# iter embedding-abi-m5.2-resume-attempt — atomic-global fix is necessary but INSUFFICIENT for the swarm leak-proof

**Date:** 2026-05-19
**Started from:** 7bfa11e (GREEN of bugfix-rc-global-stats-race)
**Status:** RE-QUARANTINED — residual handed to a new debug cycle
**Tasks completed:** 0 of 1 (the un-`#[ignore]` was attempted, verified
unsound, and reverted; the honest-rationale correction is the only
shipped change)

## Summary

After the runtime fix `bugfix-rc-global-stats-race` (`7bfa11e`,
Boss-verified: the isolated 8×2M pure-global RED
`embed_rc_global_stats_race` deterministically green 3/3; full
`cargo test -p ail` green), I un-`#[ignore]`d the M5 swarm leak-proof
`symbol_fan_swarm_leak_free` — that un-ignore was *designed* as the
integration-level acceptance of the runtime fix. **Boss verification
falsified the premise that the runtime fix was sufficient.** Across 4
swarm runs: runs 1–2 GREEN, runs 3–4 FAILED; a 6-run capture: 3
GREEN, run 4 FAILED `left: 11998383, right: 12000003`. Signature:
`Σfrees` is **stable-exact (12000003) every run**; `Σallocs` is short
by a **jittering ~1600–2260 in ~1/3 of runs**, across the 4
`ailang_rc_stats:` lines (3 per-ctx + 1 global atexit).

The atomic-global fix is real, committed, and **necessary** — it
removed the *pure* global-counter contention (the isolated RED is now
deterministic). It is **not sufficient** for the swarm: a *second,
distinct* alloc-undercount remains that the isolated 8×2M pure-global
RED did not model. The un-ignore was reverted (`git checkout` — it
was never committed); the now-stale `#[ignore]` rationale that said
"un-ignore when the runtime makes the counters atomic" was corrected
to the accurate necessary-but-insufficient state (this honesty fix is
the only shipped diff — a future agent seeing `7bfa11e` must NOT
un-ignore on that basis).

## The asymmetry (orchestrator framing for the debug carrier, NOT a fix)

`Σfrees` perfectly stable while `Σallocs` jitters is the load-bearing
clue. Both global counters are now `_Atomic`; both per-ctx counters
are plain `++` but single-writer-per-thread (each worker owns its
`Ctx`; `Ctx: !Send`). If a per-ctx counter raced, *both* alloc and
free would jitter (the dec path also `++`s a per-ctx counter) — it
does not. So the lost increments are specifically on the **alloc**
side, and not pure global contention (RED green). Boss reasoning
could not localise it further; per the debug Iron Law that is
where Boss speculation stops.

Two framings the debug cycle must both consider (do not pre-judge):

1. **A genuine residual runtime defect** — some alloc events on the
   swarm path are uncounted non-deterministically (a TLS-ctx
   set/restore window across the M3 forwarder boundary; an
   interaction with data-server's prefetch background threads; a
   path the 8×2M ctx-less RED structurally cannot reach because the
   swarm mixes TLS-NULL host allocs with TLS-ctx kernel-internal
   allocs).
2. **A test-methodology unsoundness** — `Σ` over a *heterogeneous*
   set of lines (one process-global atexit line + N per-ctx
   `ailang_ctx_free` lines, with per-box alloc/free attribution
   split asymmetrically between global and ctx) may not be a sound
   leak invariant for a multi-thread host even with correct
   counters. If so the fix is a methodology redesign (e.g.
   per-symbol single-thread subprocess leak-proof, or assert each
   line balances under a single-thread-per-process shape), not
   another runtime change — and that becomes a design decision,
   possibly a bounce-back, only AFTER root cause.

## Disposition

- `symbol_fan_swarm_leak_free` STAYS `#[ignore]`d, body verbatim
  (still quarantined, NOT weakened). Rationale corrected in all
  three breadcrumbs (module doc, fn doc, `#[ignore]` reason).
- `symbol_fan_swarm_bit_exact` remains live & GREEN — the M5
  existence proof is unaffected (the swarm IS actually correct and
  leak-free; only the *accounting* is wrong).
- The residual is handed to a fresh `debug` RED-first cycle
  (`bugfix-swarm-rc-alloc-undercount`). main stays green at the
  honesty-fix commit.
- M5 (the milestone) stays open `[~]`; m5.3 (time-shard +
  friction-harvest) remains downstream of a sound leak-proof.

## Files touched

- `ail-embed/tests/swarm.rs` (the three `#[ignore]`-rationale
  breadcrumbs corrected for doc-honesty; the test body and the
  `#[ignore]` itself unchanged)

## Stats

(no orchestrator-stats file — this is a Boss-side honesty correction +
finding record, not an implement-orchestrator iteration)
