The solver, result, and execution architecture is moving in vertical slices. Every
built-in kernel publishes a native core-program graph and a public KernelOutput.
Bootstrap policies and deliberately deferred integrations keep each slice bounded. Every
item below has an explicit replacement or retirement condition. A plan step is not
complete while its corresponding transition item remains without a current
justification.
One invariant is permanent rather than transitional: a result never authenticates its
own values or replay artifacts. Before forward execution, the consuming Model owns
immutable descriptors built from its canonical regimes and parameters and, for
data-dependent adaptive axes, a private solve-side record. Those descriptors own the
exact artifact identity and channel, payload type, canonical dtypes, ordered axes and
lengths, state/action roles, categorical code domains, applicability, requiredness, and
consuming replay route. Payloads and repeated public metadata are checked independently
against that authority at every log level. A future descriptor registry may replace
today’s private concrete dispatch, but must preserve this direction of authority.
| Transitional implementation | Exact replacement or retirement condition |
|---|---|
The private _lcm.execution.core_program types describe named solve axes, explicit value reads, internal graph dependencies, output layouts, and donation candidates across the built-in solver families. Public SolverExecutionCapabilities exposes their supported execution features, but is not a public program graph. | Plain EGM, GridSearch, NB-EGM, and an out-of-tree conformance solver exercise a versioned public program contract in lcm.solver_api, including axis alignment, input access, reductions, output roles, and replay/retention. The graph scheduler retains authority over liveness and legal donation. |
Private target/source value addresses and a transfer catalogue cover one-mesh layout pairs (ALIGNED_LOCAL, COPY_TO_SOURCE_LAYOUT, ALL_GATHER, LOCAL_SLICE, RESHARD) and cross-mesh copies (CROSS_MESH_COPY) for disjoint or nested device sets. Partially overlapping meshes are refused when neither contains the other. The adapter rebuilds mapping, tuple, and dataclass payloads, including EGM continuation leaves. | Replace these private address and adapter types through the public graph-wide input contract. Preserve production submesh placement, complete leaf addressing, and the same lowered/runtime layouts, with both aligned and copied continuation tests. |
PlannedInputLiveness counts declared reads, records retention and rolled aliases, and controls release and eligible donation. Two classes of undeclared reads remain pinned: host-read EGM breakpoint leaves and reachable inputs of programs without declared reads. Kernels still coordinate some multi-program handoffs. | Declare those host and program reads before removing their pins. Move remaining kernel-coordinated handoffs into program-level scheduling while preserving internal-output ownership and dispatch order. |
Compile-only width selection adds each candidate’s represented compiler allocation reservation to a conservative residency bound. Candidate preparation uses exact shape, dtype and required-layout descriptors; it does not allocate a transfer-copy bank for width alternatives. Core compilers allow unused inputs to be eliminated; their public Compiled.input_shardings trees identify which dynamic inputs the peak counts. Solve queries logical schedule aliases for each regime, period, core, and width, excluding only surviving aligned reads, while charging concrete fixed owners, whole-period shared destinations, and cell-local internal outputs. These reservations may overlap compiler-counted inputs. Simulation subtracts surviving actual buffer spans from call-owned storage. Eliminated inputs remain resident without changing declared reads or lifetimes. Profiled simulation host operations instead keep all explicitly placed inputs with keep_unused=True. Backend reports must include retained input bytes. An over-budget resident lower bound is refused before compilation; candidates are ranked by width product. | Measured ranking on the target hardware is deliberately not implemented: the footprint bound is the correctness property, and a measured choice would move values under assert_agrees_to_ulp rather than bit-identity. |
The first GridSearch CoreProgram covers solve-time singleton hard max and EV1 VALUE, plus collective VALUE, but publishes no replay or policy artifact | The declared output and retention contract can publish every graph-required channel and any requested replay artifact. Production simulation consumes the declared replay or recomputation route, and value-only execution is a retention specialization rather than a separate solver boundary. |
| Dense GridSearch programs for co-map routes. Every co-mapped input channel — the separate same-period and edge-reference channels included — carries named transfer metadata, so what remains dense on these routes is the route-specific streamed reduction, alongside action products of extent at most one and dense simulation-policy construction | Each remaining nontrivial route has its own production CoreProgram and route-specific streamed reduction, and simulation retains the requested policy identity or moments. Trivial action products may remain dense only as an explicit no-streaming identity route. Public solve/simulation tests, partial-tile and global-identity oracles, and the candidate certificate cover every migrated route before its dense disposition is removed. |
EV1 GridSearch uses the explicit dense disposition deliberately_dense:ev1_canonical_reduction_order; the internal streamed log-sum-exp implementation remains a reference only because blocked grouping changes canonical floating-point values and can flip winners | A streamed implementation reproduces the declared dense EV1 reduction order and values exactly for both precision profiles across exhaustive small supports, partial and non-divisor tiles, and the recorded adversarial winner-flip class. Solve and simulation replay or policy-moment tests establish the same candidate identity before this disposition is removed. |
Collective GridSearch uses the explicit dense disposition deliberately_dense:collective_resource_regression; the internal streamed collective reducer remains a reference only because paired production-shape evidence regressed warm runtime, compilation, host/compiler memory, temporary/device memory, and HLO size | A streamed collective implementation preserves candidate identity, shared feasibility, stakeholder readout, and dissolution exactly and wins a representative paired benchmark envelope on the supported hardware across runtime, compilation, host/compiler memory, temporary/device memory, and graph-size measures. Retain the independent dense oracle after production migration. |
ArtifactStore.project() | Replay routes and readers consume addressed artifact stores directly. |
Concrete built-in descriptor construction and replay-validator dispatch in the output bridge and Model | A dependency-safe descriptor registry owns construction and validation for every installed artifact type without making returned payloads or their public metadata authoritative. The registry must preserve the permanent model-authority invariant above, including independent checks of values and repeated metadata, before this concrete dispatch is removed. |
GeneratedReplayAuthority and Model._solution_authorities: a kernel emits the exact data-dependent adaptive replay-axis coordinates on the auxiliary channel of its KernelOutput under the engine-private key GENERATED_REPLAY_AUTHORITY, the solve loop keeps them beside the policy they describe, and the model binds them into its authority and caches them per parameter fingerprint; storage grows only with distinct adaptive-route parameter fingerprints and relies on the deterministic mesh for equal model/parameter inputs; the adaptive replay policy is omitted as NOT_PERSISTED under ALL_PERSISTABLE_ARTIFACTS because nothing persistable carries those coordinates | Stable persistence provides a model-verifiable semantic descriptor for dynamic solver output contracts, or the model can independently rederive those exact axes without consulting returned artifacts. Then delete the process-local sidecar/cache and its pickle transport while retaining fail-closed preflight. |
SolverDiagnostics travels on the auxiliary channel of a KernelOutput under SOLVER_DIAGNOSTICS, and the loop keeps it only under the caller’s collect_solver_diagnostics flag | Diagnostics are labelled artifacts retained when runtime_checks is enabled, independently of log_level. |
ContinuationPayload = ContinuationArtifact, a keyed protocol the engine rolls opaquely, while every shipped producer and reader still exchanges the concrete EGMCarry fields | A ContinuationReader protocol carries the operations a parent needs (interpolated value and marginal at a query), and every shipped producer/consumer requests those operations instead of reading EGMCarry fields. Do not broaden the alias to object; the key already carries identity and version, so what remains is the operation vocabulary. |
| Candidate-certificate source seals anchored to the current migration seams | Any callable move, bridge deletion, or source-route change deliberately regenerates and reviews the source inventory, then passes both precision profiles, every synchronized mutation, and every source-set perturbation. Never refresh a seal merely to make a changed route green. |
NEGM publishes a typed keeper to outer_sweep edge, and the engine lowers the consumer against the producer’s abstract outputs. The kernel still dispatches both programs and binds the completed keeper outputs at runtime. | The scheduler dispatches the declared graph and threads its internal outputs, allowing the kernel-side handoff to be removed without changing candidate aggregation or replay semantics. |
Unbudgeted eager cores place their ordinary inputs before invoking the numerical body under the planned mesh. Runtime layout checks accept physical equivalence while preserving mesh shape, names, ordered devices and memory kind. Declared transfer and compilation identities remain exact. Opaque callable closures containing incompatible committed arrays are not relocated by this adapter. Internal producer descriptors stay separate from ordinary inputs; when their abstract trace omits sharding, the adapter preserves the producer’s actual validated layout.
Budgeted solves own completion witnesses for each compiled dispatch and its declared copies. Before another core allocates transfers or executes on overlapping actual devices, the prior witnesses are completed. The full returned array tree is recorded before output validation, and eligible release/donation paths discharge witnesses before invalidating wrappers. Only transient core wrappers carry this owner; cached cores and compilation identities remain unchanged. Complete disjoint footprints stay asynchronous; conservatively including all concrete input devices can serialize a compiler-dead shared source. Edge folds, unprofiled host work, compiler autotuning and backend failures that return no completion handle remain outside this contract.
Simulation reads retained values and replay leaves on the actual ordered subject devices. Finite NNBEGM replay profiles its actual preparation bank, dropped-candidate diagnostics and canonical ranking. Its policy transfers deduplicate by artifact address and required layout, while the full bank remains owned through the unit. Other host replay routes still need their own complete profiles. The remaining forward-execution transitions are:
| Transitional implementation | Exact replacement or retirement condition |
|---|---|
PeriodSimulationReads owns addressed copies through an active regime’s complete decision, transition, and routing unit. Original solution arrays and published outputs stay owned by their callers. Unit-level retention can keep an intermediate longer than its final individual program read. | The scheduler owns every forward program and host-operation read, including output aliases, and releases each temporary after its final completed consumer. Public submesh and replay tests must preserve original solutions and published outputs through this replacement. |
Simulation budget admission covers current owned payloads, declared transfers, core dispatch, and selected pure host operations. Numeric entry uploads, including host-converted DataFrame columns and Series leaves, admit destination payloads and transfer scratch. Padding admits its compiler reservation. Automatic solves charge retained original and normalized simulation inputs alongside solve inputs. Foreign eager JAX value copies preserve source layout and admit actual compiled copies while retaining earlier copies. Complete subject-chunk profiles cover numerical programs, decoders, RNG, diagnostics, padding, retained outputs and assembly, with fresh admission before each chunk. Trusted native GridSearch value archives admit verified cache uploads and both detached copies with cumulative ownership; preloaded caches preserve source layout. Runtime UniformIIDProcess supports admit fixed-parameter uploads, parameter placement and their represented grid compiler reservation before fingerprint, authority or solve consumers read them. Their call-owned supports and exact parameter bindings participate in cumulative entry and automatic-solve residency. Preflight Cartesian action products admit their compiler reservation, retain coordinate and product owners cumulatively, and reuse exact products through serial diagnostics. Their call-local owner releases products on every validation exit. Joint and cohort-constant feasibility predicates, including serial per-constraint replay, admit their complete call-local executable against current owners; diagnostic gathers are profiled. Stochastic state-transition validation places concrete grid and scalar operands, admits the complete Cartesian law producer, retains its result through the admitted probability reduction, and uses the same memory owner during serial invalid-input replay. Central compiler reservation enforces the raw peak and represented argument/output/alias/preallocated-temporary storage for complete default-memory reports; the captured CPU trace omission and remaining runtime-storage limits are recorded in compiler_allocation_admission.md. Runtime NormalIIDProcess support with gauss_hermite=False admits its four scalar endpoint stages and final linspace separately, preserving eager rounding, weak fixed floats, exact scalar binding identity and required placement. Temporary placed parameters and scalar outputs remain charged through subsequent stages and release on failure or completion. Gauss-Hermite normal, lognormal, normal-mixture, Tauchen, Rouwenhorst and Tauchen normal-mixture runtime support producers now use validated staged recipes. The entire graph, including nested operand wiring, is checked before any stage dispatch; scalar/intermediate owners remain charged until completion or failure. Exact eager-byte, selected-device, pre-dispatch refusal and intermediate-lifetime witnesses cover these built-in producers. Regime-transition probability laws and joint-transition weight/support laws admit their complete producers against current owners before dispatch. Regime probability mappings and diagnostic coordinates remain owned through validation; joint mappings retain support and weight leaves through their consumers and release on completion or failure. Controls cover producer refusal, selected-device serial replay, public seeded results and invalid-input diagnostics. These producer-specific boundaries do not certify every allocating operation in a public call. Fully fixed support constructed at model build remains outside runtime producer admission. Built-in EGM and NB-EGM policy artifacts admit their templates, uploads and copies, so a saved and reloaded EGM solution simulates under a budget. Solver-owned and external-route artifacts, NNBEGM nested-policy templates, arbitrary lazy decoders and mixed-backend foreign materialization remain unprofiled and are refused when budgeted. | Every allocating operation in a budgeted simulation admits its compiler reservation or declared copy and scratch requirement before allocation. Low-budget witnesses reject before each allocation; supplied and automatic high-budget calls preserve numerical and decision semantics. Host staging memory is reported separately from accelerator allocator ceilings. |
| Budgeted host policy and gated replay adapters remain explicitly unsupported where their allocation and workspace contract is not represented. | Those adapters publish their real value and replay reads, executable workspace, and lifetimes through the same forward-execution contract, with acceptance and pre-allocation refusal tests for the supported routes. |
Automatic budgeted solves admit parameter copies on each consuming regime’s devices while retaining original, staged and previously placed buffers in solve residency. Scalar decision indices use shared placement in both abstract profiling and execution; vector indices use the subject axis. Public-call witnesses cover supplied and automatic solutions, selected device order, scalar terminal decisions, unchanged values and actions, and refusal before parameter transfer. CPU-emulated device witnesses establish these contracts; they do not establish GPU topology performance.
Simulation population is determined by each call’s initial conditions. The constructor
n_subjects hint and its duplicate concrete-template prewarm route have been retired.
Call-shape runtime executors remain cached; each call still validates current
parameters, process support, solution authority, and budgeted chunk residency before
dispatch. Tests cover changing populations on one model, warm executable reuse,
collective routing, serialization, and stale-support refusal. This removes a duplicate
execution route; it is not by itself evidence of an ACA speedup or whole-call memory
acceptance.
Adaptive NNBEGM replay has landed: a kernel emits its data-dependent replay-axis
coordinates on the auxiliary channel under GENERATED_REPLAY_AUTHORITY, the model binds
them into a GeneratedReplayAuthority cached per parameter fingerprint, and
_lcm/egm/outer_replay_capability.py is the adaptive nested reader; what remains
deferred is the stable persistence of those coordinates, recorded in its own row above.
Runtime width derivation has landed for the unbudgeted subject axis only
(_unbudgeted_subject_width in simulation/runtime.py, a constant byte cap over the
program’s own abstract operands, floored at the fixed default width). Width tuning
against a measured cost on the target hardware remains deliberately unimplemented, for
the reason recorded in the compile-only width-selection row above.
Active-subject compaction remains deferred. Solve placement and simulation execution retain separate acceptance gates. Compiler-key coverage observes the active bulk-key path, including changed and omitted FUES options. GPU placement, current ACA timing attribution, and the isolated macOS timing failure require fresh evidence on the final integrated source; historical timings do not close those gates.
When a new adapter, bootstrap policy, or deferred integration is introduced, add it here in the same change. Remove its row only after the retirement condition is covered by a test through the replacement seam.