R7 progress model — written before the mechanism

Status: model for the round opened on the R6 freeze. Rules nothing; receipts/R7-OPEN.md is the contract, receipts/R7-EXECUTED.md (when it exists) is the record. Every numeral in this file is a definition or a prediction, never a measurement.

R6 made movement safe: one authoritative current Locus across multicore movement, holder loss, recovery and rollback, under a declared trust profile (receipts/R6-FROZEN.md). R7 studies multiplexing as multiplexing: many Loci, few floor slots, one Carrier per floor — which ready Locus gets its next semantic transition, where it is resident while it waits, and what physical work each unit of semantic progress cost. The objective is stated first so the metrics cannot drift toward the one every scheduler is tempted by.

Optimize semantic progress per Locus, not occupancy of Carriers.

0. Standing rulings adopted from R2.1 and R6 (permanent)

• A semantic transition is never split to imitate thread suspension.

Floor Census R2.1 blocked class X by construction: parking a unit mid-transition can destroy the invariant the transition protects. R7 chooses which Locus and where it is resident; it never chooses how far a transition goes. There is no floor op that suspends a transition, and R7 adds none (F136).

• A Locus is not a thread. The decomposition in receipts/R6-FROZEN.md

§4 has no THREAD; a Carrier is a replaceable execution embodiment that happened to perform a transition. Nothing here may introduce "resume Locus at instruction k".

• Migration is not progress. MOVE_OUT / MOVE_IN / EXPORT mint no

Locus State Revision (R6.3 H0). A relocation is counted as cost, never as work (F135).

• Currentness is R6's and is not opened again. Every R7 experiment moves

Loci through a trusted measurement fabric that holds exactly one copy (the R6 unclaim, unchanged); the transfer authority, durable history and anchor of R6.1–R6.4 are not driven per transition here. Their cost is a known per-durable-mutation tax (R6.4 K6) and is named, not re-measured.

1. Vocabulary

2. The objective, decomposed

Physical work per admitted transition, under any policy, is a sum the instrument can attribute term by term:

cost / admitted transition  =  floor transition cost                (R1: the hot floor, exact instructions)
                             + dispatch cost                        (choosing the Locus; the harness's or the floor's loop)
                             + migration cost × migrations / admitted   (MOVE_OUT + MOVE_IN + install; 2 × 317 B on the fabric)
                             + refusal cost × refusals / admitted       (a transition attempted and refused)
                             + durability tax (when the mutation is durable; R6.4 K6, not run here)

Carrier utilization can be 100 % with every term but the first: a policy that installs and evicts on every transition, or one that keeps issuing refused transitions, keeps the Carrier busy and the Loci still. That is why the objective is progress and the utilization is a column beside it, and it is the exhibit the negative control produces on purpose (F133).

3. What a scheduler may do — the policy space is three choices

Because no op splits a transition, the whole policy space is:

1. Selection — among the ready Loci, which gets its next transition,

and in what order within a round.

2. Residency — when a ready Locus is parked and no slot is free, which

resident Locus is evicted (parked) to make room; and whether a Locus that becomes ready while parked is installed at all.

3. Placement — with several floors, on which floor a Locus is resident

(R6's movement, used as a policy lever).

Given a fixed atomic-transition and ready/admissible interface, ComputeDriven Locus Multiplexing exposes three scheduling control dimensions: selection, residency, and placement (the wording frozen by the R7 adjudication, §12). Around the scheduler there is more — event production and readiness admission, deadlines, backpressure, priority, durability policy — but those feed the ready set or price the transition; they are not further multiplexing dimensions:

demand / events
      ↓
  READY SET
      │
      ├── selection
      ├── residency
      └── placement
              ↓
       atomic transition
              ↓
          progress

A "preemptive" policy is not expressible, and the model treats that as a property, not a limitation: what a preemptive runtime buys by interrupting (§10.7) this floor must buy by admission — an over-long transition is refused, never cut.

4. The arms — four policies and the control they are measured against

q and A are the two knobs; the battery sweeps them and reports, it does not tune them. The control is HOT-RESIDENT; its non-vacuity is that its oldest-ready age grows without bound while the other three arms' stays bounded on the same workload.

5. The workloads — demand generators, deterministic

Every generator is seeded and deterministic (the R1/R2 precedent: a stated deterministic skew is worth more than an approximated distribution).

6. The metrics — each with its instrument, and what it cannot say

7. The in-floor profile progress (feature, measurement only)

Beside the harness, one floor-side instrument so that the dispatch term in §2 can be measured without a pipe round trip per transition: READYRUN(count, mask, rounds) performs, for each set bit of a 128-bit ready mask in slot order and for each round, exactly one admissible transition chosen by possession (Vacant → ATTACH, Attached → DETACH), counting admitted / refused / inadmissible; PROGRESS(slot) reads a slot's admitted count and last round. It carries no rdtsc and no histogram, so its marginal instruction count is the floor's plus the loop's and nothing else; benchraw is the comparable image. It is gated like bench and is not in the production image (F86 holds or the round fails). Its ready mask is the harness's word, not the floor's knowledge: the floor still knows possession, not intent.

8. Falsifiers

F133  a policy that maximizes Carrier occupancy starves a ready Locus: HOT-RESIDENT at density > 1 on UNIFORM
      shows utilization near its maximum while oldest-ready age grows without bound      (predicted; an exhibit)
F134  under RR-FAIR or AGE-FIRST a ready Locus goes more than one round without progress at density 1,
      or more than the arm's stated bound at density > 1                                 (must not)
F135  a relocation is counted as progress: STATE (generation, transitions) or a progress counter moves
      across MOVE_OUT / MOVE_IN without an admitted transition                           (must not)
F136  the instrument splits a transition: after any run, a slot's possession is not the one the count of
      admitted transitions predicts (a partial ATTACH/DETACH)                            (must not; structural)
F137  the bytes column omits what the fabric carried: the harness's byte counter ≠ 317 × records moved  (must not)
F138  thrash is unaccounted: at density k under RR-FAIR/UNIFORM, cost per admitted transition minus the
      migration term is not within the host's range of the density-1 cost               (must not)
F139  the in-floor profile does not measure the floor: READYRUN's marginal instructions per admitted
      transition differ from benchraw's by more than the dispatch loop                   (must not)
F140  progress does not sum across floors: two floors on disjoint populations admit fewer transitions
      per round than each alone, beyond the host's range                                 (must not; R6 S8 extended)
F141  the profile leaks into production: the production image anchor moves                (must not; F86)

9. Predictions, before the battery

1. RR-FAIR at density 1 on UNIFORM: zero migrations, latency exactly one

round, oldest-ready age zero; instructions per admitted transition within the host's range of the floor's own figure plus the harness's pipe cost.

2. RR-FAIR at density 4 on UNIFORM: after warm-up one eviction and one

install per admitted transition — about 634 B on the fabric per transition and about 1,000 migrations per 1k — with fairness intact. The cost of fairness without a hot set, priced.

3. HOT-RESIDENT at density 4 on UNIFORM: bytes per transition near

zero, utilization at its maximum, and the parked Loci's age growing linearly for the whole run (F133 exhibited). On SKEW-7/8 it does well on the hot set and still starves any cold Locus that becomes ready while the hot set is busy.

4. AGE-FIRST: age bounded by the population size at any density; on

UNIFORM at density > 1 it thrashes like RR-FAIR.

5. CLOCK-AGE on SKEW-7/8 at density 4 and 8: most transitions land on

the resident hot set, bytes per transition a small fraction of RR-FAIR's, oldest-ready age bounded by A — the density result: many Loci per slot cost little when a hot set exists and the policy respects it.

6. WAITING: latency measured from re-readiness; every arm but

HOT-RESIDENT bounded; HOT-RESIDENT serves a re-ready parked Locus only when the residents go quiet.

7. REFUSING-p: refusals per admitted ≈ p / (1 − p); a refusal's

in-floor cost is below an admitted transition's (no state is written); the harness's per-command cost is the same for both.

8. In-floor: READYRUN's marginal instructions per admitted transition

sit beside benchraw's, above it by the mask test and the possession branch only; the possession after rounds rounds equals the parity of the per-slot admitted count (F136 holds).

9. Two floors: progress sums to within the host's range (F140 holds).

10. F86 holds: the production image anchor is unchanged.

10. Precedent — the same objective, elsewhere (surveyed before the battery)

Every source below was fetched on 2026-09-05; each entry ends with the one place the source's model differs from the Locus frame. Anything not confirmed from a fetched source is marked (unverified).

1. Linux EEVDF — lag as the fairness primitive. Each task carries a

signed lag: positive means it is owed CPU time, negative that it has exceeded its share; only tasks with lag ≥ 0 are eligible and the earliest virtual deadline runs; a sleeper's lag decays under deferred dequeue. <https://docs.kernel.org/scheduler/sched-eevdf.html> — Teaches: starvation is a per-entity debt; oldest-ready age proxies the largest positive lag, and lag decay is the precedent for bounding a parked Locus's claim. — Differs: lag is denominated in CPU time; a Locus's debt is denominated in withheld transitions.

2. Linux CFS — vruntime and the ideal multitasking CPU. CFS runs the

task with the smallest vruntime, "the task which executed least so far". <https://docs.kernel.org/scheduler/sched-design-CFS.html> — Teaches: one monotone per-entity counter ordered by a tree makes least-served-first O(log n); admitted transitions per Locus is the analogue. — Differs: CFS charges elapsed nanoseconds on a preemptible slice; a Locus is charged whole transitions and never interrupted.

3. schbench — what wakeup latency measures. Reports wakeup latency

(post → worker begins), request latency and RPS at p50/p90/p99/p99.9. <https://github.com/masoncl/schbench> — Teaches: the latency metric has an accepted shape and percentile set; "wakeup" is when the Locus became ready, not when the floor noticed. — Differs: its worker is a preemptible thread whose request contains sleeps.

4. `perf sched latency` — ready but kept waiting. Per-task Runtime,

Count, Delay ("ready to run but kept waiting"), max delay. <https://man7.org/linux/man-pages/man1/perf-sched.1.html> — Teaches: the canonical name is scheduling latency, reported per entity as mean plus max. — Differs: bounded there by the tick and involuntary preemption; on a run-to-completion floor bounded only by the longest transition ahead.

5. `/proc/<pid>/schedstat` — run_delay. Three cumulative fields: time

on CPU, time waiting on a runqueue, timeslices. <https://docs.kernel.org/scheduler/sched-stats.html> — Teaches: the kernel keeps a per-entity cumulative "runnable but not running" integral; oldest-ready age is its instantaneous form. — Differs: a cumulative counter cannot say who is starving now.

6. Erlang/BEAM — reductions. A scheduled process gets CONTEXT_REDS

(4000) reductions; each call counts; when spent, or on a receive with no match, it is suspended. <https://raw.githubusercontent.com/happi/theBeamBook/master/chapters/scheduling.asciidoc> — Teaches: the budget can be a work count, not a clock; instructions per admitted transition is a reduction cost. — Differs: BEAM suspends mid-work at 4000 reductions; class X forbids exactly that.

7. Go runtime — sysmon and asynchronous preemption (Go 1.14).

Cooperative points in prologues left call-free loops able to delay scheduling or freeze; loop checks cost a 7.8 % geomean slowdown, so Go moved to signal-based preemption; forcePreemptNS is 10 ms. <https://github.com/golang/proposal/blob/master/design/24543-non-cooperative-preemption.md>, <https://go.dev/doc/go1.14> — Teaches: what a non-preemptive floor gives up: a long transition delays every Locus behind it, so length must be bounded by admission, not interruption. — Differs: Go chose to interrupt; the floor refuses.

8. Seastar / ScyllaDB — task quota and reactor stalls. Shard-per-core

run-to-completion; the task quota is 500 µs by default; a stall is a task not yielding for more than about 20 ms; a "task quota violations" metric is exported. <https://raw.githubusercontent.com/scylladb/seastar/master/doc/tutorial.md>, <https://github.com/scylladb/scylla-monitoring/issues/524> — Teaches: the closest production precedent: starvation control as a violation count plus a stall detector, both diagnostics; refusals per useful transition is the admission-time form. — Differs: Seastar tasks insert their own yield points; a transition has none by rule.

9. Actor runtimes — one message per turn (Orleans, Akka). Orleans

grains process each request from beginning to completion; Akka's dispatcher throughput (default 5) batches messages per thread visit. <https://learn.microsoft.com/en-us/dotnet/orleans/grains/request-scheduling>, <https://doc.akka.io/libraries/akka-core/current/general/configuration-reference.html> — Teaches: "turn" is the actor name for an atomic transition, and throughput is the precedent for q in CLOCK-AGE (locality vs fairness, made explicit). — Differs: an actor turn may await mid-request; a transition cannot.

10. Little's law. L = λW, independent of the arrival and service

distributions and of the service order. <https://en.wikipedia.org/wiki/Little%27s_law> — Teaches: mean ready-set size, admitted/s and mean latency are two metrics, not three; the third is a consistency check on the rig. — Differs: means only; p99.9 and oldest-ready age are tails the law does not constrain.

11. Brendan Gregg's USE method. Utilization is time busy; saturation is

queued work the resource cannot service; an 80 % average can hide seconds at 100 %. <https://www.brendangregg.com/usemethod.html> — Teaches: Carrier utilization is U, a diagnostic; the meaningful quantity is saturation (queued Loci, oldest-ready age). — Differs: USE is per resource; the Locus is a client of one.

12. Context-switch cost — Li, Ding, Shen 2007; FlexSC 2010. Direct

switch cost 3.4 µs; the indirect cost, set by data size and stride, ranges from microseconds to hundreds of microseconds. FlexSC: syscalls hurt through pipeline flushing and pollution of processor structures. <https://www.cs.huji.ac.il/w~feit/exp/expcs07/papers/161.pdf>, <https://www.eecg.toronto.edu/~stumm/Soares-OSDI10.html> — Teaches: switch cost is what must be re-fetched afterwards, so bytes moved per admitted transition is the right unit, not switch count. — Differs: both measure privilege crossings; a Locus switch crosses none, so only the cache term survives.

13. Denning's working set (CACM 1968). W(t, τ) is what the process

referenced in the last τ; thrashing is resident sets smaller than working sets. <https://en.wikipedia.org/wiki/Working_set> — Teaches: at ~309 B per Locus, density is how many working sets fit in cache at once; migrations per 1k is working-set churn. The skew of Locus readiness is asserted by the workload, not measured (unverified). — Differs: the page is the unit there; here residency is a cache-line question.

14. Buffer replacement — LRU, CLOCK, 2Q. CLOCK avoids re-ordering a

list on every touch; PostgreSQL's clock-sweep picks victims without a system-wide lock; 2Q (Johnson & Shasha, VLDB 1994) adds a probation queue and a ghost list so scans cannot displace the hot set. <https://en.wikipedia.org/wiki/Page_replacement_algorithm>, <https://raw.githubusercontent.com/postgres/postgres/master/src/backend/storage/buffer/README>, <https://dblp.org/rec/conf/vldb/JohnsonS94.html> — Teaches: parking is eviction: a saturating touch bit, never a reordered list, and probation so one-shot bursts cannot evict the hot set. — Differs: a page is passive; a parked Locus becomes ready on its own, so the ghost list needs a readiness bit.

Which R7 metrics already have a name. Oldest-ready age ≈ the instantaneous maximum of run_delay, EEVDF's largest positive lag, Seastar's stall detector. Ready-to-progress latency ≈ scheduling latency (perf sched Delay, schbench wakeup latency) at the same percentiles. Instructions per admitted transition ≈ an IPC-normalised per-unit cost; BEAM's reduction count is the work-counted analogue. Admitted/s ≈ λ. Carrier utilization ≈ USE's U, subordinate to saturation. Migrations per 1k ≈ working-set churn. No standard counterpart surfaced for bytes moved per admitted transition (the switch literature measures indirect cost as time, never bytes per unit of useful work) or refusals per useful transition (Seastar's violation count is after the fact; an admission-time ratio normalised to useful work has no established name in any fetched source) (unverified that none exists).

11. Hand-ons named now, not built here

• The durable path per transition (LSR advances per second under each

arm) — the R6.4 tax applied to a policy, once the hot-path numbers exist.

• Event-driven readiness from outside the harness (a real external event

making a parked Locus ready), and the readiness bit on the ghost list.

• Placement across more than two floors; a real fabric; any host but this

one.

• Priorities beyond age; deadlines; any notion of a transition's length

bound by admission (§3), which needs a transition that can be long.

12. Adjudicated (2026-09-05) — what stands, what was qualified

R7's first pass was accepted as executed at 9/10, P9 preserved as a falsified prediction, never repaired into a 10/10. Standing after the ruling:

• The objective stands, strongly: bounded semantic progress per Locus

at minimum physical work per admitted transition. Not occupancy, not thread utilization, not aggregate throughput by itself. The first battery separated four observables that a busy-CPU view conflates: busier Carrier ≠ more Locus progress ≠ fairer Locus progress ≠ more efficient Locus progress.

• The three dimensions stand with a scope clarification (§3): the

wording is three scheduling control dimensions given a fixed atomic-transition and ready/admissible interface, never "nothing else exists" — event readiness, deadlines, backpressure, priority and durability policy exist around the scheduler.

• P9 stays red. The falsified prediction — that the starving control

would be the busiest Carrier — taught more than the prediction would have: Carrier utilization does not even correlate monotonically with good multiplexing, because a Carrier can be busier because the policy spends physical work buying a semantic property such as fairness. The retained witness (P9R, ERRATA E4) tests the semantic fact — ready parked Loci exist, aggregate execution continues, oldest-ready age grows with the run, at least one ready Locus receives zero progress — and constrains no utilization ordering.

• The metric hierarchy, three classes:

The two units without a standard counterpart (§10) are canonized: fabric traffic per admitted transition asks how much physical state movement this semantic progress required (CLOCK-AGE at density 8: 97 B against RR-FAIR's 633 B, about 6.5× less); refusal amplification measures wasted attempts per useful semantic advance (P8: predicted p/(1−p) = 1/7, observed 0.1417).

• The q = 1 copy result is qualified: per-transition copy-in /

copy-out is the honest cost of a one-transition visit, not yet a universal irreducible cost. A residency visit may perform several complete transitions on one taken lineage without violating class X — nothing is suspended mid-transition. The standing cost model is therefore

``text physical cost / admitted = semantic transition body + admission checks + policy / dispatch + (take + put) / transitions-per-visit + migration amplification + refusal amplification + durability tax ``

and the immediate measurement is a batched READYRUN over q ∈ {1, 2, 4, 8, 16}, predicted cost(q) ≈ T + (take + put)/q + dispatch(q) until cache effects dominate. At scale the 309-byte context may then be copied per Locus visit, not per transition.

• BENCHZ is a known instrument defect (R7-EXECUTED §4.2), not an

erratum to any frozen finding; it is fixed before the next measurement with a permanent cold control (hot set smaller than the total set; after deterministic draws hot hits > 0, cold hits > 0, and some cold index outside the hot set), the defective op retained as the control's negative.

• Order of the next work: batched READYRUN as the preflight; then

R7.1 event-driven readiness (docs/readiness-model.md, receipts/R7.1-OPEN.md) — today's most artificial part is the harness declaring who is ready; R7.2 cross-floor placement once readiness arrives asynchronously, so placement can ask is this move worth its physical price? rather than R6's is it safe?; R7.3 the durable-path tax per policy last, so the R6.4 three-fsync cost does not swamp the scheduler effects before they are understood — at which point durable LSR advances per second becomes a primary metric.

12.1 The preflight, adjudicated (2026-09-05)

receipts/R7-READYRUNQ-EXECUTED.md was accepted: cost(q) = T + P/q is measured, not hypothetical, and the standing cost model reads

cost / admitted  ≈  transition body  +  visit overhead / transitions-per-visit  +  the other policy costs

with the Lineage take/put a per-Locus-visit cost amortized across the complete transitions served in the visit. The sentence is narrowed as docs/readiness-model.md §10 says: the preflight does not establish that every byte of the 309-byte transferable state moves once per visit. q is a residency quantum in complete semantic transitions; it is swept in R7.1 and not yet defaulted. BENCHZ stays the retained negative; BENCHZC is the positive control for cold-slot reachability and not a canonical skew generator.