Archive — history, not state. Kept for its reasoning and its evidence; its plan is closed.

One binary — the floor ruling and the mcode-linker arc

Written 2026-08-02 from a design session with John. This plan supersedes item 1 of plans/compiler-vision.md (the 255-slot rework) and absorbs the mcode-level half of that document’s opportunity map; the link-step opportunities it does not absorb remain there. It began as the 255-slot fix and grew, deliberately, into the arc that fix belongs to.

This plan absorbs the finalization arc’s remaining opens (John, 2026-08-02); plans/finalization-arc.md is archived, and this file is the live plan. The arc’s substance landed: L1–L5 complete, the mach split (7f89f8ba), the cross-press proof with make cross-check as a standing gate (b39ce01a), the docs sweeps (087eed72, e241056a, 5a5011de, 1e07d432, ff8fc6aa), and a comment sweep (664aceef + its reseed da6ffa0c). What remains is carried below as P-0. P0–P2 of this plan are gated by nothing and can start now. L6’s CI activation gates P3 and P5 — those phases change pressing and boot cross-target, and cross-check green on real runners is the standing regression gate they need underneath them. Land the L2b drain tail before P5 so the Pit lowering never ports an emitter mid-rework.

This plan repeals, by name, L3’s ruling of 2026-07-31 that “the appended-binary lane is load-bearing boot ABI” (the 16-byte discovery trailer). Under R1/P3 the boot image moves from tail-append to a linker section and the trailer lane dies. Per the guard-comment rule in method.md, comments and assertions anchored to that ruling do not bind against this arc; P3’s landing overrides them citing this plan.

The spine line updates: Pit emits, C reads; pools are the only executable; one binary; one lane.

The rulings (John, 2026-08-02, in conversation)

R1 — The binary is the floor. The boot image is a linker section of the pit binary, not a file beside it. Cold boot is: the OS maps the binary, C validates the boot section at a known symbol pair, jumps to the entry. Zero file I/O before main’s first actor. The committed boot/root.cart bytes survive only as the git-visible input forge injects; nothing loads that file at runtime. Recovery from any wedge is the last green (source, boot bytes) pair in git — and this is the ordinary path, not an escape: John’s explicit posture is that an escape lane that is only walked in emergencies rots, so the predecessor press (R3) is the one way, taken every time, automated. make nuke’s story becomes “git last-green + forge.”

R2 — The mcode→mach lowering moves to Pit. docs/spec/pipeline.md’s “C lowers, Pit links … Pit never learns an opcode” is repealed for the lowering. What C keeps, irreducibly: the interpreter, the pool validator/mapper, the boot-section symbol. What moves out: the encoder half of source/mach_pool.c — instruction words, stone object layout, fusion, the press. The rationale the old ruling protected (a fresh binary can boot from the mcode snapshot with no cart, because the lowering is compiled in) is traded away knowingly; what replaces it is R1+R3: a usable boot section is always present because forge never produces a binary without one. The C lowering survives exactly one arc as a differential oracle against the Pit lowering — lowering miscompiles are the bug class the fuzzer cannot see, and running both encoders over the corpus tests it for free. Then it dies.

R3 — Forge orchestrates the whole artifact. Cement dies as a user-facing verb; there is one producer. pit forge <recipe> (already the C build: make all is forge-bootstrap + forge) grows the boot side:

1. Forge derives the profile/ABI/toolchain stamps from the recipe. If the ABI moved, it sequences the predecessor press itself: the current binary runs the Pit lowering parameterized for the new profile, before the C rebuild. The ordering that today lives in Makefile comments and discipline becomes a dependency edge inside one program. (The lowering lane’s foreign-target refusal in pit-shop/mach_lower.cm is repealed — cross-profile emission is precisely what a Pit lowering is for, and it is also what makes cross-target bootstrap easier: pressing a Playdate or wasm boot section no longer runs any target C.)
2. Forge builds the C, injects the boot bytes via a generated two-line .s with .incbin (every toolchain in the tree accepts it: clang, gcc, emscripten, arm-gcc; cold bootstrap.sh stays POSIX sh + cc because sh can emit those two lines), and produces a candidate pair in the build directory — never touching ./pit or boot/ in place.
3. The gate runs against the candidate: boot it, smoke subset, and the fixpoint check — the candidate presses its own boot section again and forge byte-compares. This single check mechanizes two hazards at once: “prove a payload-form change on a scratch program BEFORE it reaches a reseed” (the wedge that once cost real time), and the stale-compiler first-generation window of R4.
4. Promotion is atomic and explicit: swap the binary, regenerate the committed boot bytes.

R4 — The fleet self-recompiles at boot. Boot-section residents carry their derivation identity (source-closure hash + flags). At boot, the fleet compares those identities against current source and re-realizes stale actors — the realization cache makes this once-per-edit, not per-boot. Only the root/boot actor is irreducible. Consequence: reseeds stop being welded to fleet edits. make smoke reseeds only when C changed; the boot section is pressed rarely and explicitly (ship, or “boot has gotten slow, press a fresh one”). The full-link cost of R6 lands only at those explicit pressings. The accepted risk: after a compiler edit, the stale compiler compiles the new compiler and that first-generation output serves until the next press — correct if the stale compiler compiles correctly, which is exactly what the fixpoint check in R3 verifies.

R5 — The vocabulary collapses to four words.

Cart dies as an artifact kind. Its distinguishing feature was the C-legible fixed header that let a dumb C floor cold-boot it; once the boot image is a section, exactly one thing needs that header — the binary’s own boot section, written by forge. Every external thing is opened by running Pit code and can be a richer container: a bundle. boot.qop is the dev bundle. The mount mechanism (games, mods, two-lane trust) survives unchanged inside the bundle; a game bundle carries pools pressed for the engine binary’s profile, a start plan, and assets — no header ceremony, the pool mapper’s stamp validation is the check. A shipped single-file game is the same forge fusion with a different recipe: engine pools + game pools + assets in one binary, which is also the Playdate/ROM shape, so desktop ship and console press are one invocation with different profiles.

R6 — Linking moves up to mcode; the boot section is the fully-linked lane. The semantic linker consumes N pit.mcode.unit@3 records (simple Pit records — this is why linking there is easy) and produces a linked program: import edges finalized to direct function references, whole-program streamline, inlining, claims-driven stripping, literals pooled program-wide. The link plan is the granularity lever it already is: dev = per-module (today’s behavior, cache-friendly, hot-reload friendly), ship/boot-section = fully linked. Under R4 the expensive plan runs only at explicit pressings, so it never enters the dev loop.

R7 — The mcode/mach division. Mcode is high level and dictates everything the runtime needs; it is also the AOT input, so nothing mach-specific lives there. Fused opcodes, peepholes, and outlining-for-size are lowering concerns (outlining is a target decision — right for ROM targets, wrong for desktop — so it belongs with the link plan). Inlining, guard elimination, name/log stripping, and dedup analysis are mcode concerns — AOT benefits from all of them. Native bake-in stays semantic in mcode (an import edge to a native module); finalization to a direct symbol index is a lowering/link decision stamped with the binary identity. Mcode never learns what a symbol table is. The mcode extensions this arc needs are small: a direct function-reference form for finalized same-program edges, and a program-level literal pool in the linked artifact.

R8 — No variable-length encoding in the execution stream. Rejected on evidence (below). Fixed 32-bit words stay; operand growth is an extension-word encoding (R-phase P2). Kim-style variable bytes remain correct for wire and artifact formats — where bytes are parsed once — and are the natural encoding if the mcode artifact ever leaves its current form.

TABLED — fat vs thin bundles. Whether a bundle carries portable mcode beside its pools (so an engine with the lowering actor can re-press stale-ABI bundles itself, the R4 mechanism applied one level up) or ships pools only (re-press is a publishing event). A forge recipe flag either way, not an architecture fork; nothing in this plan moves differently under either answer. Decide when the bundle work starts.

RULED (John, 2026-08-04) — stripped-log semantics. Logging does not change the behavior of a program. Stripped means UNEVALUATED: a stripped log call’s argument expressions do not run, and side effects in log arguments are a program error, not a supported channel. Stripping is PER-CHANNEL — channels are individually strippable (a build may pull debug and keep panic), which composes with claims-driven stripping: a channel is a claim. Enforcement lands in two tiers: tier 1 (with P6’s stripping) — direct effects in a log-argument subtree (assignment, send, property store on a non-fresh receiver, any sensory-classified op) are a COMPILE ERROR, using the effect classification the compiler already carries; tier 2 (deferred, own landing) — purity through calls needs interprocedural purity facts (bottom-up per unit, propagated cross-unit like other facts) and until it lands, calls in log arguments are conservatively permitted and the limitation is named in the docs.

Evidence (measured 2026-08-02 against boot/root.cart at 83316c12)

The dev root cart carries 30 pools, 1.58MB of pool bytes, 887 functions, 199,922 instruction words. Aggregate:

Against VLE (R8):

• The dominant iABC format (op,A,B,C in 8-bit fields) is 4 bytes; Kim-encoded with three small operands it is also 4 bytes. VLE wins only on formats with unused width (isJ, iABx) — estimated 10–20% of instruction bytes ≈ 5–10% of the artifact, against a real dispatch cost.
• source/mach_vm.c:327 records that the per-instruction fetch being a single indexed load with no tag test is measured load-bearing — an earlier shape with one tag test in the fetch was rejected on cost. VLE puts a data-dependent loop in every operand read of every dispatch.
• Half the machinery is keyed on instruction index, not byte offset: u16 entry_pc/disruption_pc, line tables, PGO site PCs, the origin map, the fusion press, and the linker’s post-hoc operand patching (which under VLE becomes an assembler relaxation loop, since a patch can change instruction length).
• Every serious VLE bytecode (wasm) is transcoded to fixed width before interpretation; transcoding is unavailable here because executing from mapped stone with zero load work is a pillar, and on ROM targets it moves code into the RAM that does not exist.

For pool-global constants (P2’s follow-on):

• 68.3% of all VALUES rows are byte-identical duplicates within their own pool (8,616 of 12,611 rows ≈ 138KB ≈ 9% of the cart). Structural cause: the linker gives each function a contiguous constant range so the operand index stays small — the same constant gets a fresh row per function. The dedup John wants is blocked by the narrow operand fields: the same root disease as the 255 limit.

On the 255 cliff (P1 first, and before any inlining):

• Floor units sit at the ceiling: shop_build.cm’s bootstrap_artifacts lowers at exactly 255/255, module body 254/255.
• Inlining raises slot pressure: the July experiments pushed parse_primary from <255 to 352 required slots and broke, and compile_fn sat at exactly 255. The slot fix is a hard prerequisite of R6’s inlining, not a sibling.

On instruction-sequence dedup (P7 is gated on a real census):

• Explicit disrupt tails are a dead end on this corpus: 3 sites in the entire cart — disruption originates inside C operations, not as bytecode tails.
• Whole-function byte-identical dedup: only 1.2% of instruction bytes (62 small functions).
• General repetition is large: greedy non-overlapping census finds byte-identical 8-word runs covering 35.4% of instruction bytes (22.2% at 16 words). Caveat that gates everything: constant operands are function-relative indexes, so byte identity is NOT semantic identity across functions. The 35% is an upper bound on a partly-mirage. Honest measurement requires literals resolved — i.e. it must be re-run at the mcode-link level, after constants go pool-global. Phase order below follows from this.
• Mechanism note: FUNCTION rows assume contiguous instruction ranges and function-relative u16 PCs, so cross-function sharing is outlining (shared blocks as callable units, paying call overhead), not raw range overlap — a cost model, not a linker freebie, and a per-target lowering decision (R7).

On the streamline IR (P4):

• In memory, mcode is Pit records/arrays with text opcode names; the stored unit is a canonical record with interned literals and spans — there is no JSON anywhere, and the measured ~77%-of-compile-time in streamline is traversal and copying of boxed heap values. The fix is an interned internal form for the passes (numeric opcodes, flat arrays), same instruction set, converted at the pipeline’s edges. Not a compiler overhaul. It becomes urgent when pass input goes from one unit to a linked program.

Already in place, discovered while measuring:

• The fused binary already exists: Makefile:29 — the runtime has no compiled-in root cartridge and discovers boot/root.cart from its own tail (scripts/append_boot_tail.sh). R1/R3 promote this from a shell-script afterthought to the forge-owned mechanism and swap tail-append for .incbin (bytes inside the signed image; kills the wasm MEMFS seed lane and the repack lane; ROM targets get execute-in-place naturally).
• The pool format already supports stripped names: name_value = 0xffffffff in the FUNCTION row (PIT_MACH_POOL_STRIPPED_NAME). P6’s name stripping is a producer flag plus stack-trace degradation to stable_id (symbolicate host-side via the origin sidecar), not a format change.
• All 30 dev-cart pools have empty IMPORTS and zero cross-pool function duplication (887 unique stable hashes) — the dev cart already behaves like the fully-linked end state in the ways that matter.

What C keeps, what C loses

Keeps (the irreducible floor): the interpreter (mach_vm.c), the pool validator/mapper, the boot-section symbol pair, the GC, the scheduler, the platform providers. Loses: the encoder half of mach_pool.c (instruction encoding, stone layout, fusion, the press) — to a Pit lowering actor; the binary-tail discovery dance in cart_boot.c (find own executable, hop the trailer) — deleted, not ported; the cart header path for external files — deleted with the cart artifact kind. The C lowering is kept compiled and callable for one arc solely as the differential oracle (R2), behind a flag, then deleted.

Gates become keys — the mismatch inventory and its deletion schedule

Sibling plan (ruled 2026-08-02): plans/derivations.md — the shop’s build model rebuilt on walked closures: no file lists anywhere, per-file derivations, no invalidation events (lazy per-file misses), parallel build fan-out. It owns the fate of the salts, key_inputs, and every Makefile hash list; the forge seed-check row below is where the two plans meet. Orthogonal to this plan’s floor/forge/linker work and runs alongside it.

(Ruled direction, John 2026-08-02.) The principle: matching exists wherever two independently-produced things meet at runtime. Every stamp gate compensates for a production process that lets the two sides drift; forge co-produces them, and what is co-produced stops being checked. The one-binary world converts gates (runtime refusals) into construction guarantees (forge cannot emit a mismatch) plus cache keys (drift is a silent rebuild, never a refusal). A gate dies ONLY in the landing that ships its replacement, and by name — this is the P1 lesson: the cart stamp is today the only thing between a new-ABI binary and wrong-generation words.

Dies:

Survives (all of it cheap, none of it per-edit):

1. External pools/bundles → binary — the irreducible runtime match: mounted game bundles, store-served realizations, cross-pressed carts are produced at a different time than the consuming binary. ABI + profile at mount/load, named refusal. Once per mount, not per boot.
2. Client ↔ daemon build identity — two processes from possibly-different binaries meeting on a socket. Honest refusal, fires rarely under atomic promote.
3. Cache keys — builder salt (split per the iteration-speed item), derivation keys, resident derivation, profile axes. Content addressing, not matching: a key never refuses, it misses and rebuilds. All freshness questions belong in this lane.

Dev-time proof machinery is NOT this inventory and mostly stays. Matching used as proof during development is the trust apparatus, distinct from runtime gates:

• Byte-identity regeneration proofs — make manifest twice byte-stable; byte-identical seed regeneration; the R3 fixpoint press. These grow MORE central (the fixpoint becomes THE promotion gate) while running less often (per-landing, not per-edit, once the unweld lands). The cold floor keeps the committed-manifest proof alive as long as bootstrap.sh exists.
• Completeness gates — store_freshness.ce gate A (builder closure vs declared key inputs), the key_inputs↔Makefile list comparison. Stay; they are what makes the cache-key lane trustworthy enough to carry everything the gates stop doing.
• Differential proofs — the opt/noopt fuzzer; the linked-vs-unlinked dimension (owed before P6 inlines); the C-vs-Pit lowering oracle (P5, one arc); L6 cross-check on real runners. These grow — they are the compiler arc’s trust story.
• Baselines and pins — make bench + perf/ir_census.py gate (this line used to read make budget against the pool-lane baseline; the compiler half of budget was retired 2026-08-06 and those two are what replaced it); pit test all at its known count; pin tests (reap_is_not_a_pass, arena counters). Stay.
• The arm matrix — check-arms over the profile space. Stays, landing-time.

Phases (an ordering, not a contract — later phases should shrink)

Each phase lands docs-first per plans/method.md: the pages it must change are part of the phase, not follow-up.

P-0 — Close the spine (carried from the finalization arc; details were plans/todo.md’s “Closing the finalization arc” and stay tracked there).

• L6 finish (in flight): replay the cross-press battery on the main branch, reseed commit; then John pushes, activates the cross-check CI jobs, and rules on the windows runner (the workflow carries it commented out). This is the gate for P3/P5.
• L2b drain tail: the PGO_SITES emitter is parked in git stash@{0} (also a scratchpad patch) and must land WITH its C counters — D5 deleted the only production PGO-collector path, so step 3 is a rebuild, not a port. Write the missing end-to-end drain test that RUNS a program and asserts a non-zero count.
• Close-out bill: total the deletion count across L3/L4; demonstrate the compiler-less runtime (pressed cart boots on the vm_only shape); finish the guard-comment re-anchor (one pass landed at 664aceef; the close-out re-anchor of every “do not relax” is still open — and it is where this plan’s repeal of the appended-binary-lane ruling retires that ruling’s guards); delete the L4 dead-code inventory (list in the L4 reseed commit message).

P0 — Derivation identity + staleness check. Boot-section residents (and later, linked programs) carry source-closure hash + flags; boot compares and re-realizes stale actors (R4). This is the same identity the linked artifact needs for “the boot copy is dead” to be decidable by key comparison — it gates both R4 and R6, so it goes first. Docs: docs/architecture/boot.md, executables/realization pages.

P1 — Operand-width extension. The extension-word encoding (the long-scoped option (b): ~300–500 lines in mach_pool.c/mach_vm.c). Kills the 255 cliff. Common case stays one fixed word and one indexed fetch. Docs: docs/spec/mach.md (the frame budget section), docs/spec/artifact-formats.md.

CORRECTED (found by the P1 crossing, 2026-08-02): “an ABI bump is one reseed” is FALSE post-L3. It was true when the register lane could run mcode directly; now pools are the only execution lane and the “ABI-neutral” snapshot is read by an engine that is itself a pressed pool, so a new-ABI binary cannot boot at all — and the old binary cannot press the new encoding (the authority is its own C, pre-P5). Every pre-P3 ABI bump therefore crosses on a read-acceptance bridge: the new binary accepts exactly one prior pool generation (default-off, env-gated, named refusal otherwise), boots, presses the new generation, and the committed artifacts are the CLEAN binary’s fixpoint re-press — never the bridge’s output, which is scaffolding by definition. Prove the new emitter on scratch pools (mach_pool_test.c) BEFORE the first press; the payload-form wedge hazard is the reason. The bridge is the interim predecessor-press: P3’s forge sequencing subsumes and retires it by name. P2 crosses on it too.

P2 — Pool-global VALUES. Wide constant operands let the linker intern constants pool-wide: the measured 9%-of-cart duplication goes away, and byte-identical code becomes semantically comparable — the precondition for P7’s census. Docs: docs/spec/artifact-formats.md (VALUES, the per-function-range language).

P2 implementation (2026-08-02). mach-v4+fuse1 makes VALUES one pool-global intern table and reserves the old FUNCTIONS first_value/value_count words as zero. The C lowering emits constant and branch relocation triples; the Pit linker owns interning, inserts WIDE when a global index crosses u16, and rebases branches, entry/disruption PCs, PGO sites, instruction bases, and origin rows. REGEXP literals normalize through LOADK scratch registers so every current constant operand can widen. The exact mach-v3+fuse1 predecessor remains a default-off read/write crossing lever only; scratch tests execute its local-range LOADK and old REGEXP form, and P3 retires both environment gates by name.

The crossing followed the corrected two-generation drill: v3 scaffolding first, v4 read acceptance second, then a clean no-gate snapshot press. The clean re-press passed scripts/press_fixpoint.sh byte-for-byte, so no bridge-produced artifact is retained. The synthetic linker test places a constant at index 65,536 and proves WIDE insertion, branch repair, and origin growth at the boundary.

P2 finding for later cache work: mcode did not survive this press-only ABI move. pit-shop/clerk.ce currently assigns the same full generation identity to both compiler_identity and lowering_identity, so unchanged compiler units rebuilt despite the split compiler/press salt design. P2 does not widen scope into generation cache architecture; the observation is recorded here for the owner of that lane.

P3 — Forge fusion lifecycle. .incbin injection, candidate-pair-and-promote, the fixpoint gate, predecessor-press sequencing on ABI moves (R3); retire append_boot_tail.sh, the repack target, the MEMFS seed lane, cement-as-verb. Docs: docs/architecture/boot.md, docs/architecture/c-build.md, docs/spec/pipeline.md (boot artifacts section), glossary (R5 vocabulary).

P3 done-line (ruled 2026-08-04). P3 owns how a binary carries and proves its boot floor — not whether every rep can read every artifact format. In: the review fix list, the rebase + nota fixpoint determinism proof, the non-vacuous E6 acceptance, the retirement sweep, and the previously-green standing gates staying green (check-arms at its HISTORICAL surface: each arm builds + passes its C tests — no daemon, no seed, no boot, per its own design; section-BOOT proof is required only for the shipping 64-bit lanes: darwin, docker linux/windows, web). AMENDED 2026-08-04: synthetic small-rep arms are NOT tuned to boot today’s dev fleet — a 2 MiB nan32 window was never meant to hold the full clerk, and window-ratcheting to fit current content is a treadmill. Small-rep boot arrives when P6-size/P7/link-plan dieting produces content sized for those targets. Out, explicitly: rep-by-format content defects — an arm whose suite corpus is blocked only by the recorded rep-range offset defect (board.md) or by compression viability on small reps is marked gated-by-defect and not chased; 16-bit lanes were never gated. The narrow artifact-sizing workaround is the ceiling of in-scope effort for that class. Landing note: the nan32 and kim8 boot states are gated-by-content-size, converges via P6/P7 dieting. The PIT_CART retirement rework and image-budget alignment to already valid recipe positions stay; P3 does not raise profile windows or redesign QOP offset handling. The rep-range reader defect and its missing named refusal remain the separately recorded item; failures traceable to P3 plumbing remain in scope.

P3 landing (2026-08-04). Rebased onto dev after the done-line ruling. Forge completed two clean presses and compared the binary, root image, and QOP bytes exactly (two clean boot presses are byte-identical), then promoted only the clean fixpoint. Two following Darwin smokes performed no forge or seed work. Shipping section boots passed on Darwin, Docker Linux (including vm_suite 1086/0), Docker/Wine Windows (Win32 C test, linked mount, root breed, resident ps), and web (linked resident fleet ready). check-arms retained its historical build + C-test-only surface and passed all 14 arms; host cross-check, the local Docker lane, check-cli, and the warm budget sample were green.

The retirement sweep removed the synthetic profile cement/link dependency, the default boot/boot.cart producer, and the last memory-report lookup of that retired root. pit cement now accepts only explicit app/loader carts and requires --out; web boots its linked section without a MEMFS seed. Defensive cleanup mentions of old filenames remain intentionally non-consuming. nan32 and kim8 record gated-by-content-size, converges via P6/P7 dieting and run no P3 boot proof. No profile window was raised and no QOP offset reader was redesigned; the rep-range reader defect and its missing named refusal remain on the board as a separate landing.

P3 pre-P5 sequencing, clarified (2026-08-03, resolving the apparent R3/P3/P5 contradiction). R3’s “the current binary runs the Pit lowering for the new profile” is the POST-P5 end state. Pre-P5 the C in the binary is the lowering authority, so the old binary cannot emit a new ABI — and the plan already names the interim: the P1 CORRECTED note (“the bridge is the interim predecessor-press: P3’s forge sequencing subsumes and retires it by name”) and the gates table (“the P1 bridge is the last HAND-DRIVEN crossing”). What P3 retires is the hand-driven, env-gated FORM of the crossing — PIT_CROSSING_ACCEPT_ABI as a user-facing lever, the drill in Makefile comments — not the acceptance capability. P3 internalizes it: on an ABI move, forge builds the new-ABI candidate, boots it with read-acceptance of exactly one prior generation as a FORGE-INTERNAL, forge-only mechanism (never user-set, never ambient), presses the new generation with the candidate’s own C lowering, then runs the fixpoint gate on a clean no-acceptance boot — committed artifacts are always the clean fixpoint’s output, never the bridge’s. P5 later replaces the press half with the Pit lowering, at which point the acceptance mechanism has no remaining caller and dies fully, by name. The Pit lowering does NOT move forward into P3.

P4 — MOVED to plans/compiler-perf.md (CP1) by John’s ruling 2026-08-03. The interned streamline IR is compiler-lane work: its urgency premise (P6 whole-program compilation multiplying the 77%) dissolved when the E-series findings showed the recompile cost is dominated by eliminable shop work, not compile throughput. Implemented on codex/one-binary-p4, reviewed mergeable-with-fixes; the fix list and gates live in the new plan. Nothing in this arc waits on it.

P5 — The Pit lowering. Port mach_pool.c’s encoder to a Pit actor; repeal the foreign-target refusal; run differentially against the C encoder over the corpus and the fuzzer for the whole arc (R2). Docs: docs/spec/pipeline.md (“C lowers, Pit links” rewritten; the C-floor inventory), docs/architecture/implementors-guide.md.

P6 — The mcode linker, SIZE half (rescoped 2026-08-03; the optimization half moved to plans/compiler-perf.md CP2). What stays, serving the primary goals (fused cart, smaller carts): import-edge finalization to direct references, name stripping (flag + stable-id stacks), log stripping (after the NEEDS RULING above), program-level literal pool, link plans (dev per-module / ship full), and the dedup census machinery P7 consumes. What moved with its gates: whole-program streamline, inlining, and the linked-vs-unlinked fuzzer dimension that gates inlining — that dimension is owed before CP2 inlines, not before this phase links. Docs: docs/spec/mcode.md (direct-reference form), a new linked-program section in docs/spec/artifact-formats.md, docs/architecture/pipeline.md.

P7 — Dedup/outlining phase: CLOSED NOT-WORTH-IT (2026-08-04). The honest post-P2 census was run through P6’s pit.mcode.program@1 ship/program linker on the real pit-shop/clerk linked closure: 99 units, one program group, 4,188 functions, 1,122,900 instructions, and 8,890 pre-link literal rows coalescing to 3,662 program-pool rows. Exact canonical bytes recoverable at link time were:

The pressed reference is boot/root.cart at 9,199,632 bytes; total recovery is 1.9205%, below the approximately 2% ruling threshold (by 7,314 bytes). The census measured the body and literal rows after P6’s program-level literal resolution, so the earlier pre-P2 sequence upper bound is not being reused. P7 therefore deletes itself: no dedup switch, linker implementation, or outlining phase is warranted on this corpus. Re-open only with a materially different linked artifact or a changed threshold.

P8 — Native bake-in. Direct symbol-index call finalization at lowering, stamped with binary identity (pools already carry profile/ABI/toolchain hashes; the manifest already aggregates natives). Composes with the provider-registry dissolution banked in the spec questions. Docs: endowments/executables pages.

Hazards carried forward

• A payload-form change can wedge past every escape — under R1 the blast radius is larger (the boot section IS the floor). The mitigation is no longer advice but the R3 fixpoint gate: no candidate promotes without pressing its own boot section and byte-matching. Do not hand-promote around it.
• The first-generation window (R4): between a compiler edit and the next press, everything is compiled by a compiler that the stale compiler built. A stale- compiler miscompile poisons the tree quietly. The fixpoint check catches divergence at press time; ./pit down + a fresh boot after suspicious compiler edits stays cheap insurance.
• ABI moves now need the predecessor — the old binary must be able to run the Pit lowering for the new profile. Never land an ABI change and a lowering-breaking change in one commit; forge cannot sequence across a commit that breaks both sides at once. The recovery is the last green pair in git.
• Byte identity is not semantic identity until P2 lands. Any dedup or code-sharing reasoning done on pool bytes before constants go global is reasoning about a mirage (the 35%/68% numbers above are the calibration).
• Two compiled forms must agree. No inlining before the fuzzer’s linked-vs-unlinked dimension exists. (Moved with inlining to plans/compiler-perf.md CP2, 2026-08-03; recorded here because P6-size’s linked output is the second form the dimension compares.)

Operational hazards carried verbatim from the finalization arc (each cost real time once): two-phase crossings use untracked phase1_<name>.txt files so they cannot be mistaken for package source; the daemon reads env levers, not the client — any measurement without ./pit down && first is vacuous; the first ./pit test run after make all can time out and says so — rerun before believing it; a pre-SQ1 runtime without the stop_watchers leaf lock deadlocks its own build (PIT_WORKERS=1 make is the escape); cart-crossing landings need their two reseeds IN ORDER (press lands and reseeds BEFORE C readers go; the escape is rm -f pit && make); agent worktrees spawn at stale bases — every brief names the base sha and verifies; other agents share ~/.pit’s build store — a wedged foreign daemon can stall a build. The floor-at-255 hazard (bootstrap_artifacts at 255/255) dies with P1.

The drill — every landing merges this way

Commit source-only in the agent’s worktree (never boot artifacts/stamps — regenerate yourself), cherry-pick, grep for conflict markers, make seed (the explicit pre-landing reseed; smoke deliberately no longer reseeds for Pit-only edits), rm -f boot/boot.cart boot/cart.stamp, make smoke, then under set -o pipefail: make check, make check-cli twice (cli BEFORE arms; a first post-reseed run can transiently fail), make check-arms, make lint, make manifest twice (byte-stable; git status --short boot/manifest empty after the second), make budget, make check-playdate, and ./pit down && ./pit test all on a fresh daemon. Then commit the reseed. NOTHING LANDS ON RED. Baseline: 2705 passed / 1 failed (network/http2).

Source: plans/archive/one-binary.md