roadmap: close Embedding ABI — M2 ([~]->[x]); WhatsNew

M2 (per-thread runtime context + concurrency safety) fully closed:
spec 1c58055 (grounding-check PASS 9/9) -> plan b3388c8
(Boss-corrected) -> iter c9a84b3 (PARTIAL 4/9 + Boss spec-defect
repair) + fbeeade (DONE 5-9) -> audit ad88dec (CLEAN-after-tidy;
bench exit 1 causally exonerated, NO ratify) -> tidy a80d495
(doc-honesty lockstep rename). No fieldtest (zero authoring-surface
change). Sanitiser-verified coherent stop. WhatsNew entry mirrors
the done-state notify text verbatim. Next: Embedding ABI — M3 (a
new milestone, no spec — a /boss new-milestone bounce-back).

docs/WhatsNew.md

@@ -214,3 +214,13 @@ The canonical specification and the prose-roundtrip guide have been swept so the
 To keep it that way, the specification now carries a short rule, in its own words, stating the honesty standard it holds itself to, and there is an automatic check that fails the build if a removed wishful-or-backward-looking phrasing ever creeps back in. The reviewer that guards the specification against drift was taught the same rule, so new violations get flagged going forward rather than only the ones cleaned up now.
 
 Nothing about how programs are written, type-checked, compiled, or run changed — this milestone touched documentation only. It was reviewed clean and the one flagged benchmark metric is, once again, the same pre-existing machine-drift item already on the list, proven unrelated here by before-and-after binaries that are byte-for-byte identical.
+
+## 2026-05-18 — Compiled kernels can now be called safely from many host threads at once
+
+A compiled AILang function can now be called safely from many host threads at the same time. The previous step made a single compiled numeric function callable from a C or Rust host, one caller at a time; this step makes that boundary swarm-safe — each host worker thread gets its own isolated runtime state, so a whole pool of threads can drive the same compiled kernel concurrently with no shared mutable state and no data race.
+
+This is verified, not asserted: the kernels run clean under a thread-race checker across many threads at once, and a deliberately-broken shared-state variant is correctly caught by that same checker, so the safety guarantee has teeth rather than being a claim on paper.
+
+Nothing about how programs are written changed — the source you write is byte-for-byte the same as before; only the generated calling boundary and its runtime became concurrency-safe, which is exactly the point: thread-safety here is a property of the compiled artefact, not a burden on the author. The build was reviewed clean; the one flagged benchmark number is, once again, the same pre-existing machine-drift item already on the list, proven unrelated here.
+
+The next milestone lets structured records — not just single numbers — cross that boundary with a frozen, stable memory layout. That is a fresh piece of work and a natural point to decide how to pick it up.

docs/roadmap.md

@@ -218,32 +218,50 @@ work progresses.
     finding [spec_gap]#2;
     `docs/journals/2026-05-18-iter-emit-ir-staticlib.md`.
 
-- [~] **\[milestone\]** Embedding ABI — M2: per-thread runtime
+- [x] **\[milestone\]** Embedding ABI — M2: per-thread runtime
-  context + concurrency safety. `ailang_ctx_new()/_free` threaded
+  context + concurrency safety — CLOSED 2026-05-18. A compiled
-  through every call; neutralise the two process-global hazards
+  scalar AILang kernel is now callable concurrently from a host
-  the runtime read surfaced — the non-atomic
+  thread swarm without an RC-runtime data race. `ailang_ctx_t*`
-  `g_rc_alloc_count` / `g_rc_free_count` counters + `atexit`
+  is a mandatory leading parameter of the (M3-frozen-shape) C
-  stats hook (`runtime/rc.c:86–98`), and the allocator backing
+  `@<sym>(ctx, scalars…)` ABI; the M1 forwarder publishes it via
-  (toward pure per-thread RC, no shared Boehm collector; aligns
+  a `__thread` slot around the **byte-unchanged** internal
-  with the standing P2 "Boehm full retirement" todo). Still
+  `@ail_<mod>_<fn>` call (internal convention + `_adapter`/`_clos`
-  scalar-only so any failure is attributable to concurrency, not
+  untouched — M1 decision held; TLS sound because the kernel call
-  marshalling. IO-at-the-boundary (`io/print_str` via a
+  is synchronous, ctx never held across a suspension). `runtime/rc.c`
-  per-instance sink) explicitly deferred here: pure
+  de-globalised: the two RC-counter sites became `if (ctx)
-  `(State,Chunk)->State` kernels have no effects; revisit only
+  ctx->{alloc,free}_count++ else g_rc_*++`, the `g_rc_*` statics +
-  if a logging kernel appears — deliberately not a separate
+  `atexit` retained verbatim as the null-ctx single-threaded
-  roadmap entry, by feature-acceptance discipline. Coherent stop:
+  executable fallback (executable-path leak readback byte-preserved).
-  swarm-safe scalar kernels, tsan-clean under N threads.
+  ctx near-empty by discipline (`{alloc,free}_count` only — no
-  - depends on: Embedding ABI — M1.
+  arena/lock/atomic/IO; the build-ahead trap named out-of-scope).
-  - context: 2026-05-18 chat; runtime hazard read
+  Staticlib is RC-only enforced (`--emit=staticlib` rejects
-    (`runtime/rc.c` global stats + `atexit`).
+  `--alloc=gc|bump`; Boehm never linked into a swarm artefact;
-    Spec'd + user-approved 2026-05-18 (grounding-check PASS 9/9):
+  standing P2 Boehm-retirement untouched). No authoring-surface /
-    `docs/specs/2026-05-18-embedding-abi-m2.md` — ctx as mandatory
+  schema / `ailang-check` change — the `.ail` is byte-identical to
-    explicit C-ABI param (TLS-forwarder, internal conv + `_adapter`/
+  M1; the deliverable is a swarm-safe generated ABI + de-globalised
-    `_clos` byte-untouched); ctx near-empty by discipline
+  runtime, **sanitiser-verified** (per-thread-ctx scalar swarm
-    (`{alloc,free}_count` only); hazards neutralised in the swarm
+  tsan-clean == oracle; direct rc-accounting per-ctx clean;
-    artefact, `g_rc_*`+atexit retained as the null-ctx executable
+  shared-ctx negative control a genuine `ThreadSanitizer` race at
-    fallback; staticlib RC-only enforced; no schema/surface change.
+  the de-globalised counters, exit 66 — teeth non-vacuous). Process
-    Plan next.
+  note: the first implement dispatch correctly BLOCKED on a genuine
+  spec defect (a negative control on the non-allocating scalar
+  swarm is structurally impossible — the spec's own honesty point);
+  Boss adjudicated a spec-consistency repair (teeth relocated to the
+  rc-accounting harness) rather than a brainstorm bounce. spec
+  `1c58055` (grounding-check PASS 9/9) → plan `b3388c8`
+  (Boss-corrected) → iter `c9a84b3` (PARTIAL 4/9 + Boss repair) +
+  `fbeeade` (DONE 5–9); milestone-close `audit` `ad88dec` (architect
+  one `[medium]`+`[low]` doc-honesty drift; bench `check.py` exit 1
+  decisively causally exonerated — bencher H0-refuted, all 3 firings
+  the two tracked-P2 noise families, rc.c hunk branchless+free, NO
+  ratify) → tidy `a80d495` (the `## Embedding ABI` lockstep rename,
+  drift resolved). No fieldtest (zero authoring-surface change).
+  Stays here briefly for context; remove once stale (full record in
+  `docs/journals/INDEX.md`).
+  - context: `docs/specs/2026-05-18-embedding-abi-m2.md`;
+    `docs/journals/2026-05-18-iter-embedding-abi-m2.1.md`;
+    `docs/journals/2026-05-18-audit-embedding-abi-m2.md`;
+    `docs/journals/2026-05-18-iter-embedding-abi-m2.tidy.md`.
 
 - [ ] **\[milestone\]** Embedding ABI — M3: frozen value layout +
   single ADT/record crossing + RC ownership contract. Host