PR #834 - acyclic-labs/sdk

Problem

The full-suite CPU profile spends most hot-path time in copies, comparisons, allocation/free, hashing and accounting. Startup of the 10k swarm competes with those costs in other cases.

Design

Charge item-only standalone filesystem work directly: one addition instead of 46 additions/checks of mostly zero fields. Borrow the existing budget for completed-work checks. Native authority and cancellation paths retain their existing admission order.
Reuse the checked ordinary Bytes view and skip comparisons of identical immutable views. Retained-capacity and native owners retain their outer-range checks and custody.
Walk cursor history once, respect fork-prefix cuts, keep singleton windows inline and reuse the queue on append-follow updates. Bounded native reads retain only their windows, removing unused root/position fields.
Share one small differential helper in test support. Baselines have independently initialized state and compare complete bytes, exact errors and operation/observer traces.

Deterministic verification

Production work	Original	Candidate
Standalone item-only charge arithmetic	46	1
Shared immutable byte comparison	1	0
Ordinary view range rechecks	1	0
Initial history visits, 4 / 32 batches	8 / 64	4 / 32
Singleton cursor queue allocations / bytes	1 / 24	0 / 0
Append-follow scratch allocations / bytes	1 / 96	0 / 0
Funded bounded native cursor bytes	baseline	baseline - 32

Exact equality assertions cover work and allocation counts, with controls restoring the old redundant work. The native reader baseline compares complete record bytes, provider/observer errors, all work counters, and the ordered meter-call trace across bounded ranges and read limits. The trace includes admission, examination, byte recording, refunds, allocation and release. Only the independently checked 32-byte frame reduction is normalized. A control swaps actual recording calls while preserving complete outputs and totals; ordered equality rejects it. The differential oracle itself rejects changed bytes, errors and observer order. Completed-work verification records the budget reference identity; the original by-value body fails this exact borrowing invariant while still doing one verification and zero heap allocations. Allocation-dependent unit modules are native-only, matching the dependency target guard. The existing native endpoint pool fixture now has the same native-only guard.

Measurements

Pinned native debug binaries, build time excluded:

72 default-tool cases: baseline 1.139 s; production changes plus #819's independent blocking pool 0.848 s.
Isolated 10k: 2.842 -> 2.349 s; user CPU 2.44 -> 2.05 s. The filesystem-only intervening parent changes do not affect this driver.
Full target: 77 tests / 722 scenarios passed; scenarios 4.278 s, target 4.35 s.

Paired command: E2E_FILTER=default-tools/ /usr/bin/time -v <before-or-after-e2e> scenarios --exact --nocapture; repeat with E2E_FILTER=swarm/load/ten-thousand.json. The default-tool comparison includes parent #820/#824 and the separately tested #819 pool configuration; it is a combined workload measurement, not attribution of their gains to this PR.

Tests

bb1 native Stream: ownership/range/comparison properties, cursor differential properties and allocation controls, native read cancellation/ordered-prefix checks, independent native reader differential, funding and actual record-order controls; each group <= 0.01 s.
Filesystem accounting properties, exact arithmetic/allocation controls, and original-budget identity control: 4 passed, <0.01 s.
Test-support differential oracle property and three corruption controls: 2 passed, <0.01 s.
Windows GNU: cargo check --locked -p acyclic-harness -p acyclic-objects -p acyclic-fs -p acyclic-stream -p acyclic-test-support --lib --tests --features <canonical-native-set> --target x86_64-pc-windows-gnu passed via bs.ps1.

Deletions

Remove the redundant history-window collector and native cursor root/position state. Most added lines are independent original implementations and differential properties. Net line delta: +1228 (1367 added, 139 deleted).

Decisions

No synchronization protocol, wire format, limits, deadlines or scenario expectations change. Cursor windows remain subscriber-local and immutable history remains behind the existing provider guard. No parser changes or new dependency.

Follow-up

The baseline's 3x full-suite load failure remains: only the 10k case exceeds its unchanged five-second guard. Its seed phase grows from ~0.42 s isolated to 3.4-4.4 s under load; follow is ~1.6-3.1 s. #819 owns the runtime configuration and the remaining contention investigation. These production cuts do not claim that problem is solved. Subsequent #819 measurements with a 32-worker async ceiling passed three concurrent full targets in 4.80 / 4.87 / 4.93 s; eight- and four-CPU failures remain open in that PR.

WASM check

Ran cargo check --locked -p acyclic-stream -p acyclic-fs --lib --tests --no-default-features --features acyclic-stream/wasm,acyclic-fs/memory,acyclic-fs/browser --target wasm32-unknown-unknown through bs.ps1. The new modules produce no unresolved test-support references. Filesystem's existing browser tests still fail on:

kernel/merge/directory.rs:42: test helper refers to the native-only ResolutionView::Slice (guard predates this PR, 44e8d74a5a).
distributed/tests.rs:581 and tests/workspace/publication/mod.rs:57: native async_trait Send futures implementing WASM's non-Send StreamProvider (a86d31ed7e).
multi_root.rs:2837: generic test Resolver lacks its trait's Send/Sync bounds (bac3a3daac).
tests/model.rs:66 and tests/support.rs:123: unguarded native-only constructors/error variants (2e45569f80 / a86d31ed7e).
The broad check also selects existing native-only integration fixtures. These unrelated tests were not skipped or weakened. The stream-only browser library/test check is reported separately below.
Stream-only browser lib/tests check (--no-default-features --features wasm --target wasm32-unknown-unknown): passed, 19.22 s.
Final Windows GNU canonical harness/objects/filesystem/stream lib/tests check: passed, 27.67 s.

Main conflict resolution

GitHub reported conflicts. Preserve main's perform method and its single-leaf native charge implementation. The item-only native branch delegates to that implementation; standalone branches still use direct arithmetic. Extend the existing original-leaf count assertions and independent receipt/error property to item-only charges. Extend the real acyclic_fs_loom charge model to scalar charges, including cancellation and the split-publication negative control; deleting the limit assertion must let the broken model complete. These checks retain the crate-local loom lock shim and existing lock order.

Merged-head native checks: four borrowed-accounting tests and three charge properties passed (0.01 s). The real filesystem/shared-sync Loom build (RUSTFLAGS="--cfg acyclic_fs_loom --cfg acyclic_loom") passed all three charge models in 0.08 s, including scalar cancellation and split-publication controls. The canonical Windows GNU lib/tests cross-check also passed at this head (3m24s). Signed head: 7b009e240ca015dc308826aee82b8ecbe10be7d7.

Default-tool timeout attribution (2026-10-17)

Reproduced the review failure without #819 or #852: pure #834 at 7b009e240 timed out in 71/72 cases (5.580s); #819 e9b9b1176 also timed out in 71/72 (5.415s); #852 2acb0d2b4 timed out in 69/72 (5.258s). A frozen pre-stack origin/main binary at 96790de61, with the identical default-tools tree (7462a8363371fc3a6700463531c34da451509ff7), timed out in 72/72 cases (6.295s). All commands used the same bs.ps1 namespace, native feature closure and taskset 0-159. Separate single-case runs of read/first and fs/empty passed in 0.316s and 0.250s. Thus none of the three PRs is necessary to trigger the bulk-run deadline failure. This does not claim the baseline contention is fixed, and no guard or admission setting changed.

Artifacts: e2e-tools-attribution-naq1dt9q/e2e-834 plus the previously frozen #819/#852 binaries; diagnostic root e2e-tools-diagnosis-duc7f3od. Commands: E2E_FILTER=default-tools/ taskset -c 0-159 <frozen-e2e> scenarios --exact --nocapture; narrower diagnostics replace the filter with the exact case path. Native compilation was 5m51s, excluded from runtime results.

Structural review revision

All native-only memory test modules now live under the single target-gated memory::tests::native module. Filesystem's allocation-dependent performance group likewise lives under one target-gated performance::tests::native parent. The test-support dependency cannot be reached from these modules on WASM; there are no compatibility aliases for the former test paths.

The borrowing control executes the exact old work.verify(*budget) call. The positive path and control run the same assertion that the address observed inside verification equals the accounting object's original budget address. The control must fail that assertion while retaining one verification, zero allocations and identical work. This distinguishes budget copying from extra verification work.

The observer-order control now runs the production MemoryStream::native_read with a scoped test-only fault that records the read before examination. The independent original reader has no mutation branch. Full ordered-event equality (admission, recording, release and refund, preserving arguments) rejects the control while bytes and final counters remain equal. The only normalization is the independently checked smaller cursor allowance, not event omission or sorting. The fault hook and its state do not exist in non-test builds; they add no lock, channel or production synchronization path.

Updated focused commands use the single native boundary: <stream-lib> memory::tests::native::cursor_work:: --nocapture, <stream-lib> memory::tests::native::native_read_differential:: --nocapture, <fs-lib> performance::tests::native:: --nocapture.

Signed revision 4421f1544cdd7f334fddb4617c39a2410d5195cb addresses all three findings above. Fresh bb1: 25 focused tests passed (Stream18, Filesystem7; each group <=0.03s). Stream build45.29s and Filesystem build477.39s excluded. Canonical five-crate Windows GNU lib/tests passed in3m18s; Stream WASM lib/tests passed in5.60s. Filesystem WASM lib/tests still fails on the previously identified Slice helper, Send/non-Send fixture implementations and Resolver bounds, plus native integration fixtures; none of its errors refers to test-support or the newly gated performance modules. Full log: /home/var/log/buildbox/2026-10-17T074418602Z-3212529.log. No tests or guards were weakened to hide those pre-existing failures.