UP-017 · Progress · PROPOSED CHECKABLE RUNNABLE EXECUTED STAGED

Proven Quiescence

Silence is not completion: quiescence is established by a sweep over the loci, never read off idle carriers.

Standing

PROPOSED CHECKABLE RUNNABLE EXECUTED STAGED PUBLISHED REPRODUCED

Last checked

never run

Source

none — this record cites no check

Limit

PROPOSED. The phrase appears nowhere in the tree. Dijkstra–Scholten solved termination detection in 1980 and this chapter adds no algorithm; its only content is that silence must not be read as completion.

Next rung

in_tree — a detector in this tree that distinguishes quiescent from merely-silent, and a case where it refuses.

Intent

A system whose carriers are all idle may hold loci with pending work above the floor (Dormant But Alive). Declaring it finished because no observed worker is busy is False Quiescence. Proven quiescence is a sweep that asks every locus whether it has admissible pending work and carries, beside its assertion, what it does not assert.

Problem

'All workers idle' is the completion signal in most systems, and it is wrong whenever work can wait somewhere a worker is not looking: a mailbox, a queue, a suspended locus. The failure is silent by construction — the system reports done and stops looking.

Solution

Enumerate the loci, not the carriers. Ask each for admissible pending work. Record the sweep as a sweep with a doesNotAssert field. Repeat until a full sweep finds nothing and no admission happened during it. Only then say quiescent.

Real-world analogy

A librarian who checks that no reader is at a desk, versus one who walks every shelf for a book left out. Only the second can say the library is in order, and only for the shelves walked.

Structure — on the surface

An illustration on a compute surface: loci above, carriers below. Press Play or Step; the takeaways collect as you go. Nothing here is evidence — the witness section is.

The chapter in WRL — and the chain so far

Chapter 17 of 32 — the fragment _patterns/wrl/chain/proven-quiescence.wrl, sealed alone by wrl.js

; PROVEN QUIESCENCE — its OWN clock domain: pq_clock fires ONCE at epoch 2 and is then done; the signal is
; still travelling through two relays and opens the Door later. The pulser's silence is not completion.
; pq_b is a router: chapter 18 draws from the quiescence chain's last relay.
[pulser:pq_clock](once at 2){sig_out}
[relay:pq_a]{sig_in, sig_out}
[relay:pq_b]{sig_in, sig_out}
[door:pq_done]{sig_in}

[pq_clock] --sig--> [pq_a]
[pq_a] --sig--> [pq_b]
[pq_b] --sig--> [pq_done]

module + bench seal to → sem-3f0d499f7e69fc20f10dad37ccb88861c6c007fa0f62a482b82ca7df42bcdf70

Run inputs — a ScenarioV1, the forge's own document, bound to this world's id and never part of it (D3) · ScenarioDigest scen-66ce95db624331b0364… (the run inputs' own identity, computed by the forge)

No claims: the world runs on its clocks alone for 6 epochs.

Reduced by the native reducer (ic32); the reference reducer reproduces every epoch's film hash (0.005s).

FILM v0.7
t=1
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=0
relay:pq_a:cur_out=0,next_out=0
relay:pq_b:cur_out=0,next_out=0
wire:w__pq_a__pq_b:cur=0,nxt=0
wire:w__pq_b__pq_done:cur=0,nxt=0
wire:w__pq_clock__pq_a:cur=0,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=2
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=0
relay:pq_a:cur_out=0,next_out=1
relay:pq_b:cur_out=0,next_out=0
wire:w__pq_a__pq_b:cur=0,nxt=0
wire:w__pq_b__pq_done:cur=0,nxt=0
wire:w__pq_clock__pq_a:cur=1,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=3
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=0
relay:pq_a:cur_out=1,next_out=0
relay:pq_b:cur_out=0,next_out=0
wire:w__pq_a__pq_b:cur=0,nxt=1
wire:w__pq_b__pq_done:cur=0,nxt=0
wire:w__pq_clock__pq_a:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=4
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=0
relay:pq_a:cur_out=0,next_out=0
relay:pq_b:cur_out=0,next_out=1
wire:w__pq_a__pq_b:cur=1,nxt=0
wire:w__pq_b__pq_done:cur=0,nxt=0
wire:w__pq_clock__pq_a:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=5
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=0
relay:pq_a:cur_out=0,next_out=0
relay:pq_b:cur_out=1,next_out=0
wire:w__pq_a__pq_b:cur=0,nxt=0
wire:w__pq_b__pq_done:cur=0,nxt=1
wire:w__pq_clock__pq_a:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=6
pulser:pq_clock:mode=once,p=2,phase=2,armed=0,done=1,nf=-1
door:pq_done:open=0,next_open=1
relay:pq_a:cur_out=0,next_out=0
relay:pq_b:cur_out=0,next_out=0
wire:w__pq_a__pq_b:cur=0,nxt=0
wire:w__pq_b__pq_done:cur=1,nxt=0
wire:w__pq_clock__pq_a:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

Composes with the 16 chapters before it

The chain through this chapter — every earlier fragment, this one, and the links — seals to sem-ea73561d17a864cf51ea185b76f7b5e283453725acbd1aee01e8c073932f69f2: 66 objects, 60 edges (was 62 / 57; every earlier object and edge is still present — checked, or the build refuses).

The board so far: one band per Part, signal flowing left to right; relays that fan out are routers, doors are switches, pulsers are clock domains. Hover an object — or click the board and walk it with the arrow keys — for its role, its Part and what it is wired to. This board is the chain’s sealed shape; no Film drives it, so it has no state to report, and the whole board in the conclusion is where every object’s state is read epoch by epoch. Wheel zooms · drag pans · double-click fits.

Syntax — quoted from the tree at build time

The nearest thing the tree already says (REVISION_REGISTER.md R79.2) REVISION_REGISTER.md:99

| R79.2 | **A completed sweep is not a point-in-time snapshot, and R79 said it was.** Cloudflare guarantees that an object-list operation *"will list all objects at that point in time"* — for ONE list operation. A whole-bucket enumeration is many, and no first-party source says page 1 at T₁ and page 500 at T₅₀₀ share a snapshot, so an object created behind the cursor need not appear in the sweep that passed it. `CompletedScan` implied otherwise by its name. Renamed **`CompletedSweep`**, asserting only *every provider page traversed through a verified cursor chain from beginning to normal termination*, with `doesNotAssert` stated as a field beside it. R79's recoverability is therefore **eventual, through repeated authoritative sweeps**, not one-pass reconstruction under concurrent mutation. `CLOUD_V1.md` §6.9 | 2026-08-24 | Cloudflare consistency page read first-party; the multi-page question is **unanswered by the docs** and case **N** measures it (quiesce the bucket, or repeat until the delta converges to zero) |

Forces

A sweep is not atomic: work can arrive behind it. So a sweep must say what it asserts (nothing was pending as of each locus's visit) and what it does not (that nothing arrived since), and a consumer must treat the second as the honest part. Two sweeps in a row with no arrivals between them is the usual proof shape.

Applicability

Shutdown, checkpointing, 'the migration is complete', end-of-turn for an agent runtime, any place a supervisor decides nothing is pending.

Transformations

A refusing transformation is not one that is discouraged: it is one that, applied, makes the invariant above false. The word is the tree's, and it is the same word the join uses.

Consequences

'Is it done?' gets an answer with a scope. The name is the book's; the pieces are the tree's, and P1 would label a witness for it the day one exists.

Failure mode it answers

False Quiescence — Declaring completion because no currently observed worker has work. Paid for at: REVISION_REGISTER.md:99 (CompletedScan renamed CompletedSweep; doesNotAssert added)

Witness

No witness. This pattern is PROPOSED — the tree has no check for its invariant.

Counterexample

No counterexample shipped (required only when WITNESSED).

What to take away

1. from the animationEvery slot was idle and two loci held pending work; a sweep found them, and only a second clean sweep proved quiet.
2. from the syntaxA sweep carries a doesNotAssert field: what it could not have seen is stated beside what it saw.
3. from the literatureDijkstra–Scholten (1980) proved termination for diffusing computations; the shape is the same.
4. from the witnessPROPOSED: no witness. The label says so and nothing on this page argues otherwise.

Prior art — and what is not claimed

Novelty not claimed. Termination detection was solved in 1980. The phrase 'proven quiescence' appears nowhere in the tree and is PROPOSED by the book; the classical algorithms are the answer, and the pattern's only job is to stop silence being read as completion.

Relations with other patterns

Three-Valued Outcome STATED