Register VM + Measured Stable-Rust Dispatch

Goal

Execute verified chunks efficiently and safely in stable Rust, selecting dispatch and frame designs from evidence rather than committing to unavailable tail-call machinery.

Feasibility Finding

Rust 1.93 rejects become as experimental.
The synthetic probe measured match dispatch at 2.89 ns/op and an indirect function table at 5.11 ns/op.
Treat those readings as premise rejection, not full-VM prediction; use match dispatch as the first baseline.

Implementation Sketch

Implement a compact match dispatch loop first. Benchmark generated assembly, retired instructions, branch misses, and macro workloads before considering function tables, superinstructions, or platform-specific alternatives.
Converge on one physical executor, not permanent generic and optimized semantic engines. Run that executor first with an identity plan and then with each optimized plan; retain the current canonical interpreter only as a transition oracle until identity-plan differential coverage is complete. A plan cannot delegate an unsupported operation to the old interpreter, and requested-versus-executed plan identity is observable in every report.
Make physical-plan validity a construction/decode-time invariant. A private candidate is validated once against the exact verified-program identity before becoming an immutable PhysicalVmPlan; execution views are then infallible, and steady-state execution performs no CFG analysis, validation allocation, or malformed-carrier recovery.
Specialize canonical and physical operand access through a sealed generic layout policy around one opcode match and one set of semantic helpers. Monomorphization may remove layout/optional-cursor branches, but it cannot create two opcode implementations or duplicate runtime, ownership, panic, call, or unwind semantics.
Stage physical execution so every result is attributable: (1) execute a one-entry-per-canonical-PC identity plan through shared runtime/ownership kernels; (2) add definite-initialization analysis, typed integer/boolean/dynamic banks, and flat activation bases without full-frame Unit fill; (3) replace 32-byte canonical Op fetch with independently derived compact physical records and prebound operands; (4) add general verified 4-16-operation tracelets. At each stage compare identity and candidate plans for exact canonical steps, probe stream, errors, output, roots, RC/effect order, cleanup, plan bytes, and workload results before measuring speed.
Prototype a compact hot-state variant holding PC, current frame/register base, current function, and immutable instruction/constant tables; inspect whether Rust keeps it resident across handlers and measure the effect of moving cold errors, allocation growth, diagnostics, and uncommon runtime services behind non-inlined typed helpers.
Compare common versus replicated dispatch and handler-size/code-layout variants using generated assembly and macro workloads. LuaJIT’s pinned -joff baseline demonstrates that baseline-interpreter dispatch layout matters, but its handwritten DynASM is evidence rather than an implementation template.
Use the logical VM call convention and safe typed slots selected earlier. Frames contain stable function/chunk indices, PC, register base, return destination, and panic/source metadata; no self-referential pointers.
Implement Call/TailCall/Return from explicit bytecode semantics. ARC’s self-tail calls are already loops; TailCall is emitted only when it is an explicit legal operation/proven transformation, never detected from a local Call-before-Return pattern.
Route built-ins, impl methods, derives/intrinsics, and runtime calls through the closed program/runtime descriptors. Do not reuse tree-walker Value::FunctionVal dispatch as a hidden fallback.
Enforce frame/value limits with structured stack-overflow/resource errors. Panic propagation and cleanup must not depend on unwinding the Rust interpreter stack.
Set dispatch thresholds from the frozen benchmark suite after opcode mix exists; remove the unsupported <2 ns/instruction assertion.
Prototype typed superinstructions only as output of the explicit bytecode optimization seam. A candidate carries verifier-visible expansion/provenance, has an unfused reference execution, and preserves exact RC/effect/error order. Promote it only after it improves a non-singleton macro corpus; benchmark-specific recognition is forbidden.

Prototype Experiment Ledger

Record code/config identity, inputs/outputs, dispatch counts, timing, parity, seam/hygiene, and disposition.
Run combined variants against each individual parent; never assume techniques compose.
Change production architecture text only for promoted variants.
Preserve rejected results to prevent repetition.

Date / variant	Real-VM result	Parity and seam result	Disposition
2026-07-14 — verifier-backed frame-local parallel moves; remove per-back-edge move-table and scratch clones	Output-checked 100-doors, 30 shell-free whole-process runs: median 44.24 ms -> 40.93 ms (7.5% lower); mean 45.0 ms ± 4.1 -> 41.1 ms ± 0.9. Instruction count remained 159 and executed steps remained 3,940,022.	`entered_vm=1`, fallback/unsupported/failed all zero, output remained `2000`. The change is general to SSA block arguments, reuses session-local frame scratch, preserves simultaneous-move semantics, and adds no backend coupling. Focused compile check passed; broader parity/hygiene gates remain pending.	Promote as retain/harden candidate, subject to focused parallel-cycle tests, full parity corpus, and hygiene review. It is a baseline correction, not evidence for fusion or a completion result.
2026-07-14 — inline the verified opcode match into the enclosing execution loop	Against the allocation-free-move parent, 30 shell-free 100-doors runs improved median 40.93 ms -> 31.55 ms (22.9% lower) and mean 41.1 ms ± 0.9 -> 32.3 ms ± 3.0. A perf-stat sample reduced host instructions from about 640M to 562M and cycles from 176M to 135M; branch misses remained below 0.3%. Executable text grew by 928 bytes.	Output remained `2000`; bytecode count 159, executed steps 3,940,022, full VM entry, and zero fallback/unsupported/failure were unchanged. The annotation does not cross a seam, but the large error-bearing handler still needs deliberate hot/cold factoring and codegen pins.	Promote the hot-loop shape, harden the implementation. Keep the measured inline variant while testing a compact loop with cold error/runtime helpers; require assembly and code-size regression pins rather than treating `inline(always)` as the architecture.
2026-07-14 — shared primitive strategy plus verifier-backed `IntBinary`/`BoolNot` lowering	A same-binary paired 100-doors experiment retained explicit typed and untyped compile modes. Across 50 shell-free runs, typed median was 31.228 ms versus 33.062 ms untyped (5.547% lower); typed mean was 31.948 ms versus 34.514 ms untyped (7.434% lower). Five-run perf samples reduced host instructions from 580,198,926 to 572,574,835, cycles from 134,467,678 to 132,563,648, and branches from 73,241,308 to 71,329,462. Text grew by 9,212 bytes versus the inlined parent.	Both modes printed `2000`, entered the VM fully, and retained zero fallback/unsupported/failure, 159 bytecode operations, 3,940,022 executed steps, two peak frames, and one peak heap object. Type checking, `ori_repr`, LLVM, and VM now share one registry-field mapper; `ori_repr` owns executable-backend adaptation, and the VM verifier rechecks typed register classes.	Promote as retain/harden candidate, not completion evidence. Keep the shared mapper and paired reference mode. Require arithmetic/error fixtures, multi-program macro evidence, runtime-call result signatures, compact generated opcode metadata, and corpus parity before typed opcodes become production ISA.
2026-07-14 — verifier-backed direct access after complete index/fallthrough checking	Against the saved checked-interpreter binary, 50 shell-free 100-doors runs reduced median from `0.031745495 s` to `0.0311347375 s` (1.92391865365%) and mean from `0.03269269304 s` to `0.03193631866 s` (2.31358848008%). Ten-run perf-stat reduced retired instructions from 572,573,381 to 518,627,916 (9.42158102177%), cycles from 134,993,563 to 126,231,868 (6.49045391890%), and branches from 71,329,197 to 69,499,673 (2.56490199939%).	Both binaries printed `2000`, fully entered the VM, and retained 159 bytecode operations, 3,940,022 steps, two peak frames, one peak heap object, and zero fallback/unsupported/failure. The interpreter remains safe Rust; the verifier now rejects implicit final-instruction fallthrough and proves indices before execution. Malformed-artifact pins and broad macro parity remain required.	Retain as a baseline correction pending hardening, not a dispatch verdict. The wall-time gain is much smaller than the host-instruction gain, so profile the remaining hot state and validate on calls, runtime operations, heap traffic, errors, and combined applications before promotion.
2026-07-14 — skip aggregate/iterator zero-fill when reusing frames	A paired 100-run shell-free experiment compared the unchanged reusable-frame parent with a candidate that retained stale aggregate/iterator backing slots while still clearing every register handle. The parent measured 31.659 ms mean / 31.003 ms median; the candidate measured 32.245 ms mean / 31.903 ms median.	Both binaries printed `2000` with the same 159 bytecode operations, 3,940,022 steps, two peak frames, one peak heap object, full VM entry, and zero fallback/unsupported/failure. The candidate did not alter a seam, but the measured distribution showed no gain.	Reverted as inert/slightly adverse. Aggregate/iterator zero-fill is not a material cost on this workload; do not weaken initialization invariants without evidence. Prioritize per-call allocation, compact frame layout, dynamic opcode-mix measurement, and verified region/superinstruction work.
2026-07-14 — verifier-backed direct user-call argument transfer	The parent allocated an argument-value `Vec` and cloned the parameter table for every user-function call. Direct transfer into the reset child frame reduced the existing recursion benchmark’s three-run shell-free mean from 20.687 s ± 1.764 to 17.579 s ± 0.466. The smaller doors and sharing/function-chain programs were noise-neutral.	Parent and candidate returned `Int(0)` after 1,752,452,642 bytecode steps, reached 1,024 frames, retained zero final heap objects/bytes, and reported identical frame/register/scratch peaks. One-run raw RSS was 10,520 KiB parent and 10,512 KiB candidate. The transfer uses verifier-proved exact arity/register bounds, `VmValue: Copy`, disjoint caller/child frames, and no new semantic path.	Retain and harden. The candidate removes two general per-call host allocations and materially improves the existing sustained-recursion workload without a measured memory regression. Keep the smaller workloads in the gate, add a repeated-run isolation pin, and test deep aggregate/heap arguments before production promotion.
2026-07-14 — lazy aggregate/iterator frame banks	Against the direct-call parent, the recursion fixture’s three-run mean fell from 15.747 s ± 0.257 to 11.873 s ± 0.464, or 24.6015113990%; VM-owned frame bytes fell from 3,298,640 to 127,120, or 96.1462905925%. One paired raw-RSS reading fell from 10,648 KiB to 7,388 KiB, or 30.6160781367%.	The recursion result and 1,752,452,642-step trace matched, but both parent and candidate returned `99` on new looped/nested aggregate-escape pins where evaluator and LLVM AOT returned `37` and `73`. Static destination-register aggregate identity aliases dynamic values across calls and iterations, so the executable fails the broad parity gate even though the lazy allocation mechanism did not introduce the flaw.	Revise; mechanism evidence only. Do not promote the candidate. Replace temporal frame-slot identity with a bounded session-stable value identity, retain explicit iterator-lifetime rejection, pass both escape pins, then remeasure speed and complete memory including the replacement arena.
2026-07-14 — generation-safe traced value arena	The 50,000-iteration 100-doors pressure program completed exact checksum `540000` after 952,600,025 semantic steps and 5,250,001 value allocations. Adaptive trace/sweep reclaimed 5,249,960 entries and reused 5,248,971 while bounding both peak live entries and physical slots to 1,030 and measured arena capacity to 193,472 bytes. The release run took 8.354 s and 7,164 KiB raw peak RSS. Against the append-only candidate on sustained recursion, the arena added 3.99809614469% to the three-run mean (12.606 s to 13.110 s).	Slot+generation handles reject stale identity; collection traces active frame registers, logically live move scratch, heap collection children, ownership scratch, and aggregate fields. Exact escape results `37`/`73`, the fifteen-case typed/untyped repeated corpus, collection/string suites, 26 VM tests, and warning-denied checks pass with zero exit-live heap state. LLVM is untouched and no semantic fallback was added.	Retain and harden as the identity baseline. The append-only arena is rejected because it exhausts 1,000,000 slots and about 84 MB on the same semantic shape. Preserve the bounded generation-safe design while reducing its measured interpreter overhead, extending root/property/fuzz coverage, and deriving final trace/drop schemas from shared executable value semantics.
2026-07-14 — four replicated stable-Rust dispatch sites	Against the generation-safe parent, fifty 100-doors runs regressed from 37.9 ms to 45.2 ms mean, or 19.2612137203%. Twenty-run mixed readings also regressed on strings by 9.71659919028%, file pipeline by 3.30188679245%, and JSON construction by 1.44356955381%; sharing/calls was noise-neutral. Executable text grew by 644 bytes.	The candidate retained one quota/profiler event per semantic operation, exact outputs, 26 VM tests, and the fifteen-case repeated corpus. It changed only loop layout and did not cross a semantic or backend seam.	Reverted as broadly adverse. LuaJIT’s replicated assembly tail dispatch is a design pressure, not a transferable Rust recipe. Do not retry loop unrolling without new generated-handler or assembly evidence; prioritize physical copy/constant elimination, flat activations, and typed slots.
2026-07-14 — loop-local semantic step counter	A paired ten-run 100-doors `perf stat` comparison increased retired host instructions from 651,843,658 to 659,723,974, or 1.20892730999%, and cycles from 177,947,802 to 189,690,874, or 6.59916664776%. Wall-time samples were discarded because unrelated graph queries saturated the machine during that window.	The counter synchronized to session metrics on success, quota, overflow, and handler error; exact profiler quota-prefix tests, all 26 VM tests, and the fifteen-case repeated corpus passed. No seam or semantic operation changed.	Reverted as adverse. The compiler already handles the session field efficiently; explicit synchronization enlarges the hot error/control path. Preserve per-op quota exactness and seek gains in physical operands, values, frames, and handler count.
2026-07-14 — frozen generational-arena executor disassembly	The pinned `/tmp/ori-vm-genarena` artifact has build ID `6f53de63f298ae4b4c1f1f0d4e2a5b113d9a4ee1` and SHA-256 `eb68280e261aaf7b5e6113bb41bb8061b2e4d3691a9a25f0577d1c6e0edd3a54`. Its 6,120-byte `execute_report` reserves 872 host-stack bytes and repeats quota, frame/function, PC, 32-byte `Op`, and 16-byte `VmValue` work per semantic operation. `int_binary` is 1,985 bytes, `binary` is 2,391 bytes, and `call` is 2,256 bytes with full-frame Unit fill plus checked argument transfer.	The audit was read-only. Live source changed after the artifact, so binary layout facts remain pinned to that build; an older `perf.data` build ID did not match and was rejected for symbol attribution. Recursion’s seven dominant opcodes cover 99.9999994864% of dispatches, while the short doors profile’s top four opcodes and top three regions cover 71.5735089804% and 70.7204172972%.	Promote the structural hypothesis, not an encoding. Build a dense `PhysicalVmPlan` with cached hot state, compact 8/16-byte physical entries, typed banks, flat activations, and exact canonical-PC maps. Then test general 4-16-op verified tracelets. Preserve exact quota prefixes, probes, errors, effects, roots, calls, and ARC order; retain the generic plan as the differential oracle.
2026-07-14 — combined string/runtime closure plus LLVM ownership audit	The real VM fully executes `bench_string.ori` (4 functions, 304 operations, 1,584,518 steps) and `json_builder.ori` (112 operations, 240,048 steps) after closing string descriptors and typed string operations. The combined benchmark exposed a pre-existing native runtime violation: borrowed case transforms returned an unretained in-place heap alias.	The cure preserves the canonical borrowed independent-result contract; it does not add a VM semantic special case or weaken AIMS. Runtime independence tests and two AOT regressions pass. `bench_string.ori` now exits zero through evaluator debug/release and leak-checked LLVM debug/release AOT with ARC verification. Release AOT evidence was accepted only after explicitly rebuilding the selected `target/release/libori_rt.a`; a run linked to the stale archive was discarded.	Retain the descriptor closure and ownership finding; harden the implementation. Add aliasing/result-independence to the shared runtime spec, automate compiler/runtime identity in the parity harness, and do not promote string specialization until the broad corpus and scaling gates pass.
2026-07-14 — identity physical-plan storage and validation audit	Fifteen structural tests pass and all eight real VM benchmark fixtures prepare. Exact aggregate payload is 35,236 B of plan-owned boxed tables beside 19,520 B of canonical ops; retaining both is 54,756 B. The plan alone is 1.80512295082× the canonical op payload, and combined retention is 2.80512295082×. A cold audit then proved the validator is only internally self-consistent: it can accept truncated canonical coverage, wrong operand arity/immediate kinds, and unjustified copy no-ops because it does not validate against the canonical function. Dense known-value propagation additionally holds one register-wide state per reachable PC and clones it per edge; this unreported planning scratch is O(PCs × registers).	Exact retained-table accounting and typed arithmetic overflow are valid, but the artifact is neither execution-admissible nor a complete memory result. No physical executor or timing claim was made.	Reject and redesign before execution. Validate exact canonical coverage and per-op semantics at both preparation and executor entry, add negative pins for each malformed shape, report preparation peak/cumulative allocation, move known facts to sparse block-boundary dataflow, make identity correspondence implicit, and require total resident memory plus broad speed evidence.
2026-07-14 — canonical physical-plan hardening	Preparation and execution-view acquisition now release-validate exact function/register/op coverage, contiguous operand spans, ordered reads/writes, immediate value plus kind, copy-noop proof, physical-lane bounds, and full side-table coverage against canonical bytecode. One exhaustive bytecode operand walker is the register-traversal SSOT for physical construction, validation, and verifier bounds checks; call ownership remains an explicit `CallArgument` fact. Missing function/lane/PC, wrong valid lanes, wrong immediate kind, false no-op, out-of-bounds lanes, and direct/call/constructor operand failures have negative pins. Seventy-nine VM tests and warning-denied all-target clippy pass.	The validator/proof boundary is now admissible to retain. Dense per-PC known-value clones, total retained bytes, and lack of an executor are deliberately unchanged, so this is correctness evidence rather than speed or memory evidence.	Retain the proof machinery; continue the redesign. Replace dense state with sparse block-boundary facts, report preparation peak/cumulative allocation, compress identity/bindings, then execute the validated identity plan before testing typed banks or tracelets.
2026-07-14 — sparse block-boundary physical planning	The solver now retains sorted known facts only at reachable block entries and replays each block once, replacing register-wide state at every reachable PC and cloned edge state. Exact joins, loops, moves, switch arms, direct/call operands, normal/unwind successors, unreachable blocks, and high-register functions are pinned. Across the eight real fixtures, planner scratch peak/cumulative bytes changed from `122/122` to `169/267` for the one-op return, `590/942` to `210/312` for print, `125,887/441,445` to `9,898/33,304` for the aggregate loop, `211,884/752,110` to `12,784/44,263` for nested aggregates, `42,785/107,686` to `4,257/13,313` for nested lists, `475,227/1,855,499` to `18,991/64,442` for nested strings, `28,924/76,470` to `1,425/3,634` for split control flow, and `11,672/24,272` to `802/1,482` for UTF-8 runtime work. The fixed sparse metadata regresses the one-op peak by `38.5245901639%` and cumulative allocation by `118.852459016%`; nontrivial peak reductions range from `64.4067796610%` to `96.0038044976%`. High-register release preparation improves from `22,124,059` to `154,673 ns` at 4,096 registers (`143.037627770×`) and `95,927,814` to `330,020 ns` at 16,384 registers (`290.672728926×`), while peak scratch falls to 919 B in both cases.	Construction and validation allocation are measured separately, both return current scratch to zero, and retained plan bytes are unchanged. Diagnostic paired Criterion medians improve on all eight fixtures, but shared-machine load makes those readings directional rather than promotion evidence. VM `95/95`, benchmark corpus `2/2`, formatting, and diff checks pass. Warning-denied no-deps clippy stops at the generic executor’s 102-line function; that hygiene finding remains in the active branch-wide review scope.	Retain the sparse solver and its exactness pins. Its retained complexity is `O(P + B + B×F)` for plan markers, block metadata, and boundary facts, with sorted-fact lookup `O(log F)`, insertion `O(F)`, and predecessor intersection `O(F log F)`. Accept the one-op fixed-cost regression because it is explicit and bounded, but do not claim a runtime win. Route one identity physical executor through the validated plan next; require exact generic/physical results, canonical step prefixes, quotas, probes, errors, ownership order, cleanup, and broad speed/memory evidence before typed banks, copy/constant elimination, or tracelets.
2026-07-14 — physical-executor validation-lifetime and layout audit	Live-source inspection found that every physical run calls `execution_view()`, which repeats whole-plan validation, CFG discovery, sparse fixed-point analysis, replay, operand walking, and scratch allocation. Partial retained/scratch rows before an unrelated in-progress AIMS oracle failure were `176/169/267` B for the one-op return, `376/210/312` B for print, `5,980/9,898/33,304` B for aggregate escape, and `7,804/12,784/44,263` B for nested aggregate escape, where each tuple is plan-owned/validation-peak/validation-cumulative bytes. Partial Criterion readings of 86 ns generic versus 354 ns physical on a tiny case and 2.39 us versus 12.96 us on an aggregate loop include this repeated validation and therefore are not dispatch verdicts.	Safe Rust already makes a prepared plan immutable and borrow-bound to its verified program, so repeated validation adds no safety after successful construction. The AIMS failure (`retain_first_inner` inferred `Affine`, realized `Unrestricted`) invalidated the unfinished benchmark run and is being repaired independently; no physical conclusion may use the stopped corpus. One generic semantic dispatch with sealed canonical/physical layout policies can produce two monomorphized hot loops without forking opcode, RC, runtime, error, or unwind behavior.	Promote the architecture correction and test it before metadata work. Introduce a private untrusted candidate, validate and bind it once at prepare/decode, make the branded plan’s execution view infallible, and require zero validation calls/allocations per run. Then pin error coordinates and ownership-event order, specialize only the layout/operand boundary, inspect assembly/code size, and rerun the full mixed corpus. This supersedes the earlier executor-entry revalidation requirement; malformed candidates remain fail-closed before a session can exist.
2026-07-14 — post-review identity physical-executor breadth gate	A real physical worker now consumes the prepared plan through `execute_physical_report`; the worker shares source/frontend/realization/compile/verify with the generic lane and selects only the final executor, with explicit `requested_plan`, `executed_plan`, `fallback`, phase, and prepared-plan metrics. The post-review historical-48 sweep emitted 207 case records plus run/summary and classified each generic and physical lane identically: 13 not-run frontend rejects, 46 evaluator-correct, 44 comparison-unavailable, 81 unsupported, 14 realization errors, one runtime error, four timeouts, one verifier error, three internal errors, and zero mismatch/compile/fallback/physical-prepare errors. The all-frontend-valid sweep also emitted all 209 records and classified each lane as 13 not-run, 87 evaluator-correct, two mismatches, one comparison-unavailable, 81 unsupported, 14 realization errors, one runtime error, four timeouts, one verifier error, three internal errors, and zero fallback. Generic-versus-physical shared observations were exactly equal on 207/207 in both sweeps, including typed errors and exact output artifacts. Both lanes entered 91 executions; all 182 reports cleared the final heap/value-arena leak gate, and all 91 physical entries published metrics. Every VM timeout retained supervisor phase/provenance and bounded process-group cleanup completed without a kill/reap error. Historical process RSS samples were available for all 194 generic and 194 physical workers, with explicitly lower-bound medians 9,014 and 8,974 KiB; physical plan-owned bytes were median/max 2,852/37,716 B and retained canonical-plus-plan bytes 4,416/56,852 B.	The all-frontend-valid oracle produced 184 successes, three runtime errors, and seven timeouts. It exposed three blockers hidden by generic-versus-physical agreement: `tests/valgrind/aims_fip_interprocedural.ori` and `tests/valgrind/aims_h_fip_reuse.ori` raise evaluator `NotCallable/E6032` but both VM lanes return `Int(0)`; `tests/valgrind/cow/cow_list_concat.ori` returns evaluator `Int(0)` but both VM lanes raise `type_mismatch` after seven steps. Their output-prefix artifacts are all exactly empty, so the divergence is typed result/error behavior.	Retain the executor and harness; block promotion. Generic-versus-physical equality proves that the VM-private physical projection preserves the current generic VM behavior, not that the VM has absolute evaluator or LLVM parity. Repair the three shared-semantics blockers, eliminate per-run physical revalidation by validating/branding once, and rerun error-prefix, cleanup, memory, and broad performance gates. Keep AIMS facts/policy and opcode/runtime semantics single-owned; never turn the generic executor into a fallback. LLVM debug/release/AOT and leak parity remain independently mandatory.
2026-07-14 — validate-once branded physical-plan prototype	`prepare` now validates the complete candidate before privately constructing an immutable `PhysicalVmPlan` bound by borrow to the exact `VerifiedProgram`. Execution and profiling acquire an infallible table view with no analysis, replay, operand walk, or allocation; the public physical execution APIs no longer expose an impossible post-branding `PrepareError`, and storage-metric reads no longer trigger validation. Deliberately corrupted test candidates still exercise the full validator before branding.	All 38 focused physical tests pass, including exact generic/physical results, every canonical quota prefix, profiling coordinates, call-frame failures, panic/unwind output, runtime ownership cleanup, malformed-candidate rejection, and storage accounting. The optimized Criterion binary built, but fixture construction stopped before measurement at `validated PrimOp v4 is missing its frozen fact`; the earlier full VM run similarly exposed missing v3/v5 facts in a profile fixture. No timing from either stopped run is valid, and the total frozen-fact producer is being repaired at the shared seam without fallback.	Retain the brand and infallible API shape; performance promotion remains blocked. Prove total primitive-fact population, rerun the 207-case evaluator/generic/physical sweep and LLVM debug/release/AOT leak matrix, then compare the same eight historical revalidation medians and all seventeen mixed execution workloads. Only after those gates may the removed validation cost count toward the Python floor; it cannot address long-running dispatch cost by itself.

Math checks for the typed-specialization row:

python3 .claude/skills/calc/calc.py "(1 - 0.0312283035/0.033062362)*100" -d 12 -> 5.54727003473.
python3 .claude/skills/calc/calc.py "(1 - 0.03194846844/0.03451439006)*100" -d 12 -> 7.43435307864.
python3 .claude/skills/calc/calc.py "(1 - 572574835/580198926)*100" -d 12 -> 1.31404776161.
python3 .claude/skills/calc/calc.py "5243103 - 5233891" -d 12 -> 9212.

Math checks for the verifier-backed direct-access row:

python3 .claude/skills/calc/calc.py "(0.031745495 - 0.0311347375) / 0.031745495 * 100" -d 12 -> 1.92391865365.
python3 .claude/skills/calc/calc.py "(0.03269269304 - 0.03193631866) / 0.03269269304 * 100" -d 12 -> 2.31358848008.
python3 .claude/skills/calc/calc.py "(572573381 - 518627916) / 572573381 * 100" -d 12 -> 9.42158102177.
python3 .claude/skills/calc/calc.py "(134993563 - 126231868) / 134993563 * 100" -d 12 -> 6.49045391890.
python3 .claude/skills/calc/calc.py "(71329197 - 69499673) / 71329197 * 100" -d 12 -> 2.56490199939.

Math check for the direct user-call transfer row:

python3 .claude/skills/calc/calc.py "(1 - 17.579/20.687)*100" -d 12 -> 15.0239280708.

Math checks for the sparse block-boundary planning row:

python3 .claude/skills/calc/calc.py "(169/122 - 1)*100" -d 12 -> 38.5245901639.
python3 .claude/skills/calc/calc.py "(267/122 - 1)*100" -d 12 -> 118.852459016.
python3 .claude/skills/calc/calc.py "(1 - 210/590)*100" -d 12 -> 64.4067796610.
python3 .claude/skills/calc/calc.py "(1 - 18991/475227)*100" -d 12 -> 96.0038044976.
python3 .claude/skills/calc/calc.py "475227/18991" -d 12 -> 25.0238007477.
python3 .claude/skills/calc/calc.py "1855499/64442" -d 12 -> 28.7933180224.
python3 .claude/skills/calc/calc.py "22124059/154673" -d 12 -> 143.037627770.
python3 .claude/skills/calc/calc.py "95927814/330020" -d 12 -> 290.672728926.
python3 .claude/skills/calc/calc.py "(1 - 919/1180018)*100" -d 12 -> 99.9221198321.
python3 .claude/skills/calc/calc.py "(1 - 919/4718962)*100" -d 12 -> 99.9805253783.

Math checks for the lazy frame-bank row:

python3 .claude/skills/calc/calc.py "(1 - 11.873/15.747)*100" -d 12 -> 24.6015113990.
python3 .claude/skills/calc/calc.py "(1 - 127120/3298640)*100" -d 12 -> 96.1462905925.
python3 .claude/skills/calc/calc.py "(1 - 7388/10648)*100" -d 12 -> 30.6160781367.

Math checks for the traced arena and replicated-dispatch rows:

python3 .claude/skills/calc/calc.py "(13.110/12.606-1)*100" -d 12 -> 3.99809614469.
python3 .claude/skills/calc/calc.py "(45.2/37.9-1)*100" -d 12 -> 19.2612137203.
python3 .claude/skills/calc/calc.py "(27.1/24.7-1)*100" -d 12 -> 9.71659919028.
python3 .claude/skills/calc/calc.py "(21.9/21.2-1)*100" -d 12 -> 3.30188679245.
python3 .claude/skills/calc/calc.py "(77.3/76.2-1)*100" -d 12 -> 1.44356955381.
python3 .claude/skills/calc/calc.py "5372855-5372211" -d 12 -> 644.
python3 .claude/skills/calc/calc.py "252453507372/1752452642" -d 12 -> 144.057249435.
python3 .claude/skills/calc/calc.py "63482336961/1752452642" -d 12 -> 36.2248516391.
python3 .claude/skills/calc/calc.py "30662310649/1752452642" -d 12 -> 17.4967984379.
python3 .claude/skills/calc/calc.py "75826032/1752452642" -d 12 -> 0.0432685198919.
python3 .claude/skills/calc/calc.py "(659723974/651843658-1)*100" -d 12 -> 1.20892730999.
python3 .claude/skills/calc/calc.py "(189690874/177947802-1)*100" -d 12 -> 6.59916664776.
python3 .claude/skills/calc/calc.py "(423175112+397075184+319436886+158226778+158226778+148155948+148155947)/1752452642*100" -d 12 -> 99.9999994864.
python3 .claude/skills/calc/calc.py "(148155948+148155947)/1752452642*100" -d 12 -> 16.9084109835.
python3 .claude/skills/calc/calc.py "(310035848+304235849+158226775+146285935+146285935+144838445)/1752452642*100" -d 12 -> 69.0408835025.
python3 .claude/skills/calc/calc.py "(938001+764203+582000+535808)/3940022*100" -d 12 -> 71.5735089804.
python3 .claude/skills/calc/calc.py "(1629600+578400+578400)/3940022*100" -d 12 -> 70.7204172972.
python3 .claude/skills/calc/calc.py "13.110/(4.485/2)" -d 12 -> 5.84615384615.
python3 .claude/skills/calc/calc.py "144.057249435/(13.110/(4.485/2))" -d 12 -> 24.6413716139.
python3 .claude/skills/calc/calc.py "144.057249435/(13.110/1.428)" -d 12 -> 15.6913617234.

Prototype breadth admission snapshot

The first existing-program sweep is diagnostic evidence, not a frozen acceptance corpus or a performance verdict. It demonstrates why combined applications must shape the executable/runtime closure before further specialization.

Existing Ori program	Semantic shape	Current prototype result
`tests/benchmarks/bench_small.ori`	Multiple numeric functions, loops, and calls	Full VM; four functions, 141 bytecode operations, 4,038 steps, zero fallback/unsupported/failure.
`tests/valgrind/sharing_and_functions.ori`	Ten-deep call chain plus aggregate transform pipeline in a loop	Full VM; fifteen functions, 137 bytecode operations, 30,069 steps, peak eleven frames, zero fallback/unsupported/failure.
`tests/benchmarks/bench_medium.ori`	Aggregate statistics and search	Rejected before VM by executable-program ownership-contract coherence mismatches.
`tests/benchmarks/bench_string.ori`	Nested string construction, searching, case conversion, and concatenation loops	Full VM; four functions, 304 bytecode operations, 1,584,518 steps, peak two frames and three heap objects, zero fallback/unsupported/failure. Evaluator debug/release and leak-checked LLVM debug/release AOT also exit zero.
`tests/benchmarks/cow/macro/graph_bfs.ori`	Graph construction, map/list mutation, indexing, nested traversal	Reached an ARC class-ledger readiness panic before executable-program closure.
`tests/benchmarks/cow/macro/json_builder.ori`	Looping string construction and string predicates	Full VM; one function, 112 bytecode operations, 240,048 steps, peak four heap objects, zero fallback/unsupported/failure.
`tests/benchmarks/cow/macro/file_pipeline.ori`	String generation, split/trim/filter, persistent list collection	Full VM after matching LLVM’s owned-result retain for indexed heap elements; one function, 291 bytecode operations, 262,341 steps, peak 4,805 heap objects, zero fallback/unsupported/failure. Evaluator debug/release and leak-checked LLVM debug/release AOT also exit zero.
`tests/benchmarks/cow/macro/sort_dedup.ori`	List construction, sort, mutation, indexing, validation	Rejected before VM because the closed runtime descriptor set lacks `sort`.
`tests/valgrind/collection_stress.ori`	Allocation plus chained iterator map/filter/take/fold	Rejected before VM because the closed runtime/callable set lacks `fold`.

No row may be removed because it is unsupported. The next breadth milestone closes the shared realization/runtime descriptors and makes these application shapes fully enter the VM before using them to promote dispatch or ISA work.

A release perf stat sample of the corrected recursion baseline retired 252,453,507,372 host instructions, 63,482,336,961 cycles, 30,662,310,649 branches, and 75,826,032 branch misses for 1,752,452,642 semantic operations.
Per semantic operation, the same sample reports 144.057249435 host instructions, 36.2248516391 cycles, 17.4967984379 branches, and 0.0432685198919 branch misses.
The 0.25% branch-miss rate rejects misprediction as the primary explanation. Physical planning must reduce handler/decode/value/call work and total host instructions, not only rearrange branch layout.

Pending hypothesis cells

Hypothesis	Required real-VM experiment	Promotion gate
Validate once and brand the physical plan	Compare the existing per-run `execution_view()` validation with construction/decode-only validation while leaving preparation outside steady-state Criterion timing. Corrupt only an untrusted candidate and prove no malformed branded plan or mismatched verified-program identity can be constructed.	Zero validation calls and validation scratch allocations during execution; unchanged retained bytes; exact generic/physical results, errors, canonical prefixes, profiles, ownership order, and cleanup across the frozen corpus.
Monomorphized layout policy	Replace runtime canonical/physical and optional-cursor branches with sealed canonical and physical policies around the same opcode match and shared semantic helpers. Inspect optimized assembly and measure cycles, instructions, branches, I-cache misses, and text size.	Canonical code contains no layout branch, physical code contains no canonical/physical branch, no duplicated opcode semantics exist, and broad speed wins are not offset by code-size/I-cache or memory regressions.
Typed operand specialization	The first integer/bool slice is positive on 100-doors. Extend the shared classification and paired typed/untyped modes across arithmetic, branch, collection, call, and error fixtures; add closed runtime-call result signatures before removing tag checks.	Win across the frozen semantic slices and combined-application corpus at multiple scales; verifier proves operand/result types; LLVM and VM share semantic classification; no dynamic semantic divergence or duplicated backend analysis.
Verified portable tracelets	Replace dispatch across typed CFG regions while retaining exact bytecode expansion and verifier-visible entry/exit/effect/ownership metadata.	Multi-program win, exact expansion parity including panic/RC traces, general region matcher, bounded metadata/code size.
AIMS ownership quickening	Select proved-unique or entry-guarded region variants and dequicken to the retained expansion when ownership assumptions fail.	Wins both unique and mixed-alias corpora; guard failure is exact and leak-free; no mutable global quickening state.
Native region JIT	Compile the same accepted region plan through an explicit tier service and use the same live-state/ownership maps for OSR exit or deoptimization.	Warmup and steady-state wins reported separately; no hidden LLVM fallback; absolute evaluator/VM/LLVM/AOT behavior and cleanup parity.

S.C.A.M.P.E.R. Experiment Generator

Use S.C.A.M.P.E.R. to generate falsifiable variants, never to promote architecture by analogy.

Lens	Current Ori hypothesis	Prototype evidence required
Substitute	Substitute verifier/AIMS proofs for repeated type, bounds, ownership, and COW rediscovery; substitute verified region entry for per-op dispatch.	Isolated check-removal and region-entry variants, malformed-artifact rejection, alias/panic/limit corpus, host-instruction and wall-time deltas.
Combine	Combine portable superinstructions, ownership quickening, OSR, and JIT behind one accepted `RegionPlan` and state-map contract.	Measure each mechanism alone and every proposed combination on application-shaped programs with nested semantic interactions; prove identical expansion/effect/RC traces and bounded interaction complexity.
Adapt	Adapt V8-style declarative handler metadata, LuaJIT-style operand specialization/register locality, and GHC-style unresolved-to-resolved artifact separation to Ori’s static typed pipeline.	Independently authored Ori implementations measured in the real VM; exact pinned-source influence record; no copied layouts/opcodes/handlers.
Modify	Vary region grain and select boundaries from types, effects, panics, calls, and ownership obligations rather than only functions or observed dynamic traces.	Grain sweep across numeric, collection, call, panic, and RC workloads; compile/verify latency, metadata/code size, and steady-state results.
Put to another use	Use AIMS ledgers as optimization proof input and generic-VM/evaluator/compiled execution as independent oracles for optimized regions.	Proof extraction tests, deliberately invalid proof rejection, and automated expansion-vs-optimized-vs-evaluator-vs-native comparisons.
Eliminate	Eliminate redundant SSA copies/block moves, side-table operand lookup, repeated verified bounds/tag checks, repeated uniqueness guards, and cold error construction from the hot loop.	One-change-at-a-time ablations followed by combined measurements; safety and diagnostic identity pins remain green.
Reverse/rearrange	Verify semantic bytecode/region correspondence before deriving host execution layout; make both portable tracelets and JIT consume VM state maps instead of mapping VM semantics backward from native ABI frames.	Round-trip/state-map tests, OSR entry/exit/deopt prototypes, target portability checks, and proof that `ori_vm` retains no `ori_llvm` dependency.

The ledger must also record null or negative results. A novel variant earns production consideration only by solving a measured Ori problem better than the simpler parent while preserving the pure seams and absolute parity contract.

Layer Coverage

Layer	Disposition
L1	N/A: no grammar changes.
L2	N/A: no typechecking changes.
L3	N/A: no canonicalization changes.
L4	Covered by the RC/control-flow execution-trace criterion.
L5	Covered by the VM execution criterion.
L6	N/A: dispatch is VM-only.
L7	N/A: dispatch is VM-only.
L8	N/A: dispatch is VM-only.
L9	Covered by the section cross-executor criterion.
L10	Covered by the section leak-freedom criterion.
L11	Covered by the call/control/error spec-fixture criterion.
L12	Covered by the real CLI recursion/call criterion.

Work Items

Implement stable-Rust match dispatch and the safe typed register file, then compare viable alternatives using assembly, callgrind/hardware counters, and macro workloads before selecting one.
Implement indexed frames, explicit Call/TailCall/Return, all descriptor-based callable paths, panic propagation, and clean resource limits without a tree-walker fallback or Rust-stack recursion.