From 1c5445e3fe835bdfbd1b6ece0eb3878346606592 Mon Sep 17 00:00:00 2001 From: Mike Grier Date: Wed, 4 Nov 2026 21:46:23 -0500 Subject: [PATCH] docs: archive the completed M45 milestone Every item of M45 was already archived under its own heading and left a stub; the stubs are removed, as the checklist rules say for a completed milestone, and the milestone's own account (why it was done, the decision and measurements, the items and the pull request that landed them) is archived as one entry that links them. DESIGN-NOTES and PLANS pointed at the live milestone and now point at the archive; the PLANS row for PARKED.md names both parked items by what they wait for. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHECKLIST.md | 32 -------------------------------- COMPLETED-CHECKLIST.md | 19 ++++++++++++++++++- DESIGN-NOTES.md | 2 +- PLANS.md | 4 ++-- 4 files changed, 21 insertions(+), 36 deletions(-) diff --git a/CHECKLIST.md b/CHECKLIST.md index f0ddc5ac..135244ff 100644 --- a/CHECKLIST.md +++ b/CHECKLIST.md @@ -603,35 +603,3 @@ yanks are needed, is [DE-D-8](crates/durable-ioring-events/DESIGN-NOTES.md#de-d- The engineer's own step, with their crates.io login: `cargo yank --version 0.1.1 durable-ioring-events`, then `cargo yank --version 0.5.0 win-durable-ioring` and `cargo yank --version 0.5.1 win-durable-ioring`. Both driver releases require the events crate at 0.1.1 or later within 0.1, so all three go, and the replacements must exist first. - -## M45 -- A long-haul tier, a probation tier, and suites that do only what their claims need - -Each pull request's CI, and each sabotage entry, runs a crate's whole suite, so every test pays its cost -on every one of them. Measured locally, 22 of the workspace's tests take a second or more and account -for nearly half of its serial test time; on GitHub runners, tests doing real file I/O have stalled for -many seconds while idle, which failed sabotage controls on the post-merge sweeps of `c714e83b` and -`13f06742`. So a test's scale is kept only where the claim needs it, and the scale for its own sake moves -to a long-haul tier that runs daily. Tests that have never run anywhere start on probation. The decision -is [DESIGN-NOTES.md](DESIGN-NOTES.md#long-haul-tier); the measurements behind it are in -[DESIGN-RATIONALE.md](DESIGN-RATIONALE.md#why-a-long-haul-tier). - -- [x] **M45.1** -- The tiers' convention and its census: `tools/check-test-tiers.ps1` refuses a test whose ignore reason and module disagree about its tier, in CI on every push. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m451) - -- [x] **M45.2** -- `long-haul.yml`: daily when `main` has moved, plus dispatch; the long-haul tier fails the run, the probation tier does not. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m452) - - -- [x] **M45.3** -- Probation results are kept on the `probation-results` branch and reported; the promotion threshold stays a working position. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m453) - -- [x] **M45.4** -- The six never-run tests (five flush-barrier stress instruments and the 4 GiB buffer test) are on probation, and a tier runs one test at a time. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m454) - -- [x] **M45.5** -- `blocking_push`'s capacity test writes past a declared capacity of 32 and its full-scale form is long-haul. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m455) - -- [x] **M45.6** -- `windows-file-enumeration-sys`'s three large-directory tests run over 600 files with the minimum buffer, and their full-scale forms are long-haul. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m456) - -- [x] **M45.7** -- `win-multi-file-tail-watcher`'s seven scale-bearing tests run smaller with their full-scale forms long-haul; the quiet-between-bursts waits are left and say why. -> [completed 2026-11-03](COMPLETED-CHECKLIST.md#m457) - -- [x] **M45.8** -- The census and the cost-probe tests run the cost probes at a twentieth of their workload through a new `--iteration-divisor`, with full-length forms long-haul. -> [completed 2026-11-04](COMPLETED-CHECKLIST.md#m458) - -- [x] **M45.9** -- The four waits that are their claim were measured, none was shortened, and each says why beside its constant. -> [completed 2026-11-04](COMPLETED-CHECKLIST.md#m459) - -- [x] **M45.10** -- The workspace was re-measured: 17 file-watcher stress tests that never ran are on probation, and the 13 tests still over a second are each left with a reason. -> [completed 2026-11-04](COMPLETED-CHECKLIST.md#m4510) diff --git a/COMPLETED-CHECKLIST.md b/COMPLETED-CHECKLIST.md index c6e26081..cc19c9e2 100644 --- a/COMPLETED-CHECKLIST.md +++ b/COMPLETED-CHECKLIST.md @@ -4515,4 +4515,21 @@ No sabotage entry names a moved test, and the tests' bodies are unchanged, so no The two parked items this unblocked are not ready to be graduated: what each waits for is a run on a runner after the branch merges (the post-merge sweeps for `M45+.1`, the first scheduled long-haul runs for -`M45+.2`), so each has a restated gate in [PARKED.md](PARKED.md). \ No newline at end of file +`M45+.2`), so each has a restated gate in [PARKED.md](PARKED.md). + +## Moved 2026-11-04 21:46:04 -05:00 -- M45, a long-haul tier, a probation tier, and suites that do only what their claims need + +### M45 -- A long-haul tier, a probation tier, and suites that do only what their claims need. *(completed 2026-11-04)* + +Each pull request's CI, and each sabotage entry, runs a crate's whole suite, so every test pays its cost on every one of them. +Measured locally, 22 of the workspace's tests took a second or more and accounted for nearly half of its serial test time; on +GitHub runners, tests doing real file I/O stalled for many seconds while idle, which failed sabotage controls on the post-merge +sweeps of `c714e83b` and `13f06742`. So a test's scale is kept only where the claim needs it, and the scale for its own sake +moves to a long-haul tier that runs daily. Tests that have never run anywhere start on probation. The decision is +[DESIGN-NOTES.md](DESIGN-NOTES.md#long-haul-tier); the measurements behind it are in +[DESIGN-RATIONALE.md](DESIGN-RATIONALE.md#why-a-long-haul-tier). Landed as pull request #178. + +Its items, each archived under its own heading above: [M45.1](#m451), [M45.2](#m452), [M45.3](#m453), [M45.4](#m454), +[M45.5](#m455), [M45.6](#m456), [M45.7](#m457), [M45.8](#m458) (and [M45.8.1](#m4581), withdrawn), [M45.9](#m459) and +[M45.10](#m4510). The work this left waiting on a run on a runner is parked as `M45+.1` and `M45+.2` in +[PARKED.md](PARKED.md). \ No newline at end of file diff --git a/DESIGN-NOTES.md b/DESIGN-NOTES.md index a94effcf..bccd938c 100644 --- a/DESIGN-NOTES.md +++ b/DESIGN-NOTES.md @@ -3063,7 +3063,7 @@ test's cost is paid on each; a test whose claim holds at a small size is written **A working position, not a decision:** how many passes are enough, which is `M45.3`'s to settle once there are results to look at. -The work is [CHECKLIST.md](CHECKLIST.md) `M45`. What prompted it, and the measurements, are in +The work is [COMPLETED-CHECKLIST.md](COMPLETED-CHECKLIST.md#m45) `M45`. What prompted it, and the measurements, are in [DESIGN-RATIONALE.md](DESIGN-RATIONALE.md#why-a-long-haul-tier). **Each probation test's results are kept across runs on a branch of their own, `probation-results`, and reported; how many passes are enough is a working position.** `M45.3` left this to its own work, having said only that artifacts expire and that the sabotage record's diff --git a/PLANS.md b/PLANS.md index ad4a94a8..7f8cc591 100644 --- a/PLANS.md +++ b/PLANS.md @@ -40,7 +40,7 @@ plans tracker: [crates/durable-ioring/PLANS.md](crates/durable-ioring/PLANS.md), | [CHECKLIST-mutation-survivors.md](CHECKLIST-mutation-survivors.md) | not started | Work queued from the workspace-wide cargo-mutants sweep of 2026-09-02, whose findings are kept in [mutation-sweeps/2026-09-02/](mutation-sweeps/2026-09-02/README.md) rather than re-derived -- the run took roughly fourteen hours. 2,792 caught, 1,112 survived, 198 timed out. **The headline numbers mislead in three ways and the README says how**: a timeout in a blocking-API crate is usually a detection that lost its name rather than a gap (measured: one of `windows-waitable-queues`' 120 timeouts fails four tests in 0.00s when re-injected alone), a low score on an executable probe crate is measuring the wrong thing, and three kinds of survivor -- equivalent mutants, unreachable code, and constants that want a `const` assertion -- are not missing tests at all. M1 covers the shipping crates; M2 holds the two crates that are not libraries and whose scope is an engineer's decision; M3 re-runs and prunes rather than hand-editing the tool's output into a second source of truth. | [mutation-sweeps/2026-09-02/README.md](mutation-sweeps/2026-09-02/README.md) | | [crates/topology-planner/CHECKLIST.md](crates/topology-planner/CHECKLIST.md) | in progress | **Planned, not built** -- the directory holds a plan and no code, and becomes a crate when M2 begins. Owns the mapping from a **dataflow description of an application** -- its input, output and processing code paths, the shape settled 2026-09-23 as `EP-D-6` and discharging the deferral `EP-D-4` named -- plus an abstracted idealized machine description, to **one or more suggested** sets of execution domains: which processors host a domain, where each thread pins, which memory node it allocates from, what channel connects each pair, and where each channel's buffer lives. `EP-D-6` also split planning into two stages -- connectivity inferred with no machine in hand, then realization against a machine model -- which adds `EP-1+.5` (the connectivity graph is a value and needs a type and a home) and `EP-1+.6` (the answer is a set, so what a caller receives and what `M2+.2` renders are sets). Filed because that mapping was **unowned**: [CHECKLIST-io-domains.md](CHECKLIST-io-domains.md) M32 lists the contracts "the runtime cannot be written without" and all of them concern the queue, while M33+.1 opens with "one pinned thread, its `IoRing`, its node-local registered pool, its shard" -- presupposing a plan nothing computed. Separate from `windows-topology-sys` because that crate states **facts** and this one applies **policy**; fusing them is what produced `outermost_partitioning_cache`, a policy answer sitting in the facts crate that three consumers then re-derived differently (SH-16.9). M1 was a *requirements* milestone -- it states what the topology must answer, and it fed the locality-model session, which has since concluded as `D-13`..`D-21`. **The component was deferred past PR #56 by direction**, contributing only planning documents there; #56 then closed unmerged on 2026-09-15 and its content is landing in peeled pieces instead, so the component is still unlanded and goes in its own pull request. Per `D-21` the topology reshape lands without it, since `windows-topology-sys` publishes a refined view of what the platform publishes and an adapter absorbs the rest. M2+ and M3+ are parked on that session concluding, and are additionally **awaiting a re-cut**: EP-D-4 and EP-D-5 re-scoped the component into four parts (`topology-model` holding the abstract machine description, the planner's traits and the plan type; `topology-planner`; an inward Windows adapter; an outward realizer), and only M1 has been reconciled with that. EP-1.1 is done and already earned its keep: checking the shard-set query against the model found `Processor::capacity` using `0` as both a valid efficiency class and a "not known" sentinel, which collide on every non-hybrid machine (filed as SH-16.12). | [crates/topology-planner/DESIGN-NOTES.md](crates/topology-planner/DESIGN-NOTES.md), [design-sessions/DESIGN-SESSION-2026-09-02-cache-locality-model.md](design-sessions/DESIGN-SESSION-2026-09-02-cache-locality-model.md) | | [CHECKLIST-io-domains.md](CHECKLIST-io-domains.md) | in progress | **M30 is complete and archived** in [COMPLETED-CHECKLIST.md](COMPLETED-CHECKLIST.md): the queue crate's name, skeleton and SPSC shape. M31 built the bounded-array MPSC (with a lazily created manual-reset doorbell whose reset cannot be separated from the observation that there is nothing to take -- achieved by ordering plus a re-check rather than by a lock, per D-9 and D-15) and is done but for `M31.6`, the `loom` verification, which is re-homed as `M30.4` in [CHECKLIST.md](CHECKLIST.md). M32 remains: the contract decisions -- ordering, correlation, backpressure among them -- the domain runtime cannot be written without. M33+ parks the runtime itself, the creation-time-affinity thread builder, the namespace `Outcome` extension, and the client-side `ThreadpoolWait` fan-in helper; the durability crate it also parked (`M33+.5`) was transferred on 2026-10-05 to [crates/durable-ioring](crates/durable-ioring/COMPONENT.md), reshaped to build on `IoRing` directly. M-inf holds items each gated on a specific measurement rather than on taste. The N=1 path is the whole first deliverable and depends on no NUMA hardware. | [DESIGN-NOTES.md](DESIGN-NOTES.md), [DESIGN-SESSION-2026-08-30-numa-sharded-io-execution-domains.md](design-sessions/DESIGN-SESSION-2026-08-30-numa-sharded-io-execution-domains.md) | -| [CHECKLIST.md](CHECKLIST.md) | in progress | M42: apply the documented-contract rule to the refusals made ahead of platform calls that already exist. M19: propagate the 2026-08-27 platform measurements (IoRing registration replaces the table; the completion-port/`IoRing` fork; `runs_long` as the growth mechanism; the measured 512 default maximum) into the crates whose code or documentation currently assumes otherwise. M20: decide the session-independent path form, now that path resolution is measured to follow the impersonated token's logon session. M21: reconcile with the impersonation and enumeration crates that landed during the session. M34 carries the review-driven repairs raised while shipping the placement tool: M34.1 (the reusable sabotage harness) is done, and M34.2 (route the placement tool's output through a sink rather than writing to stdout from many sites) and M34.3 (archive the completed item bodies still carried by the three root checklists) are open. M37: discharge the failable-call standard across the workspace. M30: find out how much of this workspace's algorithm correctness can be machine-checked -- a survey matching each argued-but-unchecked algorithm to a class of tool (TLA+/PlusCal, loom, bounded proof, `const` assertions), one pilot chosen because parameter shrinking makes an untestable property exhaustive, and a named list of what the pilot could not reach, which is the deliverable. Scoped as an instrument for narrowing hand-inspection rather than replacing it, and explicitly not a reversal of [D-31](crates/windows-waitable-queues/DESIGN-NOTES.md#d-31). Also re-homes `M31.6`, the `loom` verification the queue crate promises adopters before 1.0: it was previously untracked, referenced from that crate's design notes, a source file and its sabotage manifest with no live checklist item anywhere, and is now queued as M30.4. M30's rationale is in [DESIGN-RATIONALE.md](DESIGN-RATIONALE.md#machine-checking-what-is-argued) -- Tier 2, because no decision is taken yet; M30.5 is what produces one. M38 labels Model A and Model B at their first use in live files. M39 builds a locality helper that derives a file's flush domains from Windows' storage topology for durable-ioring. M43 corrects the `durable-ioring-events` 0.1.1 release, which should have been 0.2.0: release it, then yank 0.1.1 and `win-durable-ioring` 0.5.0 ([DE-D-8](crates/durable-ioring-events/DESIGN-NOTES.md#de-d-8)). M45 adds a daily long-haul tier and a probation tier, and reduces each heavy test to the size its claim needs ([long-haul-tier](DESIGN-NOTES.md#long-haul-tier)). | [DESIGN-NOTES.md](DESIGN-NOTES.md#remoting-synchronous-namespace-operations) for M19-M21 and M37; N/A for M30 | +| [CHECKLIST.md](CHECKLIST.md) | in progress | M42: apply the documented-contract rule to the refusals made ahead of platform calls that already exist. M19: propagate the 2026-08-27 platform measurements (IoRing registration replaces the table; the completion-port/`IoRing` fork; `runs_long` as the growth mechanism; the measured 512 default maximum) into the crates whose code or documentation currently assumes otherwise. M20: decide the session-independent path form, now that path resolution is measured to follow the impersonated token's logon session. M21: reconcile with the impersonation and enumeration crates that landed during the session. M34 carries the review-driven repairs raised while shipping the placement tool: M34.1 (the reusable sabotage harness) is done, and M34.2 (route the placement tool's output through a sink rather than writing to stdout from many sites) and M34.3 (archive the completed item bodies still carried by the three root checklists) are open. M37: discharge the failable-call standard across the workspace. M30: find out how much of this workspace's algorithm correctness can be machine-checked -- a survey matching each argued-but-unchecked algorithm to a class of tool (TLA+/PlusCal, loom, bounded proof, `const` assertions), one pilot chosen because parameter shrinking makes an untestable property exhaustive, and a named list of what the pilot could not reach, which is the deliverable. Scoped as an instrument for narrowing hand-inspection rather than replacing it, and explicitly not a reversal of [D-31](crates/windows-waitable-queues/DESIGN-NOTES.md#d-31). Also re-homes `M31.6`, the `loom` verification the queue crate promises adopters before 1.0: it was previously untracked, referenced from that crate's design notes, a source file and its sabotage manifest with no live checklist item anywhere, and is now queued as M30.4. M30's rationale is in [DESIGN-RATIONALE.md](DESIGN-RATIONALE.md#machine-checking-what-is-argued) -- Tier 2, because no decision is taken yet; M30.5 is what produces one. M38 labels Model A and Model B at their first use in live files. M39 builds a locality helper that derives a file's flush domains from Windows' storage topology for durable-ioring. M43 corrects the `durable-ioring-events` 0.1.1 release, which should have been 0.2.0: release it, then yank 0.1.1 and `win-durable-ioring` 0.5.0 ([DE-D-8](crates/durable-ioring-events/DESIGN-NOTES.md#de-d-8)). | [DESIGN-NOTES.md](DESIGN-NOTES.md#remoting-synchronous-namespace-operations) for M19-M21 and M37; N/A for M30 | | [CHECKLIST-ship-topology-and-queues.md](CHECKLIST-ship-topology-and-queues.md) | in progress | Release `windows-topology-sys` 0.2.0 and `windows-waitable-queues` 0.1.0, which everything shorter-term depends on. **Both reached crates.io on 2026-09-05**, by a route this file does not describe, since PR #56 closed unmerged; `SH-4.15` owns reconciling M4 with what shipped. Deliberately redundant with [CHECKLIST-io-domains.md](CHECKLIST-io-domains.md): that file plans the design, this one plans the release, and a release has failure modes a design checklist does not surface. Two were found while writing it -- `windows-waitable-queues-v*` is missing from the publish workflow's tag list, so release-please would tag it and nothing would publish it, silently; and `windows-ioring-sys` is published against `windows-topology-sys = "0.1.0"`. (That second finding was later **corrected at SH-2.2**: the pin is a *dev*-dependency, which consumers never resolve, so it obliges a pin update but no release.) M1 settled the public surface before it was public (done, archived); M2 repairs the plumbing; M3 lands the branch; M4 releases; M5 verifies from outside the workspace; M6 is long-running validation and gates the queue crate's release specifically. M7-M13 were seven PR #56 review rounds (done, archived); M14, M15 and M16 are the three later rounds and carry the file's open work -- M15 owns the fix for an ABA hole that ships **disclosed rather than fixed**, so it does not block the release. M16 is the SH-3.1.1 diff review, the first to read the branch as a diff rather than react to a comment: seven findings, six fixed, including a publish-workflow regression this branch had introduced two commits earlier and a soundness hole in the crate about to freeze its API. Its remaining four are blocked on [design-sessions/DESIGN-SESSION-2026-09-02-cache-locality-model.md](design-sessions/DESIGN-SESSION-2026-09-02-cache-locality-model.md), which began by asking whether collapsing a seven-kind, any-depth topology onto a single cache boundary is the right projection and has since settled that presence and observation must be modeled rather than collapsed into an `Option`. **That work gated the merge, and has since discharged**: unlike M14 and M15, which concern a defect in an implementation that can ship disclosed, M16 concerned the shape of the public model `windows-topology-sys` 0.2.0 would publish, and a published model cannot be reshaped without another break. It became the `MMT-*` plan, which has landed; the session has concluded and 0.2.0 shipped the new model, so M3 no longer waits on M16. The file opens with a status table. | [crates/windows-topology-sys/DESIGN-NOTES.md](crates/windows-topology-sys/DESIGN-NOTES.md), [crates/windows-waitable-queues/DESIGN-NOTES.md](crates/windows-waitable-queues/DESIGN-NOTES.md) | | [CHECKLIST-placement-tool.md](CHECKLIST-placement-tool.md) | in progress | A small Windows tool a stranger can download, run once, and send back one structured result -- distributed as a GitHub release binary, never to a registry, per `PT-5.6` -- so this workspace can collect placement and NUMA-hop measurements from hardware it does not own. The gap is concrete: every host available here has one NUMA node, so the whole `cross NUMA node` row and the inter-node hop matrix are unmeasured and no local work will change that. Extracted rather than published in place, because [crates/windows-platform-probes](crates/windows-platform-probes) is deliberately "an experiment, not a component". **M1-M4 and M36 are complete and archived** in [COMPLETED-CHECKLIST.md](COMPLETED-CHECKLIST.md): the name and what the record says about a machine, `(group, number)` processor identity so a machine with more than 64 of them is not silently miscounted, each NUMA hop measured in both directions with the ring placed deliberately, the move of the measurement modules, a schema-versioned submission record, the runner's experience and trust, and redaction of the secondary metadata by default. What remains is M5 (distribute the binary), M6 (are "equivalent" processors actually equivalent?) and M7 (report what Windows contradicts about itself). **M5+ is WITHDRAWN**: the canonical artifact is a CI-built binary compiled from this repository through `path` dependencies, so it needs nothing published, and an earlier version of this row wrongly gated the whole tool on releasing `windows-topology-sys` and `windows-waitable-queues`. | [crates/windows-placement-probe/DESIGN-NOTES.md](crates/windows-placement-probe/DESIGN-NOTES.md), [crates/windows-platform-probes/DESIGN-NOTES.md](crates/windows-platform-probes/DESIGN-NOTES.md) | | [CHECKLIST-thread-ambient.md](CHECKLIST-thread-ambient.md) | in progress | **M22-M29 are complete and archived** in [COMPLETED-CHECKLIST.md](COMPLETED-CHECKLIST.md): `windows-thread-ambient-sys` (a standalone layer that captures a thread's ambient state and applies it on another thread), `windows-namespace-request-sys` (marshalable Win32 namespace call parameter sets, over an entry list audited from three real consumers rather than guessed), `windows-platform-probes` (a durable home for the measurements this workspace's designs rest on), and the defects the audit of those three found. What remains is **pending**: the three `M26+` items were each gated on the namespace-facility design branch reaching `main`, and it has, so the gate has lifted -- reconciling the imported design background, applying the M22.2 narrowing to M21.2, and making the merge-or-delete decision on the duplicated path preparation. The file is deleted outright once those land. | [crates/windows-thread-ambient-sys/DESIGN-NOTES.md](crates/windows-thread-ambient-sys/DESIGN-NOTES.md) | @@ -60,6 +60,6 @@ plans tracker: [crates/durable-ioring/PLANS.md](crates/durable-ioring/PLANS.md), | [crates/windows-file-watcher/PARKED.md](crates/windows-file-watcher/PARKED.md) | parked | The `M-inf` horizon: `ReadDirectoryChangesExW` extended records, digest-based change verification, and a per-volume capability cache, outside v1 by D-19. | [DESIGN-NOTES.md](crates/windows-file-watcher/DESIGN-NOTES.md) (D-19) | | [crates/wtf-string/PARKED.md](crates/wtf-string/PARKED.md) | parked | The `M-inf` horizon: a checked no-interior-NUL C-string companion type, optional by D-7. | [DESIGN-NOTES.md](crates/wtf-string/DESIGN-NOTES.md) (D-7) | | [crates/windows-file-enumeration-sys/PARKED.md](crates/windows-file-enumeration-sys/PARKED.md) | parked | REVIEW-1: re-read against that contract, which no longer caps ordinary paths or rewrites any to `\\?\` form, and review it against a traversal layer before one is built. Raised from the `windows-file-watcher` side; schedules no change of its own. | [DESIGN-NOTES.md](crates/windows-file-enumeration-sys/DESIGN-NOTES.md), [workspace DESIGN-NOTES.md](DESIGN-NOTES.md#path-contracts-follow-path-construction) | -| [PARKED.md](PARKED.md) | parked | M34.25: keep or remove the Actions cache path for the sabotage catcher record once the `sabotage-records` branch is shown to work, gated on M34.24. M45+.1: what a sweep does with a control that times out, gated on M45.10. | [DESIGN-NOTES.md](DESIGN-NOTES.md#sabotage-records) | +| [PARKED.md](PARKED.md) | parked | M34.25: keep or remove the Actions cache path for the sabotage catcher record once the `sabotage-records` branch is shown to work, gated on M34.24. M45+.1: what a sweep does with a control that times out, gated on the first post-merge sweeps after M45. M45+.2: merge or delete the probation publisher's copy of the sabotage record publisher, gated on the first scheduled long-haul runs. | [DESIGN-NOTES.md](DESIGN-NOTES.md#sabotage-records) | Add a row here when new work is planned, against [CHECKLIST.md](CHECKLIST.md) or any crate's.