Historical report imported 2026-10-10 from docs/experiments/benchmarks/native-frontier-findings.md. Original SHA-256: 98b4aeb45d36e877fbcd2559ae67592777d1b4a0e6fa805c5e2cfc0e65667596. Measurements and outcomes retain their stated revisions. Links and local environment labels are normalized; $FABRIC_DATA is the mounted experiment drive. See evidence policy.

Native ownership and query admission findings

This round carries the cross-system source research into two native Fabric mechanisms under the registered protocol (local checkout reference docs/experiments/benchmarks/native-frontier-protocol.md; not present at origin/main). Both produced a useful local benefit and an adverse result that blocks nomination. No production default, format, durability order or dependency changed.

Lab	Mechanism and observed benefit	Limiting evidence
Memory	Release source payloads after Arrow conversion, before Parquet encoding. All 12 matched pairs reduced requested build heap by about 12.17–17.25%, with byte-identical files and unchanged build writes.	One held-out pair increased whole-worker RSS 15.13%, above the 10% guard. Full confirmation failed.
Query	Test the canonical key against the page/heap boundary before literal matching and cloning. Primary reused tail Scan CPU fell 11.27%; counted requested allocations fell 2,558,531 bytes.	Other first/reuse CPU and wall guards failed. The candidate is not admitted to confirmation.
Resources and verification	Serialize native work inside enforced cgroups, isolate decoder processes, preserve source and counterexamples, and authenticate cleanup.	These offline fixtures do not qualify sustained ingestion, query QPS, ACK latency or deployment RSS.

The detailed records are memory ownership, query admission and resource accounting. The memory experiment contains 24 native cells across two screening and two held-out seeds. The query screen contains 24 children, 2,304 measured first pages and 576 independently graded complete chains covering 11,040 pages; its 1,440 deliberately defective answer vectors were rejected. Complete-chain correctness and first-page timing have different measurement boundaries.

The opt-ins live in the bounded table writer (local checkout reference crates/fabric-server/src/segment/bounded.rs; not present at origin/main) and query admission. The new native corruption fixture (local checkout reference crates/fabric-server/tests/key_first.rs; not present at origin/main) checks that a key-rejected row still receives typed validation. Broader candidate library/history/snapshot checks passed 75 tests, with two existing ignored tests; their receipt (local evidence omitted from stage) records the actual compile flag and command.

What the comparison changes

The storage result demonstrates that live Rust allocation and process residency need separate models. Releasing one owner reduces requested live bytes, but the allocator and foreign runtime can retain pages for later work. The adverse pair's resident gap already exists at build return, while its requested retained heap is nearly identical. A separately registered allocator diagnostic (local checkout reference docs/experiments/benchmarks/native-ownership-rss-diagnostic-proposal.md; not present at origin/main) tested repeatability and threshold sensitivity using frozen binaries and the exact failed input. Both default-policy orders reproduced about 15% excess RSS; fixing the mmap threshold reduced it to 0.6–1.3%, with exact files and unchanged requested heap. The registered contrast therefore supports allocator-policy sensitivity; it does not identify a particular allocator owner. Its disposition is recorded in the memory findings; it cannot retroactively turn the original confirmation into a pass.

The query result locates a useful ownership boundary: tail Scan currently clones rows that its bounded selector later rejects. Earlier canonical-key admission can avoid that work. It does not avoid selected-source reads, typed validation or Parquet decoding. First-call and sealed-reader costs remain important counterexamples to generalizing one favorable reused-tail result. Existing malformed-attribute, missing-table and raw-integrity controls must still report incomplete evidence.

An explanatory model now needs two states: live owners L(t) and allocator state A(t). Requested heap estimates L(t); residency depends on both, plus foreign allocations and mappings. The same final L can accompany a different A after a different allocation/free sequence. This is a hypothesis about path dependence, supported by the fixed-policy contrast, not a calibrated RSS predictor or proof of which glibc mechanism changed. A useful next model must predict held-out resident peaks as well as requested peaks before it can drive admission limits.

A competing future strategy is bounded buffer reuse: retaining a capped allocation may reduce allocator churn even while keeping more requested bytes live than early release. That tradeoff should be tested against incremental conversion, including retained capacity, Arrow ownership, CPU and resident peaks. It is an unimplemented alternative, not a measured benefit or a third prototype nomination.

For query, an absent predicate never fills the selector: early key admission rejects no rows and has no matching/cloning work to save. Owned sealed readers also construct and validate rows before invoking the callback. These source facts explain why opportunity differs across populations; they do not establish the cause or magnitude of each observed slowdown. Future balanced repetitions should vary heap capacity and count threshold-ready rows, key rejections, literal checks and clones, while retaining the same independent full-answer oracle. The post-screen admission model derives a possible state-sensitive path from the heap's unfilled-to-full transition; it remains an unimplemented hypothesis with explicit absent-query adversaries.

Research queue after this round

Vector	Next discriminating experiment	Invariant or adversary
Conversion ownership	Locate the surviving peak after early release, then test incremental conversion and payload growth strategies at fixed run size.	A lower conversion peak cannot help if writer state still sets the maximum; full destination preallocation can recreate overlap. Preserve filters, exact bytes and journal ownership on error.
Allocation versus residency	Use the frozen-input diagnostic to choose whether a later allocator ownership trace is justified.	An allocator setting that removes one RSS gap is not a production setting or an identified allocation owner.
Query admission cost	Investigate callback/key-check overhead and admission churn with balanced repeated within-process measurements before another candidate.	Broad, absent, first-call and sealed cases must stay visible; do not select only the primary's favorable regime.
Shared staging budget	Account jointly for decoded inputs, spare capacity, sort workspace, Arrow and writer buffers before implementing shared credits.	A per-run byte cap is not a process-memory bound.
Service validation	After a component survives its guards, measure coupled ingest/query work and cancellation under small deployment limits.	Custody, complete answers, ACK behavior and backpressure remain hard constraints. No rejected component is promoted into a composite benchmark.

These are prospective research vectors, not additional executed experiments or automatic nominations. The previously confirmed 8 MiB run-cap experiment remains separate from the new early-release comparison at a fixed 8 MiB. Their gains must not be multiplied across unmatched workloads, and the normal run cap remains 16 MiB.

Verification and cleanup

The first two fast profiles passed the full workspace tests and sixteen checks, but Clippy successively rejected redundant outer request initializers in the new corruption test and benchmark example. The test repair (local checkout reference docs/experiments/benchmarks/native-verification-retry-proposal.md; not present at origin/main) and example repair (local checkout reference docs/experiments/benchmarks/native-verification-example-retry-proposal.md; not present at origin/main) remove only those initializers. Benchmark results remain tied to their frozen pre-repair sources and binaries; assertions and query/storage algorithms are unchanged. Both failed receipts remain. The first job peaked at 12,905,226,240 cgroup bytes; the two-thread retry peaked at 610,545,664, with zero swap/OOM events in both. This resource observation is separate from the performance experiments. A direct full-target Clippy preflight (local evidence omitted from stage) passed after both fixes.

All seventeen fast checks (local evidence omitted from stage) and three manual documentation checks (local evidence omitted from stage) passed with exit zero. The closeout (local evidence omitted from stage) authenticated all twenty receipts against their commands, revision and execution windows, rejecting fourteen representative defects. It authenticated and removed six frozen binary copies totaling 39,983,970 bytes. The successful fast job peaked at 921,747,456 cgroup bytes; both historical failed jobs and their costs remain in the ledger.

The two failed verification trees were archived with complete inventories and two exact readbacks before removal: first preservation (local evidence omitted from stage), second preservation (local evidence omitted from stage). Successful experiment fixtures, isolated decoders and temporary documentation runtimes were removed. The shared Cargo cache remains on the mounted data drive; source snapshots, raw measurements, exact query objects and counterexamples remain. No swap or OOM event was recorded. Bun hooks and CI remain disabled.

The resource record scopes cumulative totals through closeout. A final documentation recheck after this report reconciliation is recorded separately as final-docs-02 under the coordinator receipts (local evidence omitted from stage). These checks do not constitute deployment qualification or resolve the remaining coupled service, cancellation and sustained-capacity experiments.