the OUTFIT column stops re-opening a form per row

Reading a label opens a Form, whose replay opens the node, which figwal
answers by materialising the whole channel. The form is evicted at 15
minutes and the next listing opens it again, so a status line on a timer
cycles the store through memory forever.

The label is memoized and invalidated by any write naming an outfit key,
registered on the commit sink where the form is OPENED so every writer
passes it. The board stays the only source of truth.

Evict every form on the real-store copy, then list again: 209 forms
re-opened before, 0 after. It does NOT fix the first listing's +114 MiB,
which arrives on the topology build and is figwal's; plans/progress.md says
so and says which instrument to trust.

Author: gluck

internal/store/listing_cost_test.go

@@ -28,12 +28,17 @@ func TestListingCost(t *testing.T) {
 	}
 	defer be.Close()
 
-	heap := func() uint64 {
+	// int64, and signed deltas: HeapAlloc can fall between two readings (a GC
+	// collects more than the step allocated), and an unsigned subtraction
+	// turns that into 17592186044416 MiB of nonsense. I printed exactly that
+	// for three runs before noticing.
+	heap := func() int64 {
 		runtime.GC()
 		var m runtime.MemStats
 		runtime.ReadMemStats(&m)
-		return m.HeapAlloc
+		return int64(m.HeapAlloc)
 	}
+	mib := func(d int64) float64 { return float64(d) / (1 << 20) }
 	before := heap()
 	light := be.Store().listTrunks()
 	afterFirstScan := heap()
@@ -43,11 +48,11 @@ func TestListingCost(t *testing.T) {
 	afterTopology := heap()
 	t.Logf("trunks=%d", len(light))
 	t.Logf("first ListLight:  %+.1f MiB   (index hydration, retained across a GC)",
-		float64(afterFirstScan-before)/(1<<20))
+		mib(afterFirstScan-before))
 	t.Logf("second ListLight: %+.1f MiB   (what a repeated `fig ls` costs)",
-		float64(afterSecondScan-afterFirstScan)/(1<<20))
+		mib(afterSecondScan-afterFirstScan))
 	t.Logf("topology build:   %+.1f MiB",
-		float64(afterTopology-afterSecondScan)/(1<<20))
+		mib(afterTopology-afterSecondScan))
 	// This is what a listing does per row.
 	for i := range rows {
 		be.label(&rows[i])
@@ -58,10 +63,27 @@ func TestListingCost(t *testing.T) {
 	forms := len(be.forms)
 	be.mu.Unlock()
 
+	// THE STEADY STATE, which is what a status line on a timer produces:
+	// forms evicted for idleness, then a listing. Before the label memo, the
+	// second listing re-opened every form and re-hydrated every node.
+	be.EvictIdle(map[string]bool{}, 0)
+	evicted := heap()
+	rows2 := be.Conversations()
+	for i := range rows2 {
+		be.label(&rows2[i])
+	}
+	afterSecond := heap()
+	be.mu.Lock()
+	forms2 := len(be.forms)
+	be.mu.Unlock()
+	t.Logf("after evicting every form: %.1f MiB heap", mib(evicted))
+	t.Logf("SECOND listing:   %+.1f MiB  (%d forms re-opened, loaded heads %d)",
+		mib(afterSecond-evicted), forms2, be.Store().LoadedHeads())
+
 	t.Logf("rows=%d", len(rows))
-	t.Logf("topology total: %+.1f MiB", float64(afterTopology-before)/(1<<20))
+	t.Logf("topology total: %+.1f MiB", mib(afterTopology-before))
 	t.Logf("labels:         %+.1f MiB  (%d forms now resident)",
-		float64(afterLabels-afterTopology)/(1<<20), forms)
+		mib(afterLabels-afterTopology), forms)
 	t.Logf("resident form patches: %d", be.ResidentFormPatches())
-	t.Logf("per form: %.1f KiB", float64(afterLabels-afterTopology)/float64(max(forms, 1))/1024)
+	t.Logf("per form: %.1f KiB", mib(afterLabels-afterTopology)*1024/float64(max(forms, 1)))
 }

internal/store/window_test.go

@@ -291,3 +291,53 @@ func TestTranslationBudgetReachesTheCache(t *testing.T) {
 		t.Fatalf("read below the window returned %d of 40", len(all))
 	}
 }
+
+// The OUTFIT column's memo outlives the form it came from, because reading a
+// label opens a form, which hydrates a whole node in figwal. It must still be
+// CORRECT: a write that changes the outfit has to drop it.
+func TestLabelMemoIsInvalidatedByAWrite(t *testing.T) {
+	be, err := NewXwalBackend(t.TempDir(), 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer be.Close()
+	outfit, err := be.CreateOutfit("first", patchSet(map[string]string{"system.model": "m"}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	id, err := be.CreateConversation(outfit)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := be.ApplyForm(id, patchSet(map[string]string{
+		"system.outfit_name": "first", "system.outfit_version": "v1",
+	})); err != nil {
+		t.Fatal(err)
+	}
+	n := NodeView{ID: id}
+	be.label(&n)
+	if n.Outfit != "first" {
+		t.Fatalf("label = %q, want first", n.Outfit)
+	}
+	if _, err := be.ApplyForm(id, patchSet(map[string]string{
+		"system.outfit_name": "second", "system.outfit_version": "v2",
+	})); err != nil {
+		t.Fatal(err)
+	}
+	n2 := NodeView{ID: id}
+	be.label(&n2)
+	if n2.Outfit != "second" || n2.Version != "v2" {
+		t.Fatalf("label after a redress = %q/%q, want second/v2: the memo went stale",
+			n2.Outfit, n2.Version)
+	}
+	// A write that names no outfit key must not cost the memo.
+	if _, err := be.ApplyForm(id, patchSet(map[string]string{"brief": "x"})); err != nil {
+		t.Fatal(err)
+	}
+	be.mu.Lock()
+	_, cached := be.labels[id]
+	be.mu.Unlock()
+	if !cached {
+		t.Fatal("an unrelated write dropped the memo: the listing pays for every patch")
+	}
+}

internal/store/xwal_backend.go

@@ -246,6 +246,15 @@ func (b *XwalBackend) form(ariaID string) (*Form, error) {
 	if err != nil {
 		return nil, err
 	}
+	// One invalidation point for the label memo, registered where the form is
+	// opened, so EVERY writer passes it: the hub, the agent's own loop, a
+	// birth dressing, an outfit fold.
+	opened.OnCommit(func(_ uint64, patch message.Patch) {
+		if namesOutfit(patch) {
+			b.labelChanged(ariaID)
+		}
+	})
+
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if existing := b.forms[ariaID]; existing != nil {
@@ -256,6 +265,22 @@ func (b *XwalBackend) form(ariaID string) (*Form, error) {
 	return opened, nil
 }
 
+// namesOutfit reports whether a patch could change what the OUTFIT column
+// shows. Four keys, checked on a patch that is usually one key wide.
+func namesOutfit(patch message.Patch) bool {
+	for _, k := range []string{keyOutfitName, keyOutfitVer, keyLegacyName, keyLegacyVer} {
+		if _, ok := patch.Set[k]; ok {
+			return true
+		}
+		for _, r := range patch.Remove {
+			if r == k {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // WatchForm registers a sink for every patch committed to an aria's form. It
 // opens the Form if nobody had, which is what lets a listener follow a DORMANT
 // aria: a form is a store object, and reading one does not need an agent.
@@ -478,21 +503,57 @@ func (b *XwalBackend) label(n *NodeView) {
 // copying its inherited prefix into its own channel, renumbering its form
 // versions, and every IR record's cursor stamp would then point at the wrong
 // patch. The old shape reads fine; it just stops being minted.
+// labelOf answers the listing's OUTFIT column.
+//
+// THE MEMO IS THE POINT, for a node with no stump. Reading the label off the
+// board opens the Form, whose replay opens the NODE, and figwal answers that
+// by materializing the node's whole channel in memory
+// (log.buildOwnSnapshot). A listing does it per row, and a form evicted for
+// idleness is re-opened by the next listing, so a status line on a timer
+// cycles the whole store through memory forever. Measured: one `fig ls` on a
+// 515-aria store, 95 MB retained, with zero arias resident by figaro's own
+// count.
+//
+// So the label outlives the form it came from, and every write to that
+// aria's board drops it (labelChanged). The board is still the only source
+// of truth; this is a cache of it with a complete invalidation, not a second
+// copy of it on disk.
 func (b *XwalBackend) labelOf(n *NodeView) outfitLabel {
 	if n.Stump != "" {
 		return b.stumpLabel(n.Stump)
 	}
+	b.mu.Lock()
+	l, ok := b.labels[n.ID]
+	b.mu.Unlock()
+	if ok {
+		return l
+	}
 	snap, err := b.FormState(n.ID)
 	if err != nil {
 		return outfitLabel{}
 	}
-	l := outfitLabel{name: snapString(snap, keyOutfitName), version: snapString(snap, keyOutfitVer)}
+	l = outfitLabel{name: snapString(snap, keyOutfitName), version: snapString(snap, keyOutfitVer)}
 	if l.name == "" {
 		l.name, l.version = snapString(snap, keyLegacyName), snapString(snap, keyLegacyVer)
 	}
+	b.mu.Lock()
+	if b.labels == nil {
+		b.labels = map[string]outfitLabel{}
+	}
+	b.labels[n.ID] = l
+	b.mu.Unlock()
 	return l
 }
 
+// labelChanged drops a memoized label. Every write to a board goes through
+// this backend, so this is the whole invalidation: an outfit fold, a birth
+// dressing, or a hand-written key all pass here.
+func (b *XwalBackend) labelChanged(ariaID string) {
+	b.mu.Lock()
+	delete(b.labels, ariaID)
+	b.mu.Unlock()
+}
+
 // stumpLabel reads a stump's name and version out of the birth patch it wrote,
 // which is the only place either has ever been stated authoritatively -- the id
 // used to restate the name, and a form key of the same name is the

plans/progress.md

@@ -1351,3 +1351,36 @@ here first.
 | 8 topology form | **done**, live-validated, `internal/trunk` deleted |
 | 9 libretto | not started; §12.2.2 records a design bug found before it was built |
 | 10 API refactor | not started |
+
+### The OUTFIT column stops re-opening forms
+
+A memo for the label, invalidated by any write that names an outfit key,
+registered on the form's commit sink where it is OPENED — so every writer
+passes it: the hub, the agent's own loop, a birth dressing, an outfit fold.
+The board stays the only source of truth; this is a cache of it with a
+complete invalidation, not a second copy on disk.
+
+**The cycle it breaks.** A listing reads a label per row, which opens a Form,
+whose replay opens the node, which figwal answers by materializing the whole
+channel. A form is then evicted for idleness at 15 minutes, and the next
+listing opens it again. A status line on a timer therefore cycles the store
+through memory forever. Measured on the real-store copy:
+
+```
+evict every form, then list again:
+  before   209 forms re-opened
+  after      0 forms re-opened      (resident_form_patches 0, heads unchanged)
+```
+
+**What it does NOT fix, said plainly**: the FIRST listing still costs +114
+MiB, and that arrives on the topology build rather than on the labels. Two
+instruments disagree about which call triggers it — the daemon's own heap
+profile says `buildOwnSnapshot` under `handlers.list`, and the in-test
+`ReadMemStats` deltas put it on `Conversations()` — and I have already been
+wrong once by trusting the coarse one. Whoever takes it next should isolate
+the topology build under a profile rather than a delta.
+
+**A bug in my own instrument, since it wasted three runs**: `HeapAlloc` can
+FALL between two readings when a GC collects more than the step allocated,
+and an unsigned subtraction renders that as 17592186044416 MiB. The helper
+now returns `int64` and prints signed deltas.