adityamukho · Nov 5, 2026 · Nov 5, 2026
@@ -30,6 +30,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Documentation
 
+- **Manual shape sweep** (#841): [native shape and retention experiments](docs/benchmarks/841-shape-sweeps/README.md) cover sort/window, set and UUID cases, matched recursive controls and sustained pins/FactLogs. The report distinguishes query timings from process RSS and query-meter observations, and retains input rejections, capped attempts and attribution limits. No production, public API or nightly-route change.
+
 - **Regression history and reporting verification** (#840): [durable API/run evidence](docs/benchmarks/840-regression/completion.md) establishes numeric comparisons for all 427 native and 26 binding IDs with at least three independent v3 runs each. Separate main/v3 fixes #853/#854 preserve v3 history across measured main advances. Actual scheduled routes, 16 isolated live notification scenarios, four delivered messages and complete synthetic-resource cleanup are verified. This adds no database runtime behavior or Rust tests; further runtime lanes are tracked in #858.
 
 - **Manual migration sweep** (#838): [frozen fixtures, timings and correctness evidence](docs/benchmarks/838-migration/README.md) for native v7-to-v8 migration through 200k facts and Chromium/Firefox/WebKit through 20k facts. Includes nonmigrating native read-only open, v8 reopen and bounded post-migration cursor churn; larger browser cases and sustained pin scaling remain excluded. No production or nightly-route change.

@@ -18,6 +18,12 @@ checksummed evidence outlives Actions retention. This changes no database runtim
 behavior or Rust test counts. Additional JVM/WASI and qualified mobile nightly
 lanes are tracked separately in #858.
 
+The [#841 manual shape sweep](docs/benchmarks/841-shape-sweeps/README.md)
+records native sort/window, set, UUID, recursive-control and sustained-reader
+experiments, including rejected inputs, capped attempts and attribution limits.
+Its standalone harness and disposable diagnostic probes do not change the
+library test inventory, production code or nightly routes.
+
 ## Core Philosophy - CRITICAL
 
 **Before implementing ANY feature or change, you MUST assess it against the design philosophy in PHILOSOPHY.md.**

@@ -42,6 +42,12 @@ history, scheduled main/v3 routes and isolated live notification delivery with
 cleanup. Raw evidence and offline verifiers are retained in Git. JVM/WASI and
 qualified mobile nightly expansion are tracked separately in #858.
 
+The [manual shape sweep](docs/benchmarks/841-shape-sweeps/README.md) (#841)
+examines native sort/window, set and UUID shapes, recursive controls, and
+sustained reader retention. The report separates query latency, process RSS,
+metered allocations, input limits and capped attempts. These observations do
+not establish universal bounds or expand nightly coverage.
+
 On v3.0.0, an ascending value-only query such as `[:find ?v :where [?e :score ?v] :order-by [?v] :limit 10]` can read directly in index order and stop early when all committed `:score` history has one value kind (integer, float, or Boolean) and its source range has no pending writes. A query whose full order cannot be proved uses the existing sort (#641). Built-in `count`, `count-distinct`, `sum`, and `avg` can release completed groups when the pinned source proves their grouping order (#781). `min`/`max` also qualify when their arguments are proved Integer/Float/Boolean/nil; `sum-distinct` requires Integer/nil. A single Integer/Boolean/Float key (including mixed numeric groups) is supported. A longer effective tuple, including hidden `:with` keys, must reduce to one varying Integer/Boolean slot plus repeated occurrences and proved Integer/Boolean/nil constants. Any requested final Sort is retained for `:with`. Small grouped point queries pay proof startup cost; see the [measurements](docs/benchmarks/781-ordered-aggregate.md). Memory follows the active group and batches; distinct members within one group still grow. A limit can stop after enough emitted groups, but dropped min/max groups do not count and a retained Sort drains the input. Callbacks, `collect-set`, aggregate+window queries and unproved arguments keep full-input evaluation. When every built-in window uses the same proved nonconstant partition key, the engine can also finish and release one partition at a time. Its memory follows the largest partition plus bounded batches; one growing partition still grows. Unpartitioned windows, incompatible keys, aggregate queries, callbacks and `collect-set` keep full-input evaluation. A surrounding sort or distinct operation can still require more memory.
 
 On the unreleased v3 branch, selective in-memory ancestor queries can use entity probes instead of reading the whole edge attribute (#723). This is a query-planning optimization; it adds no storage index or configuration.

@@ -133,6 +133,7 @@ Scope — release-gate testing and documentation:
 - Regression-history/reporting evidence (#840) is complete: [all 453 numeric comparisons, preserved independent v3 history, scheduled routes and live notification/cleanup evidence](docs/benchmarks/840-regression/completion.md). Separate main/v3 fixes #853/#854 are merged; raw evidence is retained beyond artifact expiry.
 - Nightly runtime expansion (#858): add Java/JVM and WASI; qualify Swift/iOS simulator and Android emulator timings against physical-device workloads before enabling representative mobile lanes. The platform restriction from #839 applies only to that manual evidence task.
 - Manual migration evidence (#838): native v7-to-v8 through 200k facts; Chromium/Firefox/WebKit through 20k facts, with separate read-only/reopen controls and bounded post-migration cursor churn. [Results, frozen fixtures and exclusions](docs/benchmarks/838-migration/README.md); no new nightly route or sustained-pin bound.
+- Manual shape evidence (#841): [native shape sweeps, recursive controls and sustained-reader experiments](docs/benchmarks/841-shape-sweeps/README.md), with explicit input, timeout and attribution limits. The small-nightly recommendation is separate from execution; this audit adds no nightly route or release-acceptance gate.
 - Expression keyword/ref equality (#774; on `v3`): resolve literal keywords once per operator, with memory bounded by the expression. [Measurements and regression coverage](docs/benchmarks/774-expression-keywords.md); performance-only, with no v2.x backport.
 - Higher storage/WAL coverage gates and branch-coverage gates (#396; on `v3`: line and branch floors per file in `coverage-thresholds.toml`, checked on every PR)
 - Durability, recovery and operations guide (#398; done on `v3`: `docs/DURABILITY.md`, also on the docs site; found #535)

@@ -2,6 +2,15 @@
 
 This document records reproducible local benchmark snapshots. Completed release-performance history belongs in the [CHANGELOG](../CHANGELOG.md); continuous CI history is available on [Bencher](https://bencher.dev/perf/minigraf/plots).
 
+## Manual shape sweeps (#841, unreleased)
+
+The [shape and retention report](benchmarks/841-shape-sweeps/README.md) records
+native sort/window, wider-set, sparse/repeated-reference, recursive-control and
+sustained-reader experiments. It separates query latency, process RSS,
+query-meter observations and quarantine/reuse state, retaining rejected inputs
+and capped attempts. Its finite selection and attribution limits do not expand
+nightly coverage or establish universal memory bounds.
+
 ## Manual v7-to-v8 migration (#838, unreleased)
 
 The [manual migration report](benchmarks/838-migration/README.md) retains frozen

@@ -27,6 +27,13 @@ cleanup of all 46 synthetic resources. Fresh extraction reproduces the evidence
 reports, and removing delivery/comparison evidence is rejected. No Rust tests
 are added; the inventory above is unchanged. Additional runtime lanes are #858.
 
+**#841 manual shape verification**: the [standalone audit harness](benchmarks/841-shape-sweeps/README.md)
+checks full query answers before accepting timings and records sustained-reader
+snapshot, quarantine-generation, release/reuse, integrity and reopen checks.
+The report identifies executed checks and failed/deferred cases separately.
+Harness tests and disposable diagnostic probes are outside the Cargo inventory
+above; this audit adds no library test or nightly acceptance route.
+
 **#794 verification (2026-10-30)**: one added `storage::keys` unit test checks that a set's element encoding equals its elements' encodings, ordered and deduplicated by a `BTreeSet`, over 2,000 random sets of up to about 60 elements with duplicates, signed zeros, NaNs and strings up to 300 bytes, in shuffled, sorted and reversed order. It passes with both the old stable sort and the new unstable sort. The full default suite passed before merging #795 (2,038 active, 19 ignored). CI-equivalent native, browser and WASI clippy pass on Rust 1.99.1, and Rust 1.89 checks all features. The release binary is 1,260,568 bytes (3,024 smaller), below the unchanged 1,263,616-byte cap.
 
 **#781 verification (2026-10-29)**: 24 active tests and two ignored measurement

@@ -392,7 +392,7 @@ shortlist. No manual timing or release sign-off is implied by this close-out.
 | X03 | MANUAL migration | V retains its small native fixture. [#838 manual evidence](benchmarks/838-migration/README.md) separately measures native v7-to-v8 through 200k facts and Chromium/Firefox/WebKit through 20k facts, plus bounded post-migration cursor churn. Read-only v7 open is nonmigrating; same-context reopen is not cold startup. The 200k browser rung and sustained pin scaling remain excluded. These manual samples are not V or new nightly coverage |
 | X04 | MANUAL binding checks | [#839's runtime evidence](benchmarks/839-bindings/README.md) records three series each for JVM, Android, Swift/iOS and WASI (1,350 samples); binding/release acceptance remains pending. New #839 timings use only Device Farm/the dedicated bench; macOS is excluded, existing GitHub nightlies unchanged. [The remaining API/lifecycle dispositions](benchmarks/839-bindings/dispositions.md) identify measured representatives, absent APIs and proposed exclusions, including reader churn beyond [#838's bounded persistence case](benchmarks/838-migration/README.md). Python shared UniFFI coverage does not measure other host runtimes; no binding RSS bound is asserted |
 | X05 | Unverified operational follow-ups | Accumulate numeric regression baselines for 244 native and 26 foreign IDs (all have stored v3 observations/model settings, but baseline null in V). Verify live failed-upload and repeated-alert notification delivery; successful uploads and parser/audit unit tests do not exercise it. Cron execution of the final routes is unverified here: V was a dispatch. Preserve/refresh evidence beyond the 30-day artifact retention |
-| X06 | MANUAL / ENVELOPE scaling and isolation | Large 10m sorting/window/envelope sweeps, wider set cardinalities, sustained pin/quarantine/log-reader churn and sparse/repeated-ref UUID projection are outside V's fixed shortlists. [#838](benchmarks/838-migration/README.md) measures only eight commits with one old cursor plus a short-lived cursor per commit; it establishes no sustained-pin or quarantine-memory bound. Dedicated isolation of each recursive-probe optimization is unverified; representative queries do not establish per-optimization timings |
+| X06 | MANUAL / ENVELOPE scaling and isolation | Large 10m sorting/window/envelope sweeps, wider set cardinalities, sustained pin/quarantine/log-reader churn and sparse/repeated-ref UUID projection are outside V's fixed shortlists. [#841's report](benchmarks/841-shape-sweeps/README.md) records the finite public shape matrix, a capped-window retry, matched recursive controls with baseline path counters, 544-generation pin/FactLog churn and charged query memory, with every rejected, capped, limit-error and deferred slot; it establishes no universal latency or memory bound. The [protocol](benchmarks/841-shape-sweeps/PROTOCOL.md) distinguishes the finite selection from broader extensions. [#838](benchmarks/838-migration/README.md) measures only eight commits with one old cursor plus a short-lived cursor per commit. Recursive controls are end-to-end comparisons: counters show which baseline paths each case uses, not each path's share of time, and the ancestor alternative's 128-row cutoff remains unmeasured |
 | X07 | EXCLUDED exhaustive semantics | All numeric, bind, cross-kind join and forced-planner permutations remain correctness tests. Nightly controls select representative natural plans; broader hash controls include broader scans and keyword dynamic controls include binding/clone work |
 | X08 | EXCLUDED individual failure latency | Invalid bounds/windows/binds, deliberate callback errors, corrupt-page rejection, v1–v6 refusal, heavy single-entry WAL replay and individual PRS/API/QRY codes belong to correctness testing. C08 measures a successful repair of known damage and C30 measures cross-chunk rollback; neither claims exhaustive failure timing |
 | X09 | EXCLUDED unshipped/non-runtime scope | Public profiler #185, OPFS #441 and rule persistence #241 are open/unshipped at the audited revision. Proof/test/docs infrastructure and #797's study add no shipped latency path; production uuid/dist size uses separate size gates. Re-audit new production features through the release cut |