# Separate host creation from the native execution budget

On 2026-10-09, compiler candidate `886ba5c31537a65842a09922d3b387ccf495e1e0`
was published in [PR 1412](https://github.com/kimjooyoon/meta-ontology-go/pull/1412).
It uses Go 1.27.2 and decision runtime 0.2.26. The installed public compiler
remains 0.6.18 at source `13d576ef`; this candidate has not been released.

## Original evidence

The phase-observation PR 1411 passed its six canonical checks and four-platform
readiness. A separate Windows ledger run 37883255912 failed at the same aa79dc94
source. Original artifact 11594984386 is 259,138 bytes with SHA-256
`69881aa895577cde013923505a9c3680a2423b0a13acfb805570731fed9565ad`.
`windows/original.zip` preserves that archive; its digest matches API metadata.
The original combined output is retained even though it includes a diagnostic
after its first JSON line. `derived-first-json-line.json` is explicitly derived;
it equals the JSON extracted independently from the job log.

The failed native process reported:

- Start: **2,854,721,800 ns**;
- Wait: **510,000 ns**;
- total: **2,855,231,800 ns**, exactly their sum;
- initial deadline remaining: **2,000,000,000 ns**;
- context when Start returned: **DEADLINE_EXCEEDED**;
- recorded child user/system time: **0/0 ns**, with empty output.

The successful readiness and failed ledger executions had equal nonempty
executable, generated-code, driver and suite digests. The executable digest was
`4b77503bac6766ca20f71a5b45b6521cd1118c087a9be72069167de14803d10f`.
The comparison preserves both process records. It identifies the consumed
budget in Start without identifying the Windows component causing the delay
or claiming the child executed no instructions.

PR 1411 was integrated into dev `31d3419c` as observability work with this known
failure retained. `pr1411-proof/` contains the original successful six-check
artifact, source/ref verification and normal expected-head merge metadata.
The candidate and merged trees are equal. This did not promote main or publish
a release; the live PR status was UNSTABLE because of the recorded ledger failure.

## Correction and scope

Native calls arm a two-second wait budget after Start returns successfully.
The enclosing caller deadline still covers host creation, compilation, queueing
and execution. A parent deadline/cancellation is never reset. Successful Start
always leads to Wait, timeout callbacks are joined/stopped, and cancellation
continues to use the existing child/group cleanup. Observed cleanup can extend
elapsed Wait beyond its requested budget. The new `wait_limit_ns` records this
boundary; old records retain the original shared-budget interpretation.

This is a deliberate change to the native budget boundary, with no execution
retries. Generated program bytes and source/model selection have their existing
roles. It does not assert that every host startup will meet its caller deadline.

## Local validation and dogfood

Deterministic synctest cases cover a three-second Start, native timeout, earlier
parent deadline, parent expiry during Start, explicit cancellation, failed Start
and timer cleanup. A real sleeping process is stopped and joined. Old phase data
retains its absent post-start budget and exact integers. Focused race tests pass.
Full race tests pass for bodyexecution (164.234 s), workspaceexecution (59.190 s)
and toolchainrelease (13.598 s). The final legacy-phase regression was added
after that full run started and passed in the final focused run. Affected-package
vet and full build passed. The clean candidate's packaged caller profile passed
in 13.481 s, including exact output `-9007199254740994`.

`dogfood.tar.gz` preserves raw Gooo API-policy executions and saved replay,
inputs/source, timings and before/after hashes. The own QAT model is unchanged:
SHA-256 `3c68205a660695103712e2115ce90accd298b406dced8ad5ad5c9b84bab0a202`,
2,096-byte tensors. Both modes kept the same three actual classifications and
51/51 field checks over the 17 authored selection cases. Actual changes have
no correctness labels, so their score stays 0/0. Model selection called inference
once; saved replay called it zero times. New native runs show a two-second wait
budget inside a remaining parent budget of about 60 seconds.

Single local observations, fixed mode followed by model mode:

| Observation | Fixed | Own model |
| --- | ---: | ---: |
| Whole command | 0.55 s | 0.38 s |
| User / system CPU time | 0.20 / 0.09 s | 0.21 / 0.10 s |
| Peak RSS | 85,688,320 bytes | 86,261,760 bytes |
| Prediction | none | 273,583 ns |
| Model-guided generation | n/a | 18,162,541 ns |

These are sequential single samples with different cache conditions and some
concurrent local verification. They do not measure a speedup, host CPU utilization,
model-only memory, or general accuracy. No model training/download was performed.

Fresh canonical run 37885825449 and readiness run 37885825537 are pending at
publication. Package-interface PR 1410 will consume the correction after its
validation. Original failed runs were not restarted or overwritten.

## Subsequent platform completion

Readiness run 37885825537 completed successfully at this exact source on all
four platforms, followed by aggregate and eligibility. Original final artifact
11596069104 (1,045 bytes), SHA-256
`ea3710b8e42025178104f34f3e8918fb6149dc3b3791eb0380fc4c13d0d22293`, matches
the downloaded archive. Its receipt reports EVIDENCE_CLOSED/EXACT, 7/7 closed,
zero unknown/refuted cells and zero repository writes. `readiness/` retains
the original ZIP, receipt, API metadata and verification.

The separate ledger run 37885825468 completed its Linux, macOS Intel and Windows
platform jobs successfully. Windows job 113675492048 produced original artifact
11596506398 (14,152,654 bytes), SHA-256
`77138dfefe6ce94a72463689e321f05e2f544c42e23ee223b239d45f93fd92bc`.
The full downloaded archive matches its metadata and remains locally/in Actions.
`windows-completed-original-json.tar.gz` preserves all its original JSON files;
the binary archive is not duplicated here.

These JSON files contain 198 native process-record appearances, including repeated
history, rather than 198 independent executions. All are completed, all record
the two-second post-start budget, and all phase sums match their total. Maximum
observed Start was 86,215,700 ns with Wait 7,476,300 ns. This run did not reproduce
a Start longer than two seconds; the deterministic regression covers that delay.
The caller-fill-rejection executable/generated/driver/suite digests equal those
of the earlier failure, including executable `4b77503b…`. The stored comparison
retains the full digests. Canonical CI 37885825449 remains in progress; these
platform observations are not a main-promotion or release authorization.

## Canonical completion and development integration

Canonical run 37885825449 completed successfully on the original first attempt.
Original proof artifact 11597111331 is 11,213 bytes with SHA-256
`de3d3965e257aab9004f5ae16d469aa1a4cd24e36b95e3b400dc0f86811de3b9`.
`pr1412-proof/` retains its original ZIP, metadata, extracted evidence, verification
and expected-head merge response. The digest, receipt, exact head/base/refs and
six successful checks were verified. The live PR was CLEAN/MERGEABLE with no
pending or failed checks. Readiness and the complete secondary ledger were also
successful at the same source and attempt.

PR 1412 was normally squash-merged into development commit
`150dedc0fad61630077b12d7a011269c08415415`. Its tree equals tested candidate
`886ba5c3`, and its sole parent is the previously observed dev `31d3419c`.
This records development integration; installed 0.6.18 and main are unchanged.
Package-interface PR 1410 now includes the correction at `8f4c9638` and has fresh
CI, with separate local integration observations linked from Current Status.