---
status: historical
created: 2026-08-19
reason: "Stage-C W1 (d′) independent adversarial review of PR #6029 (server-execution v2): LANDABLE-WITH-FIXES, 0 BLOCKER / 3 MAJOR / 9 MINOR / 6 NIT. The (d′) mechanism held; the fixes are pin vacuity and register/spec honesty. Verbatim reviewer deliverable; the fixes landed on-branch are recorded in w1-dprime-fix-report.md beside it."
---

# Independent adversarial review — PR #6029, W1 (d′) (server-execution v2, stage C)

Reviewer: independent adversarial reviewer (read-only on the branches; nothing pushed, nothing commented; this file is the deliverable).
Head reviewed: `claude/server-exec-v2-w1-dprime` @ **`19c6448ab`** (= the PR tip at review time; the coordinator's stated tip).
Base: `claude/server-exec-v2-stage-c-design` @ `461b01822`. Diff: 16 files, +2352 / −307.
Worktree: `/Users/berni/labs-worktrees/review-w1` (detached at `19c6448ab`); tree clean at the end (§5).
All file:line references below are at `19c6448ab`.

## 1. Verdict

**LANDABLE-WITH-FIXES.**

- **No BLOCKER found.** I looked for a correctness hole or an under-demand path across enter/leave/registration/unregistration, the currency check, the push-growth notify, park/reactivation, and the deletion, and found none: the (d′) mechanism as built is correct by inspection and by the probes that bite (M-A1, M-D, M-G), the walk is fully deleted, the OFF arm is unreached by construction, the smoke's numbers are backed by raw artifacts, and every suite the builder names is green at the counts claimed (one pre-existing flake, green 2/2 alone).
- **The fixes are about the PINS and the REGISTER, not the mechanism.** Three of the named pins are vacuous for the mechanism they are named for — P-arrival does not pin the per-key currency check (the build report's recorded killing mutation for it is REFUTED: the mutant is green), P-coarse never exercises a root release (a no-op `leave` is green), and T2′-cross/T3′ pin the notify COUNTER while the value they assert was landed by another session's demand before the link existed — so the register's OW39 closure and the W1 build-delta coverage rows overstate what is red-first. Plus four counter/spec-honesty MINORs and one bounded wake-loss schedule (pre-existing shape). None of these is a reason to keep the code off the branch; all of them should be fixed before W4 reads the counters and before the confidence verdict cites the pins.

Finding counts: BLOCKER 0 · MAJOR 3 · MINOR 9 · NIT 6.

## 2. Findings by severity

### MAJOR

**MAJOR-1 — P-arrival does not pin the per-key currency check; the build report's killing mutation for it is refuted.**
Where: `packages/runner/test/executor-dprime-w0.test.ts:730–773` (P-arrival; the only use of `notCurrentRearms` is the `console.log` at :762 — no assertion); `packages/runner/src/scheduler/facade.ts:1114–1140` (`rearmNotCurrentForDemander`); build report `w1-dprime-build-report.md` §3 row "P-arrival — break `rearmNotCurrentForDemander` (return 0) → Bob's instance never materializes".
Scenario: mutation M-C (`return 0` before the writer loop, after the writers lookup) → **all 6 steps GREEN**; the log reads `[P-arrival] notCurrentRearms +0, demandArrivals +1`. Bob arrives on the ROOT key, so the KEPT root-level arrival re-arm (`invalidateActionsForDemandRoots`, `space-server.ts:2692–2712`) materializes his instance; the per-key check — design §2.2's "what serves the non-root growth the root-level re-arm cannot see" (a doc entering Alice's closure whose writer is a clean, narrowed root for Bob's sake) — is exercised by NO pin, and the only pin named for it asserts nothing about it.
Fix: (a) P-arrival must assert `stats.demand.notCurrentRearms` increased, AND a pin must construct the NON-ROOT arrival the per-key check exists for: a second principal whose closure reaches the narrowed writer's OUTPUT doc through a non-root row while NO root key of that piece gains her pair (e.g. she reaches the computed through a link from ANOTHER piece's doc she watches — the cross-piece shape — so `arrivals` is empty and only the per-key check can materialize her instance); assert `notCurrentRearms` +1 and that her instance lands; M-C must turn it red. (b) Correct the build report row (it records an observation that does not reproduce at `19c6448ab`).

**MAJOR-2 — P-coarse never exercises a root release; the leave/release path (1→0) is unpinned.**
Where: `executor-dprime-w0.test.ts:660–728` (P-coarse); the only leave assertion is `expect(stats.demand.demandRootLeaves).toBeGreaterThanOrEqual(0)` at :720 (always true); `facade.ts:1089–1103` (`leaveDemandedEntity`); register rows `verification-coverage.md:3884–3890` ("COVERED by the §8 liveness bracket on enter/leave/registration and the coarse leave … pin P-coarse") and OW39 `:3784–3810`.
Scenario: mutation M-B (`leaveDemandedEntity` returns before the decrement) → **all 6 GREEN**; `[P-coarse] demandedWriters 2 → 2; enters=2 leaves=0` in BOTH arms. In the pin, the keys that depart with Bob name entities with NO scheduler writer (his `user:bob\0…` rows — the per-user arg/draft doc and, if present, per-user instances of the space-declared computeds, which map to a `user/computed:…` entity while the writer is indexed under `space/computed:…` — see DIAG-2; the computeds' demand rides the shared `space\0computed:…` keys Alice still tracks), so no 1→0 ever happens. Mutation M-I (release one key EARLY: `before <= 2` — an UNDER-DEMAND direction) is ALSO green: no writer entity in the suite is named by two keys, so the refcount is never tested either way. The code is correct by inspection (`wasLive` captured before the flip; `notifyNodeLivenessChange` after; `withdrawDemandFrom` re-derives), but "a demanded instance's writers … release it when none does" has no red-first pin, and the register says it is COVERED.
Fix: a pin with a SPACE-scoped writer entity tracked by two sessions (one key, two pairs, which does not release) PLUS a writer reachable only through one session (e.g. a second piece only Bob watches) whose departure must flip `demandedWriters` N→N−1 and `demandRootLeaves` +1, and a later write to its input must NOT re-derive (dormant) — while the shared writer still does; and an early-release check (the shared writer stays a root after one of the two leaves).

**MAJOR-3 — T2′-cross and T3′ pin the push-growth NOTIFY counter; the "lands in a later derived commit" half is vacuous, and no pin demonstrates a value landing BECAUSE a closure (non-root) row was demanded.**
Where: `executor-dprime-w0.test.ts:868` (Alice sinks P2's result), `:889–892` (the fixture WAITS for `leaf:5` to land BEFORE the link is written), `:968` / `:1021` (the landing assertion after the link); register `verification-coverage.md:3891–3899`.
Scenario: mutation M-D (both notify sites suppressed; the builder's M2) → T2′-cross/T3′ fail ONLY on `Expected 0 to be greater than 0` and the log still says `leaf present=true`. Mutation M-E (the loop ignores every non-root row: `if (!row.root) continue;` at `space-server.ts:2503`) → only P-coarse bites (`registry keys=12` vs union 16, the size equality at `:719`); T1′/T4′/T7′, P-arrival, T2′-cross, T3′ all GREEN, because every demanded writer in the suite is ALSO reachable through a client-pulled ROOT row (T7′ log: `computed rows=4 (root:true 2 / root:false 2)`), and in T2′-cross/T3′ P2's `leaf` is demanded by ALICE's root watch. So the spec sentence "a derivation that becomes reachable through a wave's own write becomes demand when the tracker's push-time re-traversal reaches it and lands in a later derived commit" is pinned only up to "becomes demand" (the closure grows + the notify fires); the loop half (enter → root → derive → land) over a closure row is pinned by nothing but a registry-size equality. (The T2′ PROBE's "asserts the landing" is likewise vacuous: `guarded present=true` before the flip — the CREATOR's client run landed `hidden:7`, M-A1 leaves it green.)
Fix: a growth pin in which the target is demanded by NOBODY before the link (no session watches P2; the creator departs past the TTL as in the T2′ probe; the firing actor watches only the stream root with a schema that does not reach `target`), so that `leaf` lands server-side ONLY through Bob's post-link closure row; assert `demandedWriters` +1, the landing, and (for the loop half) that M-E-style row filtering makes it red. If the `source`-wiring pre-emption makes that unreachable in one piece, say so in the register row instead of "COVERED".

### MINOR

**MINOR-1 — A demand wake (growth OR watch) can be lost to the idle window when a pass straddles cycles.** `space-server.ts:2909–2919` (`??=` joins an in-flight pass; `.finally` resolves `#feedArrived` only if a waiter is installed), `:1012–1029` (`noteDemandChanged`), `:1827–1858` (`#waitForInput` consumes the latch). Schedule (default `DEFAULT_FLUSH_DEADLINE_MS` = 100, grace 300): t0 cycle 1 starts pass P1 (snapshots rows; a slow `ensurePieceRunning` keeps it in flight 500 ms) → t0+20 push growth → timer → t0+100 cycle 1 exhausts → waiter installed → t0+320 timer fires, latch=true, resolves the waiter (the latch branch is NOT taken) → cycle 2 joins P1 → exhausts → `#waitForInput` consumes the latch → cycle 3 joins P1 → P1 completes (`.finally` resolve is a no-op mid-cycle) → cycle 3 settles → `#waitForInput` sleeps up to `idleParkMs` (30 s) or the next input. P1 snapshotted BEFORE the growth, so the entered doc's writer is not a root until then (the schedule also needs no sealed contribution after P1 — `#hasWork()` true would spin a fresh-pass cycle). Pre-existing shape for watch wakes (the same latch), now also the growth path's; bounded (next input / 30 s; the client session keeps the space from parking). Fix: capture a demand-note counter at pass start; in `.finally`, if it moved, set `#pendingDemandWake = true` (re-latch) so the next wait runs a FRESH pass.

**MINOR-2 — `demandRootEnters/Leaves` under-count hook-driven transitions between passes.** `space-server.ts:2469–2470` snapshots the runtime counters at pass START and folds `counter − start` at `:2740–2743`. A transition fired by the registration hook OUTSIDE a pass — a piece loaded by event dispatch (`#drainStreamEvents` runs BEFORE the pass in `#waveCycle`), a piece stopped between passes — lands in no delta and is lost from the space-lived total (the smoke's `enters 223 = writers 223` holds only because chat's pieces load inside the pass). §7/stats.ts call it "ACCUMULATED … across the space's whole life" (`stats.ts:157`, `serving-loop.md:1255`). Fix: fold `counter − lastFolded` with `lastFolded` reset to 0 when the runtime is replaced.

**MINOR-3 — `demandPassMs` is pass WALL TIME including structure-load awaits, labelled "the pass's O(rows) reconcile cost".** `space-server.ts:2462/2746`; the label at `stats.ts:161` and `serving-loop.md:1259`. The early passes' `ensurePieceRunning`/`#confirmNoPatternMeta` awaits are inside it. Fix: either time only the reconcile segments or relabel.

**MINOR-4 — The settle series' `class` is documented as "a push-growth wake fired between admission and coverage" but is assigned on a wake AFTER coverage + the next derived commit, by adjacency; and loopback-session growth feeds it.** Code: `space-server.ts:965–998` (`#noteGrowthWakeForSettle` reads `#lastCovered`, set at coverage; `#recordGrowthLanding` at the next derived commit; `enqueueCommit` clears both). Docs: `stats.ts:186–187`, `serving-loop.md:1270`. The raw W1 smoke series confirms: 10 of 45 `value-only` entries have `growthWakes > 0` (wakes between admission and coverage do NOT change the class). Additionally the push-growth notify is not principal-filtered (`server.ts:3879–3886`, `:3990–4004`; neither is the pre-existing watch site): DIAG across the (d′) suite — 20 growth notifies = 14 Alice, 4 Bob, **2 from the SERVICE (loopback) session**. Consequences: `pushGrowthWakes` counts the serving runtime's own tracker growth; each arms a wake → an extra cycle + O(closure) pass that can find no client delta; and a loopback growth after coverage classes the covered input `structural-growth` with a "landing" at the next derived commit. The W0/W1 "structural-growth 220–263 ms p50" numbers are therefore attribution-by-adjacency (the reports say so) AND include loopback-driven entries (they do not say so). Fix: filter the notify by the observer's excluded principal (pass it on `ServerExecutionObserver`, or have the host drop notifies from the service session); fix the §7/stats.ts sentence.

**MINOR-5 — T10′ (`SCHEDULER_LIVENESS_EQUIVALENCE=1`) is vacuous in the (d′) pin suite; the guard lives in `executor-fan-out` (f).** Mutation M-A2 (disjunct dropped from `recomputeLiveRefs` ONLY, `dependency-graph.ts:615–619`) → the (d′) suite is GREEN under the hook (every demanded writer reads only authored docs: no upstream scheduler writer, liveRefs 0 either way — the check compares refcounts, not root status); the same mutant is RED in fan-out (f) (`liveness drift after registerDependentEdge: action: incremental=1 rebuilt=0`). Likewise M-H (enter bracket broken: `wasLive` forced true on enter → no upstream grant) is GREEN across dprime + fan-out (17 steps): nodes enter the demanded set at registration, before any edge exists, so the grant is vacuous there and later `registerDependentEdge` keeps refs consistent; the enter-direction grant for a node that already has upstream edges (ran under provisional demand, went dormant, then demanded) is unpinned. The code brackets correctly by inspection (`facade.ts:1032–1064`). Fix: a pin whose demanded writer has an UNDEMANDED upstream scheduler writer (reach it only through the demanded writer's read), assert the upstream re-runs on an input change (starvation witness), and keep the hook on.

**MINOR-6 — The demand pass is O(closure) per WAVE inside the settle race; the cost curve is linear with a cliff at ~10–20× today's closure.** `space-server.ts:2490` (exposure, O(Σ trackedIds) row objects + Map), `:2496–2746` (~6 linear passes with Map/Set allocation: `rowByKey`, `demandersNow` Map-of-Maps, `currentKeys`, `[...#demandersByKey.keys()]`, `[...known.keys()]` per key, `pairCount`). Measured (W1 smoke): 2030 ms / 417 passes = 4.9 ms/pass at 1922 rows / 823 keys (incl. early structure-load awaits) ≈ ≤2.5 µs/row. Linear: ~25 ms at 10 K rows, ~100 ms (= the whole default flush deadline) at ~40 K. The closure is monotone per session (R-D; W0: 0 → 1 721 over 20 notes, one session). Obligation (i) was met by "delta-cheap per row", not "off the race": the O(closure) exposure + reconcile still runs EVERY wave (and every wake cycle) and is awaited before `runtime.idle()` (`:2930–2931`). Sub-second holds at today's sizes; not a hole; the incremental-delta follow-on is named. Cheap improvement: a per-space demand generation on the memory server (bumped on watch.set/add, push growth, session prune) so a pass with an unchanged generation does only its pending structure-load retries.

**MINOR-7 — `#pendingSettles`, `#lastCovered`, `#growthAwaitingLanding` survive `park()`** (`space-server.ts:3412–3495` clears neither): an input admitted in one tenure and covered in the next records `ms` spanning the park; a growth wake right after reactivation attributes to the pre-park input. Stats honesty only.

**MINOR-8 — The OFF-arm `commitWatchState` Set diff runs with no observer.** `server.ts:3990–3999` iterates `evaluatedTrackedIds` on every full evaluation when sizes are equal, even with `#serverExecutionObserver?.demandChanged === undefined`. Negligible (full evaluations are not the hot path) but it is new OFF-reachable work; gate it on the observer. (The other OFF-reachable addition is the empty-Set `has` in `isDemandRoot`, `dependency-graph.ts:65` — no behaviour change.)

**MINOR-9 — Register/spec rows overstate red-firstness.** `verification-coverage.md:3784–3810` (OW39 CLOSED: "pins … red-first with recorded killing mutations"), `:3884–3890` (release "COVERED … pin P-coarse"), `:3891–3899` (growth "COVERED … pins T2′-cross / T3′"); `w1-dprime-build-report.md` §3 (the P-arrival row). Per MAJOR-1..3 these must be re-worded to what is actually pinned (the exposure, the notify counter, the root kind being load-bearing, the registration bracket, the registry-size equality) until the pins are strengthened. The §1 amendment (`serving-loop.md:67–75`) is descriptive and consistent with the T2′ probe's observed rows; the §7 counter LIST matches the code's fields exactly; residual (ix) is restated; the future rows (flag 4/5/9, no-grace wake, l3→W3, OW37 re-read, R-D) are present and match the build report §6.

### NIT

- NIT-1 `ServingLoopStats.settle.series[]` type (`stats.ts:190–206`) omits the runtime-added `msGrowth` / `growthWaves` / `graceMs` / `growthLandedAt` fields the reports quote, and the internal `growthWakeAt` / `wavesAtCoverage` bookkeeping leaks into the JSON (`space-server.ts:952–954`, `:968`, `:979–997`); `host.stats()` copies the array shallowly so a snapshot's entries mutate later.
- NIT-2 Stale comments: `facade.ts:1153` ("a demand walk's …"), `space-server.ts:451` ("the structure load and the demand walk address"), `executor-space-server.test.ts:889` ("reads watchedRootsForSpace on every demand pass").
- NIT-3 `watchedRootsForSpace` (`server.ts:4147`) is production-dead (tests use it as a witness at serving-loop:2823, instance-keyed-replica:625, fan-out:948); mark deprecated or migrate the witnesses.
- NIT-4 `currentKeys` (`space-server.ts:2524`) duplicates `rowByKey`'s key set; `[...known.keys()]` per key and `demandersNow`'s inner Maps are avoidable churn.
- NIT-5 `pushGrowthWakes` / `watchWakes` count NOTIFIES (pre-coalescing), and tests call `noteDemandChanged()` directly in `waitUntil` loops (counted as `watchWakes`); the names say "wakes".
- NIT-6 The `commitWatchState` notify carries reason `push-growth` for a SHRINK too (harmless; a pass retires departed keys sooner).

## 3. Mutation-probe table

All probes applied by a one-line edit at `19c6448ab`, run on `packages/runner/test/executor-dprime-w0.test.ts` in the PACKAGE-TASK form (`ENV=test deno test --no-lock --no-check --preload=test/clock-preload.ts …`, the realClockFiles preload) with `SCHEDULER_LIVENESS_EQUIVALENCE=1`, then reverted with `git checkout -- <file>`; baseline = 1 passed (6 steps), 9 s.

| probe | mutation (site) | pins RED | pins GREEN | reading |
|---|---|---|---|---|
| **M-A1** (= builder's M1) | drop `isDemandedWriter` from `isDemandRoot` AND `recomputeLiveRefs` (`dependency-graph.ts:59–65`, `:615–619`) | T1′/T4′/T5′/T7′/T9′/P-demand-set, P-coarse, P-arrival, T2′-cross, T3′ (5 timeouts: "label to land", "each user's echo", "alice's instance", "leaf:5 to land" ×2) | T2′ probe (its landing was the creator's client run) | REPRODUCED — the root kind is load-bearing |
| **M-A2** | drop the disjunct from `recomputeLiveRefs` ONLY | (d′) suite: none; `executor-fan-out`: (f) RED with `liveness drift … incremental=1 rebuilt=0` | all 6 (d′) steps | the equivalence hook is blind to the kind in the (d′) suite (no upstream writers); fan-out (f) is the real T10′ |
| **M-B** | `leaveDemandedEntity` no-op (`facade.ts:1094`) | none | all 6 | release path UNPINNED (P-coarse never releases: `2 → 2`, `leaves=0`) |
| **M-C** | `rearmNotCurrentForDemander` returns 0 before the loop (`facade.ts:1121`) | none | all 6 (`[P-arrival] notCurrentRearms +0, demandArrivals +1`) | per-key currency check UNPINNED; build-report row REFUTED |
| **M-D** (= builder's M2) | both push-growth notify sites suppressed (`server.ts:3884–3886`, `:4004`) | T2′-cross, T3′ (`Expected 0 to be greater than 0`; `leaf present=true` still) | the other 4 | REPRODUCED — the counter is pinned; the landing is not |
| **M-E** | loop ignores non-root rows (`if (!row.root) continue;` at `space-server.ts:2503`) | P-coarse only (`demandedInstances` 12 ≠ union 16) | T1′…, P-arrival, T2′-cross, T3′ | closure-row consumption pinned only by a size equality |
| **M-F** | departed keys never retired (`space-server.ts:2538` loop skipped) | P-coarse (`registry keys=19` ≠ 16) | the other 5 | registry retirement pinned (same equality) |
| **M-G** | registration hook never installed (`facade.ts:1002`) | same 5 timeouts as M-A1 | T2′ probe | registration bracket load-bearing and pinned |
| **M-H** | enter unbracketed (`wasLive` forced true on enter → no upstream grant; `facade.ts:1056`) | none (dprime + fan-out, 17 steps, hook on) | all | enter-direction grant unpinned (vacuous at registration time) |
| **M-I** | release one key EARLY (`before <= 2`, `facade.ts:1094`) — an under-demand direction | none | all 6 | no multi-key writer entity in the suite; refcount semantics unexercised |
| DIAG-1 | log growth-notify sessions | — | — | 20 notifies: 14 Alice, 4 Bob, 2 SERVICE (loopback) |
| DIAG-2 | log writer-index entities vs closure rows at T7′ | — | — | writers under `space/computed:…`; rows `space\|computed:…` (root + closure) — per-user instance rows of a space-declared doc map to a writerless `user/…` entity (harmless; explains M-B/M-I) |

## 4. Axes held (with what was verified)

1. **Registry deltas + refcount + bracket — HELD (mechanism), pins weak (MAJOR-1/2, MINOR-5).** Refcount per scope-name entity = number of registry instance keys naming it (`enter` once per NEW key, `leave` once per departed key; `addressOf` uses `fromDirtyKey`'s scope for entered and `scopeOfScopeKey` for departed — the same function, so no enter/leave vocabulary split). 0→1 / 1→0 / registration (`setSurface` after `nodes.register` — the record exists when the hook fires) / unregistration (`clearAction` after `nodes.remove` — the set entry is dropped, no liveness notify needed, no strong-ref leak) all bracket `wasLive → flip → notify`; a dirty-and-live node is queued. Park disposes the runtime (facade state dies) and clears `#demandersByKey` + the indexes, so reactivation re-enters cleanly. No early release found (release only when the LAST key naming the entity leaves; a doc tracked by two sessions is ONE key with two pairs). No leak found (a writer whose entities lose their last ref reconciles to non-root; unsubscribe drops it). `SCHEDULER_LIVENESS_EQUIVALENCE=1`: 4 executor suites (dprime, fan-out, space-server, serving-loop) green, 55 steps, no drift; the new disjunct IS exercised by the rebuild (M-A2 red in fan-out (f)), NOT by the (d′) suite (liveRefs-blind).
2. **Currency check — HELD (mechanism), UNPINNED (MAJOR-1).** New (key, pair) rows → `rearmNotCurrentForDemander`: `keyAtRatchet(fanOut, pair)` not in `clean` ⇒ `markActionInvalid(…, {fanOutInstances:"keep"})` + pending (siblings stay clean — `invalidation.ts:276`); unnarrowed writer → `space` key → skipped iff clean (correct: shared); no fan-out record → skipped (design step 3; the `undemandedNarrowingRuns` residual is pre-existing, flag 5, and `#demandersFor` now indexes by root id so a closure row on a linked piece's ROOT doc supplies a demander). Root-level arrival re-arm kept for root keys. No stale-but-never-re-armed path found: steady state is the trigger index (dirty ∧ live), arrivals are the two re-arms, departed-then-returning pairs find a pruned (→ re-arm) or still-clean-and-current instance. Vocabulary: instance-key scope ↔ declared write scope match (`entityNameKey` / `scopeOfScopeKey`); per-user instance rows of a space-declared narrowed doc map to a writerless entity while the space (redirect) row carries the demand — works, observed in DIAG-2.
3. **Push-growth notify — HELD, one bounded loss schedule (MINOR-1), unfiltered source (MINOR-4).** Both sites present (incremental `commitEntities` growth; full `commitWatchState` change incl. shrink); first-push growth is the watch-set notify; retargeted link = old target stays (coarse) + new target grows; a closing session's rows persist until the TTL prune (coarse); the latch is level-triggered and survives coalescing; a note arriving while a pass is in flight is picked up by the next FRESH pass — except the straddling-pass schedule in MINOR-1 (bounded by the next input / the idle window).
4. **Demand pass / settle race — HELD with the curve stated (MINOR-6).** No per-row engine read, proxy, or transaction in the pass (verified line by line: `demandedInstancesForSpace` is Set/Map/string work; the pass is Map/Set work + `enter`/`rearm` lookups; structure loads only for first-demand/pending ROOT keys). Cost ≈ ≤2.5 µs/row, 4.9 ms/pass at chat scale, inside `await loadPass` before `runtime.idle()` every wave; linear in the closure.
5. **Pin vacuity — NOT HELD** (MAJOR-1/2/3, MINOR-5): see §3. The builder's M1 and M2 reproduce; the P-arrival kill does not; my M-B/M-C/M-E/M-H/M-I pass green.
6. **OFF-arm — HELD (by inspection; the test-set claim accepted).** With the flag unset nothing calls `enterDemandedEntity`/`leave`/`rearm` (SpaceServer only); the hook is undefined (`?.()`); `demandedWriters` is empty (T9′ asserts it on a plain client runtime); the notify sites hit `observer?.demandChanged === undefined` → return; the two OFF-reachable additions are an empty-Set `has` in `isDemandRoot` and the `commitWatchState` Set diff (MINOR-8). "Byte-identical OFF runner suite" is the builder's pass/fail-set claim; the full runner suite is green here at the claimed counts (one known flake); the OFF store commit-table witness is W4's.
7. **Deletion completeness — HELD.** `grep demand-walk|installDemandWalk|demandSinks|demand-sink` in `packages/*/src` + memory v2: comments only (`space-server.ts:442–443`, `:2585`); tests mention it only as witnesses/stand-ins. `watchedRootsForSpace` production-dead (NIT-3); `observationIdentity`, `#demandedRoots`, `demandedIdentitiesOf` still live. Behaviour the walk provided that nothing else does now: none found — liveness → the root kind; loading → the writers' own reads + root-scoped structure load + dispatch auto-load (parity); the coordinator's case (a computed reached only through a data link from a piece whose root nobody watches) is flag 4 parity (neither the walk nor (d′) starts that piece; under (d′) its `computed:` row enters the registry with no writer); a per-user branch is reached by the branch's own run (fan-out (f), zero walk runs).
8. **Counters + settle series — PARTIALLY HELD** (MINOR-2/3/4/7, NIT-1/5): `demandedRows/Instances/Pairs/Writers` + maxima correct; `notCurrentRearms` correct; `demandPasses` correct; `pushGrowthWakes/watchWakes` are notify counts; `demandRootEnters/Leaves` accumulate across park but miss out-of-pass transitions; `demandPassMs` is wall time; the series is bounded (4000 entries, `dropped`) and attribution is by adjacency (stated in the reports, not in §7).
9. **Spec/register honesty — PARTIALLY HELD** (MINOR-9, MINOR-3/4 text): §1 amendment descriptive and consistent with observed rows; RULED sentence unchanged; §7 list = code fields; OW39 CLOSED is justified for the MECHANISM; the coverage rows overstate red-firstness per §3.
10. **Numbers — HELD.** Raw artifacts exist at `…/scratchpad/w0bench/runs/w1c1-chat-on/` (`driver.log`, `settle-series.json`, `demand-block.json`, `stats-post.json`, `toolshed.log`, `meta.json`): series COMPLETE, `[chat-series] arm=ON n=20 median=1239ms` (per-post list matches the report), recomputed value-only n=45 p50 17.1 / p95 322 (report 324 — percentile method) / max 764; structural-growth n=19 p50 263 (p95 1040 by linear interpolation vs the report's 1739 — method); `wavesBudgetExhausted 46/121`; demand block byte-equal to the report; `No default model available`; `shellServerExecutionDefine:"true"`. The binary's `gitSha a5b8ed76f` is the builder's pre-rebase commit: `git diff --stat a5b8ed76f 19c6448ab -- packages` is EMPTY (code-identical to the tip; the rebase moved only docs). Caveat: the growth split is adjacency-attributed and includes loopback-driven wakes (MINOR-4).
11. **Ordinary correctness/perf — HELD.** Anonymous sessions (key, no demander), unresolvable scopes (try/catch skip), absent targets (rows; no writer → nothing), space-scoped instances (one key, N pairs), `fromDirtyKey` parse failures (skipped); no O(rows²) (exposure dedups by `rows.has`; `#demandersFor` is an index lookup; `invalidateActionsForDemandRoots` is O(nodes) per arrival pass — pre-existing); Map/Set churn per pass is ~6 linear passes (NIT-4). fmt/lint clean on the 12 touched files.

## 5. Suites / probes run (all FOREGROUND, `--no-lock`, ≤ 600 s per call), and tree-clean confirmation

| run | result |
|---|---|
| `executor-dprime-w0.test.ts` baseline, package-task form, `SCHEDULER_LIVENESS_EQUIVALENCE=1` | 1 passed (6 steps), 0 failed, 9 s |
| runner full suite, package-task form, split in 3 explicit file lists (596 files) | 320 (2857 steps) + 537 (1846) + 354 (2021) = **1211 passed, 1 failed**: `executor-effect-channel` "receipt-race divert pin" timed out (20 s) in the 200-file batch — the test's own comment and W0 flag 14 name it a pre-existing ~1-in-3 live race; **re-run alone 2/2 green (15 steps each)** → 1212 / 6725 steps match the build report |
| memory `deno task test` | 521 passed (229 steps), 0 failed |
| toolshed / runtime-client / spec-model / piece `deno task test` | 142 (428) / 61 (212) / 23 / 37 (451) passed, 0 failed |
| equivalence batch `SCHEDULER_LIVENESS_EQUIVALENCE=1`: dprime + fan-out + space-server + serving-loop | 4 passed (55 steps), 0 failed, no drift |
| mutation probes M-A1, M-A2 (×2 suites), M-B, M-C, M-D, M-E, M-F, M-G, M-H, M-I; DIAG-1, DIAG-2 | as tabulated in §3; each reverted with `git checkout -- <file>` |
| `deno fmt --check` / `deno lint` on the 12 touched files | clean |
| tree at the end | `git status --short` → 0 changes; `deno.lock` untouched; HEAD `19c6448ab` detached |

Logs: `/private/tmp/claude-501/-Users-berni-looms-primary/0e87bf81-8ea5-450a-9ea5-1dfbee746e7a/scratchpad/rw1/*.log` (`rw1-dprime-baseline.log` beside it).