MiB is the grid reference, with a separate matched no-query control. At the selected worker count,32MiB is a held-out prediction check. Seed pending sealed journals and release at measurement start; startup settling must not consume the intended backlog. Stop or mark inconclusive if workers never overlap or the offered load is not delivered. Freeze exact fixture sizing after cheap preflight projection. This screen does not claim both deployment profiles or sustained capacity.

O8 screens dev1-node10/30 and small20-node1000/3000 aggregate logs/s with matched baseline/candidate schedules. Primary metric: collection-to-durable-ACK latency at fixed offered demand, accompanied by CPU per accepted byte, peak memory, refused/retried bytes and backlog/drain. Keep Spool acceptance, server durable commit and ACK separate. Observe ACK-to-query visibility as a polling interval; 30seconds is a proposed observation target, not a new contractual guarantee. Pre-register sample counts and percentile reporting; insufficient tail samples remain inconclusive. Optional capacity saturation is a separate future run.

Both screens must preserve raw custody plus full query answers/order/envelopes through active journal, sealed pending journal, published Segment and reclaim. Use independent existing oracles within their declared model; unresolved partial availability must use the explicitly scoped new model, never omitted assertions. Service limits must be verified in child cgroups appropriate to the registered profile. The outer20GiB budget is a harness ceiling, not a small-server result.

Resource reconciliation actually executed

coupled_resource_readiness.py (local checkout reference tools/bench/labs/catalog/coupled_resource_readiness.py; not present at origin/main) reuses the strict inventory and applies the explicit capacity assignments already recorded by launch registration (local checkout reference docs/experiments/benchmarks/coupled-launch-protocol.md; not present at origin/main): baseline freeze, historical CR3 failure archive and new capacity failure archives. The older query upper bound conservatively charged these to query too. Shared inode aliases and unassigned overhead still count toward query; approved object symlinks retain existing exact-target checks. No evidence was deleted or cap enlarged.

catalog-coupled-readiness-audit-01 ran through resource_group and run_job, exit0 in5.005232seconds; cgroup peak reported80.1MiB, zero swap, scratch removed. The stdout (local evidence omitted from stage) records controls rejecting shared-alias exclusion, unassigned/nested lookalike exclusion and both length/block overages. Snapshot allocated bytes:

Assignment	Usage	Existing cap
Aggregate	1,772,122,112	2,147,483,648
Reconciled conservative query upper bound	925,040,640	1,073,741,824
Explicit capacity assignment, including new failure archives	847,081,472	872,415,232

Capacity's assigned budget excludes aggregate overhead as explicitly registered; this does not certify the old all-overhead bound. Original768MiB overage remains historical failure. The tighter incremental ceiling is1,894,879,232bytes, leaving 122,757,120bytes at this snapshot. Proposed future reservation: at most80MiB including20MiB capacity,8MiB query,20MiB operations and32MiB coordinator/failure costs. These remain prospective projections; binary archives and failure fixtures must fit them before admission. Query and capacity headroom cannot be added to claim aggregate headroom. Re-inventory with projected reserve before/after each job; resource audit itself and later receipts add overhead after this snapshot.

All jobs stay serial in16/20GiB high/max, no swap,30-minute outer limits,8GiB owned scratch and16GiB drive-free reserve. Caches/scratch remain on the data drive. Elevated permissions are available for necessary scoped execution; no privileged installation, remote service change or containment bypass is needed for this preparation. Old evidence and shared caches remain; owned finished scratch is removed after preserving failures.

Remaining scope and readiness

Resource attribution is reconciled for the current snapshot. C4/Q4 are reviewed and closed for their admitted questions. O6/O7 are ready for the concrete semantic and checker work described above; C5/O8 are ready for bounded implementation work, not immediate native timing. Exact CLI/protocol registration follows actual harness construction. The old registered protocols remain untouched.

The proposed O6 companion checker/fixture routing and O7 prospective acceptance criterion are explicit trust-boundary work under AGENTS.md and ADR-0018. Preparing those changes is within this task; applying them requires that concrete semantic scope, in separate commits. Elevated filesystem permissions do not choose their meaning. Completion means recorded evidence for every admitted hypothesis, including nulls/inconclusive outcomes, plus documented reasons for any cell that cannot be admitted; it does not mean silently declaring every queued gate green.

Preparation verification

catalog-coupled-readiness-docs-01 ran the manual documentation profile, exit0 in16.071997seconds. Links/syntax, checker probes and hook tests passed; rounded cgroup peak253.4MiB, no swap, owned scratch removed. These checks establish documentation integrity, not the proposed mechanisms or semantic decisions. Final recorded frontier use is9741.285720seconds, leaving4658.714280seconds. Both preparation jobs have terminal receipts; no native experiment remains active from this preparation. New persistent receipts add small overhead to the audit snapshot and must be included at the next projected-reserve admission.