[helly25]

A deterministic traversal test shows five queued backend reads can be avoided after a stop. Neither tested cancellation policy passes the ordinary-workload performance screen, so retain the implementations and evidence without changing runtime behavior.

AG;DR

Scope and dependency

• Report-only successor of Record deferred immutable ZIP locator evaluation #1131; merge Reuse validated rg output transactions in matcher results #1127 -> Decode embedded language JSON into final owned storage #1128 -> Record rejected hinted archive ancestor insertion screen #1129 -> Stop main benchmarks once three of four candidates agree #1130 -> Record deferred immutable ZIP locator evaluation #1131 before this PR. Shared TODO, performance history and release-site mappings make this a linear publication dependency. Existing parent heads are unchanged.
• Exactly six files: the decision report and compressed evidence, TODO, performance analysis, release-site mappings, and one filename-specific large-file exception. No runtime, test, BUILD, worker, API or compiler change is published.
• The isolated experiment base is merged Record archive insertion qualification and reconcile tracking #1126, d8cf61cccd4b0efed5058bf6fa45228e47162b48; these development results are not current PR-context CI claims.

Behavior, decision and limits

• Both-host deterministic tests hold two active readers while stopping at an available child. The unchanged parent performs nine backend reads; each measured policy performs four, preserving complete serial visits/errors, coordinator identity and request recycling. Active I/O remains uninterruptible; no synthetic-delay speedup is claimed.
• A per-dispatch acquire-load policy shows roughly 2-4% Mac API cohort costs and 1-2% Linux parallel costs. An explicit stop committed under the existing pool mutex removes that extra dispatch load, but Mac serial API cohorts cost 6-9%. Its ordinary native Mac cohorts cost about 0.7-3.2%.
• Both policies remain unselected. A destructor-only draft is retained unmeasured because audit found payload cleanup can release workers before shutdown sets stop. Do not infer correctness or performance from its one focused passing test.
• These are bounded one-session, three raw repetitions, fastest two retained screens, not full three-session 9/7 qualification. Each measured policy has 128 in-memory API cases per host and three roles (baseline, candidate, exact-image repeat), 1,152 observations. Explicit stop additionally has 48 native CLI cases per host, 432 measured invocations plus 144 discarded warmups, with complete independent output oracles.
• Every slower cell, repeat control, failed pre-timing Linux fixture-discovery attempt, source phase and image identity is retained. No threshold invention, favorable repeat selection or drift subtraction. General O18 byte backpressure, fairness, ordered publication, active-I/O preemption and a lower-cost cancellation redesign remain open. This does not close the distinct legacy executor/frontier PR mechanisms.

Evidence and verification

• Report: docs/benchmarks/queued-read-cancellation-20261107.md; adjacent .json.gz is mapped through release-site files for download.
• Capsule: 1,059,238 compressed bytes, 147 individually verified records, 11,291,859 decoded bytes. SHA-256 df49ed6f0ba47500afd0d5d5d5c8291d2f36f6a18b2eda430f4e79209db7f159. Sources, patches, drivers, raw observations and receipts are reconstructible; executable images remain private.
• Dispatch-policy phase: all 323 optimized core/extension/documentation targets passed on both hosts, plus focused Mac ASan and Linux ASan/MSan/TSan. Explicit-stop phase: focused optimized traversal and the corresponding sanitizers passed; screened out before another full 323-target run. Full-suite claims are not transferred between phases.
• Publication checks: all handoff-file and record lengths/hashes verified; report/capsule remain byte-identical to frozen handoff; 32 release-site tests passed; site configuration, page/file mappings, exact large-file allowlist positive/negative checks, aligned tables and diff checks passed. Trunk formatting and normal signed commit hooks passed; no local clang-tidy was run as instructed.
• Normal push hooks passed. This PR's own required CI must complete on its current pushed head. Early stacked CI does not replace post-retarget current-main validation.

Current main integration

Signed synchronization 9a86eecf4d00b25c407e703be34f21e922d59142 incorporates #1131 main squash e60e317696003ce577bc10d959d31d120a57e27f. The qualified child tree remains exact after strict equal-parent-tree and real-ancestor proof. Normal commit/push hooks passed; merge hooks intentionally skip redundant Trunk on this preserved tree. Fresh own main-context CI on this pushed head is required; the earlier stacked success is feedback only. No local clang-tidy ran.

Final current-head qualification

Own current-main Test run 42374296114 succeeded on signed head 9a86eecf4d00b25c407e703be34f21e922d59142, including all ordinary tests, hosted site, CI clang-tidy, sanitizers, coverage, both-platform measurement agreement, best-seven comparison and done. Optional fourth/fifth candidates were skipped normally after initial agreement. Exact predecessor-main Test 42374086028 also succeeded. These pushed-head results establish readiness; earlier private and stacked checks remain historical evidence. Merge this head unchanged.