@@ -24,36 +24,26 @@
 # md-table-align no longer pads it to ~800 KB of whitespace.
 
 active:
-  - id: "D-559"
+  - id: "D-560"
     status: |-
-      open (2026-07-13, surfaced while building the D-418 deterministic guard). A
-      NESTED CROSS-AGENT send corrupts under alloc-torture: a watch on agent A that
-      `(send B …)`s, then `(await A) (await B)`, panics `@memcpy arguments alias`
-      (exit 134, ~1/10 under CLJW_GC_TORTURE_ALLOC=1). Repro:
-      `CLJW_GC_TORTURE_ALLOC=1 cljw -e '(let [log (agent []) a (agent 0)] (add-watch a :k (fn [k r o n] (send log conj n))) (send a inc) (send a inc) (await a) (await log) @log)'`
-      (clj-correct value is [1 2 2] — the await barrier's no-op watch fires once more).
-      DISTINCT from D-418 (that was the send/await fabrication window, now fixed +
-      the 4 single-agent cases are 10/10 clean): this is the TWO-DRAINER +
-      nested_pending path — a nested send built/held on drainer A while it runs, and
-      the log agent's own `conj` builder, interact with the main-thread window collect.
-      `@memcpy arguments alias` = a vector op memcpy'd overlapping regions → a
-      swept/recycled tail buffer aliasing. ROOT CAUSE CONFIRMED (code read
-      2026-07-13) = the D-556 DISCHARGE RESIDUAL, verbatim: "registered-WORKER-thread
-      stacks are not conservatively scanned". mark_sweep.conservativeStackScan runs
-      on the COLLECTING (main) thread's stack ONLY (`@frameAddress()` → the collector
-      frame up to `conservative_stack_top`). When MAIN triggers an STW collect (here
-      the D-418 window injection; under real load a main threshold-collect) while the
-      log-agent DRAINER is parked mid-`conj` builder, that drainer's in-progress tail
-      node is (a) NOT bracket-covered — the ADR-0150 fabrication no-collect region
-      only DEFERS the worker's OWN torture collect, not a main-triggered STW that
-      parks it at the alloc prologue (gc_heap.zig:391 parks BEFORE the fabrication_depth
-      check at :408) — and (b) NOT conservatively scanned (the scan skips parked
-      workers). So the intermediate is swept → the resumed builder's memcpy aliases.
-      This is a general worker-builder hazard (agents/futures/pmap), exposed by the
-      two-agent nested case because it maximises "a worker is mid-builder while main
-      collects".
+      open (2026-07-13, ADR-0150 am1 accepted-cost row). The D-559 fix (the
+      alloc-prologue safepoint park honors the fabrication region) makes the
+      stopWorld rendezvous delay UNBOUNDED IN FOLD-CHAIN LENGTH: a worker running
+      back-to-back fabrication brackets with no poll between (e.g. a large `into`'s
+      per-element builders — ADR-0150 guarantees "no alloc between builder calls",
+      so no park can fire until the whole fold ends) defers the collector's
+      rendezvous for the fold's full duration. Not a correctness bug (no deadlock:
+      the waiting collector holds no lock a bracket needs); a pause-time cliff.
+      Observable via `safepoint.max_stopworld_wait_ns` (monotonic max, added am1).
+      DISCHARGE SHAPE (named per the DA fork, private/notes/D559-da-critique.md
+      Alt 3): flip brackets from suppress-collect to PUBLISH-ROOTS — `gc.alloc`
+      auto-appends in-bracket allocations to a threadlocal scratch root array the
+      collector marks (raw header addresses); parks become safe anywhere, the
+      fabrication knowledge leaves the safepoint layer, the same-thread torture
+      gates become deletable, wasm-portable. Requires an ADR-0150 supersede
+      (depth 3).
     category: "concurrency"
-    barrier: "STRUCTURAL (GC collector core) — the fix is to cover a PARKED worker's native stack: either conservatively scan each parked worker's stack (the setjmp register-spill must run ON the worker before it parks, so it needs a per-worker spill buffer captured at the park point + the worker's stack bounds), OR make the ADR-0150 fabrication region hold off the STW park until the builder completes (deadlock-risk: the collector waits for the worker — needs a bounded 'finish builder then park' handshake). Deterministically reproducible (~1/10 under alloc-torture; the D-418 window-collect injection surfaces it). NOT ncpu-gated away (per user: a wrong-result/crash race is a bug, not an accepted flake). Cross-ref: D-556 discharge residual, D-418 (sibling, DISCHARGED)."
+    barrier: "blocked-by: MEASURED pause-time harm (a real workload where max_stopworld_wait_ns shows the fold-chain cliff hurting), OR an F-006 amendment (user-owned). ADR-0150 am1's ruling: under F-006 non-moving the suppress-region remains the finished form; the publish-roots flip is not taken pre-emptively. Do NOT drain this row on ease — it re-opens a settled ADR premise without its trigger."
     last_reviewed: "2026-07-13"
   - id: "D-522"
     status: |-
@@ -2334,6 +2324,11 @@ standing:
     barrier: "open after the D-440 arc completes (R4 + R5 must first rewrite the bulk of 'Phase N' citations to gap-area terms). Premature adoption = ~70 dangling citations with no 1:1 redirect. Trigger: D-440 R4/R5 done + a user nod to re-architect the planning axis (it is depth-4, the project's organizing metaphor)."
     last_reviewed: "2026-06-15"
 discharged:
+  - id: "D-559"
+    status: "DISCHARGED 2026-07-13 (ADR-0150 amendment 1). The nested-cross-agent `@memcpy arguments alias` corruption (exit 134, ~3-7% under alloc-torture + the D-418 window injection). ROOT CAUSE = the D-556 residual, precisely: the alloc-prologue safepoint park (gc_heap.alloc) fired BEFORE the `fabrication_depth` gate, so a peer's stopWorld parked a worker MID-BRACKET — its in-progress builder nodes (raw *TailNode/*HamtNode/*Cons in unrooted Zig locals) were invisible to the collect and swept; the resumed builder's memcpy aliased recycled memory. FIX (JVM-GCLocker shape; web-grounded vs Boehm per-thread-scan, rejected as wasm-unportable — DA fork in private/notes/D559-da-critique.md): the park HONORS the fabrication region (skip while depth>0; park at the next NON-bracket safepoint — bracket-boundary parks are unsound at both entry and exit, see ADR-0150 am1). HARDENING (DA Alt-1 items, all landed): `fabrication_depth` moved to root_set.zig; `safepoint.park` + `enterBlocked` assert depth==0 (chokepoint for all 6 park sites + the enterBlocked side door); `safepoint.max_stopworld_wait_ns` makes the fold-chain rendezvous delay observable; mark_sweep's false 'bracket-covered' comment rewritten. Accepted cost = D-560 (rendezvous delay unbounded in fold-chain length; discharge shape = the publish-roots flip, trigger-gated). VERIFIED: pre-fix ~3-7% crash → post-fix 100/100 clean (50 orig + 50 heavy); gc_torture 81/81 incl. the new deterministic `alloc-agent/nested_xagent` guard; clj oracle confirms [1 2 2]."
+    category: "concurrency"
+    barrier: "none — DISCHARGED. Guard: phase16_gc_torture.sh alloc-agent/nested_xagent."
+    last_reviewed: "2026-07-13"
   - id: "D-418"
     status: "DISCHARGED 2026-07-13 (user-directed — 'race だから失敗して良い性質ではない'). The send/await FABRICATION-WINDOW race — `agent_conj` intermittently returned `[2 nil]` / `[#<promise> 2]` / `[#<fn> [#<promise>]]` (the leaked object varied) under low-core / parallel-gate scheduling. ROOT CAUSE (confirmed by the Agent.java survey, private/notes/D418-agent-race-survey.md): on the JVM a constructed Action is automatically GC-reachable, so there is NO enqueue window; cljw's manual mark-sweep had one — `sendFn` built the `[f & args]` action vector (and `awaitFn` the completion promise) as a Zig LOCAL that was unrooted until `enqueueDirect` appended it to the off-heap queue (its traceGc root). A collect in that window swept the freshly-built vector, so the drainer read recycled memory. FIX (primitive/agent.zig): sendFn + awaitFn now publish the action / promise on an EvalFrame across the whole enqueue [.dev/gc_rooting.md §C]. REPRODUCER (the 'def→cgc→use' fault-injection idiom, USENIX Sec'21 use-after-compacting-GC): agent.zig `tortureCollectInWindow` injects a STW collect into the exact enqueue window under CLJW_GC_TORTURE_ALLOC — so the cross-thread race is now a SINGLE-THREAD DETERMINISTIC UAF (pre-fix `agent_conj` HUNG on a swept promise, exit 124; post-fix 10/10 [1 2]). Mechanised guard: e2e phase16_gc_torture.sh agent block — the ncpu>=4 gate is REMOVED (workaround retired), + a new deterministic alloc-torture agent block (send/conj/drain/sendoff). The nested-CROSS-agent-send case surfaced a SECOND, distinct corruption (`@memcpy arguments alias`, exit 134) → new row D-559. Serialization itself (single-drainer + `draining` flag) was NEVER the bug — the survey confirms it is the correct design for a manual-GC runtime."
     category: "concurrency"
 
@@ -207,8 +207,85 @@ window (lazy-realization/reduce) is the genuinely-different D-244 #4b scope.
 - `.dev/debt.yaml` — D-244 #4 discharged (synchronous builders) + the D-244 #4b
   (reentrant realization) follow-on + the forward (moving-GC) row.
 
+## Amendment 1 (2026-07-13, D-559) — the region also defers the safepoint PARK
+
+**Problem.** This ADR's contract says "a mid-builder stop-the-world collect is
+DEFERRED", but the implementation deferred only the SAME-thread torture / future
+auto-collect. The alloc-prologue safepoint park (`gc_heap.alloc`, ADR-0090) ran
+BEFORE the `fabrication_depth` gate, so a PEER's `stopWorld` parked a worker
+mid-bracket — its in-progress builder nodes (raw `*TailNode`/`*HamtNode`/`*Cons`
+in unrooted Zig locals) were invisible to the collect and got swept; the resumed
+builder then read recycled memory. Surfaced as D-559: a nested-cross-agent send
+(`add-watch` on agent A sending to agent B) crashing `@memcpy arguments alias`
+(exit 134, ~3-7% under `CLJW_GC_TORTURE_ALLOC=1` with the D-418 window-collect
+injection; the same signature this ADR's Context recorded for the original
+unbracketed `conj`). `mark_sweep.zig`'s "workers are parked at their
+alloc-prologue, where their intermediates are bracket-covered" comment was
+false — D-559 is its disproof.
+
+**Decision.** The alloc-prologue park HONORS the region: skip the park while
+`fabrication_depth > 0`; the thread parks at its next safepoint OUTSIDE any
+bracket (VM back-edge poll, non-bracket alloc, blocking-lock safepoint, or
+unregister). This is the JVM-GCLocker shape (JNI critical regions delay GC;
+threads in a region run to completion; the collector waits). No deadlock: a
+waiting `stopWorld` holds no lock a bracket needs (brackets are bounded pure
+builders — no eval, no locks; their allocs take only `gc_mutex`, which the
+collector takes only AFTER the rendezvous).
+
+- **No park at bracket ENTRY or EXIT** — both are unsound: at exit the just-built
+  result is an unpublished Zig local; at entry a fold's partial accumulator
+  (`acc = consHeap(rt, x, acc)`) is an unpublished raw node between brackets.
+  There is NO safe bracket-boundary park without new rooting machinery; do not
+  "optimize" one in.
+- **Enforcement**: `fabrication_depth` moved to `root_set.zig` (the shared lower
+  layer); `safepoint.park` AND `safepoint.enterBlocked` now
+  `assert(fabrication_depth == 0)` — the chokepoint guarding every other park
+  site (back-edge, lazy_seq, lock_tx, monitor) and the enterBlocked side door
+  against a future bracket that reaches one.
+- **Accepted cost (observable)**: the rendezvous delay is **unbounded in
+  fold-chain length** — back-to-back brackets with no poll between (a large
+  `into`'s per-element builders) defer the park until the fold ends. Tracked as
+  **D-560** with the publish-roots redesign (DA Alt 3 below) as the named
+  discharge shape; `safepoint.max_stopworld_wait_ns` records the worst wait so
+  the cliff is observable, not anecdotal.
+- **Scope**: this does NOT close the D-556 residual (tree_walk eval ON A WORKER
+  holds C-stack Value intermediates; the conservative scan remains
+  collecting-thread-only). At the sanctioned park sites a VM worker's live
+  values are published (operand stack / eval frames / bindings); the same claim
+  for tree_walk-on-worker is NOT made.
+
+**Alternatives considered (Devil's-advocate fork, fresh context — summary;
+full text `private/notes/D559-da-critique.md`):**
+
+- **Alt 1 (smallest-diff, taken)**: the park-deferral + asserts + honest wording
+  + wait stat. DA verdict: sound (a registered in-bracket worker never counts as
+  parked, so `collect` can never overlap a bracket); inherits the structural
+  smell that the fabrication region now couples into the safepoint protocol.
+- **Alt 2 (Boehm per-parked-worker conservative stack scan)**: closes D-559 AND
+  the D-556 residual in one mechanism, no latency cliff. Rejected as
+  finished-form-HOSTILE on this project's horizon: wasm value stacks are
+  unscannable, so gap area II (Wasm-edge-native) cannot port it, and it deepens
+  platform coupling.
+- **Alt 3 (wildcard, DA-recommended per F-002)**: flip brackets from
+  suppress-collect to PUBLISH-ROOTS — `gc.alloc` auto-appends in-bracket
+  allocations to a threadlocal scratch root array the collector marks; parks
+  become safe anywhere, no rendezvous delay, no fabrication knowledge in the
+  safepoint layer, torture gates deletable, wasm-portable. Costs: per-in-bracket-
+  alloc append, a new clear-point invariant, an ADR-0150 supersede (depth 3).
+  **Main-loop ruling**: this ADR's accepted premise (F-006 non-moving → the
+  no-collect region IS the finished form; publish-roots was Fork 2's rejected
+  gold-plating) still stands — D-559 was an implementation gap in the region's
+  contract, not evidence the regime is wrong. Alt 3 becomes the named discharge
+  shape of D-560, triggered by MEASURED pause-time harm (or an F-006 amendment,
+  user-owned), not pre-emptively.
+
 ## Revision history
 
+- 2026-07-13 **Amendment 1** (D-559): the region also defers the alloc-prologue
+  safepoint park (a peer-STW mid-bracket park corrupted worker builders);
+  `fabrication_depth` moved to `root_set.zig`; park/enterBlocked asserts; the
+  fold-chain rendezvous-delay cost recorded as D-560 with the publish-roots
+  redesign (DA Alt 3) as its discharge shape.
 - 2026-06-16 issued + **REJECTED same day**, then **REVERSED to ACCEPTED same day**.
   The design (Alt A no-collect region) was DA-forked (Fork 1, recommended Alt A). It
   was then rejected on the belief that Alt A contradicts ADR-0090's "never suppress,
 
@@ -28,6 +28,16 @@
 const std = @import("std");
 const io_default = @import("io_default.zig");
 const root_set = @import("../gc/root_set.zig");
+const clock = @import("../clock.zig");
+
+/// Diagnostic (ADR-0150 am1 / D-560): the longest single `stopWorld` rendezvous
+/// wait observed this process, in ns. The am1 park-deferral makes the wait
+/// unbounded in fold-chain length (a worker running back-to-back fabrication
+/// brackets parks only at its next non-bracket safepoint), so the delay must be
+/// OBSERVABLE — if this grows into real pause-time trouble, D-560 names the
+/// publish-roots redesign that removes the cliff. Monotonic max; read on demand
+/// (no print path wired — a probe reads it via a debugger / future stats dump).
+pub var max_stopworld_wait_ns: std.atomic.Value(i64) = .init(0);
 
 /// Armed by a collecting thread (`stopWorld`); read by the VM back-edge poll +
 /// the `alloc`-boundary check. A worker that observes this set at a safe point
@@ -53,6 +63,14 @@ var resume_cond: std.Io.Condition = .init;
 /// count before this thread parks. The resume guard tests the FLAG, not the
 /// count, so a spurious `Condition` wakeup re-parks correctly.
 pub fn park() void {
+    // ADR-0150 am1 / D-559: a thread must NEVER park inside a fabrication
+    // no-collect region — its in-progress builder nodes are unrooted Zig
+    // locals the collector cannot see, so a park here hands the peer's
+    // collect a stack it will corrupt. The alloc-prologue gate (gc_heap)
+    // skips the park mid-bracket; this assert is the chokepoint guarding
+    // every OTHER park site (back-edge poll, lazy_seq, lock_tx, monitor)
+    // against a future bracket that reaches one of them.
+    std.debug.assert(root_set.fabrication_depth == 0);
     io_default.lockMutex(&sp_mutex);
     defer io_default.unlockMutex(&sp_mutex);
     parked_count += 1;
@@ -72,6 +90,12 @@ pub fn park() void {
 /// from the registry BEFORE arming so a worker arriving late still parks (the
 /// flag is armed first); a parked-count overshoot only relaxes the `<` wait.
 pub fn stopWorld(self_registered: bool) void {
+    const t0 = clock.nanoTime(io_default.get());
+    defer {
+        const waited = clock.nanoTime(io_default.get()) - t0;
+        if (waited > max_stopworld_wait_ns.load(.monotonic))
+            max_stopworld_wait_ns.store(waited, .monotonic);
+    }
     gc_requested.store(true, .release);
     io_default.lockMutex(&sp_mutex);
     defer io_default.unlockMutex(&sp_mutex);
@@ -109,6 +133,12 @@ pub fn noteWorkerLeft() void {
 /// torture deadlock: `force` runs the thunk under the once-lock, so the COLLECTING
 /// main thread holds it across a collect while a worker blocks on it).
 pub fn enterBlocked() void {
+    // ADR-0150 am1 / D-559: same invariant as `park` — counting a mid-bracket
+    // thread as parked would let the collector proceed over its unrooted
+    // builder intermediates (the side door the alloc-prologue gate does not
+    // cover). Brackets are pure builders that take no locks, so this cannot
+    // fire today; it guards the invariant against future bracket bodies.
+    std.debug.assert(root_set.fabrication_depth == 0);
     io_default.lockMutex(&sp_mutex);
     defer io_default.unlockMutex(&sp_mutex);
     parked_count += 1;