# chitta-field performance ## Phase 1 synchronization inventory — 2026-09-16 This inventory covers the registered handler surface and its maintenance, queue, backfill, distillation and subconscious callers. An FFI call releases its Rust guards before returning; separate FFI calls are not one transaction. | Mutable state / caller | Synchronization and publication | Evidence | | --- | --- | --- | | Task-ledger tables, indexes and revisions | Dedicated transaction mutex covers read/validate, WAL append and publication; reads return copies. Persistence callbacks must not reenter the ledger. | `chitta/include/chitta/task_ledger.hpp:78`, `chitta/src/handlers/field_task_ledger.cpp:23` | | Query embedding LRU and in-flight requests | Cache mutex and shared futures; inference outside the mutex; hit/miss counters atomic. | `chitta/include/chitta/rpc/field_handler.hpp:101` | | Health/soul memory and spectral caches | Separate mutexes, single-flight refresh outside locks, stale values while refreshing. One store lifetime per daemon. | `chitta/src/handlers/field_system.cpp:19`, `chitta/src/handlers/field_system.cpp:61` | | Distillation model and enabled flag | `distill_mutex_` for the string; atomic flag. | `chitta/include/chitta/rpc/field_handler.hpp:235` | | Embedding jobs and cached vectors | Separate queue/cache mutexes; pressure flags atomic. | `chitta/include/chitta/embed_queue.hpp:254`, `chitta/include/chitta/embed_queue.hpp:261` | | Embedding contexts / model | Per-context mutexes and bounded semaphore; model immutable after construction. | `chitta/include/chitta/vak_llama.hpp:86` | | Subconscious queues / stats | Separate event, embedding, suggestion, anticipation and tool-sequence mutexes; counters/timestamps atomic. | `chitta/include/chitta/mind/subconscious.hpp:116`, `chitta/include/chitta/mind/subconscious.hpp:276` | | Subconscious callbacks / load probe | Setter and copy-out mutex; invoke copies outside that mutex; initial callbacks installed before starting workers. | `chitta/include/chitta/mind/subconscious.hpp:226`, `chitta/src/simple_cli.cpp:401` | | Sadhana state and subscriptions | Manager mutex and subscription mutex; counters atomic. Construct and set stream callback before readers start; handler pointer atomic. | `chitta/include/chitta/sadhana/sadhana_manager.hpp:218`, `chitta/include/chitta/sadhana/sadhana_manager.hpp:224`, `chitta/src/simple_cli.cpp:291` | | Queue counters and paths | Counter values atomic; pointer/path publication uses a dedicated mutex and copy-out snapshot. File scans and FFI calls occur after releasing it. | `chitta/include/chitta/rpc/field_handler.hpp:208` | | Write notification callback | Mutex on setter/copy; callback invoked outside lock so reentrant replacement is safe. | `chitta/include/chitta/rpc/field_handler.hpp:220` | | Registrations, schemas, recall callback, embed/subconscious/load pointers | Published during construction/startup before serving; thereafter immutable. Owners remain alive while workers drain. | `chitta/include/chitta/rpc/field_handler.hpp:162`, `chitta/src/simple_cli.cpp:274` | | RPC budgets and maintenance load/wait counters | Atomics; immutable configured limits. | `chitta/include/chitta/rpc/work_policy.hpp:101`, `chitta/include/chitta/rpc/field_handler.hpp:762` | | Consolidation admission | Atomic in-flight flag; request-local work and Rust-owned stored state. | `chitta/src/handlers/field_memory_recall.cpp:2165` | | RPC / compaction lifetime | Foreground pool explicitly drained before referenced locals die; owned compaction thread joined before pool and handlers are destroyed. | `chitta/src/simple_cli.cpp:264`, `chitta/src/simple_cli.cpp:1335` | | Queue lane / applied-ack state | One worker owns each lane. Existing checked `cf_sync` precedes applied-ack fsync/rename. Phase 1 changes acquisition only. | `chitta/src/queue_processor.cpp:182`, `chitta/src/queue_processor.cpp:937` | | Maintenance / distillation / backfill | Handler factories obey the startup switch; Rust collect/plan/apply phases own their state. Belief read/decide/write sequences lack a store-level compare-and-apply transaction. | `chitta/src/distillation.cpp:78`, `chitta/include/chitta/rpc/field_handler.hpp:352`, `chitta/src/simple_cli.cpp:534` | | Subconscious direct store writes | Startup injects a null global-mutex pointer when the shared switch is off; local queue locks remain. | `chitta/src/subconscious.cpp:106`, `chitta/src/simple_cli.cpp:284` | The acknowledgement policy is independent of acquisition: historically exclusive write classes call `FieldStore::sync()` after dispatch, while existing lock-free and subprocess classes retain the boundaries below. Bypassing a mutex must not silently bypass that sync. Multi-FFI belief maintenance remains unqualified for production without the global lock; component locks alone do not prevent stale read/decide/write decisions. Initial baseline on frozen snapshot da86decb: distinct-query restart identity 15/20 then 18/20; both fixed-query controls 20/20. The lead confirmed the drift on unchanged main and replaced this stream's identity gate with no worse than before on the same copy/script plus fixed control 20/20. Reports remain outside git. The global-lock default remains subject to the 300-second stress gate. Step (b) validation, 2026-09-16: CTest 26/26, MCP 149/149, all 23 hook scripts, CI Ruff and chaos 9/9 pass. Same-copy distinct restart identity 20/20, fixed response and ordered-ID controls both 20/20. Current-truth remains 20/50; golden nDCG moves from 0.5708 to 0.5773 (both below the grader's 0.7 target). The inherited primary-node hook fixture initially saw the old binary; it passed with exit 75 after rebuilding the merged Phase 6 daemon. ## Named Rust lock timings — 2026-09-16 All 76 parking_lot component RwLocks in `chitta-field/src/field.rs` and the standard-library archive RwLock use guards from `chitta-field/src/profile.rs`. Acquisition attempts, wait and hold maxima are always measured, including timed read failures and unwinding. The archive retains standard-library poisoning. `[lockprof] RUST component=... mode=... held_us=... wait_us=...` is emitted on first use, new lifetime maxima, each 4096th completion, and every wait or hold over 50 ms. The guard releases its component before writing diagnostics. No profiling environment variable is required and no RPC or file format changes. Reports distinguish observed stress-interval timings from lifetime maxima that can include startup. Every over-threshold completion is logged even when its component had a larger startup maximum. Timing includes scheduler delays; these are real periods during which other clients cannot acquire the component. Step (c) validation, 2026-09-16: Rust release build and 291 tests pass (two existing fixtures ignored), CTest 26/26, MCP 149/149, hooks 23 scripts, SMRITI 46/46, CI Ruff and chaos 9/9. Embedding identity remains 768 / nomic-embed-text-v1.5 / text-format 1, format ID 9230643459983636874. The same-copy distinct-query restart result is 15/20 against the 18/20 baseline: the revised no-worse gate is unmet. Both fixed-query controls remain 20/20. Current-truth is still 20/50 and golden nDCG is 0.5772. These are observations, not qualification to remove the global lock. The profiler observes 33 exercised components, with startup-inclusive maximum hold 705.761 ms and wait 71.131 ms. ## Global-lock switch validation — 2026-09-16 `CHITTA_GLOBAL_LOCK=1` retains the historical dispatcher policy; exactly `0` removes `rpc_mutex_` from every RPC, queue dispatch and background lock factory, including maintenance, distillation, backfill and subconscious callbacks. Configuration is frozen at startup. Unset or invalid values retain the global lock. This keeps removal disabled by default while the exit gate is unmet. The previous write classification still controls WAL sync independently of mutex ownership. Four policy tests cover both values, unset/invalid input, publication of configuration, real contention and the actual `cf_sync` calls. All three migrated workload classes ran for 300 seconds with 12 persistent writer clients and 12 reader clients on private copies, with the switch set to 0. The first ledger stage preceded the all-tools bypass; the two memory classes used the final bypass. Background backfill and Rust touch flushing remain active on these quiesced copies. No client exceeded its 30-second deadline. | Initial 300 s class run | Acknowledged writes | Reader iterations | Maximum RPC (ms) | Rust hold / wait maximum (ms) | Holds >50 ms | | --- | ---: | ---: | ---: | ---: | ---: | | ledger | 15,103 | 3,197 | 2,567.902 | 348.833 / 219.516 | 2,237 | | observe | 21,113 | 11,023 | 1,928.914 | 242.633 / 831.098 | 4,945 | | remember | 22,825 | 9,023 | 1,131.022 | 350.516 / 717.085 | 4,350 | All three runs had zero client errors, exact memory counts and no malformed Rust timing records. Ledger replay verified all 15,103 acknowledgements. Initial memory runs failed an overly strict replay comparison: the remember diagnostic showed only access_count 16,342→16,363 and last_accessed_ms advancing while verification itself called touching reads. The observe failure did not retain field differences and remains unexplained by that initial report. These initial failures are preserved; they are not clean replay results. The stress tool's corrected comparison and follow-up measurements are documented separately below. A preceding connection-per-call smoke run reset a connection after 88 ledger acknowledgements. Persistent-client runs avoid connection churn; the tool keeps that mode available as a separate diagnostic. An observe smoke also exposed a Rust/native stderr interleaving. The profiler now emits each short record in one write; the final observe and remember runs recorded 27,214 and 20,329 intact timing lines respectively. Final gates: Rust release build and 291 tests pass (two existing ignored), CTest 30/30, MCP 149/149, hooks 23/23, SMRITI 46/46, CI Ruff and chaos 9/9 with the switch off and BLAS/OMP/Rayon threads limited to one. An initial CTest ledger takeover fixture hit its 75 ms fail-open client budget; its unchanged retry and the final full suite passed. Same-original-copy restart identity is **20/20 after versus 18/20 before**, with both fixed controls **20/20**. Separate initial stress-copy identities were ledger 18/20, observe 18/20 and remember 15/20; the last failed its individual no-worse gate. Current-truth remains 20/50; golden nDCG is 0.5691 versus 0.5708 before (both below the grader's 0.7 target). Embedding identity and contracts are unchanged. **Removal is unqualified for every class:** every full workload exceeded the 50 ms Rust hold gate. Maintenance/control, sadhana, code-intelligence and deletion workloads have not each received a dedicated 300-second mixed-client run. Factory tests and chaos coverage do not substitute for those runs. The live-week hold gate is also unmeasured; deployment and live writes are outside this stream. ## Reproducing mixed RPC stress — 2026-09-16 `scripts/stress-rpc.py` requires an explicitly named private replica, validates its metadata, daemon argv, socket peer and worktree executable, and refuses to run unless `CHITTA_GLOBAL_LOCK=0`. Start each class from a fresh copy of the stopped evaluation replica family, using its own mind and port: ```sh export PATH=/maps/projects/fernandezguerra/apps/opt/conda/envs/bioinfo/bin:$PATH export CHITTA_LIVE_MIND=/absolute/path/to/stopped-eval-replica export CHITTA_EVAL_MIND=/tmp/my-private-lock-stress export CHITTA_EVAL_PORT=17439 export CHITTA_BIN="$PWD/bin/chitta" CHITTAD_BIN="$PWD/bin/chittad" export CHITTA_GLOBAL_LOCK=0 CHITTA_NO_ASSOC_LEARN=1 export OPENBLAS_NUM_THREADS=1 OMP_NUM_THREADS=1 RAYON_NUM_THREADS=1 bash scripts/eval-replica.sh start python3 scripts/stress-rpc.py --mind "$CHITTA_EVAL_MIND" \ --handler-class remember --report /tmp/my-lock-stress.json ``` Defaults are 12 writers, 12 readers and 300 seconds. Repeat with `ledger` and `observe` on separate copies. Each client uses a persistent socket; optional `--connection-mode per-call` also stresses connection churn. Each complete RPC has a monotonic 30-second deadline, including send, receive and JSON parsing. The tool checks exact memory counts, unique acknowledgements, payload and state for every recall hit (including newly published memories), then SIGKILLs only the validated scratch daemon and checks every acknowledgement after WAL replay. It reports interval and lifetime Rust lock maxima separately; absent or malformed profiling records cannot qualify a run. Exit 0 requires every exit gate, including identity; short runs and `--skip-identity` are diagnostic and always exit 1. The identity panel runs before any workload creates memories. To use the lead's no-worse exception, record the baseline before changing the binary using `scripts/stress-embed-recall.py --restart-only --mind COPY --label before --output /tmp/before.json`, then supply `--identity-baseline /tmp/before.json` when measuring that same copy after the change. The ordered query list and both fixed-query controls are checked; a baseline containing a `mind` field must name this copy. Without a baseline, the distinct-query gate requires 20/20. Never invoke `eval-replica.sh start` between the before/after measurements: it recopies the family. Reports, replica contents and logs stay outside git. Replay comparison excludes wall-time-decayed strength. All other payload and authored state must match exactly; access counts and timestamps must not regress. Decay rate may change only when access state advances. This matters because `get` and `expand_memory` enqueue touches and the Rust worker persists them even while a verification pass is reading other rows. The verifier therefore proves authored-state durability and monotonic access state, not byte identity of read-induced bookkeeping. A real captured access-only mismatch is accepted; injected payload/confidence changes and count/timestamp regressions are rejected. Socket-stall, non-replica and absent/malformed-profile negative checks also pass. Final corrected-verifier repeats ran concurrently for 300 seconds each on their already-mutated private copies, with 12 writers and 12 readers per daemon. Both passed counts, hit payload/state checks and every acknowledgement after SIGKILL/WAL replay, with zero client errors and zero malformed timing records: | Repeat class | Writes replayed | Reader iterations | Maximum RPC (ms) | Interval Rust hold / wait maximum (ms) | Holds >50 ms | | --- | ---: | ---: | ---: | ---: | ---: | | observe | 18,901 | 11,539 | 3,291.325 | 727.692 / 1,331.772 | 4,663 | | remember | 21,378 | 9,383 | 1,149.374 | 736.738 / 669.846 | 3,995 | These repeats used `--skip-identity` because the original-copy identity panel had already finished and these copies contained stress writes. They exited 1, correctly: diagnostic runs cannot meet the full gate and the hold limit was exceeded. Their timing differences from the sequential initial runs are not performance deltas: corpus size and concurrent load differed. Initial stress copy identity comparisons against the original-copy baseline are diagnostic, not the lead's required same-copy comparison; the latter is the separate final 20/20 versus 18/20 measurement above. No class is qualified for default removal. ### Phase 3 review follow-up (2026-09-16) Merged main's recall diagnostics and deterministic measurement behavior, with Rust `847e7e3` and superproject `68cd0a37`. Recall now accepts `sources=false` for memory-only evaluation. Source rows retain their citations, but their uncalibrated BM25 ranks no longer force calibrated confidence to one: `source_hits` reports their count separately. A private-replica check with three sources preserves memory order and `max_relevance=0.813876867` in both modes; before the confidence fix, source merging forced it to `1.0`. The paired native binaries use a fresh private `da86decb` copy from `learning-cut-20260915-frozen`, pinned recall time and a bounded embedding wait. The before binary has no source switch, so its golden memory-only control used an empty source-root registry. The same copy was then registered to this worktree under `project:cc-soul` for default current-truth evaluation. Both the source-toggle build and final build use `sources=false` for golden recall. | Gate | Before | After | | --- | --- | --- | | Golden nDCG@20, three runs | 0.480414590, 0.480414590, 0.480414590 | 0.480414590, 0.480414590, 0.480414590 | | Current-truth, default sources | 36/50; visible 20/30, holdout 16/20 | 36/50; visible 20/30, holdout 16/20 | | Original five strict probes | 3/5 | 3/5 | | Ordered identity, three restarts | 20/20 each | 20/20 each | | Within-process identity | 20/20 | 20/20 | | Chaos, single-threaded BLAS/OMP/Rayon | 9/9 | 9/9 | | Prompt-hook median | 890 ms | 929 ms | | Same 20 continuation pairs | 0/20 | 0/20 | No current-truth question outcome or class moved; wrong-confident answers remain zero. Prompt median increased 39 ms, within the before-run 241 ms noise allowance. The golden band stored in `benchmarks/noise.json` is **0.490965206–0.494473852**, measured on family `bbcaed33`; both requested `da86decb` arms miss it. The source toggle removes the mechanical displacement without tuning anchor demotion. The current 36/50 retention gate passes; the original 40/50 and five-probe 5/5 goals remain unmet. No frozen questions or acceptance bands were changed. Native verification passes: Rust **293 tests**, 2 ignored (the same Rust artifact in both binaries); **26/26 CTests**, **159 MCP tests**, **46 SMRITI tests**, CI Ruff and shell syntax/ShellCheck. Format identity remains `9230643459983636874`; the embedding identity sidecar remains absent. Contract checks print `contracts unchanged` after the authorized recall input update. The before hook run passed 27/27; the concurrent after run passed 26/27, with the saddle timing case at 174.21 ms incremental p95 against its 150 ms limit. Rerunning that case alone after the stress runs passed at **36.76 ms**; both observations are retained, with no timeout or threshold changes. The continuation builder read 641 transcripts across 382 project directories with conversation records, producing 258 eligible consecutive pairs. The newest 20 all lack an explicit final plan line or usable ledger next action: strict production-selector replay scores **0/20**, before and after. Four builder/scorer tests pass, including project isolation and branch rejection. This is a failed 18/20 gate, not evidence that historical sessions wrote these capsules. Pair IDs, transcript SHA-256 digests, ground truth and individual failure reasons stay in `/projects/caeg/scratch/kbd606/tmp/continuation-fixture/`, outside Git. ### Phase 3 source-index measurement (2026-09-16) Paired private copy of `learning-cut-20260915-frozen`, family `da86decb`: current-truth rose from 20/50 (visible 11/30, holdout 9/20) to 36/50 (20/30, 16/20). Environment-variable and hook-location classes improved; the 40/50 gate remains unmet. Original five probes are preserved verbatim in `benchmarks/current_truth/original_probes.json`; its explicit deterministic rubric scored 0/5 before and 3/5 after, distinct from the historical human verdict of 2/5. The reconstructed frozen probes remain a separate report. Golden nDCG@20 fell from 0.480335 to 0.449095 (three runs each), outside the paired baseline noise band. Source rows occupy result slots previously used by memory IDs, which this golden panel grades; this is still a failed gate. Baseline ordered restart identity was 16/20, and baseline prompt median was 935 ms with a 354 ms noise allowance. These are measurements, not a claim that Phase 3 is qualified for deployment. The indexed prompt median was 958 ms (+23 ms, inside that allowance). Verification: 26 CTests, 149 MCP tests (explicit stub binary), 46 SMRITI tests and all hook scripts passed. Replica chaos passed eight cases; its NFS lock case was skipped on the initial XFS scratch directory and must be rerun on NFS. ### Phase 3 anchors and final paired checks (2026-09-16) The derived Rust anchor index adds no snapshot fields. Lifecycle tests cover foreign replay, load, changed/missing files and forgetting. A private-daemon fixture also passed current-state rendering, missed-watcher detection, same-scope supersession, independent scopes and delayed old events. On the same `da86decb` copy, current-truth remains **36/50** versus **20/50**: visible **20/30** versus **11/30**, holdout **16/20** versus **9/20**. The 16 gains comprise seven environment-variable/default questions, seven hook questions, one operational-safety question and the rename date; no question regressed. Original strict probes are **3/5** (deploy, PostToolUse and field performance); reconstructed frozen probes are **1/5**. Neither probe rubric is the historical memo's human useful-hit judgment. Final-binary golden nDCG@20 over three runs was **0.452860, 0.449226, 0.449226**, mean **0.450437**, below the paired baseline mean **0.480335** and its noise band. The final fixed-source ordered restart comparison was **16/20 before and 15/20 after** (same queries, script and replica copy), failing the replacement gate. Earlier comparisons scored 13/20 while sources were changing and 16/20 before the final learning-order fix; those results are retained rather than selecting the passing repeat. Prompt median was **965 ms** versus **935 ms**, within the baseline's 354 ms allowance. The preceding binary's three-run golden mean was 0.445206 and prompt median was 893 ms. The complete final NFS chaos run passed **9/9**, including the unchanged 8-second hook deadline, with all three thread caps set to one. The initial XFS run's NFS skip was also rerun alone on NFS and passed. Rust release tests: **291 passed, 2 ignored**; CTest **26/26**, MCP **149**, SMRITI **46**, hooks **27/27**. Format ID remains `9230643459983636874`; the embedding identity sidecar remains absent. Current-truth, original probes, golden recall and restart identity remain unqualified. Co-retrieval learning runs after source merging, so source IDs and displaced memory IDs do not receive memory co-occurrence updates. Continuation qualification is also unmet: the authorized transcript directory contains two conversational sessions and one title-only file. The construction script produced one consecutive pair; the strict production-selector replay scored **0/1**, short of **18/20**. Builder/scorer tests and the synthetic ledger capsule checks pass, including short completion invalidation, but do not replace the missing real cases. The extraction/scoring rule is documented in `docs/HOOKS.md`; transcript data and fixture output are outside the repository. ## Acknowledged-write durability Status 2026-09-16 (Phase 6 source audit). A successful response is not a universal fsync guarantee. The dispatcher in `field_handler.hpp` calls `FieldStore::sync()` after exclusive write handlers release the C++ mutex. It bypasses that call for lock-free/subprocess handlers. The inventory below covers all 188 registered handlers outside its read-only set, including aliases and conservative write classifications. A read-only operation within `ledger_op` skips the sync. | Write RPCs | Acknowledgement boundary | | --- | --- | | `compact_wal` | Completed snapshot/manifest commit and covered-WAL compaction; handler checks the result. | | `learn_codebase`, `distill_now`, `consolidation_pass` | No dispatcher fsync. WAL-backed changes use append/OS flush and the WAL maintenance timer; snapshot-only state changed by these operations still needs a snapshot. Preview/disabled/no-op calls may write nothing. | | `log_event`, `log_event_ex`, `log_decision`, `predicate_run` | Primary tape/predicate state is snapshot-resident, not a WAL-append acknowledgement. Incidental WAL-backed side effects use timer sync. Do not treat these as durable event-ledger APIs. | | `ack_memory`, `add_delegation`, `add_observation`, `add_probe`, `agent_disable`, `agent_upsert`, `anticipation_observe`, `anticipation_record_outcome`, `anticipation_success`, `approve_memory`, `assert_fact`, `assoc_decay` | Dispatcher calls WAL fsync before returning. | | `attach_debt_evidence`, `batch_forget`, `branch_create`, `branch_resolve`, `calibration_record`, `checkpoint`, `cleanup`, `clear_codebase`, `close_intervention`, `close_rederive`, `compact_context`, `connect` | Dispatcher calls WAL fsync before returning. | | `connect_temporal`, `consolidate_similar`, `consolidation_auto`, `consolidation_merge`, `create_episode`, `curiosity_note_gap`, `curiosity_resolve`, `cycle`, `dedupe_symbols`, `defer_debt`, `densify_backfill`, `describe_symbol` | Dispatcher calls WAL fsync before returning. | | `disable_source`, `distill_set_model`, `dream_cancel`, `dream_force_woke`, `dream_start`, `dream_wander`, `embed_symbols`, `enroll_wisdom_lineage`, `executor_flush`, `export_soul`, `export_training_pairs`, `file_index_all` | Dispatcher calls WAL fsync before returning. | | `file_index_session`, `file_restore`, `flush_embeddings`, `forget`, `forget_kind`, `full_resonate`, `goal_complete`, `goal_progress`, `goal_set`, `grow`, `habit_observe`, `habit_strengthen` | Dispatcher calls WAL fsync before returning. | | `habit_weaken`, `health_check_start`, `hygiene_run`, `impl_start`, `import_soul`, `ingest_source`, `insight_promote`, `learn_outcome`, `ledger_append`, `ledger_compile`, `ledger_delete`, `ledger_op` | Dispatcher calls WAL fsync before returning. | | `ledger_save`, `lineage_expiry_check`, `link_evidence`, `log_exposure`, `long_task_complete`, `long_task_event`, `long_task_start`, `long_task_update`, `mark_memory_invalidated`, `memory_lock`, `memory_outcome`, `memory_unlock` | Dispatcher calls WAL fsync before returning. | | `msg_ack`, `msg_ack_all`, `msg_respond`, `msg_send`, `nack_memory`, `narrative_log`, `observe`, `pending_embed_ids`, `pin_memory`, `predicate_attach`, `probe_calibrate`, `probe_seed` | Dispatcher calls WAL fsync before returning. | | `profile_observe`, `profile_update`, `promote_memory`, `propose_change`, `prune_episodes`, `queue_experiments`, `realm_add`, `realm_remove`, `realm_set`, `realm_visibility`, `rebuild_fts_index`, `reconcile_pass` | Dispatcher calls WAL fsync before returning. | | `reconsolidate`, `record_attribution`, `record_feedback`, `record_surprise`, `reembed_memories`, `register_debt`, `register_task`, `reject_memory`, `remap_realms`, `remember`, `remember_batch`, `repl_execute` | Dispatcher calls WAL fsync before returning. | | `repl_session_delete`, `repl_session_set`, `resolve_contradiction`, `resolve_debt`, `resolve_merge`, `resolve_probe`, `restore_code_intel_confidence`, `retract_fact`, `sadhana_checkpoint`, `sadhana_pause`, `sadhana_resume`, `sadhana_set_goal` | Dispatcher calls WAL fsync before returning. | | `sadhana_set_interval`, `sadhana_set_max_turns`, `sadhana_set_model`, `sadhana_start`, `sadhana_stop`, `save_spectral_snapshot`, `seed_hdc_geometry`, `semantic_backfill`, `session_deregister`, `session_heartbeat`, `session_register`, `session_sync` | Dispatcher calls WAL fsync before returning. | | `set_affect`, `set_criterion`, `set_evidence_type`, `set_memory_type`, `set_priority_tier`, `skill_deprecate`, `skill_upload`, `span_backfill`, `span_backfill_memories`, `stageb_set_surface`, `start_intervention`, `strengthen` | Dispatcher calls WAL fsync before returning. | | `suggestion_resolve`, `suggestion_track`, `tag`, `think_wander`, `tick_lineage_staleness`, `transcript_register`, `transcript_remove`, `transcript_update`, `transition_wisdom_lineage`, `trigger_add`, `trigger_dismiss`, `trigger_fire` | Dispatcher calls WAL fsync before returning. | | `trim_realm_names`, `triplet_supersede`, `unpin_memory`, `update`, `update_scorer_model`, `update_source_weight`, `update_task`, `update_wisdom_lifecycle`, `upsert_wisdom_candidate`, `weaken`, `wiki_export`, `witness_memory` | Dispatcher calls WAL fsync before returning. | For the dispatcher-synced rows, this protects WAL-backed mutations on a healthy filesystem, not arbitrary C++ configuration, subprocess results, exports or snapshot-only organs. `FieldStore::sync()` currently discards `cf_sync`'s error code, so an I/O failure can still produce an apparent success; correcting that API is outside this phase's file scope. The WAL sync interval defaults to `CHITTA_WAL_SYNC_MS=200` ms. This is a scheduling interval, not a hard bound during I/O stalls. `scripts/stress-embed-recall.py --durability-test --mind PRIVATE_COPY --label kill --output /tmp/p6-kill.json` acknowledges a unique `remember`, kills that checked scratch process, restarts the **same** copied store, and asserts the memory is retrievable by ID. A process SIGKILL does not evict the kernel page cache and cannot establish power-loss safety; the timer-synced case must not be asserted lost. Never use `eval-replica.sh start` between ack and verification: it replaces the copy from its source and would invalidate this test. ## Phase 6 follow-up verification (2026-09-16) Base: merged `main` at `fd2797f1`; Rust submodule `5c5b5dd`. Native GGUF embedding remains 768-dimensional nomic-embed-text-v1.5, four contexts, one opt-in document worker, and `CHITTA_RUNTIME_LOCAL=1`. The private NFS copy was selected from learning-cut-20260915-frozen: family `da86decb`, manifest generation 39285, snapshot sequence 206502617. This differs from the earlier Phase 6 copy; these measurements are a new run, not a controlled before/after comparison. The timing runner waited until native tests, Rust tests and chaos finished. The node's reported load averages at measurement were 86.89/89.88/84.34. | Measurement | Result | | --- | --- | | Remember writes | 200/200; zero errors | | Pending embeddings after / drain time | 0 / 64.44 s | | Idle recall p50 / p95 (40 samples) | 88.9 / 134.1 ms | | Recall during writes p50 / p95 (18 samples) | 77.0 / 113.9 ms | | Full loaded-window recall p50 / p95 (590 samples) | 78.7 / 162.8 ms | | Remember acknowledgement p50 / p95 | 986.1 / 1636.8 ms | | Cached restart | 16.098 s; 5 s gate unmet | | Distinct-query ordered IDs across restart | 20/20 | | Fixed-query full response / ordered IDs across restart | 20/20 / 20/20 | The full-window 150 ms stress gate **failed**; the write-active subset alone passes. No runtime-placement or worker default was enabled. Validation: frozen-replica chaos **9/9** (361.985 s summed case time), CTest **25/25** (103.35 s, real-model pool test included), Rust **289 passed / 2 ignored**, hooks **23/23**, MCP **149**, SMRITI **46**, and contracts unchanged before commits and after stress. Shell syntax, warning-level ShellCheck and touched-Python Ruff checks pass. The first CTest attempt failed with an older `python3` selected by `/usr/bin` in synthetic chaos helpers; explicitly configuring CMake with Conda Python fixed this. Its queue-log assertion and registration timing failure did not recur in the corrected run; the standalone queue-isolation rerun also passed. Timestamp checks covered 205 mixed C++/C/raw-fd/concurrent/partial lines and 5,528 nonempty daemon log lines, all dated. A real scratch daemon refusing a foreign recorded lock holder produced one dated cross-host incident. The soak remains unestablished. Raw JSON/logs remain untracked under `results/followup/` and `/tmp/p6-*`; all scratch daemons were stopped. Remaining work: atomic queued mutation plus `ack_id` receipt requires a store transaction API; Phase 7's ledger was retained without duplication. Automatic cross-node client fallback was deferred as allowed: safe completion also needs MCP's bridge, CLI and socket-only helpers, including suppression of secondary-node local starts (transport diff: zero lines). See `docs/CLI.md` for the requested primary-node guard and its service-manager restart limitation. Shared lifecycle and FileChanged markers still reside on NFS. Phase 6 is not complete. ## Phase 6 measurements and remaining gates Status 2026-09-16: single sequential control/treatment runs on separate private NFS copies of family `bbcaed33`, generation 38047. Both use the local 768-d nomic GGUF with four contexts (`CHITTA_WITH_LLAMA_CPP=ON`), with runtime placement off in both arms to isolate worker scheduling. Both admitted all 200 concurrent remembers, reported zero RPC errors and reached zero pending embeddings. The 90-second post-ack sampling period includes asynchronous embedding work; the treatment backlog drained at 62.4 seconds. These are descriptive runs, not a noise-calibrated causal claim. Preliminary Ollama fallback runs were discarded after correcting a CMake compiler-reset issue. | Measurement | Default workers (off) | One bounded document worker | | --- | ---: | ---: | | Idle recall p50 / p95, 40 samples | 92.0 / 123.2 ms | 79.2 / 105.7 ms | | Recall during writes p50 / p95 | 124.4 / 624.7 ms (n=3) | 75.2 / 128.1 ms (n=15) | | Full loaded-window recall p50 / p95 | 78.2 / 139.0 ms (n=837) | 76.0 / 137.7 ms (n=863) | | Remember acknowledgement p50 / p95 | 430.9 / 754.5 ms | 787.8 / 1387.6 ms | | Cached restart to successful recall | 20.608 s | 20.001 s | The recall target passes in the treatment run; the small write-active sample counts limit percentile precision. Write acknowledgements are slower. The cached-start ≤5 s exit gate **does not pass**. The historical 9.5 s operational figure below was not reproduced by this worktree on these copies. `benchmarks/field-perf/run.sh --restart --mind PRIVATE_COPY --label LABEL --output /tmp/restart.json` measures existing-copy cached readiness, rejects `warming_up` replies, and compares 20 distinct queries before/after restart. `scripts/stress-embed-recall.py` multiplexes 200 concurrent remember RPCs over one connection (the daemon accepts at most 32 connections), samples recall on another connection, and reports both the write-active and full sampling windows, errors and remaining pending embeddings. It never accepts warm-up replies as successful writes and keeps sampling until embeddings drain (300-second limit) and the minimum post-ack interval elapses. Raw output belongs in /tmp or untracked results, never git. Validation on 2026-09-16: release Rust 285 passed (2 ignored), unchanged 768/nomic/format-1 identity, all 16 real-GGUF CTests, 149 MCP tests, 46 SMRITI tests, all 21 hook scripts, CI ruff and touched-shell checks passed. The final contract snapshot printed **contracts unchanged**. Focused fixtures cover both placements, queue alias precedence, bounded admission, reader progress, and ledger append-before-offset crash recovery. An actual hook-to-daemon probe checkpointed a local tail to the private NFS ledger with its offset. An acknowledged durable remember survived immediate SIGKILL on the same copy; a timer-synced symbol also survived, which is permitted. The broader 20-distinct-query restart diagnostic is **not consistently stable**: initial pristine GGUF control/treatment both matched 20/20, the final pristine treatment matched 16/20, and post-load repeats matched 12/20 with workers off and 11/20 with workers on/local placement. These failures are reported rather than counting only passing attempts; the default-control repeat does not isolate a worker regression. A further treatment repeat matched 18/20. Universal ordered-ID identity remains unestablished. Separately, the established fixed query `chitta recall performance lock contention`, realm `project:cc-soul`, limit 5, `no_learn=true`, passed **20/20 full-JSON response pairs** across restart with workers off and with one bounded worker/local placement on. The restart runner reports both the fixed-query gate and the broader diagnostic; the former does not imply that all queries are stable. Runtime placement remains default-off. Queue recovery is currently checkpointed at-least-once: no atomic store API couples an arbitrary queued mutation to its `ack_id` receipt. Exact idempotence across a crash in that gap remains an unmet Phase 6 gate; Phase 7's applied-ack sidecar does not close the mutation/receipt crash gap. The follow-up migrates transient markers in prompt-core, SessionStart, stop-core and pre-tool-hook (see `docs/HOOKS.md` for the groups). Files shared with other lifecycle hooks, and file-changed-hook's `.reindex_*` marker, remain on NFS; file-changed-hook is outside the follow-up scope. Do not enable local placement as a completed migration until those gates are resolved. The fortnight instrument is `scripts/report-runtime-incidents.py chittad.log`. It reports open failures, stale-lock replacements, cross-host lock holders, repeated starts within five minutes, and lockprof holds strictly over 150 ms. Daemon stderr now carries ISO-8601 UTC timestamps, including Rust/C diagnostics. Use `--host` when analyzing logs from another host. Undated records remain `undated`; a log with no matches does not prove a fortnight of coverage. Status as of 2026-09-16. The dated results below preserve the `fix/field-perf` measurements on private eval copies, including unmet targets and the ancillary MCP SDK failure. Two original JSON artifacts are absent; their committed tables are linked instead. Current live startup is about 9.5 s with sidecar hits, about 20 s on the first start after deployment or a format change; see [startup and recovery](CLI.md#startup-sidecars-and-instance-lock). These current operational figures do not replace the historical control/experiment measurements below. ## 2026-09-16: Phase 7 recovery gates Final authorized fixes: **9/9 full-copy chaos cases passed**, **25/25 CTests passed** (100.33 s), and **289 Rust library tests passed, 2 ignored** (53.26 s). Production commit: `b4c06294`; Rust submodule: `765b68e`. [Implementation and touched functions](../Documentation.md) describe the merge boundary; [dated JSON evidence](chaos-2026-09-16.json) preserves both failures and final results. | Case | Result | Native fixture recovery | Full replica recovery | |---|---|---:|---:| | SIGKILL during save | PASS | 1.129 s | 19.957 s | | Second opener | PASS | 1.193 s | 1.221 s | | Unlinked active WAL | PASS | 1.187 s | 11.868 s | | Stale / foreign lock on NFS | PASS | 1.178 s | 11.752 s | | ENOSPC during save | PASS | 1.240 s | 60.998 s | | Queue processing replay | PASS | 1.166 s | 12.354 s | | Restart during prompt hook | PASS | 0.503 s | 0.894 s | | HTTP MCP session restart | PASS | 0.002 s | 0.002 s | | Binary format probe under load | PASS | 0.016–0.024 s | 0.021 s | The WAL case restored **19,622 bytes** on the full replica (**733 bytes** on the native fixture), including a WAL-only pre-unlink memory. Both repeated queue replays preserved exact identity and state: **11.472 / 12.354 s** on the full copy and **1.150 / 1.166 s** on the native fixture. The queue proof also checks same-batch duplicate IDs, pruning on the next batch, and ack retention for coalesced saves. Its test helper disables decay for that one memory through the existing state-update FFI while the scratch daemon is stopped; this keeps the `get` view's wall-time-dependent strength stable without an equality tolerance. These are single shared-node observations; CTest and the final full-copy run used independent scratch stores concurrently. Recovery includes startup and invariant readback; ENOSPC includes the later successful save. Hook time measures the interrupted hook's exit, MCP time measures the stale-session call after listener readiness, and format time is the maximum of three real-model probes. The ledger survives the tested post-ack crash and snapshot compaction; it is not a transaction spanning store mutation and ack publication. The separate WAL-only confidence reconstruction diagnostic is documented in the implementation report. No services, installed binaries, source corpus, frozen evaluation files, or embedding identity were changed. The independent canary soak remains outside this completed recovery gate. ### Original failure evidence Initial tests on `feat/chaos-tests`, before the authorized production fixes, exposed two defects. The original failure evidence follows. Cargo release: **288 passed, 2 ignored**. Native CTest: **23/25 passed**, with `chaos_wal_test` and `chaos_queue_test` failing. MCP (149), SMRITI, every hook fixture, CI Ruff check/format, and touched-shell parse and ShellCheck gates passed. No production recovery logic had changed at that point. Each CTest case uses its own 128-memory native snapshot family, copied by `eval-replica.sh`. The full-corpus runs use a separate NFS copy of `bbcaed33`, private ports/sockets and isolated hook HOME. Subsequent starts reopen the faulted copy; they never refresh it from the source. All process kills target captured scratch PIDs. The HTTP test restarts an owned MCP process, not a live systemd unit. CI reports NFS-only lock tests as skipped on non-NFS filesystems. | Case | Invariant / outcome | Native fixture recovery | Full replica recovery | |---|---|---:|---:| | SIGKILL during save | PASS: every acknowledged ID/content recovered; manifest unpublished at kill | 1.124 s | 21.918 s | | Second opener | PASS: refused with recorded holder PID | 1.192 s | 1.128 s | | Unlinked active WAL | **FAIL: an acknowledged post-unlink write disappeared** | ready 1.074 s, invariant failed | daemon-ready 9.342 s, invariant failed | | Stale / foreign lock on NFS | PASS: dead same-host holder replaced on a new inode and logged; foreign holder refused | 1.114 s | 41.560 s | | ENOSPC during save | PASS: manifest unchanged, acknowledged prefix recovered, next save succeeded | 1.214 s | 55.775 s including successful resave | | Queue processing replay | **FAIL: replay created a second memory with identical content after a snapshot** | ready 1.110 s, invariant failed | ready 10.592 s, duplicate IDs | | Restart during prompt hook | PASS: fails open within external 8 s budget; next hook completes recall | 0.485 s | 1.071 s | | HTTP MCP session restart | PASS: stale session returns explicit 404 within 5 s; new session/tool call succeeds | 0.001 s | 0.002 s | | Binary format probe under load | PASS: production `spawn_format_id_probe`, four real GGUF embedding workers and an atfork stall sentinel | 0.02016–0.02029 s (<1 s) | same native process test | Timings are single observations, not latency distributions. Second-opener time includes a readback; hook time measures the interrupted hook's exit, and MCP time measures the next call after the replacement listener is ready. Full-replica WAL 9.342 s is the daemon's logged startup time, not successful durable recovery. The lock test holds the old inode while recording a verified dead PID: it models a retained NFS server lock; merely writing an unlocked stale file would not exercise the recovery branch. `save_fault_test.cpp` is a test-only preload library, never linked into release executables: `CHITTA_CHAOS_STORE` scopes interception to one scratch store; `CHITTA_CHAOS_PAUSE_ARM` stops at a temporary snapshot write, and `CHITTA_CHAOS_ENOSPC_ARM` returns real ENOSPC from that write and records a hit. This run used that deterministic error seam, not a privileged tmpfs/loop mount. The NFS failure is consistent with silly-renaming: the open unlinked inode can retain a nonzero link count, so append misses deletion; sync detects the missing path only after the first new operation was written to the abandoned inode. Queue replay is checked by exact identity **and state**, not only daemon health: a weaker ID-only check hid a confidence change; snapshotting before replay then exposed duplicate IDs. These failures originally exceeded the tests-only scope; the user subsequently authorized both production fixes. The independent week-long canary soak remains outstanding. The original failure assertions are retained. See [implementation and proof boundaries](../Documentation.md) and [machine-readable evidence](chaos-2026-09-16.json). ## Measurement boundary The supplied live baseline (134,129 memories, 7.95 GB RSS, 62 s first recall, hybrid p95 not supplied) is context, not the control arm. The scratch family is `bbcaed33`, generation 38047, snapshot sequence 206208172, with its selected WAL. It reports 133,724 records (133,712 live in detailed health), approximately 1.37M triplets, and 768-dimensional `nomic-embed-text-v1.5` embeddings. Both primary arms load the same validated family. Autonomous work is quiesced; this does not reproduce live writer contention. `benchmarks/field-perf/run.sh` copies the manifests, selected snapshot family, WAL, migration markers and lite encoder according to `scripts/eval-replica.sh`, validating selection before and after copying. Each child owns a private store, runtime directory, socket and RPC port with `CHITTA_NO_QUEUE=1`. The runner only terminates its own child. It leaves the copy available for audit and never opens a daemon on the source. Measurements use socket JSON-RPC, excluding CLI process-launch overhead. Readiness is the first non-warming health response; the daemon also logs process-start-to-dispatch time. First recall is issued immediately, before a common 30-second settling interval. Hybrid runs before other timed workloads so they cannot consume its refresh backlog. Each workload has 20 repetitions; p95 is nearest rank (19th sample). Query: `chitta recall performance lock contention`; realm: `project:cc-soul`; limit: 5; `no_learn=true`. Lanes: sem, ctx, hyb, kw, corr. Both primary arms enable profiling. Results retain IDs and schema shapes, never memory text. The control is `e109286` chitta-field / `f8686fed` superproject plus load/recall timers and allocation diagnostics, measured before optimizations. Wall-clock performance varies with this shared node's load. A single 20-sample workload is evidence for this replica/query, not a general latency guarantee. ## Before and after Primary control: [BEFORE JSON](../benchmarks/field-perf/results-before.json). Primary final implementation: [AFTER table, label `primed`](../benchmarks/field-perf/table-primed.md). The original primed JSON is not present in this checkout; the committed table preserves its reported measurements. Earlier `after` / `final` artifacts are intermediate steps, identified below. | Metric | before | |---|---:| | Ready (ms) | 35928.8 | | First recall (ms) | 6440.6 | | RSS (MiB) | 4322.4 | | hybrid p50 / p95 (ms) | 33.7 / 245.1 | | keyword p50 / p95 (ms) | 6.3 / 8.5 | | fused p50 / p95 (ms) | 33.6 / 42.4 | | smart p50 / p95 (ms) | 11.9 / 17.8 | | recall_lanes p50 / p95 (ms) | 33.6 / 35.6 | | Load snapshot (ms) | 3657 | | Load pld (ms) | 120 | | Load emb (ms) | 222 | | Load lite_encoder (ms) | 15 | | Load hdc [10](#ref-10) (ms) | 247 | | Load triplets (ms) | 3665 | | Load turbo (ms) | 5926 | | Metric | primed | |---|---:| | Ready (ms) | 28712.3 | | First recall (ms) | 92.4 | | RSS (MiB) | 3220.2 | | hybrid p50 / p95 (ms) | 34.7 / 64.1 | | keyword p50 / p95 (ms) | 6.3 / 6.8 | | fused p50 / p95 (ms) | 34.1 / 35.8 | | smart p50 / p95 (ms) | 12.2 / 18.0 | | recall_lanes p50 / p95 (ms) | 35.0 / 41.6 | | Load snapshot (ms) | 3982 | | Load pld (ms) | 131 | | Load emb (ms) | 251 | | Load lite_encoder (ms) | 22 | | Load hdc (ms) | 276 | | Load turbo (ms) | 6456 | | Load triplets (ms) | 3311 | The process-ready log reports 35,912 → 28,696 ms; the tables use the external readiness probe. One/five/fifteen-minute load averages were [67.63, 69.67, 70.09] BEFORE and [56.68, 55.73, 57.18] AFTER. | Requested target | Final observation | Verdict | |---|---|---| | First recall < 2× warm p50 | 92.4 / 34.1 = 2.71× | Not met | | Hybrid p95 < 400 ms | 64.1 ms | Met | | Hybrid p50 unchanged or better | 33.7 → 34.7 ms | Not demonstrated; final median is slightly higher | | RSS reduced by ≥25% | 4322.4 → 3220.2 MiB (25.50% reduction) | Met | | Same hybrid IDs/order | 20/20 identical | Met for this query | First recall improved 98.57%, but remaining cold-query/competitive-refresh work still exceeds the requested ratio against repeated warm queries. Host variation does not establish median parity. Clean checkpoint restart with the final binary ([committed table](../benchmarks/field-perf/table-clean-final.md); the original JSON is not present in this checkout): | Load measurement | BEFORE legacy family | AFTER same legacy family | AFTER clean checkpoint | |---|---:|---:|---:| | Triplet migration (ms) | 3665 | 3311 | 0 | | Ready (ms) | 35928.8 | 28712.3 | 28533.2 | ## Design and evidence by item 1. **Startup phases and readiness.** `chitta-field/src/field.rs:654` times snapshot decoding separately from `.pld` and `.emb`; `field.rs:1270` times lite/HDC loads; `field.rs:1473` times triplet migration; `src/hnsw.rs:3112` times Turbo construction. Lines have the requested `[chitta-field] load phase= ms=` form. `chitta/src/simple_cli.cpp:892` logs process-start-to-ready immediately before normal request dispatch. These phases overlap and do not add up to total startup: WAL replay, derived-map reconstruction, event tape/CDAWG [6](#ref-6), model setup and other initialization remain in the wall time. 2. **Warm before serving.** `chitta-field/src/field.rs:1265` starts Turbo and lite work beside HDC loading after replay/normalization, before store locks exist, and joins both before open returns. `hnsw.rs` publishes a completed immutable index, with no age-only maintenance rebuild on an unchanged corpus. The C++ loader also primes the encoder queue while the store loads and joins before leaving warming (`simple_cli.cpp:1674`). Before publishing Turbo, every bounded refresh worker executes a read-only search with a corpus vector, initializing the pool and search scratch without touching learned state. This last step reduced first recall from 118.5 to 92.4 ms in sequential measurements. No `.turbo` format is introduced. The startup regression test asserts that opening a persisted fixture returns with Turbo already available. 3. **Triplet migration.** `src/organ/triplet.rs:140` tracks whether the live SPO set is clean. Duplicate insertion/replay and invalidation clear that flag. Snapshot writes clean the cloned triplet organ and persist the optional V23 `triplets_clean` section (`src/snapshot.rs:1267`); an old V23 without the section still migrates once. Dirty WAL replay forces migration again. Borrowed dedup keys preserve the highest-weight winner without allocating three strings per row. The clean-checkpoint restart measures the migration portion as 0 ms; decoding and rebuilding derived triplet maps remain part of loading. This avoids recurring dedup, not every triplet-related allocation. 4. **Hybrid tail.** The control's first recall spent several seconds in competitive-weight refresh, with the first control diagnostic showing approximately 3.07 + 3.15 seconds in its two semantic lanes. The primary BEFORE log has a maximum single refresh stage of 4.20 seconds. Early warm hybrid samples remained around 245 ms while later samples fell near 33 ms: they were paying the outstanding refresh work. `src/store.rs:3008` captures an immutable fresh-Turbo view under a short semantic guard, runs independent neighbor searches in a bounded pool off all store guards, then applies weights using the existing two-phase logic. The original single-query arithmetic, deletion filtering and candidate order are retained. Dirty, scalar and HNSW [4](#ref-4) routes fall back to the existing search. A bitwise score/ID test covers serial versus parallel behavior. A four-query batching experiment was discarded because it changed float rounding without a measured latency gain. `CHITTA_RECALL_PROFILE=1` enables Rust semantic search / CW refresh / scoring timers and C++ setup, semantic lanes, keyword, HDC, bridge/fusion, rerank, prefilter, metadata, format and span timers (`src/profile.rs:1`, `chitta/src/handlers/field_memory_recall.cpp:17`). Output stays on stderr. In the verified run, CW refresh peaked at 12.63 ms; rerank/prefilter/format were not dominant. The supplied live 500–1100 ms tail was not reproduced in the quiesced scratch daemon, so this result does not establish that all live contention is resolved. 5. **Memory.** `src/profile.rs:44` emits capacity estimates for payloads, states, embeddings, HNSW, HDC, triplets, spans, CDAWG, semantic caches, lite encoder, keyword and episode structures. Each guard is held alone. `chitta/src/handlers/field_system.cpp:149` adds a `memory_breakdown` line to detailed health; request `health_check` with `details=true` to bypass the atomic fast path. The shared FFI additions are `cf_memory_breakdown` and `cf_recall_profile_enabled`; allocated C strings retain the existing `cf_free_string` ownership rule. The largest avoidable allocation found was the keyword reverse index: 13,426,880 per-document term entries replicated strings for just 108,299 distinct terms. `src/organ/keyword.rs:27` uses runtime `u32` term IDs, reclaiming IDs when the last posting disappears; serialized postings and BM25 [24](#ref-24) scoring stay unchanged. Episode HDC uses exact bit-plane counters instead of a `u16` per dimension (`src/hdc.rs:567`), including saturation behavior. Triplet source paths share `Arc` (`src/organ/triplet.rs:16`): 804,781 paths referenced only 6,197 distinct strings, approximately 79.35 MB repeated bytes versus 0.61 MB unique. Their custom serde encoding is exactly the former String representation. Subject/predicate/object strings were left alone because the reverse keyword map offered the larger measured saving. | Component allocation estimate (MiB) | BEFORE | AFTER | |---|---:|---:| | payloads | 168.31 | 168.31 | | states | 62.25 | 62.25 | | embeddings | 399.99 | 399.99 | | hnsw | 0.00 | 0.00 | | hdc | 269.50 | 269.50 | | triplets | 712.42 | 627.04 | | spans | 0.00 | 0.00 | | cdawg | 85.89 | 85.89 | | semantic_caches | 50.74 | 50.74 | | lite_encoder | 11.09 | 11.09 | | keyword_postings | not captured | 223.34 | | keyword_reverse | 672.09 (legacy estimate) | 66.99 | | episode_hdc | 51.70 (legacy estimate) | 7.30 | Estimates exclude allocator headers/fragmentation, Turbo internals, several other organs, the embedding model and thread stacks. They are allocation attribution, not additive RSS measurements. The reported RSS comes separately from `/proc//status`. HNSW is zero for this replica's flat-scan route; zero spans means this copied family has no loaded span store. Legacy keyword/episode figures are explicit counterfactual capacity estimates on the final data, not component counters captured in BEFORE. 6. **Reproduction.** See [benchmark instructions](../benchmarks/field-perf/README.md). `run.sh