Prototype Retirement and Production Hardening

Goal

Converge from measured prototypes to one production implementation that satisfies the architecture contract, absolute evaluator/VM/LLVM/AOT behavior parity, and the full implementation-hygiene ruleset. Prototype success is evidence, never permission to ship a deficient structure; production-shaped prototype components may remain in their final owners when every retain gate is demonstrated.

Convergence Sequence

Freeze the prototype evidence: supported ARC/opcode/value/runtime surface, full-VM/fallback/failure counts, output mismatches, profiles, benchmark distributions, memory behavior, and rejected approaches.
Classify every component as retain, harden, replace, or delete. Map each retained component and decision to the owning production seam, invariant, test, and applicable parity/performance evidence.
Implement or harden production modules in dependency order: artifact contract/validation, pure lowering, verifier, safe value/runtime boundary, execution engine, then oric routing. Do not rewrite an already-correct owner/API solely because it originated during feasibility work.
Run exact evaluator/VM/LLVM debug/release/AOT parity as each semantic surface lands. Do not defer broad parity until integration.
Delete the prototype harnesses and all duplicate types/tables/dispatch code before final hardening; retain qualifying production-owned modules in place and preserve benchmark evidence outside production code.
Run implementation-hygiene review over the transitive blast radius, cure every validated finding, then rerun the complete parity/safety/performance matrix.

Prototype Residue That Must Not Ship

silent or counted fallback in a production backend;
no-op, traced-only, reordered, coalesced, or inferred RC/AIMS operations;
a second opcode/value/call-signature definition retained beside production types;
compiler/session/LLVM handles inside VM artifacts or runtime state;
ambient mutable globals, thread-local semantic state, or cross-test heap/stack reuse;
unchecked indices, malformed-bytecode assumptions, unwrap/panic on user-controlled paths, or unbounded recursion/worklists;
stringly internal errors, ad hoc stderr logging, comparator-aware semantics, or benchmark-only fast paths;
unsafe/raw native-layout slots without a separately approved safety proof and measured necessity;
example-only feature flags, dead code allowances, stale dumps, debug prints, temporary environment switches, or duplicate harness logic.

Implementation-Hygiene Gates

Area	Required production disposition
Ownership and duplication	One owner per transform/table/invariant; delete parallel lowering, callable discovery, runtime descriptor, opcode, and diagnostic implementations.
Exhaustiveness	Exhaustive matches over ARC instructions/terminators, logical `ValueSemanticsId`/`ExecutableDropPlanId` classes, VM physical-plan mechanism variants, callable kinds, opcodes, verifier errors, runtime calls, and backend choices; negative pins for new variants. The six legacy `RcStrategy` shapes remain migration-coverage cases only.
Safety	Safe Rust default; checked indexing/arithmetic/conversions; verifier validity carried by type; malformed/fuzzed input cannot panic, go out of bounds, allocate without limits, or invoke runtime effects.
Control flow	Explicit frame stack and fuel/resource limits; no Rust-stack recursion for guest recursion; correct branch-local state snapshots and edge-local ownership operations.
Memory	Exact AIMS logical event/drop-plan identity, multiplicity, order, transfer edge, and cleanup obligation; independently validated VM storage/count/COW mechanisms; recursive child release; unwind/panic/quota cleanup; final-live-zero checks; managed live/peak/cumulative byte and object accounting; frame/register/scratch and bytecode/metadata footprint; scale slopes; alternate representation views; and per-run storage ownership.
Errors and diagnostics	Typed errors inside; one actionable user-facing conversion at `oric`; no ICE for reachable user errors; unsupported modes name the supported command/mode.
State and concurrency	Immutable shared artifacts; session-local caches; fresh execution state per run/test; no global mutation; parallel tests only after race/isolation stress.
Hot paths	Allocation-free steady dispatch/frame reuse where measured, no exception-driven common path, no repeated interning/string lookup, and no optimization retained without macro evidence.
Comments and API shape	Comments explain invariants/why; no narration or stale claims; minimal visibility; constructors/builders validate invariants and fallible construction returns `Result`.
Validation	Formatting, lint with warnings denied, focused/unit/property/fuzz tests, malformed corpus, full compiler tests, debug/release/AOT parity, sanitizer/Miri where applicable, leak/isolation stress, and reproducible benchmarks.

The current .claude/rules/impl-hygiene.md is the SSOT at execution time. This table identifies mandatory VM-specific surfaces; it does not freeze or replace newer rules added before implementation.

Absolute Parity After Every Change

Every retained productionization, cleanup, and optimization change must preserve zero mismatches across the applicable evaluator, VM, LLVM debug/release, and AOT corpus.
The differential record includes result/output/order/exit/panic/diagnostic behavior and ownership/leak outcomes. A mismatch has these consequences:

invalidates the change’s benchmark result;
blocks merging/default-backend progress;
is localized by shared frontend/executable-program/function/chunk provenance;
is fixed in the owning transform/backend or causes the change to be reverted.

No waiver, tolerance, backend-specific expected output, fallback, or widened normalizer can turn a mismatch green.

Production Exit Gates

ori_vm has the allowed one-way dependency graph and contains no prototype/example dependency.
Production ori run --backend=vm and ori test --backend=vm report zero fallback paths; all applicable corpus cases execute in VM or fail with the same defined source-level behavior as the oracle.
Prototype files and duplicate definitions are removed; repository searches and dependency tests prove zero residue.
Implementation-hygiene review is dry over the transitive blast radius, with all findings fixed and regression-pinned.
Formatting/lint/tests, property/fuzz/malformed/resource gates, leak/sanitizer/isolation gates, and exact multi-backend parity are green in the required profiles.
Post-hardening benchmarks still clear both Python bottom bars (2× speed and 2× workload-attributable peak-memory efficiency with unadjusted RSS no worse) and ultimately the LuaJIT -joff speed/memory north-star gates; hygiene work cannot be bypassed to recover either resource.

Layer Coverage

Layer	Disposition
L1	Covered by full accepted/rejected parse regression run after convergence.
L2	Covered by compile-pass/fail regression run after convergence.
L3	Covered by canonical/evaluator oracle fixtures and pattern/effect-order parity.
L4	Covered by exact post-AIMS provenance and RC trace gates after prototype removal.
L5	Covered by zero evaluator/VM mismatches.
L6	Covered by zero evaluator/VM/LLVM-debug mismatches.
L7	Covered by zero evaluator/VM/LLVM-release mismatches.
L8	Covered by zero evaluator/VM/AOT mismatches.
L9	Covered by the full differential matrix after every retained hardening change.
L10	Covered by leak, sanitizer, malformed, resource, panic/unwind, and isolation gates.
L11	Covered by callable/value/control-flow/error/effect/collection fixture completeness.
L12	Covered by real `ori run`/`ori test` production-path and no-fallback checks.

Work Items

Port only evidence-backed prototype decisions into production-owned modules, delete the throwaway examples and every prototype-only fallback, no-op ownership path, duplicate opcode definition, and benchmark shortcut.
Run the full implementation-hygiene, lint, formatting, unit, property, fuzz, malformed-input, resource-limit, sanitizer, leak, and isolation gates over the production VM blast radius and fix every validated finding.
Re-run exact evaluator, VM, LLVM debug/release, and AOT observable parity after hardening and after every retained performance change; any mismatch invalidates the change and blocks production adoption.