fix(gc): re-arm the idle reclaimer on elapsed idle — a declined compaction currently parks the heap 221 MB high

changelog.d/9831-idle-reclaim-elapsed-rearm.md

@@ -0,0 +1,73 @@
+**A declined idle compaction is no longer a terminal state: the memory reducer
+re-arms on elapsed idle as well as on mutator collections, so a heap that parks
+1.3 points under the compactor's residue gate gets revisited instead of holding
+221 MB until the next turn.**
+
+Measured on the compiled claude-code TUI, one 400-char turn then a 120 s idle
+window, quiet host (load < 0.1), both rounds of each arm:
+
+| arm | after turn | after 120 s idle |
+|---|---|---|
+| A | 757 / 759 MB | **512 / 527 MB** |
+| R | 738 / 742 MB | **748 / 748 MB** |
+
+R *ends the turn 19 MB better than A* and finishes 221 MB worse. The reclaimer's
+own diagnostic says why, and it is a closed loop:
+
+1. **The compactor's residue gate declines**, reproducibly and narrowly.
+   `compaction_owed` gate 1 wants residue ≥ 25 % of old-gen occupancy; A is at
+   **25.94 / 25.95 %** and starts two compactions, R is at **23.68 / 23.67 %**
+   and starts none. Within-arm spread across rounds is 0.01–0.02 points: a
+   stable operating point just under a threshold, not a coin-flip.
+2. **The decline removes the only event that could revisit it.** The reducer's
+   activity gate needs `2^backoff` collections *it did not start*, and
+   `external_collections()` subtracts only the reducer's own — so a **compaction
+   is what registers as external**. A's trace shows each one contributing
+   exactly +1 (`external_collections` 13 → 14 → 15 across three attempts, one
+   compaction between each). R stays at 9, `since_attempt` never reaches 1, and
+   there is no second attempt in the whole window.
+3. So the heap parks, and the largest piece of the loss is downstream of that:
+   A right-sizes the arena from **182.45 MB of capacity to 81.79 MB** across its
+   three observations, while R holds **168.82 MB** on one. Roughly 87 MB of
+   capacity + 57 MB of young blocks + 38 MB of old-gen ≈ 182 of the 221 MB.
+
+**The fix extends an exemption that already exists twelve lines above it**, for
+the identical deadlock: `StartReason::ArenaRightSize` bypasses the same gate
+because arena blocks need a second full observation that an idle mutator will
+never produce (#9709). This adds `StartReason::IdleElapsed` on the same
+reasoning — a requirement denominated in *mutator collections* cannot be met by
+a heap whose mutator is idle, which is precisely when the reducer is wanted.
+
+**Why the gate constant was not the fix, on measurement rather than principle.**
+Lowering `IDLE_COMPACT_MIN_RESIDUE_PCT` from 25 to 23 would have let R start a
+compaction — and the same R binary in a 5 s window *did* clear the gate, at
+25.81 %, ran the compaction, and **released 0** (`kept_promise=false`,
+`backoff_shift 0→1`). Nor is that peculiar to R: A's own second compaction
+releases 0 at **54.6 %** residue. Half of A's compactions in this capture
+released nothing, aborting ~4x earlier (`pause_us` 107k/161k against 442k) on
+what looks like a budget. The knob is not merely forbidden; it does not work.
+
+**Anti-spin needs no new rule.** The elapsed wait is
+`IDLE_RECLAIM_REARM_MS << backoff_shift` — the *same* shift that prices the
+activity arm — so an unproductive full doubles it: 15 s, 30 s, 60 s, 120 s,
+240 s. And the arm is **disarmed entirely at `IDLE_RECLAIM_MAX_BACKOFF_SHIFT`**
+rather than merely slowed, because five unproductive attempts establish there is
+nothing to give and an idle process must not pay a whole-heap mark forever.
+A productive full resets the shift, so a heap still returning memory keeps being
+asked every 15 s — which is the case this exists for. `IDLE_RECLAIM_REARM_MS` is
+deliberately larger than `IDLE_RECLAIM_MIN_INTERVAL_MS` so the rate floor is
+never the binding constraint and the two gates cannot be confused in a diag.
+
+Two tests, each sabotage-proved: a parked heap with **no** external collection
+anywhere gets a second attempt at the wait and not before, identified by reason
+rather than by attempt count; and an unproductive streak doubles the wait each
+time and then stops. Removing the arm fails the first, removing the backoff
+scaling fails the second's "must not re-arm before the doubled wait", and
+removing the disarm fails its "at the maximum shift the elapsed arm is
+disarmed".
+
+The young half of the loss is **not** addressed here and is measured, not
+assumed: after R's single reclaim, `[gc-general-reclaim] examined=66 released=0
+has_live=39 aging=22` — 39 of 66 arena blocks hold a live object, against 3 of
+65 in A, and only an evacuation can consolidate those. Whether an idle young
+evacuation is also needed is a separate question and a separate change.

changelog.d/9838-tiny-parse-pressure-pricing.md

@@ -0,0 +1,37 @@
+**The tiny-parse pressure guard now prices the collections it forces by the
+adaptive step's productivity backoff (#9831).** On the compiled claude-code
+TUI a 3300-character streamed reply spent 30–41 s of CPU in the base arm and
+27.8–29.2 s with the fix (mean −19 %, every interleaved pair a win), with
+post-turn and post-idle RSS flat within the base's own spread and peak RSS
+unchanged.
+
+#9831 measured the `ArenaBytes` arm firing 51 times in one 66-delta reply,
+each collection freeing a median 131 KB, while the adaptive step sat
+saturated at 1 GiB — and located the discarded backoff in the arm's own
+ceiling clamp. That clamp was not what re-fired the arm: between two firings
+the arena grew a few hundred KB against a trigger armed 16–128 MB above the
+post-collection total. What pulled the trigger down was the tiny-parse
+pressure guard, which after every `JSON.parse` growing the arena by ≤ 1 MB
+tested the absolute `arena_in_use_bytes() >= 48 MB` and, if it held, set the
+trigger to "now". That is a quantity no collection can lower below the live
+set, so on a heap that sits above it permanently every small parse (one per
+SSE delta) forced a minor whose backoff nothing read — #9589's shape one
+trigger over.
+
+The guard now also requires the arena to have grown, since the last
+collection of any kind ended, by a headroom priced from the step: the step
+rescaled so its power-on value buys the 16 MB headroom floor and each
+doubling the arm's clamp discards buys one more doubling, bounded by the
+trigger ceiling. A productive collection keeps today's cadence; an
+unproductive one earns room. The parse-boundary collector re-prices a
+pending request so a collection that already satisfied it is not followed by
+a second. `PERRY_GC_DIAG=1` gains a `[gc-tiny-parse] forced collection …`
+witness line. The arm's own arithmetic is unchanged and now documents why
+(pricing it directly was measured at −10.8 % CPU for +22 % footprint, the
+issue's refuted branch).
+
+Validation: `test_memory_json_churn.ts` (the guard's motivating shape) is
+byte-identical in output and RSS in all four GC modes; 48/48 `test_gap_gc_*`
+and 8/8 `test_gap_json_*` pass; nine new `gc::tests::tiny_parse_pressure`
+tests pin the pricing and the predicate, sabotage-proved against both the
+old absolute guard and a raw-step pricing.

crates/perry-runtime/src/gc/idle_reclaim.rs

@@ -51,9 +51,20 @@
 //! 1. **Activity or arena debt.** Normally at least `2^backoff` collections
 //!    the reducer did not start itself have completed since its last full. A
 //!    collection is the signal that the mutator allocated enough to matter.
-//!    The exception is a bounded [`super::arena_right_size`] episode: arena
-//!    blocks need two full observations before their mappings can be returned,
-//!    and an idle heap cannot create the second through mutator activity.
+//!    There are two exceptions, and they are the same argument twice: a
+//!    requirement denominated in *mutator collections* cannot be met by a heap
+//!    whose mutator is idle, which is exactly when the reducer is wanted.
+//!    First, a bounded [`super::arena_right_size`] episode: arena blocks need
+//!    two full observations before their mappings can be returned, and an idle
+//!    heap cannot create the second through mutator activity. Second, elapsed
+//!    idle — see [`IDLE_RECLAIM_REARM_MS`] — because a *declined* follow-up
+//!    would otherwise be terminal (#9831): measured on the claude-code TUI, the
+//!    compactor's residue gate declines at 23.7 %, so no compaction runs, so no
+//!    collection is registered, so `since_attempt` stays 0 and the reducer
+//!    never runs again. The compaction IS the event that re-arms the reducer,
+//!    so declining one removes the only thing that could revisit the decision,
+//!    and the heap parks 221 MB above where the same workload settles when the
+//!    first compaction happens to fire.
 //! 2. **Quiet.** At least [`IDLE_RECLAIM_QUIET_MS`] since the last such
 //!    collection was observed — a burst still in progress collects every few
 //!    hundred milliseconds and must not be interleaved with a whole-heap mark.
@@ -125,6 +136,23 @@ pub const IDLE_RECLAIM_PRODUCTIVE_PCT: usize = 5;
 /// exceeds `2^this` collections.
 pub const IDLE_RECLAIM_MAX_BACKOFF_SHIFT: u32 = 5;
 
+/// Elapsed idle that substitutes for the activity requirement, at
+/// `backoff_shift == 0`; the wait is `IDLE_RECLAIM_REARM_MS << backoff_shift`,
+/// so it is the SAME backoff that prices the activity arm.
+///
+/// This is the whole of the anti-spin argument and it needs no new rule: an
+/// unproductive full doubles the wait, so a heap with nothing to give is asked
+/// at 15 s, 30 s, 60 s, 120 s, 240 s and then — because the arm is disarmed at
+/// [`IDLE_RECLAIM_MAX_BACKOFF_SHIFT`] — **not again until real mutator activity
+/// resets the shift**. Five bounded attempts over ~8 minutes, then silence. A
+/// PRODUCTIVE full resets the shift to zero, so a heap that is still giving
+/// memory back keeps being asked every 15 s, which is the case this exists for.
+///
+/// Larger than [`IDLE_RECLAIM_MIN_INTERVAL_MS`] on purpose, so the rate floor
+/// is never the binding constraint on this arm and the two gates cannot be
+/// confused for one another when reading a diag.
+pub const IDLE_RECLAIM_REARM_MS: u64 = 15_000;
+
 /// Most collector work the park hook will do in any one wall-clock second
 /// while a budgeted cycle is open; past this the loop parks instead.
 pub const IDLE_RECLAIM_MAX_WORK_MS_PER_SECOND: u64 = 500;
@@ -147,13 +175,18 @@ enum StartReason {
     /// Sustained arena slack still needs full observations before empty blocks
     /// can be returned, even though the mutator has done nothing new.
     ArenaRightSize,
+    /// The activity requirement has not been met, but enough idle time has
+    /// passed that waiting for a mutator collection is waiting for something
+    /// that is not coming. See [`IDLE_RECLAIM_REARM_MS`].
+    IdleElapsed,
 }
 
 impl StartReason {
     fn as_str(self) -> &'static str {
         match self {
             StartReason::Activity => "activity",
             StartReason::ArenaRightSize => "arena_right_size",
+            StartReason::IdleElapsed => "idle_elapsed",
         }
     }
 }
@@ -247,6 +280,10 @@ static YIELDS: AtomicU64 = AtomicU64::new(0);
 static START_BLOCKED: AtomicU64 = AtomicU64::new(0);
 static WORK_CAPPED: AtomicU64 = AtomicU64::new(0);
 static POST_PURGES: AtomicU64 = AtomicU64::new(0);
+/// Fulls started because idle time elapsed rather than because the mutator
+/// collected. Counted so a test can assert WHICH arm started a full — the
+/// attempt count alone cannot tell the two apart.
+static IDLE_ELAPSED_STARTS: AtomicU64 = AtomicU64::new(0);
 
 /// Reducer fulls started in this process.
 pub fn idle_reclaim_attempts() -> u64 {
@@ -300,6 +337,10 @@ pub fn idle_reclaim_post_purges() -> u64 {
 }
 
 /// Current unproductive-streak backoff shift on this thread.
+pub fn idle_reclaim_elapsed_starts() -> u64 {
+    IDLE_ELAPSED_STARTS.load(Ordering::Relaxed)
+}
+
 pub fn idle_reclaim_backoff_shift() -> u32 {
     STATE.with(|s| s.borrow().backoff_shift)
 }
@@ -366,10 +407,28 @@ fn start_reason(now: u64) -> Option<StartReason> {
             return Some(StartReason::ArenaRightSize);
         }
         let since_attempt = external.saturating_sub(st.external_at_last_attempt);
-        if since_attempt < (1u64 << st.backoff_shift) {
-            return None;
+        if since_attempt >= (1u64 << st.backoff_shift) {
+            return Some(StartReason::Activity);
         }
-        Some(StartReason::Activity)
+        // The activity requirement is denominated in collections the reducer
+        // did not start, and on a quiet heap the only such collections are the
+        // compactor's — which run only once the reducer has already moved the
+        // residue ratio past the compactor's own gate. When that gate declines,
+        // nothing else can move it, and the decline is permanent. Elapsed idle
+        // is the same requirement in the one unit a quiet heap still produces.
+        //
+        // Disarmed at the maximum shift rather than merely slowed: five
+        // unproductive attempts are enough to establish there is nothing to
+        // give, and after them this arm must stop entirely or an idle process
+        // pays a whole-heap mark forever. Real activity resets the shift (via a
+        // productive full) and re-enables it.
+        if st.attempts > 0
+            && st.backoff_shift < IDLE_RECLAIM_MAX_BACKOFF_SHIFT
+            && now.saturating_sub(st.last_attempt_ms) >= (IDLE_RECLAIM_REARM_MS << st.backoff_shift)
+        {
+            return Some(StartReason::IdleElapsed);
+        }
+        None
     })
 }
 
@@ -384,6 +443,9 @@ fn note_started(now: u64, reason: StartReason) {
         if reason == StartReason::ArenaRightSize {
             super::arena_right_size::note_started();
         }
+        if reason == StartReason::IdleElapsed {
+            IDLE_ELAPSED_STARTS.fetch_add(1, Ordering::Relaxed);
+        }
         if gc_diag_enabled() {
             let (_, right_size_fulls_remaining, _, usage) = super::arena_right_size::snapshot();
             eprintln!(

crates/perry-runtime/src/gc/mod.rs

@@ -60,12 +60,12 @@ pub use idle_compact::{
 };
 pub use idle_reclaim::{
     idle_reclaim_attempts, idle_reclaim_backoff_shift, idle_reclaim_completions,
-    idle_reclaim_enabled_from_value, idle_reclaim_freed_bytes, idle_reclaim_old_reclaimed_bytes,
-    idle_reclaim_post_purges, idle_reclaim_productive, idle_reclaim_slices,
-    idle_reclaim_start_blocked, idle_reclaim_work_capped, idle_reclaim_yields,
+    idle_reclaim_elapsed_starts, idle_reclaim_enabled_from_value, idle_reclaim_freed_bytes,
+    idle_reclaim_old_reclaimed_bytes, idle_reclaim_post_purges, idle_reclaim_productive,
+    idle_reclaim_slices, idle_reclaim_start_blocked, idle_reclaim_work_capped, idle_reclaim_yields,
     IDLE_RECLAIM_MAX_BACKOFF_SHIFT, IDLE_RECLAIM_MAX_WORK_MS_PER_SECOND,
     IDLE_RECLAIM_MIN_INTERVAL_MS, IDLE_RECLAIM_PRODUCTIVE_MIN_BYTES, IDLE_RECLAIM_PRODUCTIVE_PCT,
-    IDLE_RECLAIM_QUIET_MS, IDLE_RECLAIM_SLICE_US,
+    IDLE_RECLAIM_QUIET_MS, IDLE_RECLAIM_REARM_MS, IDLE_RECLAIM_SLICE_US,
 };
 pub(crate) use idle_reclaim::{park_hook as idle_reclaim_park_hook, ParkVerdict};
 mod telemetry;