runD 1.0.4 Alpha

runD 1.0.4 Alpha

This release closes cold Pipeline preparation memory ownership and backend divergence while preserving deterministic execution across CPU, Metal, and Vulkan.

Release source: b2cb9270ce0fdd48f5266ec096bf855f071cc4b2

Exact preparation ownership and admission (#4)

• CPU preparation now materializes its typed layout in one sealed, page-aligned arena. Immutable Program storage is retained once, while occurrence-specific bindings and coordinates remain compact routes; Map, collective, primitive, worker, and tile scratch no longer create an allocator-owned forest or scale with the outer/inner route product.
• PipelinePlan::peak_bytes remains the exact runD-owned logical payload. arena_extent_bytes reports the exact CPU mapping span, and committed_peak_bytes reports the page-rounded Device admission charge without relabeling process RSS or adding a guessed margin.
• DevicePipelineMemoryLimit and Device::pipeline_memory() provide one Device-owned aggregate authority across live Pipelines. Local MemoryBudget admission happens first, Device reservation happens once before materialization, and rollback/release are deterministic.
• Whole-process RSS remains an operational envelope for allocator, runtime, thread-stack, and driver-private memory. Deployments requiring a literal cap should apply an OS process/container limit above the Device governor.

Frozen accelerator preparation and warm execution

• Primary and transactional-alternate streams share one immutable accelerator template registry. Equal templates are planned and charged once; every backend consumes the same frozen manifest instead of reconstructing a second planning authority.
• Metal calibrates its admitted ICB size classes from the selected device, records the command graph in chunks of at most 65,536 commands, and reduces warm host work to ceil(D / 65,536) compact 16-byte chunk records. It performs no per-command descriptor walk, rebinding, dynamic count readback, or warm allocation.
• Vulkan plans command, parameter, descriptor, pipeline, native-object, and source-materialization capacity before allocation. Oversized product shapes now return a deterministic PipelineCapacity result with stable step/template/outer/inner/phase coordinates and a native reason key instead of expanding until process termination.
• Linux/GCC builds without the Metal SDK now compile only the documented portable unavailable boundary; native Metal helpers cannot leak into that build graph.

Deterministic contract

Canonical outer/inner order, publication-before-later-read, zero and partial-tail behavior, first-failure priority, fixed-width status, reset behavior, binding identity, and raw output parity are unchanged. Memory pressure, allocator order, pointer values, and runtime scheduling do not enter graph identity or admission order.

Verification and platform boundary

• Debug repository contracts: 35/35 passed.
• Release package contracts: 25/25 passed.
• Darwin arm64 clean-source candidate: archive extraction, sealed identity, verifier, and installed SDK external-consumer rebuild passed; 84 consumer build targets completed.
• Linux x64: the tag-pinned Ubuntu 24.04 / GCC 13 candidate workflow passed the complete Release contract, source-identity seal, verified SDK candidate lifecycle, extracted installed consumer, and temporary artifact upload.

Linux remains a validated candidate rather than a supported release platform. Its temporary workflow artifact is intentionally not attached to this release; the published SDK asset is Darwin arm64 only.

Assets

• rund-sdk-1.0.4-darwin-arm64.tar.gz
• rund-sdk-1.0.4-darwin-arm64.sha256
• rund-verify

Darwin SDK SHA-256: b8706f61c75efdd020a3ba969afd71f583c90a9acc9dadd0a50f9bcf4b84c10f