# V16.16 — Critical-Path Execution & Cost Runtime

## Why this release exists

V16.15 made parallel coding correct: proven-independent writers overlap in
isolated worktrees, integration is transactional, and the economy gate refuses
unprofitable parallelism. But five production gaps kept the runtime slower and
more expensive than its design:

| # | Bottleneck (confirmed in the baseline) | Consequence |
|---|---|---|
| A | The economy gate charged every overhead component once **per child**, as if sandbox creation, process start and context build never overlapped, and production never supplied `perChildWorkMs` | Real parallel writers unreachable in production wiring |
| B | The child delta carried only a snapshot **reference**, while the prompt re-added task JSON and parent goal through separate paths | Shared facts starved or duplicated per child |
| C | Blind `text.slice(...)` budget cuts on snapshots, deltas and capsules | Corrupted paths/commands/refs mid-record |
| D | The conflict classifier read bare words (`service`, `tag`, `release`, `publish`, `deploy`) from prose as runtime side effects | False conflicts refused real parallelism |
| E | No durable intent before root mutation; `spawnSync` Git blocked the event loop; no run identity on sandboxes | Crash-unsafe integration, frozen watchdogs, unenforced sandbox binding |

V16.16 fixes exactly these, in the existing owners, without adding a second
authority for anything.

## Laws

- **REDUCE WORK, NOT CORRECTNESS.** Every economy is a refused redundancy, never a skipped proof.
- **REDUCE CONTEXT, NOT REQUIRED EVIDENCE.** The capsule carries every field a safe execution needs.
- **REDUCE VERIFICATION WASTE, NOT VERIFICATION STRENGTH.** Receipt reuse needs an exact, fresh, unaffected PASS; release gates always run fresh.
- **PARALLELIZE ONLY PROVEN-INDEPENDENT WORK.** Independence still needs the conflict graph; economy is necessary, never sufficient.
- **STOP WHEN CORRECTNESS IS PROVEN.** The stop planner never creates PASS; the local verifier remains the only PASS authority.
- **Writer bound is hard.** Default 2, maximum 3. No history, budget or caller can widen it.
- **Root writes stay serial.** Only isolated sandbox writes overlap; integration applies one patch at a time.

## Capabilities

| # | Owner | Question |
|---|-------|----------|
| A | `lib/parallel-execution-policy-v16-15.mjs` + `lib/critical-path-history-v16-16.mjs` | Is parallelism economical on the critical path, tuned by measured history? |
| B | `lib/wave-shared-context-v16-15.mjs` (`buildCanonicalChildCapsule`, `fitSections`) | What does the child actually receive, within a hard structural budget? |
| C | `lib/execution-conflict-graph-v16-15.mjs` | Which scopes are provably independent under structured evidence? |
| D | `lib/integration-transaction-v16-15.mjs` + `lib/run-journal.mjs` | How does a wave land durably and recover from process death? |
| E | `lib/git-async-runtime-v16-16.mjs` + `lib/worktree-sandbox.mjs` | How does Git stop blocking the event loop without a second engine? |
| F | `lib/parallel-coding-runtime-v16-15.mjs` (composition) | One call per wave: prewarm, proof plan, telemetry, stop decision |
| G | `lib/orchestration-budget-v16-6.mjs` (`reserveRunCost`) | Does this wave fit the run's cost reservation? |
| H | `lib/provider-cache-stability.mjs` | Is the shared prefix stable for provider prefix-cache reuse? |

Two narrow new modules exist only because no owner could hold them:
`critical-path-history-v16-16` (bounded EMA, no persistence, no seed data) and
`git-async-runtime-v16-16` (bounded async Git primitive). Neither is a second
pool, graph, verifier, store, budget or metrics authority.

## Production wiring

`pi/extensions/ues.ts` reaches the stack only through the lazy registry; it
contains no static import of any V16.15/V16.16 decision module, so boot pays
for none of it. Per wave it:

1. declares scopes with full structured evidence (acceptance, verification
   commands, services, external effects, generated outputs, planned commands);
2. plans with measured history estimates (absent history is NOT_MEASURED);
3. builds one snapshot, one delta per child (accounting path), and one
   canonical capsule per child (the only prompt assembly);
4. creates sandboxes bound to run + wave, integrates with
   `expectedRunId`/`expectedWaveId`/`expectedRootHead`, recovers crashed
   intents once per run, and records measured timings back into history.

## Verification

Parallelism never produces PASS. Child sandbox PASS never proves the combined
root. `planProofReuse` reuses only exact, fresh, unaffected receipts, and
never for final-release or security-sensitive gates. DeepSeek never edits,
never verifies, never decides. The local verifier is the only PASS authority.

## Non-goals / explicit limits

No swarm, no writer concurrency above 3, no browser pool, no vector store, no
always-on advisors, no new providers, no second scheduler/pool/broker/store/
metrics, no GitHub Actions, no timeout inflation, no skipped tests.

## Benchmark honesty

`scripts/bench-v16-16-critical-path.mjs` labels every cell `SIMULATED`,
`SYNTHETIC`, `MEASURED` or `LIVE`. It carries `summedSpeedupClaim: null`,
`tokenSavingClaim: null`, `qualityClaim: NOT_INFERRED_FROM_BENCH` and
`providerTokens: NOT_MEASURED`. No V16.15-baseline milliseconds are reported:
the replaced formula cannot be re-measured without checking out old code, and
inventing them would be fabrication. The report counts failed cells and exits
non-zero on any failure.

## Economy model

`serialCost = sum(child work)`; `parallelCost = waveSetupSerial +
max(sandboxCreate, rpcStart, contextBuild) + max(childExecution) +
max(targetedVerify) + childCount * integration`. Overlapped components
contribute their maximum; only root integration serializes. Scopes without an
explicit estimate get a deterministic ESTIMATED figure from their declarations
(files, acceptance, verification, task length); explicit caller figures stay
MEASURED. Measured history tunes components inside a 0.25x-4x clamp band after
a minimum sample count, and can never widen the writer bound or promote a
TINY/SMALL task.

## Context delivery

Two classes: (A) a small mandatory shared prefix inlined in every capsule
(goal, constraints, requirement ids, verification commands, generation,
evidence ref lines - no bodies, no previews); (B) large shared evidence as
Evidence Store references fetched on demand. Volatile ids sort after the
stable prefix so provider prefix-cache reuse never breaks on a run id.

## Integration durability

`integration.begin` (full intent) is journaled before any root mutation, one
`integration.patch-applied` per applied patch, `integration.commit` on
success, rollback records on reversal. Recovery reverses only proven-owned
patches, fails closed on user changes or a moved HEAD, never runs
`git reset --hard`, never rolls back a commit, and is idempotent via recovery
records. Without a run id the transaction runs undurably and says so
(`durable: false` is absent; receipts carry `durable: true` only when the
intent was journaled).

## Measurement provenance

Every number carries `MEASURED`, `DERIVED`, `ESTIMATED` or `NOT_MEASURED`.
Provider tokens are `NOT_MEASURED` unless the provider reported them; chars are
never converted into tokens. The duplicate-context figure compares measured
chars against a hypothetical naive baseline: the counts are measured, the
comparison is derived, and it is never presented as a provider saving.
`integration-root-rollbacks` counts only genuine reversals, never preflight
rejections or no-op waves.