Requirements: Yune

Defined: 2026-04-28 Core Value: Yune should preserve predictable classic RIME input while making AI/LLM assistance a first-class, local-first, non-blocking source of candidates, ranking, context, and memory.

Note (2026-06-17): The GSD .planning/ system has been retired. This requirement list and its statuses are preserved here; the Phase references (e.g. in the Traceability table) are historical GSD labels — now only in git history — kept for context. The live roadmap is roadmap.md; historical milestone context is in ledgers/milestone-history.md; decisions are in decisions.md; conventions in conventions.md.

Registry contract (2026-07-16): Completed requirement definitions and final dispositions are historical traceability, not current roadmap scope. M60 and M61 are complete. M61 closed with disposition D, an evidence-backed measured partial/no-go; no production-default memory reduction or supplemental-ratchet claim was accepted. No numbered milestone is currently active. Non-milestone deferred and transferred rows remain explicitly outside the current sequence. A future structural split may move completed rows to a requirement-history ledger, but it must preserve every ID, terminal disposition, and the trace-only M19/M31/M33–M36 records.

v1 Requirements

Requirements for the compatibility milestone (historically GSD phases 1–5).

CLI Frontend Surrogate

CLI-01: Developer can initialize yune-rime-api from yune-cli with explicit shared data and user data directories.
CLI-02: Developer can deploy and select schemas through the CLI using the RIME ABI path, not direct yune-core fixture setup.
CLI-03: Developer can create and destroy RIME sessions from the CLI and process interactive key events through RimeProcessKey.
CLI-04: Developer can render commit text, preedit, candidate page, highlight index, and status after each CLI key event.
CLI-05: Developer can replay transcript key sequences through the RIME ABI and compare the transcript against expected output.

Frontend ABI Validation

ABI-01: Developer can run the current ABI against at least one real frontend client or native frontend-like loading path and record observed gaps.
ABI-02: Struct layout, lifetime, notification, deployment, and session gaps found by frontend validation have focused regression coverage.
ABI-03: Runtime resource IDs from C APIs and schema YAML reject path traversal, absolute paths, platform separators, and other non-logical IDs before filesystem joins.
ABI-04: Process-wide session, module, notification, switcher, and runtime state behavior remains deterministic under repeated initialize/finalize and session lifecycle operations.

Schema Pipeline Depth

SCHEMA-01: speller behavior covers previous-match segment splitting and non-auto-commit composition behavior beyond current focused auto-commit paths.
SCHEMA-02: editor, navigator, and selector behavior covers deeper segment/selection span semantics and navigator fallback interactions beyond current focused overrides.
SCHEMA-03: chord_composer, shape_processor/shape_formatter, punct_segmentor, and fallback_segmentor behavior covers larger-chain and remaining lifecycle edge cases.
SCHEMA-04: Remaining librime gear behavior around memory, poet/grammar, contextual_translation, and unity_table_encoder has explicit compatibility increments or documented deferrals.
SCHEMA-05: Full spelling algebra, correction/tolerance search interaction, OpenCC conversion data, and distribution-scale processor/segmentor/translator/filter chains are compared directly against librime behavior.

Dictionary And Compiled Data

DATA-01: Runtime dictionary loading can consume compiled .table.bin, .prism.bin, and .reverse.bin payloads beyond the current metadata slice.
DATA-02: Dictionary rebuild execution handles source-vs-prebuilt fallback, table/prism/reverse checksum decisions, pack checksum chaining, and compiled output freshness.
DATA-03: Stem-column data, reverse-db dict_settings, preset-vocabulary phrase injection, and UniTE-style encoder payloads are consumed where librime schemas rely on them.
DATA-04: Correction data and tolerance search inputs are represented in the compiled-data path sufficiently for schema-loaded lookup compatibility.

User Dictionary Compatibility

USERDB-01: User dictionary storage supports librime-compatible LevelDB/userdb behavior or a documented compatible abstraction beyond the current plain text shim.
USERDB-02: Snapshot backup, restore, recovery, sync, and transaction rollback behavior match librime-observable semantics.
USERDB-03: Learning, frequency updates, predictive lookup, and backdated scan behavior are represented in runtime candidate ranking and userdb persistence.

Engineering Structure And Quality

QUAL-01: Every new compatibility slice starts with an owning implementation module, owning test module, and explicit librime comparison target.
QUAL-02: lib.rs and main.rs remain facades/orchestration glue; temporary spike code is extracted before a second related behavior lands.
QUAL-03: Remaining oversized compatibility tests are split only along behavior ownership boundaries, without mixing mechanical moves and behavior changes.
QUAL-04: Quality gates for implementation phases include focused tests, cargo fmt, relevant cargo test targets, and workspace tests when shared behavior changes.

v2 Requirements

Requirements for the next validation milestone before AI-native product work.

Real Frontend Validation

FRONTEND-VALIDATION-01: A host-shaped native loader or real frontend path validates rime_get_api, setup, initialize, deploy, schema selection, session lifecycle, key processing, context/status reads, commit text, and teardown.
FRONTEND-VALIDATION-02: TypeDuck-Web-style browser/WebAssembly integration is attempted as a real application frontend path, with wrapper gaps and browser-specific limits documented.
FRONTEND-VALIDATION-03: Squirrel or a macOS frontend-shaped integration is attempted after the browser/WebAssembly path, with reproducible blockers documented if direct integration cannot run locally.
FRONTEND-VALIDATION-04: ibus-rime or fcitx-rime validation is scoped after the macOS path, with environment requirements and lifecycle differences documented.
FRONTEND-VALIDATION-05: Frontend-observed ABI/runtime mismatches are captured as notes, fixtures, or focused regression tests before being fixed.

Frontend-Sensitive Benchmarks

BENCH-01: Benchmarks record baseline latency for session create/destroy, per-key RimeProcessKey, schema deployment, dictionary loading, and userdb learning/sync paths.
BENCH-02: Benchmark output is reproducible enough to compare future frontend or AI-native changes against the compatibility foundation baseline.

TypeDuck-Web Browser Integration Requirements

Requirements for the next integration milestone. These requirements turn the Phase 6 TypeDuck-Web validation and the seed Rust adapter into a browser-usable path before AI-native product work begins.

M9 completed real-assets validation. The build-out (WASM export contract, TS bridge, browser filesystem) landed, and the WASM artifact now builds as loadable Emscripten yune-typeduck.js/.wasm with a Node smoke for one yune_typeduck_* call plus one FS operation. A post-review audit found the first WI-4 browser matrix used the placeholder echo path for candidate evidence. HR-1 proves the patched TypeDuck-Web worker can load real jyut6ping3_mobile assets and render nei candidates (你, 呢, 尼) in a real browser. HR-2 resolves the startup setOption export/wrapper/adapter gap, HR-3 proves browser deploy() returns true with real assets after adding the plain jyut6ping3.schema.yaml preload, and HR-4 proves live-worker persistence sync plus real reload survival. HR-5 reruns the full browser matrix against real assets, including paging, deletion, phrase commit, dictionary-panel rendering, and zero warning/error console entries after the post-review pure-modifier delete-path fix. Rich dictionary-comment byte parity is committed in cantonese_parity; the browser-shaped native rich-comment test also asserts the full real-assets path when local v1.1.2 oracle build assets are present. HR-6 locks the shared reverse-lookup joiner and schema-prompt bytes against the TypeDuck v1.1.2 oracle. HR-7 closes M9 with GO WITH CONDITIONS for gated AI-native frontend exposure.

WASM Build And Export Contract

TYPEDUCK-WASM-01: Developer can build the TypeDuck adapter for the intended Emscripten/WASM target as a loadable JS+WASM module.
TYPEDUCK-WASM-02: The browser build preserves all required yune_typeduck_* exports for JS callers and exposes the Emscripten runtime methods needed by the TypeScript host.
TYPEDUCK-WASM-03: Native adapter contract tests remain the deterministic fallback when local browser/WASM tooling is unavailable.

TypeScript Bridge And Runtime Package

TYPEDUCK-JS-01: A TypeScript wrapper exposes init, process-key, candidate action, deploy, customize, set-option, and cleanup operations.
TYPEDUCK-JS-02: The wrapper centralizes JSON parsing and pairs every owned adapter response with yune_typeduck_free_response.
TYPEDUCK-JS-03: Browser keycode/mask mapping is explicit and covered by deterministic tests.
TYPEDUCK-JS-04: Runtime lifecycle documentation makes the one-active-process-global-service constraint visible to TypeDuck-Web callers.

Browser Filesystem And Persistence

TYPEDUCK-FS-01: Browser setup creates the expected shared data, user data, and deployed build directory layout before adapter init.
TYPEDUCK-FS-02: Schema and dictionary assets can be preloaded into the virtual filesystem before adapter init.
TYPEDUCK-FS-03: IDBFS or equivalent persistence syncs before init and after deploy, customize, and userdb mutations.
TYPEDUCK-FS-04: Missing assets, failed sync, and stale deployed config recovery paths are documented and tested where possible.

TypeDuck-Web App Integration And E2E

TYPEDUCK-E2E-01: The upstream TypeDuck-Web repository is cloned or vendored in a reproducible test location, and its current librime/WASM bridge seam is identified.
TYPEDUCK-E2E-02: TypeDuck-Web is patched or configured so its input-engine binding calls the Yune TypeScript bridge instead of the original librime bridge, with candidate text/comment/highlight mapped from the runtime response shape.
TYPEDUCK-E2E-03: Real TypeDuck-Web browser validation covers composition, candidate paging, selection, deletion, commit output, deploy, customize, persistence smoke flows, and dictionary-panel rendering, with PASS evidence recorded from the HR-5 real-assets matrix. Rich dictionary-comment byte parity is committed in cantonese_parity; the browser-shaped native rich-comment test is explicitly skipped unless local v1.1.2 oracle build assets are present.
TYPEDUCK-E2E-04: Integration findings end with a go/no-go recommendation for exposing AI-native behavior through real frontends; HR-7 records GO WITH CONDITIONS.

M12 Upstream Oracle And Behavioral Parity Requirements

Status: complete. Upstream rime/librime 1.17.0 is the default core oracle target. TypeDuck v1.1.2 remains a compatibility-profile oracle for TypeDuck-Web/Windows only. The official upstream Windows MSVC release binary is the behavioral-capture oracle; local source builds are a reproducibility check rather than the primary capture source. Later M17/M18 closeouts resolved the former sentence/lattice and processor blockers with fresh upstream fixtures.

TypeDuck-Windows Native IME Contract Requirements

Status: complete as a TypeDuck compatibility profile. A first pass landed (Phases 11-16), M9 web validation is complete, and the archived pre-M12 native Windows package smoke has been superseded by current M10 T1/T2 profile package, build/link, packaged lifecycle evidence, and stock TypeDuck-Windows real-server IPC smoke evidence against rime_get_typeduck_profile_api(). The shared comment requirement is covered for the current v1.1.2 oracle slices; captured Cantonese engine fixtures are active, and the M10 T3 smoke now proves key input/output through the native TypeDuck-Windows/weasel IPC path. This T3 proof is a stock server/client IPC smoke, not an interactive TSF typing or visible panel rendering smoke; those are owned by the dedicated Windows Yune repository. These requirements target that native path and no longer define Yune's active core oracle milestone.

WIN-TEST-01: Windows cargo test --workspace has a trustworthy green baseline, including portable signature timestamp shape and test-only poison-lock recovery.
WIN-ABI-01: config_list_append_{string,bool,int,double} helper behavior is implemented and exposed through the named, opt-in M19 TypeDuck-profile accessor; the default upstream rime_get_api() does not expose these fork-only slots.
WIN-ORACLE-01: The TypeDuck-HK/librime v1.1.2 binary and pinned schema are captured as a reproducible oracle, or a precise blocker is documented.
WIN-COMMENT-01: Candidate comment semantics match the v1.1.2 oracle for dictionary lookup payloads, reverse lookup joins, and prompt/schema identity. Dictionary lookup payload bytes, schema-prompt bytes, and reverse-lookup joiner coverage are oracle-backed.
WIN-BUILD-01: Yune produces a current TypeDuck-profile native Windows package (rime.dll, import .lib, upstream-shaped default headers, and rime_typeduck_profile_api.h) and the package script loads the packaged DLL through rime_get_typeduck_profile_api().
WIN-PARITY-01: Cantonese/Jyutping parity regression coverage locks the captured v1.1.2 engine behavior in active cantonese_parity tests; schema-menu/userdb observations remain frontend/T3 evidence limits.
WIN-FRONTEND-01: TypeDuck-Windows builds/links against the Yune package and passes a stock real-server IPC smoke. Stock TypeDuckServer.exe starts from output\, loads packaged Yune output\rime.dll, and stock TestTypeDuckIPC.exe /console returns a nonzero session, sends ngohaig key events, and receives status.schema_id=jyut6ping3 plus candidate/context data. Tracked evidence: docs/plans/completed/m10-evidence/t3-stock-real-server/. Caveat: the dedicated Windows Yune repository owns interactive TSF typing, visible candidate-window rendering, and candidate-panel UI behavior.

WEB-02 Jyutping WASM Memory Attribution Requirements

Status: complete as Phase 0 source-fallback classification. WEB-02 adds a web-safe inspector storage diagnostic and classifies the public-demo Jyutping browser owner left unclassified by M46. Evidence: docs/reports/evidence/web02-jyutping-wasm-memory-attribution/; plan: docs/plans/completed/web02-plan-jyutping-wasm-memory-attribution.md.

WEB02-ATTR-01: The web ABI response can expose selected storage, mapping mode, byte-source length, source-fallback deferrals, and memory-owner rows through the existing inspector JSON path without adding a new export.
WEB02-ATTR-02: The shipped public-demo Jyutping assets are reconciled against the live web ABI path. WEB-02 proves Rime::Prism/3.0 Jyutping prisms are rejected as UnsupportedVersion, selected storage is owned_heap, and retained translator.entries_by_code rows total 529,602,374 B.
WEB02-ATTR-03: WEB-02 does not claim a memory reduction. The 893.1 MiB high-water remains a measured blocker until a follow-up branch fixes the browser/public-demo compiled-asset contract and remeasures.

P2-WIN-02 TypeDuck Windows Boundary Compatibility Requirements

Status: complete; Yune boundary fixed and non-Yune TSF input-delivery blocker classified. P2-WIN-02 closes the Yune-side raw TypeDuck jyut6ping3 ngohaig boundary bug found by TypeDuck-Windows Phase 0C without widening the default upstream ABI. Evidence: docs/reports/evidence/p2-win02-boundary-compat-2026-06-22/; plan: docs/plans/completed/p2-win02-plan-typeduck-boundary-compat.md.

P2-WIN02-BOUNDARY-01: Phase 0C ngohaig raw comment evidence is promoted into a Yune-owned TypeDuck v1.1.2 fixture with locked provenance and native parity tests.
P2-WIN02-BOUNDARY-02: Yune emits TypeDuck v1.1.2 rich \f\r1, comment bytes for the Windows-facing jyut6ping3 ngohaig path through both core and Rime ABI tests.
P2-WIN02-BOUNDARY-03: Compiled TypeDuck dictionary_lookup_filter side dictionaries preserve lookup records, and workspace deployment rebuilds those side artifacts instead of relying on stale external compiled data.
P2-WIN02-BOUNDARY-04: The TypeDuck-Windows uninitialized RimeConfig boundary is tolerated without freeing foreign pointers, and repeated session/schema lifecycle remains responsive in focused ABI tests.
P2-WIN02-BOUNDARY-05: The rebuilt TypeDuck Windows package passes the packaged DLL smoke, direct RimeCandidate.comment byte probe, TypeDuck-Web regression gate, and stock TypeDuck-Windows IPC smoke with rich comments.
P2-WIN02-BOUNDARY-06: Interactive Notepad TSF smoke proves candidate commit, produces a newly classified non-Yune blocker with committed evidence, or the user explicitly accepts IPC-only closure. The approved reruns produced the newly classified non-Yune blocker path: session-scoped TypeDuck activation succeeded and the Yune-backed server stayed alive, but Notepad still received raw ASCII, so the remaining issue belongs to TSF input-delivery/frontend-shell work.

Deferred, Transferred, And AI-Foundation Requirements

This section deliberately mixes non-milestone deferred work, transferred product ownership, and the completed M11 AI foundation. None of its deferred or transferred rows allocates a current milestone; current sequencing remains in roadmap.md.

Plugin Compatibility

PLUGIN-01: Yune can load or adapt librime C++ plugin ABI extensions.
PLUGIN-02: Lua, dynamic octagram plugin loading, predict, proto, and other distribution plugin ecosystems have migration paths.

Product Frontend (transferred)

FRONTEND-01 (transferred): The dedicated Windows Yune repository owns a new graphical Windows end-user frontend. This engine repository owns only explicit package/API requirements brought back with an accepted proposal and tests.
FRONTEND-02 (Windows/native transfer): CanCLID/yune-windows owns optional AI ranking and contextual-completion UI in the Windows product. The active repo-local M32 plan separately owns any future yune-web AI product surface. Any new native host-context, privacy, or ABI surface requires a separate engine proposal here.

iOS Keyboard Developer Track

IOS-DEV-01: Yune provides a documented iOS package/host contract for keyboard developers, separate from the default upstream RimeApi table and without changing RimeCandidate.
IOS-DEV-02: iOS resource deployment is explicit: schemas, dictionaries, OpenCC data, and userdb storage are bundled or generated in a sandbox-safe location without arbitrary filesystem paths or startup recompilation surprises.
IOS-DEV-03: Swift/Obj-C integration defines keyboard-extension lifecycle, memory, persistence, and privacy constraints before TypeDuck iOS exposure is claimed.
IOS-DEV-04: Mobile-specific behavior such as near-key correction maps or keyboard-layout differences is data/config-driven or UI-owned, not hardcoded as desktop-vs-mobile engine branches.

AI Extension Foundation (complete)

AI-01: Engine exposes an AiCandidateProvider interface and staged, input-keyed AI results without replacing classic translators. S1 implements this for the direct CLI mock path.
AI-02: Candidate ranking supports local model and rule-backed implementations with deterministic timeout/fallback behavior. S2 covers the background worker, input-keyed fallback, fixed-point confidence metadata, and confidence-ordered AI merge; S5 adds the local rule-backed provider.
AI-03: Contextual phrase and sentence completion can produce source-labeled AI candidates without allowing AI candidates to auto-commit by default. S1 covers source labeling and the no-default-auto-commit gate; S5 adds contextual local-model completions.
AI-04: Context providers define what app, field, preceding text, cursor, schema, and candidate-list data may be shared with AI providers. S3 implements AiContext plus EngineAiContextProvider snapshots.
AI-05: Memory store records user vocabulary, phrase preferences, and domain terms through explicit, inspectable, clearable policy. S4 implements MemoryStore, clear/disable controls, snapshot import/export, and .ai-memory namespace helpers.
AI-06: Privacy policy disables learning and remote calls for sensitive contexts and keeps classic input fully functional when AI is disabled. S3 blocks remote calls; S4 applies the same privacy gate to AI memory writes.
AI-07: CLI frontend surrogate can demonstrate AI candidate/ranking behavior with mock and local providers before native frontends expose it. S1 covers yune-cli run --ai-provider mock; S5 adds --ai-provider local.

M13 AI-native Frontend Exposure Requirements

Status: complete for TypeDuck-Web. M13 exposes the M11 local AI layer through TypeDuck-Web only, default-off and local-first, with the key path still provider-free. Native product UI exposure belongs to its product repository; any new Yune host-context, privacy, or ABI requirement remains separate engine work.

M13-AI-01: yune_typeduck_process_key remains provider-free and classic-first; AI provider work runs only through the second-pass yune_typeduck_stage_ai path.
M13-AI-02: Browser AI is default-off, can be toggled without redeploy, and set_ai_enabled(false) clears any staged result for the current input.
M13-AI-03: AI candidates render after the classic top candidate, never at index 0, with source labels derived from engine snapshot data aligned to the rendered page; RimeCandidate and the upstream RimeApi table remain unchanged.
M13-AI-04: Browser commit safety preserves classic default commit behavior; AI rows never auto-commit and require explicit selection.
M13-AI-05: Explicit AI commits do not touch librime userdb; under the sensitive browser default, AI-memory learning is suppressed and no .ai-memory persistence is written.
M13-AI-06: Real TypeDuck-Web browser evidence covers AI-off byte identity, AI-on source-labeled second-pass rows, no auto-commit, explicit AI selection, and zero warning/error console entries.

M14–M16 TypeDuck-Web Fork Parity Requirements

Status: M14 capture complete; M15 engine parity complete; M16 browser validation complete with documented browser-surface limits. Complete the TypeDuck jyut6ping3 target so the TypeDuck-Web example behaves like the fork. Oracle-measured against TypeDuck-HK v1.1.2; jyut6ping3 is dictionary-driven and does not require the upstream language model (Track 2 / M17). See roadmap M14–M16 and decisions.md D-27.

TYPEDUCK-PARITY-01: A v1.1.2 capture path is established by parameterizing the scenario-capable upstream probe's oracle identity (modules/distribution/provenance) — or a thin v1.1.2 wrapper — and Cantonese goldens are captured from the v1.1.2 oracle binary for combine_candidates, show_full_code, enable_sentence, completion/prediction, and correction at multiple input lengths.
TYPEDUCK-PARITY-02: The oracle-observable surface for schema-menu hiding (hide_lone_schema/hide_caret) is identified (config API, schema-list/switcher API, or TypeDuck-Web UI state) and emitted behavior is captured — not static config inspection alone.
TYPEDUCK-PARITY-03: A feasibility spike determines whether per-entry userdb pronunciations are capturable via the levers user-dict export/import/seed hooks; if not, the gap is documented as a fork-only deferral with the precise blocker.
TYPEDUCK-PARITY-04: combine_candidates (candidate grouping) and show_full_code (cangjie preedit algebra) are implemented and pass the captured goldens through Yune's real engine path.
TYPEDUCK-PARITY-05: enable_sentence, completion ranking, and correction/tolerance tuning are refined to pass the captured goldens.
TYPEDUCK-PARITY-06: OpenCC hk2s coverage is expanded from the built-in slice to the full conversion data the jyut6ping3 simplifier needs.
TYPEDUCK-PARITY-07: The TypeDuck-Web browser matrix passes for the app-exposed jyut6ping3_mobile surface plus M13 AI, while deploy-only variants (common:/separate_candidates, common:/show_full_code), schema-menu UI hiding, correction UI detail, and per-entry userdb pronunciation are explicitly documented as browser/userdb inspection limits backed by M14/M15 oracle evidence.

Fork Parity Backlog — Cantonese engine-parity (complete)

Status: complete. Derived from the full Cantoboard + TypeDuck fork-vs-1.17.0 audit in ledgers/fork-parity-ledger.md. These were genuine fork deltas Yune needed to preserve or explicitly decline (distinct from the upstream-depth Track 2 M17–M19 work). M14–M16 closed the captured browser surface; these were the uncaptured / partial deltas the goldens did not exercise. Each completed implementation was measured against the v1.1.2 oracle or closed by an explicit product decision.

FORK-PARITY-01: The Cantonese 容錯 (fuzzy) spelling-algebra ruleset (lv1_laanjam, lv2_upper, shortcuts, lv2_lower, abbreviation — including the ng→m rule behind the F1 m case) runs on the real ~127k-entry jyut6ping3 dictionary, with a real-dictionary golden.
FORK-PARITY-02: PreferUserPhrase weighted gate — a user-dictionary phrase outranks a competing system phrase only with a longer code, or equal-length code and weight ≥ the system phrase.
FORK-PARITY-03: Per-entry userdb element/full-code pronunciation recovery, including multi-syllable sentence commits preserving all primary lookup codes.
FORK-PARITY-04: hide_lone_schema — suppress the schema switcher when only one schema exists (838e3d41).
FORK-PARITY-05: Correction fidelity — edit-distance-scaled penalty + discard non-minimal-distance corrections (kCorrection, 81e13724), an enable_correction gate independent of enable_completion (585f4656), and restricting corrections to normal spellings (733eedc8→2f79c3ab).
FORK-PARITY-06: letter_to_tone/tone_to_letter — type v/x/q for tones via the TypeDuck profile's preedit_format path.
FORK-PARITY-07: TypeDuck-profile 全形/半形 state labels (vs upstream 全角/半角) — schema-asset/golden change only, no Rust change.
FORK-PARITY-08: Product decision and implementation: do not chase full TypeDuck prediction-ranking byte parity; preserve upstream 1.17.0 long-entry completion (santai can surface 身體健康) and expose profile controls for prediction_never_first plus raw-weight/frequency thresholds.
FORK-PARITY-09: Product decision: display_languages gloss-column selection lives in TypeDuck-Web UI; the engine continues to emit stable, ordered lookup payloads without adding engine-side language filtering.

M20 Web Demo Showcase Controls Requirements

Status: complete. M20 is a web/demo track for this repo's patched internal TypeDuck-Web harness, not a reopened M13 and not the separately cloned TypeDuck-HK/TypeDuck-Web product. It exposes already-supported Yune behavior through honest UI controls and guided scenarios while preserving the M9/M13/M16 browser gates and the upstream-first ABI constraints. Browser evidence is under apps/yune-web/e2e/results/m20-showcase-controls/.

M20-DEMO-01: TypeDuck-Web exposes only runtime-backed active controls: schema/deploy-time controls flow through customize() plus deploy, live session controls flow through setOption(), display-only controls are grouped separately, and no new RimeApi, RimeCandidate, or yune_typeduck_* export is added for UI convenience.
M20-DEMO-02: Prediction controls are honest and profile-aligned: prediction_never_first defaults on, and the UI exposes one prediction threshold control because the frequency/weight config aliases drive the same engine threshold; the fine-grained threshold UI has a real-assets-calibrated santai cutoff plus documented range bounds in browser evidence.
M20-DEMO-03: Static or default-on engine features are guided scenarios, not fake toggles: long-entry prediction (santai -> 身體健康), Cantonese fuzzy/容錯, letter-to-tone, reverse lookup/dictionary panels, and AI second-pass behavior are demonstrable without misrepresenting their configurability.
M20-DEMO-04: The internal TypeDuck-Web harness and @yune-ime/typeduck-runtime subtrees have local AGENTS.md guidance covering patch discipline, runtime wrapper boundaries, browser evidence, the control-honesty rule, and the distinction between the harness, the runtime bridge, and the real TypeDuck-Web web IME product.
M20-DEMO-05: Real browser evidence includes an honesty gate proving supported controls with visible before/after output where the jyut6ping3_mobile browser surface can render it: AI candidates, combine_candidates, prediction_never_first, prediction threshold, live setOption() controls, display-language/Jyutping rendering, and guided scenarios. Deploy-time controls whose current browser panel effect is not independently visible keep real persisted jyut6ping3_mobile.custom.yaml assertions, but are not counted as candidate-output proof. Input Memory has a visible learned-prediction on-state and an explicit browser-surface N/A for memory-off suppression; Auto-correction now has real nri browser before/after evidence, with correction off rendering the v1.1.2 prefix fallback rows and correction on rendering 你 first. The full oracle row set and commit previews remain engine-proven by cantonese_parity. ascii_punct now has M18 engine behavior but remains absent as a working browser toggle until a browser-visible evidence slice proves it. The fixed jyut6ping3_mobile browser schema lacks a cangjie namespace, so Reverse code display / Cangjie / show_full_code are labeled current-surface N/A rather than fake working toggles.
M20-DEMO-06: The internal TypeDuck-Web harness is documented and maintained as Yune's canonical browser playground: every browser-safe supported engine feature is reachable through an active control or guided scenario, and unsupported or deferred behavior is clearly absent or labeled rather than partially exposed.
M20-DEMO-07: Headline TypeDuck profile toggles are not lost in the playground: translator/combine_candidates is an active control whose UI default is documented as an M20 grouped-candidate demo choice. The original M20 raw-asset note was superseded by M41: common:/separate_candidates remains available but inactive by default, so shipped browser schemas now match the grouped-candidate UI default without a startup deploy. show_full_code is either exercised through a browser-reachable Cangjie side-lookup scenario/control or explicitly recorded as N/A for the current jyut6ping3_mobile-only surface.

M22 Web Playground Requirements

M22-PLAY-01: The internal TypeDuck-Web playground has an opt-in read-only engine inspector showing segment tags, candidate source/quality/ preedit/comment details, spelling-algebra expansion, filter audit, prediction score/threshold data, and AI staging state.
M22-PLAY-02: The inspector is off by default, preserves classic candidate response identity when disabled, has committed browser evidence, and does not change the default RimeApi, RimeCandidate, or ABI layout files.
M22-PLAY-03: Remaining browser-safe controls (traditionalization, extended_charset, disabled, dictionary_exclude, and any ascii_punct exposure after M18) are exposed only when they clear the M20 honesty gate with real browser before/after evidence; otherwise they are documented as browser-surface N/A. Corrective WEB-05 evidence keeps dictionary_exclude and disabled browser-visible, keeps ascii_punct absent from M22-era claims, and records current extended_charset as visible but effect-N/A for the shipped cangjie5 browser schema because no charset_filter/cjk_minifier gear is installed.
M22-PLAY-04: The playground loads jyut6ping3_mobile, cangjie5, and luna_pinyin through a real schema switcher with reverse lookup for the new schemas, using generated or provenance-stamped compiled artifacts with measured browser asset sizes.

M24 TypeDuck-Web Dogfooding Requirements

Status: complete. M24 closed the first manual dogfooding/demo-hardening batch for the internal TypeDuck-Web playground. The closed issue ledger and evidence index live in plans/completed/m24-plan-typeduck-web-dogfooding.md, with browser evidence under apps/yune-web/e2e/results/m24-dogfooding/.

M24-DOGFOOD-REQ-01: The dogfood browser harness records issue-scoped evidence under m24-dogfooding/<issue-id>/, and startup evidence includes the worker phase markers, yune-typeduck.js/.wasm asset identity, and loaded shared schema assets.
M24-DOGFOOD-REQ-02: Candidate rendering strips literal \f, \r, and \v controls from visible rows while preserving dictionary parsing, and compound candidates keep row text compact with details in the dictionary panel.
M24-DOGFOOD-REQ-03: Browser/runtime correctness fixes remain fixture-backed where engine output is involved: jigaajiusihaa ordering is locked to TypeDuck v1.1.2, page-size customization writes menu/page_size, and the historical M24 Jyutping reverse lookup path uses packaged browser assets; M25 updates the current web profile to bare `zhe for luna_pinyin.
M24-DOGFOOD-REQ-04: The TypeDuck-Web playground settings are Cantonese-first and grouped by engine/session/display/frontend purpose, with checklist display languages, real schema names, labeled engine status, and full Chinese typeface family names.
M24-DOGFOOD-REQ-05: The dogfood UI stack is Vite + React + Tailwind CSS plus small local components only; DaisyUI is removed from package metadata, Tailwind config, and local component class usage.

M25 TypeDuck-Web Dogfooding Round 2 Requirements

Status: complete. M25 closed the second manual dogfooding round for the internal TypeDuck-Web playground. The completed ledger and closeout evidence index live in plans/completed/m25-plan-typeduck-web-dogfooding-round-2.md, with browser evidence under apps/yune-web/e2e/results/m25-dogfooding/.

M25-DOGFOOD-REQ-01: Every closed M25 row has issue-scoped browser JSON/screenshot evidence, an owning Playwright or native test listed in the ledger closeout table, and TypeDuck-Web source changes regenerated into apps/yune-web/patches/yune-web-runtime.patch with reverse/forward patch checks.
M25-DOGFOOD-REQ-02: Browser startup uses the release-mode WASM build, records phase timing evidence, reuses fresh deploy state instead of forcing schema invalidation, and normal typing no longer shows the global loading state.
M25-DOGFOOD-REQ-03: Page size is an obvious 3-10 setting wired to menu/page_size; native and browser tests prove the candidate panel cap and page navigation at 3, 9, and 10 visible rows.
M25-DOGFOOD-REQ-04: The current Jyutping web profile uses bare ` for luna_pinyin reverse lookup, removes the vestigial bare reverse_lookup slot, keeps retained Loengfan/Cangjie secondary lookups on explicit non-bare triggers such as `vl / `vc, and shows the trigger map in the web UI.
M25-DOGFOOD-REQ-05: The schema selector, Luna visible name, Cangjie version control, Display/Live settings order, and IME Settings alignment are browser-evidenced across desktop and narrow viewports.
M25-DOGFOOD-REQ-06: Binary dogfood controls use checkbox-style affordances, Candidate Menu Layout uses radio choices, and the UI stack remains Vite + React + Tailwind CSS plus small local components only.

M26 Performance Hardening Requirements

Status: complete. M26 turned the post-M25 performance review into a measurement-first hardening milestone. It separates native engine cost from browser/WASM/worker/React latency before any optimization claims are accepted.

M26-PERF-REQ-01: Native large-real-asset benchmarks cover jyut6ping3_mobile, luna_pinyin, representative cangjie5, and the TypeDuck dynamic-correction path, reporting median, p95, p99, max, cold-first-key versus warm steady-state, operation count, full-ABI versus engine-only cost, and allocation/RSS notes. Evidence: apps/yune-web/e2e/results/m26-performance/native-before.md and apps/yune-web/e2e/results/m26-performance/native-after.md.
M26-PERF-REQ-02: Browser diagnostics record keydown-to-paint or the closest browser-supported proxy for normal typing, long phrases, page changes, reverse lookup, and cold/warm startup, without treating browser-only numbers as native engine latency. Evidence: apps/yune-web/e2e/results/m26-performance/typing-keydown-to-paint-before.json and apps/yune-web/e2e/results/m26-performance/typing-keydown-to-paint-after.json.
M26-PERF-REQ-03: Startup diagnostics attribute the current coarse TypeDuck-Web runtime:initialized interval into worker/package load, WASM module creation, filesystem mount/sync, schema asset deploy/reuse, TypeDuckRuntime.init, schema selection, and startup complete buckets. Evidence: apps/yune-web/e2e/results/m26-performance/startup-attribution-before.json and apps/yune-web/e2e/results/m26-performance/startup-attribution-after.json.
M26-PERF-REQ-04: One measured optimization landed with before/after native and browser evidence. The largest measured owner was startup/schema-selection/runtime initialization, now closed by the named M27 follow-up docs/plans/completed/m27-plan-typeduck-web-startup-runtime-init.md. The landed lower-risk M26 slice targets the measured TypeDuck dynamic-correction stress owner: per_key_real_jyut6ping3_mobile_jigaajiusihaa_correction_engine_only improved from median 451490.692us / p95 467909.308us to median 121712.662us / p95 124420.115us by pruning impossible-length candidates before the restricted-distance matrix. Evidence: apps/yune-web/e2e/results/m26-performance/optimization-choice.md.
M26-PERF-REQ-05: Compatibility gates remain green: upstream luna_pinyin, Cantonese parity, native typeduck_web, TypeScript runtime tests/build, TypeDuck-Web build, focused M26 browser evidence, and TypeDuck-Web patch reverse/forward checks. Evidence: apps/yune-web/e2e/results/m26-performance/task-5-gates.md and apps/yune-web/e2e/results/m26-performance/patch-checks.md.

M27 TypeDuck-Web Startup Runtime Init Requirements

Status: complete. M27 closed the startup/schema-selection/runtime-init owner measured by M26 and the TypeDuck-Web engine-control update surface with native/browser path reconciliation, native owner spans, Windows process memory, browser-to-native mapping, a measured spelling-algebra startup optimization, and live-vs-deploy control classification evidence.

M27-STARTUP-REQ-01: Native startup benchmarks reconcile the browser-paid path against native rows and split the browser-paid jyut6ping3_mobile path into observable owners. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/startup-path-reconciliation.md, apps/yune-web/e2e/results/m27-startup-runtime/native-startup-before.md, and apps/yune-web/e2e/results/m27-startup-runtime/native-startup-after.md.
M27-STARTUP-REQ-02: Native startup evidence includes real Windows process-memory metrics, including working-set deltas and peak working-set bytes for startup spans. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/native-startup-before.md and apps/yune-web/e2e/results/m27-startup-runtime/native-startup-after.md.
M27-STARTUP-REQ-03: Browser startup evidence records fresh and reload paths, preserves the M26 startup markers, adds m27EvidenceVersion, and maps browser schema:select / runtime:init timing back to native startup owners without treating browser timing as native engine timing. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/browser-startup-after.md and apps/yune-web/e2e/results/m27-startup-runtime/browser-startup-after-after.json.
M27-STARTUP-REQ-04: The evidenced top startup owner was materially reduced by caching spelling-algebra expansions per original code. Native startup_real_jyut6ping3_mobile_runtime_ready improved from about 15.55s median to about 6.35s, and browser fresh/reload startup improved to 5.680s / 5.466s. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/optimization-choice.md, apps/yune-web/e2e/results/m27-startup-runtime/native-startup-after.md, and apps/yune-web/e2e/results/m27-startup-runtime/browser-startup-after.md.
M27-STARTUP-REQ-05: Compatibility gates remain green: upstream luna_pinyin, Cantonese parity, native typeduck_web, workspace tests, frontend benchmarks, TypeScript runtime tests/build, TypeDuck-Web build, focused M27 startup/control browser evidence, TypeDuck-Web patch checks, and git diff --check. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/task-5-gates.md and apps/yune-web/e2e/results/m27-startup-runtime/patch-checks.md.
M27-STARTUP-REQ-06: TypeDuck-Web engine controls are classified as live, browser-only, deploy-time, or local-runtime-only. AI candidates no longer use the page-wide loading wrapper and do not emit runtime init, schema select, deploy markers, or visible loading; deploy-backed controls remain measured separately. Evidence: apps/yune-web/e2e/results/m27-startup-runtime/control-classification-before.md and apps/yune-web/e2e/results/m27-startup-runtime/control-classification-after-after.json.

M28 TypeDuck Partial Candidate Selection Requirements

Status: complete. M28 closed segment-aware partial candidate selection as a separate engine-correctness milestone after M27. The v1.1.2 oracle remains authoritative where it diverges from the user-feel target.

M28-PARTIAL-REQ-01: Git history and code evidence classify the caksijathaacoenggeoizi -> select 測 behavior as previously missing support, not a recent regression. Evidence: apps/yune-web/e2e/results/m28-partial-selection/history-classification.md.
M28-PARTIAL-REQ-02: TypeDuck-HK/librime v1.1.2 oracle fixture captures partial-selection behavior for caksijathaacoenggeoizi, including first committed text, remaining input/preedit, next candidates, and final oracle flow. Evidence: crates/yune-core/tests/fixtures/typeduck-v1.1.2/jyut6ping3-m28-partial-selection.json and apps/yune-web/e2e/results/m28-partial-selection/oracle-capture.md.
M28-PARTIAL-REQ-03: Native yune-core and yune-rime-api tests cover segment-aware partial commit/recomposition and preserve FORK-PARITY-03 userdb pronunciation recovery: whole-sentence commits keep full primary codes, while true partial commits record only the consumed span. Evidence: crates/yune-core/tests/cantonese_parity.rs, crates/yune-rime-api/tests/typeduck_web.rs, and apps/yune-web/e2e/results/m28-partial-selection/task-5-gates.md.
M28-PARTIAL-REQ-04: TypeDuck-Web browser evidence proves selecting 測 does not commit raw sijathaacoenggeoizi, continues through the captured component flow, and records that the user-feel 測試一下長句子 target is not the TypeDuck v1.1.2 oracle flow. Evidence: apps/yune-web/e2e/results/m28-partial-selection/browser-partial-selection.json and apps/yune-web/e2e/results/m28-partial-selection/browser-evidence.md.
M28-PARTIAL-REQ-05: Full compatibility gates remain green: cargo fmt --check, workspace clippy, upstream luna_pinyin, cantonese_parity, typeduck_web, workspace tests, frontend benchmarks, TypeScript runtime tests/build, TypeDuck-Web build/evidence, patch checks, and git diff --check. Evidence: apps/yune-web/e2e/results/m28-partial-selection/task-5-gates.md.

M28 Follow-up Upstream Jyutping Composition Requirements

Status: complete. This follow-up closes the post-M28 dogfood gaps for Space/default-confirm partial recomposition and upstream-style Jyutping long composition. Evidence: apps/yune-web/e2e/results/m28-follow-up-upstream-jyutping/; plan: docs/plans/completed/m28-follow-up-plan-upstream-jyutping-composition.md.

M28F-UPSTREAM-REQ-01: Space/default-confirm for caksijathaacoenggeoizi commits only the consumed prefix candidate and keeps the remaining input composing; it never commits 測sijathaacoenggeoizi.
M28F-UPSTREAM-REQ-02: A checked-in hybrid upstream-librime-engine Jyutping fixture captures caksijathaacoenggeoizi composition/ranking with provenance: upstream engine repository/tag/commit, pinned Jyutping schema/dictionary source repository/commit, upstream deploy command, capture command, options, and candidate rows. The fixture contains no local absolute paths and lives outside the pure upstream-1.17.0 fixture family.
M28F-UPSTREAM-REQ-03: docs/decisions.md recorded a narrow historical decision that this Jyutping long-composition/ranking slice followed the captured-and-accepted hybrid fixture over TypeDuck v1.1.2 when they disagreed, while TypeDuck v1.1.2 remained the compatibility oracle for profile ABI/comment surfaces and the hybrid fixture explicitly excluded dictionary-comment payloads. For future canonical jyut6ping3 candidate claims, the 2026-07-05 D-31 amendment now requires upstream rime/librime 1.17.0 plus pinned rime/rime-cantonese.
M28F-UPSTREAM-REQ-04: Native tests follow the accepted captured ordering for this case: sentence/lattice candidate first when enabled, fixture-captured fallback rows after it, and no invented phrase-prefix row when upstream did not capture one.
M28F-UPSTREAM-REQ-05: TypeDuck-Web browser evidence covers auto-composition off plus Space/default-confirm, and auto-composition on plus first-page ranking, without raw-tail commits.
M28F-UPSTREAM-REQ-06: Full compatibility gates remain green: Rust fmt/clippy/tests, upstream luna_pinyin, cantonese_parity, typeduck_web, TypeScript runtime tests/build, TypeDuck-Web build/evidence, patch checks if source changes, and git diff --check.

M29 Startup Memory And Typing Performance Requirements

Status: complete. M29 refreshed post-M28-follow-up startup, memory, and typing evidence; classified the M27-style 1.79GB peak as repeated-benchmark high-water with real single-startup ready pressure around 1.10GB; reduced the measured spelling_algebra_expand startup owner by avoiding no-op regex replacement allocation; and kept typing as attribution evidence because the fresh owner profile was mixed and already much smaller than startup. Evidence: apps/yune-web/e2e/results/m29-performance/; plan: docs/plans/completed/m29-plan-startup-memory-typing-performance.md.

M29-PERF-REQ-01: Fresh M29 baselines re-run native startup benchmarks, browser startup evidence, and browser keydown-to-paint typing evidence on the current post-M28-follow-up code.
M29-PERF-REQ-02: Memory evidence classifies the M27 1.79GB peak as per-startup pressure, benchmark cumulative high-water, or unresolved with a precise blocker and next measurement.
M29-PERF-REQ-03: Startup attribution identifies the top remaining owner, expected to be spelling_algebra_expand unless fresh evidence proves otherwise, before any startup optimization is implemented.
M29-PERF-REQ-04: Typing attribution identifies the top owner for normal and long-phrase keydown-to-paint latency across browser, worker, serialization, native/WASM processing, and render spans.
M29-PERF-REQ-05: At least one startup or typing optimization lands with before/after native and browser evidence, or the chosen owner is closed with an evidence-backed reason it cannot be reduced safely in this milestone.
M29-PERF-REQ-06: Full gates remain green: Rust fmt/clippy/tests, frontend benchmark, TypeScript runtime tests/build, TypeDuck-Web build, focused M29 Playwright evidence, patch checks if source changes, and git diff --check.

M30 Engine Representation Performance Requirements

Status: complete. M30 closed as an engine-only follow-up after M29. It accepted Lever A: the duplicate steady-state expanded-entry vector is removed for spelling-algebra-backed translators, the final entries_by_code map is built by moving Candidate values, and TypeDuck row order is preserved through a builder-only source stream. Single-startup ready pressure improved from 1,103,331,328 bytes to 838,209,536 bytes in the Lever A run and 839,217,152 bytes in the final gate. Native runtime-ready startup median was noisy but improved versus baseline in both after-runs (6,242,614.900us -> 5,952,128.400us in the Lever A run; 6,120,732.800us in the final gate). Browser startup and typing stayed flat/noisy after fresh WASM rebuild, so M30 records no browser latency win. Evidence: apps/yune-web/e2e/results/m30-engine-performance/; plan: docs/plans/completed/m30-plan-engine-representation-performance.md.

M30-PERF-REQ-01: Fresh M30 native and browser baselines were captured before implementation, including single-startup memory, startup owner spans, watched hai/jigaajiusihaa key rows, and browser attribution. Evidence: apps/yune-web/e2e/results/m30-engine-performance/native-before.md and apps/yune-web/e2e/results/m30-engine-performance/m30-baseline.md.
M30-PERF-REQ-02: M29 evidence markdown tables were reconciled against the committed startup/typing JSON before M30 optimization claims. Evidence: apps/yune-web/e2e/results/m30-engine-performance/m29-evidence-check.md.
M30-PERF-REQ-03: Expanded-table Lever A landed with before/after evidence proving reduced startup memory and no accepted behavior changes. Evidence: apps/yune-web/e2e/results/m30-engine-performance/lever-a.md.
M30-PERF-REQ-04: Internal string-sharing / compact abbreviation representation was deferred after Lever A because the accepted slice already delivered a large memory win and the watched per-key rows did not justify a broader candidate-payload rewrite in M30.
M30-PERF-REQ-05: Long-input sentence-lattice backpointers were deferred because the Lever A after-run kept jigaajiusihaa rows flat/noisy rather than identifying sentence DP as the next M30 hot owner.
M30-PERF-REQ-06: Correction-stress indexing was deferred because M26 had already reduced the correction stress path and M30's correction-on row stayed flat after Lever A.
M30-PERF-REQ-07: Full gates remained green: Rust fmt/clippy/tests, frontend benchmark, TypeScript runtime tests/build, TypeDuck-Web build, focused browser performance evidence, no tracked TypeDuck-Web source patch change, and git diff --check. Evidence: apps/yune-web/e2e/results/m30-engine-performance/task-6-gates.md.

Follow-on (no requirement IDs): M21 is complete as a post-M20 comparison protocol and hard-oracle closeout. It compared the Yune harness against the deployed typeduck.hk/web product as a behavior/feel target, but the v1.1.2 fixtures remained the hard oracle. The final gap ledger has no remaining hard-oracle action rows: M21-GAP-01 is closed by jyut6ping3-m21-sentence-composition.json, M21-GAP-02 is closed by jyut6ping3-m21-prediction-ranking.json plus real nri browser before/after evidence, and jyut6ping3-m21-closeout.json locks the remaining baseline/fuzzy/sentence/hk2s/tone-letter/paging rows including the final m and mgoi fixes.

M37 Engine Hyper-Optimization Requirements

Status: complete. M37 closed the engine hyper-optimization gates from plans/completed/m37-plan-engine-hyper-optimization.md. Evidence: docs/reports/evidence/m37-engine-hyper-optimization/, especially phase-0-baseline/, phase-1-page-bounded-sentence/, phase-3-final-native/, rsmarisa-path.md, and storage-path.md.

M38 Engine Performance Parity Requirements

Status: complete. M38 closed as the pure isolated-engine parity milestone in plans/completed/m38-plan-engine-performance-parity.md. Closeout evidence lives under reports/evidence/m38-engine-performance-parity/, with the final same-run native benchmark in phase-5-final-native/ and final gate summary in final-gates.md.

M39 Long-Input Engine Hardening Requirements

Status: complete. M39 closed as a native-engine-only long-input hardening milestone in plans/completed/m39-plan-long-input-engine-hardening.md. Closeout evidence lives under reports/evidence/m39-long-input-engine-hardening/, with the final same-run native benchmark in phase-4-final-native/ and final gate summary in final-gates.md.

M39-ENGINE-01: Final same-run native evidence includes startup, session, hao, ni, zhongguo, both required Track A long rows, and the required Track B jyut6ping3_mobile 50+ character row, with Task 1 owner attribution recorded before optimization.
M39-ENGINE-02: Final startup/runtime-ready and session medians do not regress and remain within 1.25x of same-run upstream librime: startup 0.917x, session 0.938x.
M39-ENGINE-03: Final hao, ni, and zhongguo rows remain within their short/medium gates: 3.281x, 3.863x, and 0.329x.
M39-ENGINE-04: Both required Track A long rows finish within the agreed 5x gate, and the Track B profile row is measured and no-regressed: ceshiyixiachangjushuruxingnengzenyang at 1.765x, zhegeyinqingqishiyinggaizhichichaochangjuzishurucainengyong at 1.320x, and neigojangingkeisatjinggoiziwunciucoenggeoizisyujapsinhojijung at final median 188.857us/op, p95 194.910us/op, below Phase 0. Task 1 proves Track A is upstream sentence-model scanning while Track B is a TypeDuck-profile no-marisa prefix/fallback path.
M39-ENGINE-05: Final Track A selected storage remains rsmarisa_byte_backed, table/prism bytes are mmap-backed, selected table/prism heap mirror bytes are 0, source_fallback=false, and runtime rsmarisa exact/prefix counters are positive.
M39-ENGINE-06: Final output/context paths are bounded for Track A target rows, no full-list fallback fires on those rows, and the Track B profile fallback/full-list merge is counted and explained as compatibility behavior.
M39-ENGINE-07: Final memory evidence includes owner attribution and no regression: Track A max peak moves from 163,598,336 B to 123,985,920 B, Track B peak moves from 504,557,568 B to 504,041,472 B, and selected table/prism heap mirrors stay at 0.
M39-ENGINE-08: Upstream-observable behavior, paging, TypeDuck boundary behavior, and touched compatibility paths are covered by focused tests plus cargo test --workspace.
M39-ENGINE-09: Final reports make native-engine-only claims and explicitly exclude browser, frontend, application, product-delivery, packaging, deployment, and public-demo speed claims.

M40 Compiled Sentence Lookup Index Requirements

Status: complete. M40 closed in plans/completed/m40-plan-compiled-sentence-lookup-index.md. Closeout evidence lives under reports/evidence/m40-compiled-sentence-lookup-index/, with the final same-run native benchmark in phase-4-final-native/ and final gate summary in final-gates.md.

M41 yune-web Startup Optimization Requirements

Status: complete. M41 is tracked in plans/completed/m41-plan-yune-web-startup-optimization.md, with final evidence under ../apps/yune-web/e2e/results/m41-yune-web-startup-optimization/. It optimized the tracked apps/yune-web/ browser harness after M40, using fresh real-browser evidence instead of native-engine extrapolation.

M42 Abbreviation Sentence Parity And Short-Key Guardrail Requirements

Status: complete with measured performance blocker. M42 is tracked in plans/completed/m42-plan-abbreviation-sentence-parity-short-key-guardrails.md. It is a native-engine-only follow-up to M40. Phase 0 proved upstream librime 1.17.0 exports meaningful candidates for the two incomplete-pinyin rows, so M42 followed the implementation branch. Yune now matches the captured first-page native candidate output for both rows, but the rows remain slower than same-run librime (3.469x and 5.069x), so M42 closes as behavior parity plus a measured abbreviation-latency blocker rather than as a speed win. ni/hao were profiled first and not optimized.

M43 Native Memory And Short-Key Owner Reduction Requirements

Status: complete with measured memory blocker. M43 is tracked in plans/completed/m43-plan-native-memory-short-key-owner-reduction.md. It is a native-engine-only follow-up to M42. It selected the Track A memory-owner branch, reduced poet.entries_by_code by 19,513,879 B, and records whole-process memory as a measured blocker because peak memory did not meet the M43 memory-win target.

M44 Native Performance Owner Reduction Requirements

Status: complete with measured ni and memory blockers. M44 is tracked in plans/completed/m44-plan-native-performance-owner-reduction.md. It is a native-engine follow-up to the post-M43 bottleneck analysis. It targeted all four current performance blockers together and closes as a partial result: Track A hao, Track A abbreviation rows, and Track B product-profile short rows pass their targets; Track A ni and whole-process memory remain measured blockers.

M45 Native Short-Key Latency And Memory Attribution Requirements

Status: complete with measured blockers. M45 is tracked in plans/completed/m45-plan-native-short-key-latency-memory-attribution.md. It is a native-engine-only follow-up to M44 and the post-M44 diagnostic profiling. It targets Track A luna_pinyin short-prefix latency for n, ni, and hao, and resolves the Track A memory target question by attribution before any storage rewrite.

WEB-01 Yune Web WASM Heap And Payload Requirements

Status: complete with measured no-go. WEB-01 is tracked in plans/completed/web01-plan-yune-web-wasm-heap-payload-optimization.md. It is a browser-harness-only sidecar after M45. It adds reusable browser attribution evidence, calibrates browser INITIAL_MEMORY, and records the remaining Jyutping WASM high-water as outside the WEB-01 harness-only scope.

WEB-03 Three-Schema Launch Readiness Requirements

Status: complete. WEB-03 is tracked in plans/completed/web03-plan-three-schema-launch-readiness.md. The engine fix landed separately in 3ffd4b21; regenerated launch assets landed in ef37bfe9. The final browser remeasure shows the shipping Jyutping launch path at 160.0 MiB ready/peak/steady WASM. The old 893.1 MiB value remains only for the synthetic no-launch-assets extras negative-control row. A post-closeout follow-up restores byte-backed Jyutping phrase composition (ngogokdak -> 我覺得) and visible prefix lookup rows in the regenerated compact path. A later correctness follow-up fixes a DartsDoubleArray prism construction bug that had corrupted the byte-backed toneless-to-canonical mapping for common multi-syllable words (see WEB03-10). The 2026-07-13 maintenance corrective records the post-closeout 77e353a5 public asset split, restores clean-checkout native gate reproducibility, and adds the learned-state browser latency hard stop in WEB03-11.

WEB-04 Octagram Debug Harness Requirements

Status: complete; browser behavior re-proved at M59 closeout source 5fa986d8. WEB-04 originally made the completed M54 native octagram grammar feature observable in the tracked apps/yune-web harness through a default-off luna_pinyin_octagram profile. It does not broaden the engine support contract, does not vendor full third-party .gram bytes, and does not claim browser performance improvement. Evidence: docs/reports/evidence/web04-octagram-debug-harness/; plan: docs/plans/completed/web04-plan-octagram-debug-harness-luna-pinyin.md.

WEB04-OCTAGRAM-01: The lotem zh-hant-t-essay-bgw.gram development model is fetched by pinned URL/commit/checksum into a gitignored local apps/yune-web/public/schema/dev/octagram/ path; no full .gram model bytes are committed.
WEB04-OCTAGRAM-02: The browser harness exposes a dedicated luna_pinyin_octagram schema profile with inline grammar/language, while plain luna_pinyin remains default-off/null-grammar and no shared grammar.yaml/hant node is added.
WEB04-OCTAGRAM-03: The browser worker delivers the model only for the octagram profile through the existing extraSharedAssets seam, validates byte size and SHA256, and reports delivered/fallback/checksum/schema-select high-water memory diagnostics.
WEB04-OCTAGRAM-04: Playwright evidence proves the octagram profile delivers the pinned model and changes all four named rows versus plain Luna, proves plain Luna remains unchanged as the negative control, and fails closed when the model is missing instead of passing on fallback output. The original closeout proved this row. M59 Increment 4e restores the source-built native plain/null plus Octagram gate to 8/8; Playwright at closeout source 5fa986d8 passes all three WEB-04 browser cases, covering all four Octagram ranking rows plus the plain and missing-model controls.
WEB04-OCTAGRAM-05: WEB-04 leaves crates/, packages/yune-web-runtime, default rime_get_api(), and the support contract unchanged; it is browser harness dogfooding/observability only.

WEB-05 Harness Control Surface Requirements

Status: complete. WEB-05 surfaces the existing web-harness controls and diagnostics needed by external frontend teams without changing crates/ or packages/yune-web-runtime. Evidence: docs/reports/evidence/web05-control-surface/; plan: docs/plans/completed/web05-plan-harness-control-surface.md.

WEB05-SURFACE-01: A committed controls ledger enumerates every engine control/diagnostic reachable through existing seams, fully dispositioned as surfaced, already surfaced, engine-lane deferred, runtime-lane deferred, or deliberately no-surface. The final ledger has 108 raw rows, 13 retained surface rows, the unsupported key-binder shortcut reference classified no-surface, and two named deferred rows.
WEB05-SURFACE-02: Every retained WEB-05 surface row is operable in the dev harness with localized labels and observable data-* state through existing worker/action/listener seams. Dev-power controls are gated out of the public demo via the shared IS_PUBLIC_DEMO constant; defaults remain behavior compatible with the pre-WEB-05 harness.
WEB05-SURFACE-03: Playwright evidence covers each control group plus a same-WASM default-behavior negative control captured from parent a87c6b88; public-demo build evidence proves the new debug/admin controls are absent and do not leave new raw action-result, deploy-cache, or injected-assets data pulls behind. The remaining deferred rows are debug.storage (runtime parser gap) and engine option read-back (get_option web export gap); named follow-ups cover persisted-config deploy cache freshness and the current Extended charset browser-effect N/A row.

M46 Jyutping Native And WASM Memory Attribution Requirements

Status: complete with measured no-go. M46 is tracked in plans/completed/m46-plan-jyutping-native-wasm-memory-attribution.md. It follows M45 and WEB-01 by attributing the remaining TypeDuck/Jyutping memory owners across native Track B and browser WASM before choosing any optimization branch. It closed with schema-switch correctness fixed and memory recorded as measured-no-go-owner-unclassified.

Post-M38 Engine Performance Follow-Up Requirements

Status: complete through M39. These requirements do not reopen M38. The post-M38 baseline in reports/evidence/post-m38-long-input-baseline/baseline-native/ and the 59-character stress run in reports/evidence/post-m38-long-input-baseline/stress-59-native/ showed that uninterrupted long input was not in parity. M39 supplied the required evidence and closeout gates.

POST-M38-PERF-01: The next same-run native Yune-versus-librime benchmark keeps the M38 Track A rows (hao, ni, zhongguo) and includes the required long continuous pinyin rows ceshiyixiachangjushuruxingnengzenyang and zhegeyinqingqishiyinggaizhichichaochangjuzishurucainengyong, plus the required Track B jyut6ping3_mobile 50+ character row neigojangingkeisatjinggoiziwunciucoenggeoizisyujapsinhojijung.
POST-M38-PERF-02: The long-input rows record the same evidence shape as the M38 target rows: Yune/librime medians and ratios, selected backend, mapping mode, heap mirror bytes, rsmarisa/no-marisa fallback counters, raw prism/table lookup, translator production, context export, memory, allocation, and ABI export counters. The Track B row records the same Yune owner/status/memory evidence even where a same-run librime ratio is not yet available.
POST-M38-PERF-03: Any long-input optimization claim identifies whether the owner is lookup enumeration, sentence/full-list behavior, paging/context growth, ABI export, userdb/filter/ranker work, or another measured bucket.
POST-M38-PERF-04: Long-composition translator attribution splits the current top-level translator bucket into inner owners, including sentence/full-list fallback, StaticTableTranslator::sentence_candidate, upstream sentence-model lookup, substring exact/prefix lookup loops, path cloning, sorting, context/export, prefix fallback, and any userdb/filter/ranker work that fires for the long row.
POST-M38-PERF-05: Memory follow-up uses the post-M38 working-set/peak baseline as the comparison anchor and adds heap-owner attribution before any memory reduction claim is accepted.
POST-M38-PERF-06: Long uninterrupted input is treated as a primary engine requirement, not an optional stress test. The next milestone records a length-curve benchmark around short, medium, 37-character, Track A 50+ character, Track B jyut6ping3_mobile 50+ character, and 59-character inputs, and it does not claim broader typing parity unless the 50+ character rows are brought into the agreed gates or closed by explicit measured no-go.
POST-M38-PERF-07: The next engine-performance milestone blocks cross-dimension regressions: startup/session, short-input latency, long-input latency, mmap/rsmarisa activation, bounded output, working set, peak memory, and upstream-observable behavior must all be reported and must not regress outside the milestone's explicit gates.
POST-M38-PERF-08: The next closeout report includes a single optimization-strategy gate table that shows every required method is still active or explicitly closed by measured no-go: same-run native benchmark, mmap/file-backed selected bytes, real rsmarisa runtime lookup, lazy/page-bounded candidate production, page-sized context export, startup/session lifecycle fast paths, owner counters, heap-owner attribution, memory baselines, and behavior tests.
POST-M38-PERF-09: M39 cannot begin a sentence/composition rewrite until Task 0 records the jyut6ping3_mobile neigojangingkeisatjinggoiziwunciucoenggeoizisyujapsinhojijung baseline and Task 1 records whether that row shares the Track A long-input owner or is dominated by a profile-specific path such as prefix fallback, dynamic correction, or another measured bucket.

M50 Track A Launch Readiness Completion

M50-ENGINE-01: Broad workspace clippy is restored after the Task 0 blocker and recorded as a required closeout gate.
M50-ENGINE-02: Fresh same-run Track A baseline and final benchmark evidence are captured under docs/reports/evidence/m50-track-a-launch-readiness/.
M50-ENGINE-03: The n short-key row is inside the <=3.0x same-run librime gate in final evidence.
M50-ENGINE-04: The ni short-key row and 37-character Luna row are closed as measured blockers when the final run misses the <=3.0x gate.
M50-ENGINE-05: Full Luna Track A memory is attributed as a measured blocker without conflating it with the M47 TypeDuck keyboard-profile memory result.
M50-ENGINE-06: M50 remains native Track A scoped and makes no web, browser, product, package, deployment, or iOS-device claim.

M51 Engine Support Contract And ABI Freeze

M51-CONTRACT-01: The engine support contract exists at docs/contracts/engine-support-contract.md and is linked from conventions.
M51-ABI-01: Default upstream rime_get_api() and upstream-shaped RimeCandidate layout remain locked by focused ABI tests.
M51-ABI-02: TypeDuck fork-only ABI slots remain profile-scoped behind rime_get_typeduck_profile_api() and are covered by profile-table tests. Post-M51 cleanup documents and guards rime_get_yune_windows_profile_api() as a parallel accessor for the same current profile table.
M51-ABI-03: The yune_web_* exported-symbol ABI remains synchronized with scripts/yune-web-exports.txt, Rust #[no_mangle] exports, the Emscripten linker anchor, and TypeScript runtime bindings.
M51-EVIDENCE-01: Native, browser, product, and platform claims must cite their own evidence lanes; Windows working-set/private proxies are not Apple phys_footprint.

M52 Track A Guardrails And Blocker Disposition

M52-ENGINE-01: A committed Track A latency regression guardrail covers n, ni, hao, the 37-character row, and the existing 59-character Luna row, with a fail-on-regression gate.
M52-ENGINE-02: A committed Track A memory-peak attribution/ceiling gate prevents silent regression or reframing of the Luna peak.
M52-ENGINE-03: The ni latency row is improved under <=3.0x or closed with a bounded-microsecond ceiling rationale.
M52-ENGINE-04: The 37-character Luna latency row is improved under <=3.0x or closed with a bounded-microsecond ceiling rationale.
M52-ENGINE-05: The full Luna Track A memory peak is reduced with named owner movement or closed with a precise product-profile-relevance statement.
M52-ENGINE-06: M52 stays native Track A scoped and makes no web, browser, product, package, deployment, iOS-device, or ABI claim.

M53 Engine Release-Readiness Audit

M53-AUDIT-01: Support-contract consistency is verified across the contract, conventions, roadmap, requirements, and milestone ledger with no contradiction.
M53-AUDIT-02: ABI wording matches the code - default upstream rime_get_api()/RimeCandidate, profile-only TypeDuck/Yune Windows slots, and exactly 14 yune_web_* exports.
M53-AUDIT-03: M52 guardrail evidence is fresh and numerically consistent across the docs, with the manual regression-gate command canonical.
M53-AUDIT-04: Public claims were contract-accurate for the 2026-06-30 M53 closeout; README.md (and one linked archived report) claim drift across performance wording (broad "faster than librime" scoped to zhongguo + the two abbreviation rows), compatibility scope, then-current oracle precedence for the TypeDuck profile lane, frontend-validation scope (TypeDuck-Windows limited to backend/profile/IPC smoke), ABI/drop-in wording, and Rust safety/lint-scope wording was corrected. The 2026-07-05 D-31 amendment supersedes that older jyut6ping3 oracle framing for future canonical candidate behavior.
M53-AUDIT-05: All engine-doc evidence links and anchors resolve and the 2026-06-30 dashboard visuals are adopted.

M54 Native Octagram Grammar Support

M54-OCTAGRAM-01: The lotem canonical oracle lane and RIME-LMDG validation lane have pinned source/data versions, model checksums, data-license status, attribution notes, and fixture manifests defining the supported octagram scope.
M54-OCTAGRAM-02: Yune implements octagram-compatible grammar loading and scoring through a native Rust Grammar provider, not a librime C++ plugin ABI.
M54-OCTAGRAM-03: The poet sentence/lattice path uses upstream-compatible grammar context and preserves null-grammar behavior when no model is configured.
M54-OCTAGRAM-04: Oracle fixture evidence proves accepted candidate behavior for the named octagram target, and negative controls prove existing luna_pinyin and jyut6ping3 behavior is unchanged.
M54-OCTAGRAM-05: Documentation and support-contract wording distinguish named native octagram support from broader plugin ABI compatibility, which remains deferred.
M54-OCTAGRAM-06: Evidence records octagram model memory/timing impact without making unsupported frontend, browser, platform, product, or broad performance claims.
M54-OCTAGRAM-07: Checked-in fixture data respects model-data licensing: full lotem/RIME-LMDG .gram files are not vendored; the repository stores oracle outputs, checksums/URLs, license notes, and small synthetic parser/scoring fixtures.

M55 Native Track A Match-Or-Beat Program

Status: complete with corrected claims (partial against the original Tier M bars). M55 produced the full-suite native Track A ratchet, attributed the old memory floor, built YUNE-POET/2 byte-backed poet storage, expanded the oracle sentence fixtures, and landed real graph/DP reductions. The 2026-07-04 corrective review then found three of the final closeout's headline mechanisms were measurement artifacts (a benchmark-shape key deferral, benchmark-input short-key aliases, and an uninvalidated process-global config cache); they were removed, the benchmark now reads context after every keypress, byte-backed poet returned to explicit opt-in, and the standing gate was re-derived from honest per-key runs. Evidence: docs/reports/evidence/m55-native-match-or-beat/corrective-2026-07-04/.

M55-PERF-01: A full-suite same-run native ratchet artifact covers startup, session lifecycle, Track A key rows including the two long Luna rows, currently-winning rows, Track A memory, and Track B product absolute guards, with historical no-go rows, the pre-corrective rows, and the corrective re-baseline all preserved as evidence.
M55-PERF-02: Phase 1 attributes the old 105.6 MB unclassified lower bound before optimization and records named owner movement.
M55-PERF-03: Phase 2/2R serves poet.vocabulary, poet.entries_by_code, and abbreviation vocabulary through byte-backed poet storage while preserving candidate-output parity; after the corrective re-baseline the YUNE-POET/2 path is explicit opt-in (YUNE_POET_BYTE_BACKED=1, ~113 MB peak) because it fails the honest per-key long-row ceilings until the incremental sentence scratch is ported to byte-backed storage.
M55-PERF-04: The standing native Track A gate is the corrective per-key m55-thresholds.csv (2026-07-04). The pre-corrective M55 artifact and the M52 artifact are batch-shaped history: the benchmark metric changed (context read per keypress), so their ceilings are not comparable.
M55-PERF-05: Phase 3R expands oracle sentence fixtures, records graph/access-volume diagnostics for owned and byte-backed builders, and reduces owned-path long-row graph work with byte-identical candidate output. Honest per-key state: 37-character Luna ~1.97x, 59-character Luna ~1.53x (the closeout's 0.237x/0.086x were artifacts of the reverted key deferral under a read-once benchmark shape).
M55-PERF-06: Reports, roadmap, requirements, milestone history, and plan state reflect the corrected record without public C ABI widening, retained heap indexes, browser/product/platform performance claims, or M56/WEB-05 scope creep; candidate-page divergence vs librime on the benchmark rows (n, zhongguo, both sentence tops - pre-existing) is disclosed, not hidden behind self-referential parity fixtures.
M55-PERF-07: Phase 2R redesigns poet storage as YUNE-POET/2 with a compiled index, fixed-width headers, zero decode before candidate acceptance, and loud rejection or rebuild of YUNE-POET/1 on the runtime path; measured Phase 2R and corrective evidence record it as no-go for default-on until the scratch-port owner lands.
M55-PERF-08: The default-on flip rule stands, but the 2026-07-04 flip is reversed: its two "green" flag-on ratchets were contaminated by the key deferral and short-key aliases. Any future flip requires the full corrective per-key ratchet green twice with byte-backing enabled and Track A memory <=125 MB.

M56 Engine Productization Hardening

Status: complete. M56 hardens the engine as a product dependency for external frontends without ABI widening or defined happy-path behavior changes. The corrected closeout preserves the WEB-03 launch product schema payload: optional poet storage is not shipped as default *.poet.bin assets. Evidence: docs/reports/evidence/m56-productization-hardening/.

M56-HARDEN-01: Every compiled/persistent artifact kind from the Phase 0 ledger has version/validity checking with loud rejection or rebuild, stale-injection coverage, or an explicit artifact-specific disposition.
M56-HARDEN-02: Standing cold/warm conformance tests deploy from isolated temp shared/user dirs, then run a second deploy over the same temp output to prove table/prism/reverse reuse for luna_pinyin and TypeDuck jyut6ping3, with measured runtime recorded. The warm test does not depend on newly committed product binaries or *.poet.bin payloads.
M56-HARDEN-03: The user-data lifecycle ledger is fully dispositioned: learning, persistence, recovery, format freeze, and sync surface rows are tested or contracted, with zero silent gaps.
M56-HARDEN-04: Every discovered extern "C" export is unwind-guarded by test-enforced inventory; the ABI abuse suite passes with zero panic escapes, conservative failure returns, and post-poison happy-path recovery.
M56-HARDEN-05: Yune-defined staleness, recovery, crash/poison, threading, and release panic policies are documented in the engine support contract with enforcing tests cited in evidence.
M56-HARDEN-06: Closeout passes the full quality gate, parity suites, and the standing M55 corrective native ratchet. The ratchet is a guarded regression pass with tight headroom on short-key and 37-char dimensions, not a new faster baseline.

M57 macOS Track A Sentence-Model Parity And Verification Repair

Status: complete. M57 repairs the macOS Track A verification bundle by making upstream Luna compact compiled-table sentence-model construction platform-stable for the known target payloads. Evidence: docs/reports/evidence/m57-macos-track-a-sentence-model-parity/.

M57-PARITY-01: The macOS failure is classified as a Yune-side compiled-table construction defect, not a macOS librime oracle contradiction. The before evidence records the bad owner shape (poet.entries_by_code 191,984, poet.lookup_index 31,262, poet.abbreviation_vocabulary 421,966) and wrong abbreviation candidates.
M57-PARITY-02: Yune accepts the macOS upstream luna_pinyin MARISA checksum pair (0xb3d4e98e / 0x29d56c89) only behind the existing target gates: dictionary luna_pinyin, MARISA string-table size 1,574,520, and the known source/table checksum tuple.
M57-PARITY-03: The repair preserves ABI and profile boundaries: no default RimeApi widening, no TypeDuck profile ABI widening, and no WEB-05 or control-surface behavior change.
M57-PARITY-04: Real compiled-table regression coverage exists. The focused tests cover synthetic MARISA enumeration diagnostics and a committed real compiled Luna table fixture; the schema-install unit test covers the macOS upstream Luna MARISA checksum pair.
M57-PARITY-05: Post-fix macOS evidence restores the expected compact sentence-model shape: stored_entries=498,564, compact_all_codes_count=332,604, compact_expanded_table_entries=513,353, poet.entries_by_code=513,353, poet.lookup_index=332,604, and poet.abbreviation_vocabulary=11.
M57-PARITY-06: Closeout includes two full macOS native verification passes with recomputed summary-comparison.csv, candidate snapshots matching local librime for cszysmsrsd and zybfshmsru, full quality checks for the touched engine path, and an explicit WEB-03 guard disposition as not-run due missing local public-demo/dist/schema fixtures.

M58 Canonical Jyutping Oracle And TypeDuck Profile Disposition

Status: complete for candidate reachability, with a recorded M55 ratchet residual. M58 rebases canonical Cantonese/Jyutping candidate behavior on upstream rime/librime 1.17.0 with pinned rime/rime-cantonese, keeps TypeDuck multilingual behavior as a separate profile/data lane, fixes the current yune-web TypeDuck/profile beingo / 畀 and zi / 諮 reachability reports by preserving short-input TypeDuck/profile-ranked paging, adds a post-closeout corrective for zijiguk / standalone 諮 long-composition selection/recomposition, and records the schema-id blast-radius audit without implementing a rename. The standing M55/Track B performance ratchet was run twice after the long-composition follow-up and failed the recorded ni, hao, zhongguo, and Track B long-Jyutping latency rows; this is a named performance residual, not a candidate-behavior blocker.

M58-JYUTPING-01: Canonical jyut6ping3 candidate behavior is captured from upstream rime/librime 1.17.0 plus pinned rime/rime-cantonese schema/data before any candidate reachability or admission code changes, using a named upstream capture harness, mirrored page size/options, and captured_all_pages: true.
M58-JYUTPING-02: Schema identity split direction is not implemented until the executor inventories the jyut6ping3 / jyut6ping3_mobile blast radius and records explicit user sign-off. The preferred proposal remains canonical jyut6ping3 plus TypeDuck jyut6ping3_typeduck, but it is a gated choice rather than an assumed edit.
M58-JYUTPING-03: Every M58 oracle fixture and compiled artifact records schema source repository, source commit, upstream engine/oracle version, and Yune-facing schema id, plus page size and option set.
M58-JYUTPING-04: Candidate reachability/admission fixes are derived from canonical rime/rime-cantonese upstream-librime captures, not from TypeDuck-HK/librime v1.1.2 candidate ordering, unless the fix is explicitly scoped as TypeDuck-profile-only.
M58-JYUTPING-05: TypeDuck-only multilingual comments, dictionary lookup payloads, profile controls, display/comment behavior, and grandfathered M14-M28 profile candidate guards remain regression guarded without widening canonical candidate behavior.
M58-JYUTPING-06: The shipped-product beingo / 畀 and zi / 諮 reachability reports, plus the post-closeout zijiguk / standalone 諮 long-composition gap, receive explicit dispositions in both the canonical and TypeDuck/profile lanes; M58 cannot close merely because a shipped-lane bug is TypeDuck-profile-only.
M58-JYUTPING-07: Schema-install profile predicates and product identity blast radius are audited before any schema-id split, especially is_typeduck_jyut6ping3_profile, is_yune_web_launch_byte_backed_profile, Track B/M55 threshold names, WEB-03/public-demo manifests, and userdb dictionary-name persistence.
M58-JYUTPING-08: If canonical upstream captures cannot be produced or if they contradict the planned reachability/admission fix, M58 stops for an explicit decision rather than substituting TypeDuck v1.1.2 candidate output.

M59 Schema-General Single-Character Reachability + Canonical Parity

Status: complete under the full D-47/D-48 Path A contract. Increment 4c closes strict Lane A 13/13 with no exception consumed; Increment 4d closes Cangjie CJ-1 at strict 12/12 and 3 passed / 0 ignored; Increment 4e closes the seven-input Lane B exact-order lane at 5879405c, while 443cc636 supplies final-source Lane A/Lane B and performance acceptance; commit 5fa986d8 closes shipped-schema coverage. M59 delivers the owner requirement that composing an arbitrary non-lexicon phrase one character at a time works on every schema. GPT's first execution was gamed (per-input match arms replaying oracle candidates baked into engine source + circular tests) and was reverted; the luna lane was reimplemented as a genuine general mechanism and landed (c89a8ea9). Owner amendment (2026-07-07) made the behavior a default-ON, schema-general guarantee delivered in M59, not M60. Increment 3b (2cb7e411) completes that default-on transformed-algebra guarantee and M59-REACH-02. Increment 4a (ca52ec42) implements the sentence/phrase mechanism. Its owner-provided Opus blocking review found an explicit-false reachability bypass; fix 2257fbbe now passes the exact owning deployment matrix, full workspace clippy, focused parity, and a fresh 32/32 signed ratchet guard. On 2026-07-11 the owner renewed the narrowly scoped D-48 class-3 exception for the complete captured equal-weight residual (6,086 inversions, zero cross-weight inversions, no beyond-oracle-depth use) with the recorded revisit triggers. Increment 4b is implemented through d508e05b; its accepted production capture and five-round performance packet bind to that clean source, and its designated review approved 4c to start. Increment 4c at clean source e11557e2 implements ordered one-to-many OpenCC conversion, stable deduplication, and default-only partial recomposition. The final 13-input all-page comparator is strict 13/13 across 5,705 candidate text/order/position rows, preedit, and commit preview, with zero exception or beyond-depth use. The renewed 4a class-3 disposition remains recorded but is unused by final Lane A. Canonical comments retain 854 non-gating differences outside the D-48 text/order contract. Five fresh source-bound rounds pass all 32 aggregate median rows under unchanged ceilings while preserving two individual red observations. Increment 4d at clean source 38e759f6 then closes Cangjie CJ-1: marked strict 12/12, 3 passed / 0 ignored, and unmarked exact 12/12, with a fresh 32/32 five-round guard. Lane A and Cangjie are complete. Increment 4e at clean source 5879405c closes all seven captured Lane B inputs page-for-page and position-for-position, restores the exact deployed 37/59 page shape, and records native WEB-04 8/8. Its five fresh complete 17+1 rounds pass all 32/32 aggregate rows and all 160/160 individual observations under unchanged ceilings, completing M59-PARITY-02 and M59-REACH-04. Commit 5fa986d8 completes M59-REACH-03 with exact 60-asset manifest/tree coverage, 10 schema-asset dispositions, three configuration carriers, and nine executable validation rows. The final packet closes evidence, WEB-04 Playwright at source 5fa986d8, and release/package gates through a recorded nonduplicative native recovery, fail-closed Emscripten build, typecheck, tracked/public builds, and complete functional browser coverage. Independent acceptance follow-up 07845e02 makes REACH-03 manifest/tree reconciliation bidirectional across every regular asset. That follow-up's clean Lane A capture exposed a post-4c transformed equal-weight ordering regression; 443cc636 fixes the structural collector policy and its clean release capture is strict 13/13 across all 5,705 positions with no exception. The rejected 12/13 comparator and accepted source-current capture are both preserved. Five fresh complete 17+1 rounds at 443cc636 pass all 32/32 aggregate rows and all 160/160 individual observations under unchanged signed ceilings; this supersedes 5879405c as final M59-REACH-04 evidence. Browser, WASM, ABI, and schema-payload evidence is not claimed rerun after 5fa986d8. Separately, the macOS long-page follow-up is reviewed and measured only at source commit 89875ee2; its exact 37/59 pages and compiled NaturalLog/stored-f32 inclusive-5% fixture change no signed ceiling, exception, milestone, or Windows 4a disposition. It did not cause or supersede the renewed class-3 disposition or 4b permission, and no combined/reconciled commit is claimed measured.

M59-REACH-01: The reachability mechanism is general — keyed on syllable/dictionary structure, never per-input match/allowlists or baked oracle data. Verified: luna moboyi→莫伯洢 (owner case); anti-gaming controls zhongguo→中 + bare-syllable set, and an independent novel input reach their leading-single families on the real byte-backed product path via source-truthful, non-circular tests.
M59-REACH-02 (owner amendment, binding): Composing an arbitrary non-lexicon phrase one character at a time is default-ON for EVERY schema — luna_pinyin, jyut6ping3/rime-cantonese, cangjie/shape schemas, and any future schema (e.g. rime-teochew) — automatically on install, with ZERO per-schema adaptation work. Engine/translator-level default; per-schema opt-out only with a recorded reason. No schema silently onboards without it. Completed by Increment 3b (2cb7e411): the translator-level default and deployed-algebra surface mapping require no schema-id gate or per-schema true flag; the real deploy matrix is default-on and explicit-false for product Jyutping, canonical Cantonese, Cangjie, Luna, Luna Octagram, Double Pinyin, and Bopomofo, with Stroke as an identity/null-map control. The fixed-DLL five-round acceptance passes all 32 aggregate rows.
M59-REACH-03: The canonical shipped-schema manifest at apps/yune-web/public/schema-asset-manifest.json is reconciled one-to-one with a checked-in acceptance-coverage table: every schema-bearing asset is named, every installable/selectable schema has a real-path arbitrary non-lexicon composition test, and dependency-only validation assets receive an explicit non-top-level disposition rather than disappearing from coverage. The pinned canonical rime-cantonese validation lane is recorded separately and is not mislabeled as shipped. A newly manifested schema automatically adds an open acceptance row. Oracle-backed output is used where upstream exhibits the behavior and recorded owner-spec output where it does not. The prefix_fallback vs leading_syllable_reachability relationship is documented. Separately from manifest-derived product coverage, the transformed-algebra 3b fixture matrix runs real deploy-path default-on and explicit-false rows for product Jyutping, canonical Cantonese, Cangjie, Luna, Luna Octagram, Double Pinyin, and Bopomofo. Double Pinyin and Bopomofo remain mandatory in this fixture matrix even though they are not currently shipped product schemas. Completed at 5fa986d8: both manifests are identical and cover the exact 60-asset tree; the checked-in registry dispositions all 10 schema assets and three configuration carriers; and nine executable validation rows link the fixed eight-row deployment matrix plus the direct selectable tracked jyut6ping3 real-deploy row. The updater discovers a new schema asset and creates a blocking status: open row rather than silently accepting it.
M59-REACH-04 (performance): The checked-in multi-run aggregator evaluates the full 17-input Track A set, including the 37-character, 59-character, and nine owner-signed 2026-07-09 rows, together with the existing Track B product row and every standing startup/session/memory guard. It writes gate-verdict.csv using the rule "aggregate median observation <= signed ceiling" and exits nonzero when any row fails. Every observation and failed run is preserved; there is no adaptive cherry-picking, quiet re-baseline, threshold relaxation, or run-until-green. Final acceptance is five fresh complete rounds from the final behavior commit with every aggregate row green. Increment 4b's accepted production-source guard at d508e05b supplies five fresh rounds over the complete 17+1 input set: all 32 aggregate rows and all 160 individual observations pass, including n, ni, hao, and the 37/59-character rows. At that historical 4b boundary it was increment evidence rather than final M59-REACH-04 acceptance; the source-current 443cc636 paragraph below is authoritative for final behavior acceptance. Increment 4c adds another five source-bound rounds at e11557e2: all 32 aggregate median rows pass under unchanged ceilings, with two individual red observations preserved. Increment 4d adds five source-bound one-build/four- reuse rounds at 38e759f6: all 32 aggregate rows and all 160 individual observations pass under unchanged ceilings. Final acceptance is the five fresh complete rounds at final behavior source 443cc636: all 32/32 aggregate rows and 160/160 individual observations pass unchanged ceilings, including n, ni, hao, and both 37/59-character rows. The predeclared short-key owner stop was not triggered.
M59-PARITY-01 (Lane A): Yune + pinned rime/rime-cantonese matches upstream rime/librime 1.17.0 + rime/rime-cantonese page/prefix-exact for candidate text and order across the committed 13-input canonical capture: be, bei, bein, being, beingo, beix, beixngoxx, ngohaig, ngohaigo, n, nri, mgoi, and zijiguk. Every divergence is named; the retained phase-1/phase-2 groundwork is re-validated, not re-baked. Increment 4c closes the strict raw comparator at 13/13 across all pages and 5,705 candidates, including exact preedit and commit preview. No exception or beyond-depth row is consumed; the historical 4a class-3 disposition is unused by the final capture. Candidate comments are outside this text/order requirement and retain 854 explicitly non-gating differences.
M59-PARITY-02 (Lane B exact order): Yune luna_pinyin matches pinned upstream librime for complete captured candidate text, order, and position ranges for moboyi, boyi, yi, zhonggao, zhongguo, gao, and guo. Comparison is page/prefix-exact through the captured range under mirrored options, per D-48; no ordered-subsequence allowance or unsigned exception is accepted. The supplemental macOS follow-up repairs the expanded 37- and 59-character page-zero ScriptTranslation oracle shape at measured source 89875ee2. Those benchmark rows do not amend this seven-input acceptance list, and that source-scoped diagnostic makes no claim about the seven-row state at a later Windows or reconciled commit. Completed independently at clean production source 5879405c and revalidated after the final collector repair at 443cc636: all captured pages for the seven inputs match text, page number/size, page-local and global position, and final-page state over tracked byte-backed Luna assets. No new exception, promotion, input allowlist, or baked oracle data is used.
M59-PARITY-03 (Cangjie exact order): The marked cangjie5 oracle-validation lane has a pinned upstream capture and matches candidate text and order page/prefix-exact through the librime-comparable range, including the CJ-1 owner/control fixture. The three D-48 composition rows are standing tests; any row beyond librime composition depth uses recorded owner-provenance first-candidate pins rather than invented oracle output. Final acceptance is 3 passed / 0 ignored, with product and unmarked Cangjie behavior unchanged. Completed at clean source 38e759f6: the explicit validation marker produces a strict all-page 12/12 comparator, including tak exact 30/30; the owning composition suite is 3 passed / 0 ignored; and the separately captured unmarked control remains exact 12/12 against fd6bd2a7. No exception, replacement, tail policy, schema-id gate, input allowlist, or baked oracle data is used.

For M59-PARITY-01..03, the only permitted divergence classes are the already owner-signed equal-weight ties and beyond-oracle-depth rows. No new exception is created. Promotion tables, input-specific branches or allowlists, baked/replayed oracle candidates, and circular oracle-derived fixtures are prohibited.

M59-NAV-01 (unified forward navigation): A single Engine policy, derived from SchemaBehaviorProfile rather than schema id, governs Engine paging, next-candidate navigation, physical PageDown, RimeChangePage, and browser/API paging. Standard schemas complete before forward navigation; TypeDuck inputs longer than two characters complete, while TypeDuck inputs of at most two characters retain bounded output. Physical/API paging remain equivalent. Acceptance includes cantonese_parity 41/41 without golden edits, typeduck_windows_boundary 4/4, source-bound e37ee011 WASM reaching zi -> 諮 within four PageDown operations, and stable beingo, zijiguk, Luna, physical-page, and API-page behavior. Completed at e37ee011 without golden edits. Evidence: reports/evidence/m59-canonical-jyutping-reachability-parity/increment-2-profile-paging/.
M59-EVIDENCE-01 (reproducibility and provenance): Deterministic, checked-in capture/classification/comparison tooling covers Lane A, Lane B, and expanded Cangjie. Preserved raw oracle and Yune outputs record inputs, page settings/options, source repositories and commits, oracle and Yune binary hashes, Yune commit, exact commands, and classifier version. Re-running the tools over the frozen raw inputs reproduces the comparator and gate artifacts; expected oracle output is never derived from Yune. The supplemental macOS follow-up at source 89875ee2 contributes a non-circular table compiled by pinned librime that proves natural-log .table.bin weight interpretation and the inclusive 5% ScriptEncoder boundary; its decoded fixture SHA-256 is 34784ffd5af9bdc79926a00057cbf8c201a64473a2334acd748685e2d1fd6405. Increment 4d adds clean, hash-bound marked/unmarked Cangjie all-page captures, strict comparators, create-new staging provenance, a preserved public-API owned/byte-backed 504/504 audit, and a source-bound five-round packet. Increment 4e adds the complete seven-input Lane B raw/comparator packet, exact deployed 37/59 proof, native WEB-04 8/8, and five source-bound performance rounds. final-closeout/ reconciles every accepted lane with its native source and the 5fa986d8 WASM, app/package, manifest/model-hash, and browser receipts without storing generated binaries. It preserves every failed serial attempt and targeted recovery rather than rewriting them as one clean run.
M59-DEPLOY-01 (workspace fidelity): Workspace deployment matches the pinned librime WorkspaceUpdate behavior: a missing top-level schema allows valid siblings to deploy but produces aggregate failure; a malformed present schema fails; an absent dependency is diagnosed and skipped; and a malformed present dependency fails. Missing dependencies are not recorded as successfully built, and broad missing-top-level tolerance is not introduced. Landed with real-path regression coverage in 2ee0805f.
M59-GATES-01 (final release gates): Closeout source 5fa986d8 passes cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, the full workspace-test surface through the retained successful prefix plus targeted recovery, and cargo build --release -p yune-rime-api; it builds fail-closed Emscripten WASM with YUNE_WEB_WASM_REQUIRE_EMSCRIPTEN=1 and passes app typecheck/build, schema-manifest validation, focused M58 paging Playwright, the functional local browser suite, and public packaging build. The unchanged runtime package is rebuilt by public packaging rather than receiving a duplicate standalone reassurance run. The first broad workspace- test invocation stopped on a host-memory allocation abort during cantonese_parity after its completed targets passed; the interrupted and never-reached targets were resumed nonduplicatively and are green, with declared ignores preserved. Later native collector repair 443cc636 passes its focused transformed/identity controls, source-current Lane A/Lane B gates, cargo fmt --check, and the final five-round ratchet; no later broad workspace, browser, WASM, ABI, or package rerun is claimed. The fail-closed Emscripten build, typecheck, tracked app, public package, WEB-04 3/3, M58 1/1, and all unique functional Playwright rows pass. The unrelated 150-sample startup benchmark is explicitly not an M59 correctness gate. WEB-05's historical same-WASM row is excluded rather than rebaselined across a different binary.

M60 Schema-General Reachability Capability Formalism

Status: complete. M60 formalizes the default-on capability M59 already shipped. It adds fail-closed opt-out and onboarding governance without changing reachability, ranking, schema installation, ABI, browser behavior, or any signed performance threshold. The finalized plan is plans/completed/m60-plan-schema-general-single-character-reachability.md.

M60-CONTRACT-01: One canonical contract records the default-on invariant, explicit-false semantics, selection/recomposition scope, anti-gaming prohibitions, exact M59/WEB03 evidence boundaries, covered translator arms, and the actual per-input prefix_fallback_owned precedence rule.
M60-OPTOUT-01: The live M59-seeded acceptance registry retains its m59-reach03-v1 coverage-format version, adds a separate M60 reachability- formalism version, and contains an exactly empty current reachabilityOptOuts array plus a complete, owner-approved future row schema keyed by exact schema asset, setting asset, and deployed translator namespace; no placeholder/current opt-out is added.
M60-AUDIT-01: A tooling-only Rust extractor reuses production configuration/deployment semantics and source tracing; the mandatory checker and synthetic tests use its output to enforce a classified-root disposition for every Git-tracked schema YAML plus a bijection between every affected shipped namespaced explicit-false tuple and valid opt-out rows, rejecting duplicate, incomplete, expired, unsafe, unknown, unregistered, overlapping, open, orphaned, stale, or unresolved records.
M60-ONBOARD-01: The updater and onboarding contract keep every new schema in the registered repository-owned product roots blocking-open until classification, correct oracle/owner provenance, and a narrow real-path acceptance test are supplied; unsupported/N/A and an auto-created opt-out cannot close it, a future product root must register with the checker, and the production updater must exercise the same tested reconciliation helper.
M60-BOUNDARY-01: M59 and WEB03-11 evidence stays source-bound and immutable; M60 permits only a read-only Rust audit tool and focused tests and changes no runtime behavior, C ABI/API table/export, schema/profile id, browser or Windows product surface, performance threshold, oracle fixture, or M61 scope.
M60-EVIDENCE-01: Exact-source text-only evidence records the checker, negative tests, four narrow Rust tests, onboarding test, link audit, evidence-growth guard, separate pre-review/final tree hashes, an exact review-receipt delta, diff check, and two independent reviews; the plan moves to completed only in the final closeout commit.

M61 Native Track A Memory-Owner Reduction

Status: complete — disposition D measured partial/no-go. M61 is bound to formal M60 closeout 0eff06a088992f417602a71300c447cdfa525255, post-correction kickoff base bc0df36a6eee3ad63319d8c29336542082559c94, correction-source measurement commit 91f5969688a3d2dba96a67d1cfe813c7ba4ee861, and explicit revert 01a62f2a6cd2b3d668545a110de8c7c3fc2fbb10. The corrected diagnostic completed five owned and five byte-backed rounds, but owner reconciliation failed the frozen coverage and residual bounds. No production-default reduction was accepted, the supplemental ratchet remains unclaimed, and the runtime tree was restored exactly to the pushed quality-repair tree. The completed plan is plans/completed/m61-plan-native-track-a-memory-owner-reduction.md.

M61-BASELINE-01: Complete with measured no-go. Source 91f59696 completed five green fixed-binary owned rounds, one green exploratory byte-backed round, and five green byte-backed rounds before the plan-prescribed reconciliation red.
M61-ATTR-01: Complete with measured no-go. The 25,096,192 B whole-process private delta had 18,724,242 B of explained heap-owner delta, but coverage was 0.746098930, below 0.80, and the 6,371,950 B residual exceeded the 5,019,238 B bound; no safe owner branch cleared reconciliation.
M61-BRANCH-01: Complete. Disposition D was selected after the first correction-source measured red, and correction 91f59696 was explicitly reverted by 01a62f2a without rewriting history.
M61-REDUCE-01: Closed by measured no-go. No production-default native memory reduction, environment-dependent substitute, behavior omission, reduced candidate page, hidden cache, or browser payload change is claimed.
M61-COMPAT-01: Complete. The owned and byte-backed diagnostics retained 17/17 candidate parity, green Track B and signed guards, and the explicit revert restored runtime tree f1c36a0079d85628f5cbef140bd94288930cc2e8, preserving ABI, lifecycle, artifact, cache, and no-POET-browser-payload boundaries. Two later cfg(test)- only closeout corrections align complete-list/paging assertions and the M56 lifecycle-documentation lock with their current contracts without changing production behavior.
M61-RATCHET-01: Closed by measured no-go. The byte-backed diagnostic projected below the frozen 125,000,000 B cap, but no production-default final set was accepted; the supplemental row remains unclaimed and the historical M55/M59 registry is unchanged.
M61-EVIDENCE-01: Complete. The compact source-bound packet preserves the measured red, exact correction/revert lineage, privacy/link/growth/ manifest/diff checks, external raw-root binding, the literal workspace red, no-verdict interruption, disjoint owning-target/never-reached recovery, and independent requirement/evidence and change-isolation reviews.

Out of Scope

Explicitly excluded from the current milestone.

Feature	Reason
Full librime C++ plugin ABI compatibility	Expensive and not yet required by a concrete frontend or distribution migration path
Cloud inference as a required dependency	Classic input behavior must remain local-first and predictable
New repo-local GUI product	Windows product/frontend work has transferred to `CanCLID/yune-windows`; `yune-web` remains this repository's harness/public demo, and any other product surface requires its own approved track
Behavior changes during mechanical refactors	Compatibility work needs measurable, reviewable behavior slices
100% feature parity with librime internals	The oracle is a behavioral floor, not a feature target; a librime feature is implemented only when a named target schema/frontend needs it (see roadmap "Scope Ledger" and `decisions.md` D-25)

Traceability

Which phases cover which requirements. Updated during roadmap creation.

Requirement	Phase	Status
CLI-01	Phase 1	Complete
CLI-02	Phase 1	Complete
CLI-03	Phase 1	Complete
CLI-04	Phase 1	Complete
CLI-05	Phase 1	Complete
ABI-01	Phase 2	Complete
ABI-02	Phase 2	Complete
ABI-03	Phase 2	Complete
ABI-04	Phase 2	Complete
SCHEMA-01	Phase 3	Complete
SCHEMA-02	Phase 3	Complete
SCHEMA-03	Phase 3	Complete
SCHEMA-04	Phase 3	Complete
SCHEMA-05	Phase 3	Complete
DATA-01	Phase 4	Complete
DATA-02	Phase 4	Complete
DATA-03	Phase 4	Complete
DATA-04	Phase 4	Complete
USERDB-01	Phase 5	Complete
USERDB-02	Phase 5	Complete
USERDB-03	Phase 5	Complete
QUAL-01	Phase 1	Complete
QUAL-02	Phase 1	Complete
QUAL-03	Phase 5	Complete
QUAL-04	Phase 5	Complete
FRONTEND-VALIDATION-01	Phase 6	Complete
FRONTEND-VALIDATION-02	Phase 6	Complete
FRONTEND-VALIDATION-03	Phase 6	Complete
FRONTEND-VALIDATION-04	Phase 6	Complete
FRONTEND-VALIDATION-05	Phase 6	Complete
BENCH-01	Phase 6	Complete
BENCH-02	Phase 6	Complete
TYPEDUCK-WASM-01	Phase 7	Complete
TYPEDUCK-WASM-02	Phase 7	Complete
TYPEDUCK-WASM-03	Phase 7	Complete
TYPEDUCK-JS-01	Phase 8	Complete
TYPEDUCK-JS-02	Phase 8	Complete
TYPEDUCK-JS-03	Phase 8	Complete
TYPEDUCK-JS-04	Phase 8	Complete
TYPEDUCK-FS-01	Phase 9	Complete
TYPEDUCK-FS-02	Phase 9	Complete
TYPEDUCK-FS-03	Phase 9	Complete
TYPEDUCK-FS-04	Phase 9	Complete
TYPEDUCK-E2E-01	Phase 10	Complete
TYPEDUCK-E2E-02	Phase 10	Complete
TYPEDUCK-E2E-03	Phase 10 / 17	Complete - HR-5 real-assets browser matrix passes; rich comment byte parity is committed in `cantonese_parity`
TYPEDUCK-E2E-04	Phase 10 / 17	Complete - HR-7 records GO WITH CONDITIONS
WIN-TEST-01	Phase 11	Complete
WIN-ABI-01	Phase 12 / M19	Complete - helper coverage retained and exposed through named `rime_get_typeduck_profile_api()`; not exposed by default upstream `rime_get_api()`
WIN-ORACLE-01	Phase 13	Complete
WIN-COMMENT-01	Phase 14 / 17	Complete - dictionary payload, schema prompt, and joiner oracle covered
WIN-BUILD-01	Phase 15 / M10	Complete - current TypeDuck-profile package/header smoke and packaged DLL profile lifecycle pass
WIN-PARITY-01	Phase 16 / M10	Complete - captured v1.1.2 engine behavior is active; frontend-only schema-menu/userdb observations remain T3 evidence scope
WIN-FRONTEND-01	M10	Complete - T1 build/link and stock T3 TypeDuckServer/TestTypeDuckIPC real-server IPC smoke pass against the Yune package; the dedicated `CanCLID/yune-windows` repository owns interactive TSF typing and visible candidate-panel rendering
P2-WIN02-BOUNDARY-01	P2-WIN-02	Complete - Phase 0C `ngohaig` fixture and provenance are checked in
P2-WIN02-BOUNDARY-02	P2-WIN-02	Complete - core and ABI tests assert TypeDuck `\f\r1,` rich comments
P2-WIN02-BOUNDARY-03	P2-WIN-02	Complete - compiled lookup records and deployment side-dictionary rebuild are covered
P2-WIN02-BOUNDARY-04	P2-WIN-02	Complete - uninitialized config boundary and repeated lifecycle tests pass
P2-WIN02-BOUNDARY-05	P2-WIN-02	Complete - package, direct DLL probe, TypeDuck-Web gate, and stock IPC smoke pass
P2-WIN02-BOUNDARY-06	P2-WIN-02	Complete - approved Notepad TSF reruns classify the remaining raw-ASCII behavior as non-Yune TSF input-delivery/frontend-shell work
UPSTREAM-ORACLE-01	M12	Complete - upstream `1.17.0` provenance pinned as default core oracle
UPSTREAM-ORACLE-02	M12	Complete - fixture naming separates `upstream-1.17.0` and `typeduck-v1.1.2` goldens
UPSTREAM-AUDIT-01	M12	Complete - coverage audit captured in `docs/plans/completed/m12-audit-coverage.md`
TYPEDUCK-PROFILE-01	M12/M10	Complete - TypeDuck-specific coverage remains profile-only; M10 verifies the native Windows frontend path without widening the default ABI
UPSTREAM-BEHAVIOR-01	M12	Complete - six official-binary `luna_pinyin` fixture files are checked in under `upstream-1.17.0`
UPSTREAM-BEHAVIOR-02	M12	Complete - full `ni` selection fixture includes all exact dictionary rows and candidate essay rows
UPSTREAM-BEHAVIOR-03	M12	Complete - active parity tests drive real parser/dictionary/translator/filter/Engine paths
UPSTREAM-BEHAVIOR-04	M12/M17/M18/M54	Complete - former sentence/lattice and processor blockers are fixture-backed; M54 adds named native octagram-compatible grammar support; broader grammar/plugin/contextual paths remain deferred
UPSTREAM-BEHAVIOR-05	M12	Complete - provenance test scans all upstream `luna_pinyin` fixtures and source policies
UPSTREAM-BEHAVIOR-06	M17	Complete - upstream `luna_pinyin` sentence/lattice fixtures and null-grammar poet path are active
AI-01	M11 S1	Complete - staged provider interface in `yune-core`
AI-02	M11 S2/S5	Complete - worker/fallback/confidence merge plus local rule-backed provider
AI-03	M11 S1/S5	Complete - source-labeled contextual/local completions with no default AI auto-commit
AI-04	M11 S3	Complete - context snapshot provider covers app, field, preceding text, cursor, schema, and candidate count
AI-05	M11 S4	Complete - AI memory store records explicit AI selections, is inspectable/clearable/disable-able, and uses `.ai-memory` namespace helpers
AI-06	M11 S3/S4	Complete - default-sensitive privacy blocks remote calls and suppresses AI memory writes while classic input remains available
AI-07	M11 S1/S5	Complete - direct CLI demonstrates `--ai-provider mock` and `--ai-provider local`
M13-AI-01	M13	Complete - `process_key` stays provider-free; `stage_ai` owns the local provider pass
M13-AI-02	M13	Complete - default-off browser toggle and disable-clears-staged-row behavior covered
M13-AI-03	M13	Complete - source labels flow from engine snapshot data without ABI/table changes
M13-AI-04	M13	Complete - browser/default commit remains classic; AI selection is explicit
M13-AI-05	M13	Complete - AI commits skip userdb and sensitive default suppresses AI memory learning
M13-AI-06	M13	Complete - real TypeDuck-Web M13 Playwright evidence covers the safety scenarios
TYPEDUCK-PARITY-01	M14	Complete - v1.1.2 wrapper + Cantonese option/completion/correction goldens captured
TYPEDUCK-PARITY-02	M14	Complete - emitted schema-list surface captured; UI hiding assertion deferred to M16
TYPEDUCK-PARITY-03	M14	Complete - levers export spike captured a learned `nei5` userdb row
TYPEDUCK-PARITY-04	M15	Complete - combine_candidates + show_full_code pass M14-backed real-engine assertions
TYPEDUCK-PARITY-05	M15	Complete - enable_sentence/completion/correction parity assertions are active
TYPEDUCK-PARITY-06	M15	Complete - checked-in OpenCC source dictionaries drive `hk2s` simplification
TYPEDUCK-PARITY-07	M16	Complete with conditions - real TypeDuck-Web Playwright matrix covers app-exposed Cantonese paths plus M13 AI; deploy-only/UI/userdb gaps are explicit
FORK-PARITY-01	backlog	Complete - 容錯 ruleset runs on the real ~127k jyut6ping3 dictionary with golden coverage
FORK-PARITY-02	backlog	Complete - weighted PreferUserPhrase gate implemented
FORK-PARITY-03	backlog	Complete - per-entry userdb pronunciation recovery, including multi-syllable sentence codes
FORK-PARITY-04	backlog	Complete - `hide_lone_schema` implemented
FORK-PARITY-05	backlog	Complete - correction edit-distance/min-distance/enable_correction gate/normal-only behavior implemented
FORK-PARITY-06	backlog	Complete - TypeDuck letter-tone preedit path implemented
FORK-PARITY-07	backlog	Complete - TypeDuck-profile `全形`/`半形` labels locked
FORK-PARITY-08	backlog	Complete - upstream ranking accepted except the oracle-backed TypeDuck `jyut6ping3` prediction-count limit; long-entry prediction preserved with threshold and never-first controls implemented
FORK-PARITY-09	backlog	Complete - UI-side `display_languages` decision recorded
M20-DEMO-01	M20	Complete - controls use existing customize/deploy and setOption paths while preserving ABI/export boundaries
M20-DEMO-02	M20	Complete - prediction never-first defaults on; real-assets-calibrated threshold control filters `santai` predictions with documented range bounds
M20-DEMO-03	M20	Complete - static/default-on features use guided scenarios, not fake toggles
M20-DEMO-04	M20	Complete - local AGENTS guidance added for internal TypeDuck-Web harness, runtime package, and product-surface distinction
M20-DEMO-05	M20	Complete - browser honesty gate separates visible before/after controls from explicit browser-surface N/A for Input Memory off-state and current-schema Cangjie/show_full_code limits; Auto-correction `nri` now has real browser before/after evidence; `ascii_punct` still needs browser-visible evidence before becoming a working web toggle
M20-DEMO-06	M20	Complete - internal TypeDuck-Web harness is documented as the canonical browser playground for supported engine features
M20-DEMO-07	M20	Complete - documented demo-default `combine_candidates` active control plus current-schema `show_full_code`/Cangjie N/A evidence
M19-BREADTH-01	M19	Complete - generalized upstream schema capture recipe and provenance guard added
M19-BREADTH-02	M19	Complete - `double_pinyin` upstream 1.17.0 fixture and owning parity test added
M19-BREADTH-03	M19	Complete - `cangjie5` upstream 1.17.0 fixture and owning parity test added
M19-BREADTH-04	M19	Complete - `bopomofo` upstream 1.17.0 fixture and owning parity test added
M19-ABI-01	M19	Complete - named TypeDuck-profile ABI accessor exposes list-append slots while default `rime_get_api()` remains upstream-shaped
M50-ENGINE-01	M50	Complete - broad workspace clippy restored and retained as a closeout gate
M50-ENGINE-02	M50	Complete - fresh baseline and final same-run Track A benchmark evidence captured
M50-ENGINE-03	M50	Complete - final `n` row is inside the `<=3.0x` same-run librime gate
M50-ENGINE-04	M50	Complete with measured blockers - final `ni` and 37-character rows miss the `<=3.0x` gate and remain measured blockers
M50-ENGINE-05	M50	Complete with measured blocker - full Luna Track A memory is attributed separately from M47 TypeDuck keyboard-profile memory
M50-ENGINE-06	M50	Complete - scope stayed native Track A only with no web, product, package, deployment, or iOS-device claim
M51-CONTRACT-01	M51	Complete - contract document exists and conventions link to it
M51-ABI-01	M51	Complete - default upstream ABI layout and `RimeCandidate` are locked by focused ABI tests
M51-ABI-02	M51	Complete - TypeDuck fork-only slots remain profile-scoped and round-trip through profile-table tests; post-M51 cleanup adds Yune Windows accessor coverage for the same current profile table
M51-ABI-03	M51	Complete - `yune_web_*` export allowlist is synchronized across Rust exports, linker anchor, and TypeScript runtime
M51-EVIDENCE-01	M51	Complete - engine support contract requires separate native/browser/product/platform evidence lanes
M52-ENGINE-01	M52	Complete - committed Track A thresholds cover `n`, `ni`, `hao`, 37-character, and 59-character rows, and the final fail-on-regression gate passes
M52-ENGINE-02	M52	Complete - committed memory ceiling covers Track A peak `188,383,232 B` under the `198,000,000 B` threshold
M52-ENGINE-03	M52	Complete - `ni` closes as a bounded-microsecond ceiling at `44.950us` / `3.143x` with a `30.650us` absolute gap and threshold pass
M52-ENGINE-04	M52	Complete - 37-character Luna closes as a bounded-microsecond ceiling at `895.178us` / `3.053x` with a `601.967us` absolute gap and threshold pass
M52-ENGINE-05	M52	Complete - full Luna Track A memory closes as a guardrailed comparison-lane watch with `poet.vocabulary` and product-profile relevance named
M52-ENGINE-06	M52	Complete - scope stayed native Track A only with no web, browser, product, package, deployment, iOS-device, or ABI claim
M53-AUDIT-01	M53	Complete - support-contract consistency verified across contract, conventions, roadmap, requirements, and ledger
M53-AUDIT-02	M53	Complete - ABI wording matches code: default upstream `rime_get_api()`/`RimeCandidate`, profile-only fork slots, exactly 14 `yune_web_*` exports
M53-AUDIT-03	M53	Complete - M52 guardrail evidence fresh and numerically consistent; regression-gate command canonical
M53-AUDIT-04	M53	Complete - `README.md`/archived public claim drift corrected for the 2026-06-30 release-readiness state across performance ("faster than librime" scoped to `zhongguo` + abbreviation rows), compatibility scope, then-current TypeDuck profile oracle precedence, TypeDuck-Windows frontend-validation scope, ABI/drop-in wording, and Rust safety/lint-scope wording; future canonical `jyut6ping3` candidate claims follow the 2026-07-05 D-31 `rime-cantonese` amendment
M53-AUDIT-05	M53	Complete - all engine-doc evidence links/anchors resolve and the 2026-06-30 dashboard visuals are adopted
M54-OCTAGRAM-01	M54	Complete - lotem canonical and RIME-LMDG validation lanes are pinned with commits, checksums, license notes, and manifests
M54-OCTAGRAM-02	M54	Complete - native Rust `OctagramGrammar` loads and scores `.gram` data behind the existing `Grammar` provider path
M54-OCTAGRAM-03	M54	Complete - grammar scoring uses two-word context and preserves null-grammar behavior for schemas without `.gram`
M54-OCTAGRAM-04	M54	Complete - accepted octagram candidate behavior is evidenced; upstream luna null-grammar and TypeDuck `jyut6ping3` regression gates pass
M54-OCTAGRAM-05	M54	Complete - support contract and roadmap distinguish native octagram support from deferred librime C++ plugin ABI support
M54-OCTAGRAM-06	M54	Complete - octagram owner rows and final evidence record memory/timing scope without public performance claims
M54-OCTAGRAM-07	M54	Complete - full third-party `.gram` models stay external; checked-in data is oracle output/provenance plus Yune-owned synthetic tests
M55-PERF-01	M55	Complete - full-suite same-run ratchet artifact exists; historical no-go rows, pre-corrective rows, and the 2026-07-04 corrective per-key re-baseline all preserved
M55-PERF-02	M55	Complete - Phase 1 attributes the old unclassified memory floor and records named owner movement
M55-PERF-03	M55	Complete (corrected) - `YUNE-POET/2` poet payloads are byte-backed and parity-preserving; explicit opt-in, not default-on, until the incremental scratch is ported to byte-backed storage
M55-PERF-04	M55	Complete (corrected) - the corrective per-key `m55-thresholds.csv` is the standing native Track A gate; the pre-corrective M55 artifact and M52 artifact are batch-shaped history
M55-PERF-05	M55	Complete (corrected) - fixture expansion and graph-volume reduction are real; honest per-key long rows are `~1.97x`/`~1.53x`, not the reverted deferral's `0.237x`/`0.086x`
M55-PERF-06	M55	Complete (corrected) - docs reflect the corrected record; pre-existing candidate-page divergence vs librime is disclosed
M55-PERF-07	M55	Complete (corrected) - `YUNE-POET/2` redesign landed; default-on re-land is a named future owner (scratch port), not achieved
M55-PERF-08	M55	Reversed - the default-on flip's supporting ratchets were contaminated (key deferral + short-key aliases); flip reversed in the corrective series; the rule itself stands for any future flip
M56-HARDEN-01	M56	Complete - artifact inventory rows have loud stale/corrupt handling or explicit artifact-specific dispositions
M56-HARDEN-02	M56	Complete - cold/warm conformance tests cover `luna_pinyin` and TypeDuck `jyut6ping3` product paths using isolated temp deploy output, not new committed product binaries
M56-HARDEN-03	M56	Complete - user-data learning, persistence, recovery, format-freeze, and sync rows are tested or contracted
M56-HARDEN-04	M56	Complete - all discovered C ABI exports are guard-inventory tested and ABI abuse tests pass
M56-HARDEN-05	M56	Complete - support contract documents staleness, user-data, crash/poison, threading, and release panic policies
M56-HARDEN-06	M56	Complete - full quality gate, parity suites, and standing M55 ratchet closeout evidence are recorded under the M56 evidence root; ratchet pass is guarded with tight headroom rather than a performance-win claim
M57-PARITY-01	M57	Complete - macOS failure classified as Yune-side compiled-table sentence-model construction defect with before counters and wrong candidates preserved
M57-PARITY-02	M57	Complete - macOS upstream Luna MARISA checksum pair accepted only under the existing target-scoped `luna_pinyin` gate
M57-PARITY-03	M57	Complete - no default ABI, TypeDuck profile ABI, WEB-05, or control-surface widening
M57-PARITY-04	M57	Complete - synthetic MARISA, real compiled Luna fixture, and checksum-pair regression coverage added
M57-PARITY-05	M57	Complete - post-fix macOS compact model shape restored with `332,604` codes, `513,353` expanded entries, and 11-entry abbreviation vocabulary
M57-PARITY-06	M57	Complete - two full macOS native passes, recomputed summaries, candidate snapshots, quality checks, and WEB-03 fixture disposition recorded
M58-JYUTPING-01	M58	Complete - all-pages canonical upstream `rime-cantonese` captures produced with upstream `rime/librime 1.17.0`, pinned schema commit, page size 5, mirrored options, and `captured_all_pages: true`
M58-JYUTPING-02	M58	Complete - schema id split was not implemented; preferred `jyut6ping3` plus `jyut6ping3_typeduck` direction remains sign-off gated after blast-radius audit
M58-JYUTPING-03	M58	Complete - Phase 0/1/2b evidence records schema repos/commits, oracle versions, Yune-facing ids, page sizes, option state, and regenerated public schema manifest hashes
M58-JYUTPING-04	M58	Complete - canonical `zijiguk` and `beingo` captures did not require a canonical fix; the landed `beingo` / 畀 and `zi` / 諮 reachability fix is explicitly scoped to the current TypeDuck/profile yune-web product lane
M58-JYUTPING-05	M58	Complete - TypeDuck multilingual/comment/profile behavior and grandfathered M14-M28 candidate guards remain profile-lane fixtures and are not promoted to canonical `rime-cantonese` expected output
M58-JYUTPING-06	M58	Complete - `beingo` / 畀, `zi` / 諮, and the post-closeout `zijiguk` / standalone `諮` composition gap are dispositioned in canonical and TypeDuck/profile lanes; yune-web reaches each target through page navigation without first-page promotion, and `zijiguk` selection commits `諮` while recomposing `jiguk`; the repeated M55 ratchet miss is tracked separately as a performance residual
M58-JYUTPING-07	M58	Complete - schema predicates, `jyut6ping3_mobile`, Track B/M55 names, WEB-03/public-demo manifests, and userdb key blast radius audited before any id split
M58-JYUTPING-08	M58	Complete - canonical captures succeeded and were not substituted with TypeDuck v1.1.2 candidate output
M59-REACH-01	M59	Complete - the retained leading-single mechanism is structure-driven and covered by source-truthful anti-gaming controls
M59-REACH-02	M59	Complete - Increment 3b (`2cb7e411`) makes deployed-algebra reachability default-on and schema-general without schema-id/per-input gates; seven required default-on/explicit-false deploy rows plus Stroke control and the 32-row five-run aggregate gate are green
M59-REACH-03	M59	Complete - `5fa986d8` reconciles the 60 accepted assets across both manifests, dispositions all 10 schema assets and three configuration carriers, links nine executable validation rows, and makes newly discovered schemas fail closed with an open acceptance row; independent-review follow-up `07845e02` enforces exact bidirectional equality for every regular tree asset and rejects unsupported or symbolic-link entries
M59-REACH-04	M59	Complete - five fresh complete 17+1 rounds at final behavior source `443cc636` pass all 32 aggregate rows and all 160 individual observations under unchanged signed ceilings, including `n`, `ni`, `hao`, and both 37/59-character rows
M59-PARITY-01	M59	Complete - Increment 4c first closes the complete 13-input all-page Lane A capture; independent-review follow-up `443cc636` repairs a shipping-source transformed-tie regression and revalidates a clean release at strict `13/13` across all 5,705 candidate positions, with zero exception or beyond-depth use; the historical 4a class-3 disposition remains unused
M59-PARITY-02	M59	Complete - clean production source `5879405c` closes every captured page and position for all seven Lane B inputs over tracked byte-backed Luna assets and `443cc636` revalidates that exact gate after the final collector repair; deployed 37/59 page shape and native WEB-04 8/8 remain closed without new exceptions or promotion/input/oracle hacks
M59-PARITY-03	M59	Complete - clean source `38e759f6` closes CJ-1: marked upstream-Cangjie is strict all-page 12/12, the owning suite is 3 passed / 0 ignored, and unmarked control remains exact 12/12, with no new exception or promotion/input/oracle hack
M59-NAV-01	M59	Complete - `e37ee011` centralizes profile-driven forward navigation in Engine, explicitly activates the TypeDuck product marker in both direct harnesses, passes Cantonese 41/41 and TypeDuck-Windows 4/4, keeps physical/API and Luna controls stable, and proves its source-bound browser WASM reaches `zi -> 諮` in four PageDown operations
M59-EVIDENCE-01	M59	Complete - `final-closeout/` reconciles the accepted Lane A, Lane B, Cangjie, 37/59, REACH-03, performance, native recovery, fail-closed WASM, package, and browser receipts with hashes and no generated binaries
M59-DEPLOY-01	M59	Complete - `2ee0805f` matches pinned librime missing/malformed top-level schema and dependency semantics with real-path regression coverage
M59-GATES-01	M59	Complete - retained native prefix plus nonduplicative serial recovery, release build, fail-closed Emscripten, typecheck, tracked/public builds, WEB-04 3/3, M58 1/1, and all unique functional Playwright rows pass; startup benchmark and cross-binary WEB-05 baseline are explicitly excluded
M60-CONTRACT-01	M60	Complete - canonical default-on/explicit-false, source-bound authority, covered-arm, and per-input dual-mechanism capability contract
M60-OPTOUT-01	M60	Complete - retained M59 coverage version plus separate M60 formalism version, exact empty current opt-out collection, and namespaced future row schema
M60-AUDIT-01	M60	Complete - Rust production-semantic audit output, fail-closed Git-tracked schema-root inventory, affected-schema/namespaced-explicit-false opt-out bijection, and production-validator negatives
M60-ONBOARD-01	M60	Complete - schemas in registered product roots remain blocking-open until classified and real-path accepted; new product roots must register and the production updater uses the tested helper
M60-BOUNDARY-01	M60	Complete - tooling-only Rust audit/test changes with no runtime behavior, C ABI/API-table/export, profile/schema-id, browser, performance, Windows product, or M61 expansion
M60-EVIDENCE-01	M60	Complete - compact exact-source evidence, four narrow Rust gates, links, growth guard, preserved pre-review/final trees, exact three-path receipt delta, commit-tree equality, and two reviews
M61-BASELINE-01	M61	Complete with measured no-go - green five-round owned set, green exploratory byte-backed round, and green five-round byte-backed set before the preserved reconciliation red
M61-ATTR-01	M61	Complete with measured no-go - 0.746098930 coverage and 6,371,950 B residual fail the frozen reconciliation bounds
M61-BRANCH-01	M61	Complete - disposition D selected and correction 91f59696 explicitly reverted by 01a62f2a
M61-REDUCE-01	M61	Complete by no-go - no production-default reduction, behavior omission, environment substitute, or browser payload change claimed
M61-COMPAT-01	M61	Complete - 17/17 diagnostics, explicit restoration of runtime tree f1c36a0079d85628f5cbef140bd94288930cc2e8, and two cfg(test)-only closeout contract corrections preserve the compatibility boundary without production behavior change
M61-RATCHET-01	M61	Complete by no-go - supplemental row unclaimed and historical M55/M59 registry unchanged
M61-EVIDENCE-01	M61	Complete - compact source-bound packet, privacy/link/growth/manifest gates, external raw retention, exact correction/revert lineage, preserved workspace/recovery chronology, and two reviews
WEB02-ATTR-01	WEB-02	Complete - existing inspector JSON exposes selected storage, mapping, byte-source length, fallback deferrals, and owner rows without a new export
WEB02-ATTR-02	WEB-02	Complete - public-demo Jyutping assets are reconciled to the live web ABI path and the owned-heap fallback owner is measured
WEB02-ATTR-03	WEB-02	Complete - WEB-02 records attribution only and retains the measured memory blocker without a reduction claim
WEB03-01	WEB-03	Complete - clean launch regeneration emits current compiled assets with Prism/4 and no reused-prebuilt rows
WEB03-02	WEB-03	Complete - source, manifests, public build/cache, and worker lists include the regenerated launch assets
WEB03-03	WEB-03	Complete - workspace rebuild separates vocabulary text from imported dictionaries and preserves Luna essay weights
WEB03-04	WEB-03	Complete - all three public schemas prove byte-backed storage with no source fallback
WEB03-05	WEB-03	Complete - deterministic Cangjie shape-code smoke returns 日 first for input `a`
WEB03-06	WEB-03	Complete - fresh WASM/public build and three-schema browser remeasurement are recorded
WEB03-07	WEB-03	Complete - final browser reports, evidence, public claims, visuals, and closeout were refreshed from measured data
WEB03-08	WEB-03	Complete - byte-backed launch guards retain multi-syllable Jyutping composition and visible lookup rows
WEB03-09	WEB-03	Complete - long-input byte-backed expansion and browser latency are bounded with focused evidence
WEB03-10	WEB-03	Complete - corrected Prism construction restores canonical common multi-syllable Jyutping words with native guards
WEB03-11	WEB-03	Complete - hardened closeout passed at `ef485b10`; source-bound deployment maintenance activated at `d5f2ca7b` with unchanged local gate, immutable preview canary, identical-byte promotion, and 11/11 production byte verification
WEB04-OCTAGRAM-01	WEB-04	Complete - pinned lotem development `.gram` is fetched locally into a gitignored path by URL/commit/checksum; model bytes are not committed
WEB04-OCTAGRAM-02	WEB-04	Complete - dedicated `luna_pinyin_octagram` profile enables inline grammar while plain `luna_pinyin` stays default-off/null-grammar
WEB04-OCTAGRAM-03	WEB-04	Complete - worker uses `extraSharedAssets`, validates bytes/checksum, and exposes delivered/fallback/checksum/schema-select high-water memory diagnostics
WEB04-OCTAGRAM-04	WEB-04 / M59 4e	Complete - native plain/null plus Octagram is 8/8, and Playwright at closeout source `5fa986d8` passes the three WEB-04 browser cases covering all four ranking rows plus plain and missing-model controls; no later browser rerun is claimed
WEB04-OCTAGRAM-05	WEB-04	Complete - no `crates/`, `packages/yune-web-runtime`, default ABI, or support-contract widening is part of the browser harness slice
WEB05-SURFACE-01	WEB-05	Complete - 108-row controls ledger fully dispositions existing web-harness controls/diagnostics with public-demo posture for all 13 retained surface rows and `no-surface` disposition for the unsupported key-binder shortcut reference
WEB05-SURFACE-02	WEB-05	Complete - every retained surface row is operable in the dev harness through existing seams with localized labels, observable state, and shared `IS_PUBLIC_DEMO` gating for dev-power controls
WEB05-SURFACE-03	WEB-05	Complete - parent-baseline same-WASM default behavior and public-demo hidden-control/data-surface Playwright evidence are recorded; `debug.storage` and `get_option` remain named deferred rows, with deploy-cache persisted-config and Extended charset browser-effect follow-ups named
M22-PLAY-01	M22 Bucket 2	Complete - opt-in read-only inspector exposes engine debug data in the TypeDuck-Web playground
M22-PLAY-02	M22 Bucket 2	Complete - inspector is default-off, response-identity tested, browser-evidenced, and ABI-layout neutral
M22-PLAY-03	M22 Bucket 1	Complete with corrective note - disabled and dictionary_exclude have current browser-visible evidence; extended_charset is visible but current cangjie5 browser-effect N/A without charset_filter/cjk_minifier; ascii_punct remains absent from M22-era browser-effect claims
M22-PLAY-04	M22 Bucket 3	Complete - jyut6ping3_mobile, cangjie5, and luna_pinyin load through a real schema switcher; cangjie5 and luna_pinyin reverse lookup are active with measured browser asset sizes
M24-DOGFOOD-REQ-01	M24	Complete - issue-scoped M24 browser evidence and startup asset markers are recorded
M24-DOGFOOD-REQ-02	M24	Complete - comment controls are hidden and compound candidate details live in the dictionary panel
M24-DOGFOOD-REQ-03	M24	Complete - ordering, page-size, and Jyutping reverse lookup are fixture/native/browser guarded
M24-DOGFOOD-REQ-04	M24	Complete - Cantonese-first grouped settings, schema names, status labels, and typeface picker are browser-evidenced
M24-DOGFOOD-REQ-05	M24	Complete - DaisyUI removed; local Tailwind components build and pass browser evidence
M25-DOGFOOD-REQ-01	M25	Complete - issue-scoped M25 browser evidence, owning tests, and regenerated patch checks are recorded
M25-DOGFOOD-REQ-02	M25	Complete - release browser WASM, deploy reuse, phase timing, and typing/loading separation are browser-evidenced
M25-DOGFOOD-REQ-03	M25	Complete - 3-10 page-size customization and candidate caps are native/browser tested
M25-DOGFOOD-REQ-04	M25	Complete - bare-grave Luna reverse lookup and explicit `vl`/`vc` side lookup triggers are native/browser tested
M25-DOGFOOD-REQ-05	M25	Complete - top-control layout, settings order, and alignment are browser-evidenced
M25-DOGFOOD-REQ-06	M25	Complete - checkbox and radio affordances preserve the local Tailwind component stack
M26-PERF-REQ-01	M26	Complete - native large-real-asset benchmark coverage with cold/warm, full-ABI/engine-only, correction-path, and memory/allocation reporting
M26-PERF-REQ-02	M26	Complete - browser keydown-to-paint instrumentation for normal typing, long phrases, paging, and reverse lookup
M26-PERF-REQ-03	M26	Complete - startup attribution below `runtime:initialized`
M26-PERF-REQ-04	M26	Complete - startup owner deferred to M27; measured TypeDuck dynamic-correction optimization landed with before/after evidence
M26-PERF-REQ-05	M26	Complete - compatibility, integration, and TypeDuck-Web patch discipline gates remain green
M27-STARTUP-REQ-01	M27	Complete - browser-paid startup-path reconciliation and native sub-attribution by owner
M27-STARTUP-REQ-02	M27	Complete - hard Windows process-memory evidence recorded
M27-STARTUP-REQ-03	M27	Complete - browser fresh/reload startup evidence mapped to native owners
M27-STARTUP-REQ-04	M27	Complete - measured top-owner startup bottleneck materially reduced with timing, memory, and browser before-after evidence
M27-STARTUP-REQ-05	M27	Complete - compatibility, integration, benchmark, browser, and patch discipline gates remain green
M27-STARTUP-REQ-06	M27	Complete - engine controls classified as live, browser-only, deploy-time, or local-runtime-only with marker evidence
M28-PARTIAL-REQ-01	M28	Complete - history evidence classifies partial selection as previously missing support
M28-PARTIAL-REQ-02	M28	Complete - capture-not-confirm TypeDuck v1.1.2 oracle fixture for partial selection
M28-PARTIAL-REQ-03	M28	Complete - native engine/API tests cover segment-aware partial commit and FORK-PARITY-03 learning preservation
M28-PARTIAL-REQ-04	M28	Complete - TypeDuck-Web browser evidence covers continued selection and raw-tail guard
M28-PARTIAL-REQ-05	M28	Complete - compatibility and integration gates remain green
M28F-UPSTREAM-REQ-01	M28 follow-up	Complete - Space/default-confirm uses scoped consumed-span recomposition
M28F-UPSTREAM-REQ-02	M28 follow-up	Complete - hybrid upstream-engine Jyutping fixture with pinned source-YAML provenance and no local paths
M28F-UPSTREAM-REQ-03	M28 follow-up	Complete - historical narrow decision for accepted hybrid fixture, live-site exclusion, and comment-scope exclusion; future canonical `jyut6ping3` candidate claims follow the 2026-07-05 D-31 `rime-cantonese` amendment
M28F-UPSTREAM-REQ-04	M28 follow-up	Complete - native ordering tests follow the accepted upstream-Jyutping fixture and preserve TypeDuck profile guards
M28F-UPSTREAM-REQ-05	M28 follow-up	Complete - TypeDuck-Web browser evidence for Space/default-confirm and ranking
M28F-UPSTREAM-REQ-06	M28 follow-up	Complete - full compatibility and integration gates
M29-PERF-REQ-01	M29	Complete - fresh native startup, browser startup, and typing baselines
M29-PERF-REQ-02	M29	Complete - `1.79GB` peak classified as repeated-benchmark high-water, with real single-startup ready pressure around `1.10GB`
M29-PERF-REQ-03	M29	Complete - `spelling_algebra_expand` remained the top startup owner before optimization
M29-PERF-REQ-04	M29	Complete - browser keydown-to-paint attribution recorded worker/native, response mapping, React update, and paint-proxy owners
M29-PERF-REQ-05	M29	Complete - no-op spelling-algebra replacement allocation avoidance reduced the native startup owner with before/after evidence
M29-PERF-REQ-06	M29	Complete - full compatibility and integration gates
M30-PERF-REQ-01	M30	Complete - fresh native/browser baselines captured before implementation
M30-PERF-REQ-02	M30	Complete - M29 markdown tables reconciled to committed JSON
M30-PERF-REQ-03	M30	Complete - expanded-table Lever A landed with memory/startup evidence
M30-PERF-REQ-04	M30	Complete - shared-payload rewrite deferred after Lever A evidence
M30-PERF-REQ-05	M30	Complete - sentence-DP backpointers deferred because long-input rows did not justify the rewrite
M30-PERF-REQ-06	M30	Complete - correction-stress indexing deferred because correction rows stayed flat
M30-PERF-REQ-07	M30	Complete - full compatibility and integration gates
M33-PERF-REQ-01	M33	Complete - fresh native and cross-engine baselines captured before M33 claims; evidence under `docs/reports/evidence/m33-2026-06-23/`
M33-PERF-REQ-02	M33	Complete - comparison fairness enforced by lazy reverse lookup, so no headline compares luna-plus-stroke Yune startup against luna-only librime
M33-PERF-REQ-03	M33	Complete - lazy reverse-lookup loading preserves first-use reverse lookup behavior and removes eager `stroke` startup/session/resident asymmetry
M33-PERF-REQ-04	M33	Complete - build-once dictionary translator sharing reduces repeated schema/session cost with byte-identical candidates and source invalidation coverage
M33-PERF-REQ-05	M33	Complete - lazy spelling-algebra lookup was spike-gated and deferred because prism-only lookup is insufficient; byte-identical lookup needs a queryable table+prism path
M33-PERF-REQ-06	M33	Complete - mmap compiled artifacts deferred by stop gate; low-risk slice fixed warm re-select/session while remaining gaps are cold startup, footprint, and per-key candidate-pipeline/storage representation
M33-PERF-REQ-07	M33	Complete - public performance report, root-cause report, README, roadmap, requirements, and archived plan now use the fair M33 rerun with cold/warm and peak-memory caveats; no chart SVG generated
M33-PERF-REQ-08	M33	Complete - full Rust compatibility, ABI, benchmark, and diff gates run for M33; no frontend/browser claim made because no frontend/WASM path changed
M31-PUBLIC-REQ-00	M31	Complete - public identity and provenance are recorded in `public-demo/PROVENANCE.md`, the app is named `yune-web`, and the page identifies itself as a Yune engine demo through a TypeDuck-Web-derived harness
M31-PUBLIC-REQ-01	M31	Complete - P2-WIN-02 is complete, P2-WIN-01 priority is unaffected, and M31 stayed scoped to browser delivery/UI/devops without widening Windows or default ABI surfaces
M31-PUBLIC-REQ-02	M31	Complete - the public demo exposes only Hong Kong Traditional plus `hk2s` Simplified, both backed by native/runtime/browser evidence; unsupported OpenCC standards are absent
M31-PUBLIC-REQ-03	M31	Complete - the output-standard control changes candidate output through Yune's `simplification` option, not browser-only postprocessing
M31-PUBLIC-REQ-04	M31	Complete - `public-demo/build.ps1`, the checked-in patch, bridge, WASM, schema asset manifest, and evidence reproduce the deployable `yune-web` package from checked-in Yune state
M31-PUBLIC-REQ-05	M31	Complete - Cloudflare local preview and deployed smoke passed for app boot, WASM load, schema asset load, `jyut6ping3_mobile` typing, output-standard toggle, and root routing at `https://yune-web.pages.dev`
M31-PUBLIC-REQ-06	M31	Complete - AI remains default-off/local-only with no remote calls, telemetry, secrets, or third-party model keys in the public smoke; AI-off classic output is preserved
M31-PUBLIC-REQ-07	M31	Complete - public payload is measured, pruned, and documented: one public schema surface, 41 deployed files, 32,147,434 bytes, and non-public Cangjie/Loengfan/side-layout assets excluded
M31-PUBLIC-REQ-08	M31	Complete with measured caveat - public boot is selected-schema-only for `jyut6ping3_mobile` and excludes non-public schema families, but the current TypeDuck product schema still boots Luna and scholar lookup assets required by exposed behavior instead of fully deferring every reverse-lookup dependency
M31-PUBLIC-REQ-09	M31	Complete with measured caveat - schema/runtime assets have SHA-256 metadata and Cache Storage warm-cache evidence (`31` hits, `0` misses on warm reload); reverse-lookup-specific cold-first-use deferral remains future work for the current schema dependency set
M31-PUBLIC-REQ-10	M31	Complete - Pages Direct Upload, browser Cache Storage, cold/warm startup markers, and deployed smoke evidence are recorded; no browser-startup or typing speed win is claimed
M31-PUBLIC-REQ-11	M31	Complete - WASM/download-size work is reported only as delivery packaging/pruning; Rust engine latency claims remain in M34/M36/M37 performance tracks
M31-PUBLIC-REQ-12	M31	Complete - Rust, runtime, TypeDuck-Web build, local/deployed Playwright, patch reverse/forward, Wrangler dry-run, and `git diff --check` gates passed for M31
M31-PUBLIC-REQ-13	M31	Complete - public-facing strings, package name, deployment config, docs, evidence labels, route copy, and repo-owned app path use `yune-web`; the upstream-derived source checkout lives under `apps/yune-web/source/`
M34-PERF-REQ-01	M34	Complete - fresh native and fair cross-engine M33-surface baselines captured under `docs/reports/evidence/m34-queryable-table-prism/`
M34-PERF-REQ-02	M34	Complete - attribution identified full-result materialization/context work as the accepted Lever A owner; a temporary `ni`/`hao` diagnostic artifact records lookup, prefix scan, eligibility probe, eager materialization, sort, and bounded materialization spans, with no diagnostic instrumentation retained
M34-PERF-REQ-03	M34	Complete - full-list readers were audited, including correction, sentence, prefix fallback, prediction-never-first, filters/rankers, ABI context, and candidate-list iterators
M34-PERF-REQ-04	M34	Complete - internal bounded request/result contract added without changing public C ABI; eager translation remains the fallback
M34-PERF-REQ-05	M34	Complete - safe short `luna_pinyin` first-page refresh uses bounded materialization with lazy full-list expansion; full-list filters/rankers/userdb paths fallback eager
M34-PERF-REQ-06	M34	Complete - internal heap-backed `TableLookup` abstraction covers exact, prefix, and all-code queries with focused tests
M34-PERF-REQ-07	M34	Closed by stop-gate - compiled `.table.bin` query storage was not implemented because current readers still materialize owned dictionaries and candidate payload parity work remains
M34-PERF-REQ-08	M34	Closed by stop-gate - prism+table candidate integration was not implemented because prism does not carry candidate payload bytes and needs a table-backed payload query path first
M34-PERF-REQ-09	M34	Complete - TypeDuck `jyut6ping3` behavior stayed byte-identical under `cantonese_parity` and `typeduck_web`; default/profile ABI isolation preserved
M34-PERF-REQ-10	M34	Complete - native `luna_pinyin` `ni` full-ABI improved `1,760.250us` -> `1,132.950us`; TypeDuck full-ABI watch rows stayed within the accepted guard
M34-PERF-REQ-11	M34	Closed by stop-gate - memory/cold-start claims are separated; mmap/borrowed storage was not attempted because queryable table/prism storage did not land
M34-PERF-REQ-12	M34	Complete - Rust, focused parity, workspace, benchmark, report, and diff gates run; no runtime/browser gates needed because those paths did not change
M34-PERF-REQ-13	M34	Complete - `my_rime` reference split recorded; engine data-path lessons stay in engine work and delivery/cache lessons route to M31
M35-PERF-REQ-01	M35	Complete - fresh M35 native and fair cross-engine baselines captured under `docs/reports/evidence/m35-compact-table-prism-storage/` for startup/session, memory, `ni`, `hao`, `zhongguo`, and TypeDuck watch rows
M35-PERF-REQ-02	M35	Complete - `TableLookup` now returns `LookupCandidate` / `LookupCandidateEntry` views instead of heap `&[Candidate]` slices, materializing owned `Candidate` values only at selected or compatibility boundaries
M35-PERF-REQ-03	M35	Complete - heap-backed behavior through the candidate-view API is covered by focused lookup tests and existing upstream/TypeDuck parity gates
M35-PERF-REQ-04	M35	Complete - `CompactTableStore` preserves text, raw code/comment, raw weight/order, correction/tolerance data, and advanced dictionary payloads; TypeDuck lookup-record compact enablement remains guarded by no-go
M35-PERF-REQ-05	M35	Complete - compact exact, prefix, and all-code queries reproduce heap-backed output in focused tests, and upstream `luna_pinyin` parity passes with compact storage active
M35-PERF-REQ-06	M35	Complete - prism lookup is used only for spelling/canonical-code discovery while compact table storage supplies payloads; upstream `luna_pinyin` no longer re-expands heap aliases
M35-PERF-REQ-07	M35	Complete - `StaticTableTranslator` chooses private heap or boxed compact storage; compact-active upstream `luna_pinyin` does not retain heap `entries_by_code`
M35-PERF-REQ-08	M35	Complete - compact runtime storage is enabled for safe upstream `luna_pinyin`; TypeDuck `jyut6ping3` stays on documented heap fallback because profile invariants are broader
M35-PERF-REQ-09	M35	Complete with stretch no-go - native short-input rows improved (`hao_engine_only` `1092.879us` -> `750.517us`, `ni_engine_only` `891.791us` -> `697.044us`), but low-hundreds stretch remains a measured future owner
M35-PERF-REQ-10	M35	Complete with stretch no-go - memory attribution separates upstream and product schemas; upstream dictionary-specific `translator_install` delta dropped `37556224` -> `9822208` bytes, while fair-harness `40-70 MB` whole-process peak stretch remains deferred
M35-PERF-REQ-11	M35	Closed by no-go - mmap/borrowed storage was not attempted because compact owned storage removed the upstream expansion delta and the remaining whole-process peak needs a separate borrowed/demand-paged design
M35-PERF-REQ-12	M35	Complete - TypeDuck profile rows remain byte-identical under `cantonese_parity` and `typeduck_web`; full-ABI watch rows stayed within the 10% guard while heap fallback remains active
M35-PERF-REQ-13	M35	Complete - performance and root-cause reports separate native engine-only, full-ABI, fair cross-engine, memory, and browser-delivery claims; cross-engine ratios are not the headline
M35-PERF-REQ-14	M35	Complete - Rust, focused parity, workspace, benchmark, fair cross-engine, docs/report, and diff gates pass; runtime/browser gates are N/A because no runtime/browser-visible files changed
M36-PERF-REQ-01	M36	Complete - native in-process harness records Track A (`luna_pinyin` Yune vs librime) separately from Track B (`jyut6ping3_mobile` Yune before/after), with startup, session, per-key, resident working-set, and peak working-set rows under `docs/reports/evidence/m36-product-path/`
M36-PERF-REQ-02	M36	Complete - strategy evidence separates product owners from comparison-only rows; Track A ratios remain caveats and Track B before/after rows are the only TypeDuck product performance headline
M36-PERF-REQ-03	M36	Complete - product path status CSV records stale unsupported shipped product blobs at baseline and final `compiled_ready=true` rebuilt table/prism/reverse artifacts for both `jyut6ping3` and `jyut6ping3_scolar`
M36-PERF-REQ-04	M36	Closed by no-go - no browser/WASM/runtime-visible files changed, so browser free wins, `INITIAL_MEMORY`, bundle gating, and delivery/cache claims remain M31 work with browser smoke required before any claim
M36-PERF-REQ-05	M36	Closed by no-go - standalone byte-arena/StringId interning was not the selected product owner after attribution; the accepted storage win is compiled-active no-marisa product artifacts plus compact storage, with API-boundary owned candidates preserved
M36-PERF-REQ-06	M36	Complete with measured `rsmarisa` no-go - actual shipped `jyut6ping3` and `jyut6ping3_scolar` blobs are stale and unsupported as a table/prism/reverse set, so M36 lands schema-scoped Yune-readable no-marisa re-emitted artifacts with no final runtime `SourceFallback`
M36-PERF-REQ-07	M36	Complete - product translator installation preserves prism payloads on compiled product loads, writes configured prism stems such as `jyut6ping3_mobile`, and keeps TypeDuck rich comments, lookup records, correction/tolerance, partial selection, long composition, and userdb gates green
M36-PERF-REQ-08	M36	Closed by no-go - bounded/lazy candidate windows were not generalized to TypeDuck product rows because whole-list, paging, filters/rankers, correction/tolerance, context, and userdb invariants remain broader than the safe upstream subset
M36-PERF-REQ-09	M36	Complete - performance/root-cause reports, checked-in charts, and evidence docs separate native vs browser, product vs comparison, memory vs latency, and landed wins vs no-go strategies; no "matched librime", "faster than librime", or browser claim is made
M36-PERF-REQ-10	M36	Complete - final fmt/clippy/focused parity/workspace tests, `typeduck_web`, `frontend_baselines`, native M36 benchmark evidence, report SVG/XML checks, `git diff --check`, and completed-plan updates are recorded; runtime/browser/patch gates are N/A because no runtime-visible files changed
M37-ENGINE-01	M37	Complete - Phase 0 attribution explains Track B `hai` materialization/filtering owners and product memory owners; evidence in `phase-0-baseline/`
M37-ENGINE-02	M37	Complete - selected product storage is byte-backed/mapped, `rsmarisa` was tried on real product marisa payloads, and memory moved materially
M37-ENGINE-03	M37	Complete - final product status proves fresh artifacts, no `SourceFallback`, and active byte-backed mapped product path
M37-ENGINE-04	M37	Complete - default Track B product rows prove page-bounded materialization in `m37_metrics.csv`
M37-ENGINE-05	M37	Complete - `RimeGetContext` exports page reads through page snapshot counters without full candidate-list cloning
M37-ENGINE-06	M37	Complete - focused upstream and TypeDuck behavior gates remained byte-identical; browser speed gates were N/A because no browser claim was made
M37-ENGINE-07	M37	Complete - Track B `hai` moved from `15,241.000us` to `8,336.800us` and residual owner is named
M37-ENGINE-08	M37	Complete - Track B product memory moved from the M36 baseline and Track A working-set evidence was refreshed
M37-ENGINE-09	M37	Complete - final native product path reports `mapping_mode=mmap`; `rsmarisa` probes also report `mmap`
M37-ENGINE-10	M37	Complete - reports separate native/browser and Track A/Track B claims; no browser speed claim is made
M37-ENGINE-11	M37	Complete - final quality gates are recorded in the completed M37 plan; runtime/browser gates were N/A for performance claims
M38-ENGINE-01	M38	Complete - final claims are native isolated-engine only; product/frontend/browser rows are not used as closeout evidence
M38-ENGINE-02	M38	Complete - phase 0 recorded fresh same-run upstream librime and Yune baseline rows
M38-ENGINE-03	M38	Complete - owner attribution recorded for lifecycle, lookup, materialization, context, memory, and allocation rows
M38-ENGINE-04	M38	Complete - final Track A hot path uses `rsmarisa_byte_backed` deployed table lookup with positive counters and zero no-marisa fallback
M38-ENGINE-05	M38	Complete - final selected table/prism bytes are mmap-backed with table/prism heap mirror bytes `0`
M38-ENGINE-06	M38	Complete - final startup/session medians are within `1.25x` of same-run librime
M38-ENGINE-07	M38	Complete - final `hao`, `ni`, and `zhongguo` rows are each within `5x` of same-run librime
M38-ENGINE-08	M38	Complete - raw prism, raw table, raw `rsmarisa`, translator, and context-export rows recorded
M38-ENGINE-09	M38	Complete - first-page reads are page-bounded for target rows with fallback counters reported
M38-ENGINE-10	M38	Complete - working set, peak working set, allocation counters, and remaining memory gap are reported honestly
M38-ENGINE-11	M38	Complete - touched upstream `luna_pinyin` behavior and shared compatibility tests are green
M38-ENGINE-12	M38	Complete - final reports make only native isolated-engine claims
M38-ENGINE-13	M38	Complete - fmt, clippy, focused tests, workspace tests, final native benchmark, report checks, and `git diff --check` recorded
M39-ENGINE-01	M39	Complete - final native benchmark includes startup, session, short/medium rows, both Track A long rows, the Track B long profile row, and owner attribution
M39-ENGINE-02	M39	Complete - startup and session remain within `1.25x` of same-run librime
M39-ENGINE-03	M39	Complete - `hao`, `ni`, and `zhongguo` remain inside short/medium gates
M39-ENGINE-04	M39	Complete - both Track A long rows are inside the `5x` gate and the Track B 50+ profile row is no-regressed
M39-ENGINE-05	M39	Complete - Track A `rsmarisa`, mmap-backed bytes, zero heap mirrors, and source-fallback status are preserved
M39-ENGINE-06	M39	Complete - bounded Track A output and counted/explained Track B profile fallback are recorded
M39-ENGINE-07	M39	Complete - memory owner attribution and no-regression are recorded
M39-ENGINE-08	M39	Complete - focused behavior gates and workspace tests are green
M39-ENGINE-09	M39	Complete - final reports make only native-engine claims
M40-ENGINE-01	M40	Complete - final native benchmark includes startup, session, short/medium, long, incomplete-pinyin, and Track B guard rows
M40-ENGINE-02	M40	Complete - both Track A long rows improve from M39 and finish within `1.25x` of same-run librime
M40-ENGINE-03	M40	Complete - exact range index, reachable vertices, prefix filter, and phrase index all prove active by counters
M40-ENGINE-04	M40	Complete - 59-character code-prefix checks and table entries considered drop by more than `40%`
M40-ENGINE-05	M40	Complete - startup/runtime-ready and session stay within librime and M39 no-regression gates
M40-ENGINE-06	M40	Complete - `hao`, `ni`, and `zhongguo` stay inside short/medium no-regression gates
M40-ENGINE-07	M40	Complete - `rsmarisa`, mmap-backed selected bytes, zero heap mirrors, and no source fallback are preserved
M40-ENGINE-08	M40	Complete - Track A peak memory does not regress and the compact sentence index has owner attribution
M40-ENGINE-09	M40	Complete - bounded first-page output and page-sized context export are preserved
M40-ENGINE-10	M40	Complete - upstream-observable `luna_pinyin` behavior and touched compatibility paths remain covered
M40-ENGINE-11	M40	Complete - final claims remain native-engine-only
M40-ENGINE-12	M40	Complete - cross-keystroke graph rebuild is measured and is not the top remaining owner
M41-YWEB-01	M41	Complete - final production-browser evidence records environment, build, URL, sample count, and run status
M41-YWEB-02	M41	Complete - real-worker and mock-worker cold/warm scenarios cover `luna_pinyin` and `jyut6ping3_mobile`
M41-YWEB-03	M41	Complete - required Track A and Track B typing rows are included in browser evidence
M41-YWEB-04	M41	Complete - browser startup owner attribution names runtime packaging plus redundant startup deploy as the old blocker
M41-YWEB-05	M41	Complete - final ready-to-input improves by `72.2-95.9%` on the main pre/post rows
M41-YWEB-06	M41	Complete - runtime packaging and cache/resource evidence are covered for tracked harness and public-demo
M41-YWEB-07	M41	Complete - cold and warm ready-to-input medians improve and final cold rows are under budget
M41-YWEB-08	M41	Complete with measured caveat - first-key rows are recorded; final tracked cold p95 is no worse than `235 ms`, but phase-0 first-key comparison is a one-sample diagnostic baseline
M41-YWEB-09	M41	Complete - browser heap, DOM, and Windows working-set samples are recorded in final evidence
M41-YWEB-10	M41	Complete - web build, public build, typecheck, startup benchmark, focused composition/candidate smoke rows, and diff checks pass; broad historical `@smoke` has stale non-M41 failures
M42-ENGINE-01	M42	Complete - upstream librime `1.17.0` oracle output for both rows is captured with candidate/order/preedit/schema/provenance details
M42-ENGINE-02	M42	Complete - Phase 0 selected the implementation branch because both rows had meaningful oracle candidates
M42-ENGINE-03	M42	Complete - implementation adds bounded prism/schema-derived abbreviation span routing without selected table/prism heap mirrors
M42-ENGINE-04	M42	Complete - validated abbreviation spans route through a separate sentence path while full-pinyin rows keep the M40 path
M42-ENGINE-05	M42	Complete - native ABI candidate text, comments, order, context preedit, commit preview, and first-page metadata match the captured oracle
M42-ENGINE-06	M42	Complete with measured blocker - behavior-comparable rows are `3.469x` and `5.069x` same-run librime, so M42 is not a speed win
M42-ENGINE-07	M42	Complete - startup, session, `hao`, `ni`, and `zhongguo` remain inside guards; `ni`/`hao` owners were profiled and not optimized
M42-ENGINE-08	M42	Complete - both Track A long rows remain within `1.25x` and preserve the M40 full-pinyin path
M42-ENGINE-09	M42	Complete - Track A `rsmarisa`, mmap/byte-backed selected bytes, zero heap mirrors, no source fallback, and positive counters remain intact
M42-ENGINE-10	M42	Complete - Track A peak memory is `119,775,232 B`, first-page output remains bounded, and abbreviation owners are attributed
M42-ENGINE-11	M42	Complete - Track B 50+ row remains guard-only at `186.513us/op` median with no TypeDuck-profile speed claim
M42-ENGINE-12	M42	Complete - final docs, reports, candidate-output artifact, evidence bundle, native benchmark rows, and Rust/diff quality gates are required in the final gate record
M43-ENGINE-01	M43	Complete - fresh same-run native baseline includes startup, session, Track A target rows, M42 abbreviation rows, and Track B guard
M43-ENGINE-02	M43	Complete - structural Track A memory-owner evidence classifies heap/mmap/shared/overlap bytes and reconciles estimates against measured memory
M43-ENGINE-03	M43	Complete - `hao`/`ni` owner profile splits lookup, translation, materialization, ranking/filtering, context/export, and ABI allocation/free buckets
M43-ENGINE-04	M43	Complete - Phase 0 selected Branch A memory-owner reduction before hot-path implementation
M43-ENGINE-05	M43	Complete with measured blocker - `poet.entries_by_code` dropped `19,513,879 B`, but whole-process Track A peak did not meet the memory-win target
M43-ENGINE-06	M43	Complete - short-key branch was not selected; `hao`/`ni` residual same-run librime ratios are reported without a speed claim
M43-ENGINE-07	M43	Complete - M42 abbreviation candidate-output parity remains a final native guard and is not reported as a speed win
M43-ENGINE-08	M43	Complete - startup/session, `zhongguo`, and both Track A long rows preserve M42/M40 guards
M43-ENGINE-09	M43	Complete - `rsmarisa`, mmap/byte-backed selected bytes, zero heap mirrors, no source fallback, and positive counters remain intact
M43-ENGINE-10	M43	Complete with measured blocker - final Track A peak stayed inside Phase 0 noise and bounded output/context plus Track B guards pass, but historical M42 `+5%` peak ceiling remains above target
M43-ENGINE-11	M43	Complete - M43 reporting stays native-only with no web/product/browser/TypeDuck-profile speed claim
M43-ENGINE-12	M43	Complete - final reports, docs, evidence bundle, native benchmark rows, and Rust/diff quality gates are recorded
M44-ENGINE-01	M44	Complete - fresh same-run native baseline captured all four target families plus startup/session and guard rows
M44-ENGINE-02	M44	Complete - abbreviation, short-key, memory, and Track B owner counters were added and exported in the benchmark CSV schema
M44-ENGINE-03	M44	Complete - Phase 0 recorded one verdict per workstream before hot-path implementation
M44-ENGINE-04	M44	Complete - abbreviation latency targets pass while preserving M42 output and M40 full-pinyin boundaries
M44-ENGINE-05	M44	Complete with measured blocker - `hao` passes, `ni` remains `49.450us` / `3.434x`, and short-key output/page-bound behavior is guarded by benchmark evidence plus focused regression tests
M44-ENGINE-06	M44	Complete with measured blocker - final Track A peak is `127,619,072 B`, so the memory target is missed with reconciled RSS/owner evidence
M44-ENGINE-07	M44	Complete - Track B native product-profile short rows improved `84.7-92.4%` while preserving the long guard and source-fallback-free storage
M44-ENGINE-08	M44	Complete - startup/session, `zhongguo`, and both Track A long rows remain inside guards
M44-ENGINE-09	M44	Complete - `rsmarisa`, mmap/byte-backed selected bytes, zero heap mirrors, no source fallback, and positive counters remain intact
M44-ENGINE-10	M44	Complete - output/profile guards, page bounds, and retained-cache accounting remain intact; final oracle candidate-output artifact is scoped to abbreviation rows
M44-ENGINE-11	M44	Complete - M44 reporting stays native/profile-scoped with no unrelated speed claim
M44-ENGINE-12	M44	Complete - final reports, docs, evidence bundle, target rows, scoped candidate-output evidence, and Rust/diff quality gates are recorded
M45-ENGINE-01	M45	Complete - fresh same-run native baseline captured short-key rows, guard rows, Track B guard, and memory evidence
M45-ENGINE-02	M45	Complete - upstream candidate-output oracle evidence for `n`, `ni`, and `hao` is captured and final Yune comparison passes
M45-ENGINE-03	M45	Complete - short-key owner counters are exported in the benchmark evidence
M45-ENGINE-04	M45	Complete - memory attribution splits steady resident, high-water peak, private bytes, peak pagefile, retained owners, and storage classes
M45-ENGINE-05	M45	Complete - branch verdicts recorded as `short-key-measured-no-go` and `steady-state-meets-target-standing-peak-cost`
M45-ENGINE-06	M45	Complete with measured blockers - no short-key implementation branch was retained; `hao` preserves the M44 pass, but `n` and `ni` miss `<=3.0x` while matching oracle output
M45-ENGINE-07	M45	Complete - M44 under-fill fallback behavior and sentence-path separation are preserved; short rows keep `upstream_sentence_model_calls=0`
M45-ENGINE-08	M45	Complete with measured peak blocker - steady resident target is met, but real `127,475,712 B` peak remains visible and no storage rewrite is retained
M45-ENGINE-09	M45	Complete - `rsmarisa`, mmap/byte-backed selected bytes, zero heap mirrors, no source fallback, and positive counters remain intact
M45-ENGINE-10	M45	Complete - startup/session, `zhongguo`, M40 long rows, M42/M44 abbreviations, bounded output/context, and Track B guard remain inside gates
M45-ENGINE-11	M45	Complete - reporting stays native-engine-scoped with no web/WASM/product/browser claim
M45-ENGINE-12	M45	Complete - final reports, docs, evidence, candidate-output comparison, memory verdict, and Rust/diff quality gates are recorded
WEB01-00	WEB-01	Complete - executable WEB-01 diff contains no `crates/` changes
WEB01-01	WEB-01	Complete - yune-web/My RIME comparator benchmark is reusable and writes evidence
WEB01-02	WEB-01	Complete - asset-family attribution benchmark covers Luna and Jyutping families
WEB01-03	WEB-01	Complete - M41/current-runtime reconciliation note is recorded
WEB01-04	WEB-01	Complete - browser WASM initial memory is configurable by environment variable
WEB01-05	WEB-01	Complete with measured no-go - 64 MiB does not reduce settled heap and 48 MiB worsens Luna
WEB01-06	WEB-01	Complete with measured no-go - Jyutping remains `893.1 MiB` for `extras`, `jyutping-core`, and `full-jyutping`
WEB01-07	WEB-01	Complete with blocker - payload ownership is quantified, but reverse/schema-switch smokes block safe pruning; the `~1.9 GiB` schema-switch/no-candidate row needs pre-WEB-01 reproduction or regression classification
WEB01-08	WEB-01	Complete - report and visualizations are refreshed from final evidence
WEB01-09	WEB-01	Complete - final gates record benchmark, build, and focused smoke outcomes
WEB01-10	WEB-01	Complete - WEB-01 makes no native, browser heap, payload, public-demo speed, or product-delivery win claim
M46-MEM-01	M46	Complete - Phase 0 provenance and serialized benchmark context recorded under `reports/evidence/m46-jyutping-native-wasm-memory-attribution/provenance.md`
M46-MEM-02	M46	Complete - fresh native Track B baseline covers `h`, `ha`, `hai`, `hau`, `nei`, `ngo`, 50+ guard, storage, memory, and status evidence
M46-MEM-03	M46	Complete - Phase 0 added owner rows in `memory-owner-profile.csv`; no new `m37_metrics.csv` columns required `M37_METRIC_FIELDS` changes
M46-MEM-04	M46	Complete with blocker - native owner attribution now splits code strings, candidate text/comment payload, lookup records, base/scolar status bytes, allocator proxies, and unclassified process memory; headline memory remains mostly unclassified
M46-MEM-05	M46	Complete - owner rows classify reducible, required, guarded, mmap-backed, shared/overlapping, transient, and unclassified bytes
M46-MEM-06	M46	Complete with blocker - browser/WASM attribution covers single-schema Luna/Jyutping, Jyutping asset families, schema-switch sequences, and native-vs-WASM gap; Jyutping remains `893.1 MiB`
M46-MEM-07	M46	Complete - Branch A fixed the product-affecting schema-switch no-candidate correctness bug; clean Jyutping, Cangjie -> Luna -> Jyutping, and Jyutping -> Luna -> Jyutping now return `nei -> 你` with six candidates and zero worker action errors
M46-MEM-08	M46	Complete - Phase 0 verdict selects `schema-switch-regression-fix-first` and links schema-switch correctness plus native-vs-WASM gap evidence
M46-MEM-09	M46	Closed by no-go - Phase 0 did not authorize a Track B `rsmarisa` spike; any future spike still must reconcile D-33/M36, preserve table/reverse/prism semantics, and prove measured movement
M46-MEM-10	M46	Closed by no-go - payload/scolar/reverse/transient optimization branches were not authorized because the named owners did not explain the headline memory; future work still must preserve TypeDuck v1.1.2 behavior, browser surfaces, and the `cantonese_parity` hard gate
M46-MEM-11	M46	Complete - deployed Track B storage remains source-fallback-free with selected storage/status evidence from Phase 0
M46-MEM-12	M46	Complete - Track B short rows, 50+ guard, and Track A no-regression rows remained stable in the M46 evidence and required gates
M46-MEM-13	M46	Complete with measured no-go - M46 does not claim success because native and browser memory did not move; remaining memory owner is `measured-no-go-owner-unclassified`
M46-MEM-14	M46	Complete - reports, visual, roadmap, requirements, decisions, ledger, plan state, and final gates are recorded for the partial closeout
POST-M38-PERF-01	Post-M38	Complete through M39 - final same-run native benchmark includes required long continuous pinyin rows and Track B row
POST-M38-PERF-02	Post-M38	Complete through M39 - long-input rows carry owner/status/memory evidence
POST-M38-PERF-03	Post-M38	Complete through M39 - optimization claim names the measured owner
POST-M38-PERF-04	Post-M38	Complete through M39 - long-composition/profile attribution splits inner owners
POST-M38-PERF-05	Post-M38	Complete through M39 - memory follow-up uses baseline and owner attribution
POST-M38-PERF-06	Post-M38	Complete through M39 - 50+ character rows are primary closeout gates
POST-M38-PERF-07	Post-M38	Complete through M39 - cross-dimension no-regression gates are reported
POST-M38-PERF-08	Post-M38	Complete through M39 - strategy gate table is recorded in final-gates evidence
POST-M38-PERF-09	Post-M38	Complete through M39 - Cantonese path-sharing verdict is recorded before optimization

Coverage:

v1 requirements: 25 total
v2 validation requirements: 7 total
TypeDuck-Web integration requirements: 15 total
TypeDuck-Windows native IME requirements: 7 total
M12/M17/M18 upstream oracle and behavioral parity requirements: 10 total, 10 complete
M13 AI-native frontend exposure requirements: 6 total, 6 complete
M14–M16 TypeDuck-Web fork parity requirements: 7 total, 7 complete (M16 complete with explicit browser/userdb inspection limits)
Fork parity backlog (Cantonese engine-parity, vs upstream 1.17.0): 9 total, 9 complete; see ledgers/fork-parity-ledger.md
M20 web demo showcase controls requirements: 7 total, 7 complete
M19 schema breadth and TypeDuck-profile ABI requirements: 5 total, 5 complete
M22 web playground requirements: 4 total, 4 complete
M24 TypeDuck-Web dogfooding requirements: 5 total, 5 complete
M25 TypeDuck-Web dogfooding round 2 requirements: 6 total, 6 complete
M26 performance hardening requirements: 5 total, 5 complete
M27 TypeDuck-Web startup runtime init and control-classification requirements: 6 total, 6 complete
M28 TypeDuck partial candidate selection requirements: 5 total, 5 complete
M28 follow-up upstream Jyutping composition requirements: 6 total, 6 complete, 0 draft
M29 startup memory and typing performance requirements: 6 total, 6 complete, 0 draft
M30 engine representation performance requirements: 7 total, 7 complete, 0 draft
P2-WIN-02 TypeDuck Windows boundary compatibility requirements: 6 total, 6 complete, 0 open
M33 engine native lookup performance requirements: 8 total, 8 complete, 0 draft
M31 yune-web public demo readiness requirements: 14 total, 12 complete, 2 complete with measured caveat, 0 draft
M34 lazy candidate pipeline and queryable table+prism performance requirements: 13 total, 10 implemented/complete, 3 closed by stop-gate, 0 draft
M35 compact table+prism runtime storage performance requirements: 14 total, 13 complete, 1 closed by no-go, 0 draft
M36 product-path engine optimization requirements: 10 total, 7 complete, 3 closed by no-go, 0 draft
M37 engine hyper-optimization requirements: 11 total, 11 complete, 0 planned
M38 engine performance parity requirements: 13 total, 13 complete, 0 active
M39 long-input engine hardening requirements: 9 total, 9 complete, 0 active
M40 compiled sentence lookup index requirements: 12 total, 12 complete, 0 active
M41 yune-web startup optimization requirements: 10 total, 9 complete, 1 complete with measured caveat, 0 active
M42 abbreviation sentence parity and short-key guardrail requirements: 12 total, 11 complete, 1 complete with measured blocker, 0 active
M43 native memory and short-key owner reduction requirements: 12 total, 10 complete, 2 complete with measured blocker, 0 active
M44 native performance owner reduction requirements: 12 total, 10 complete, 2 complete with measured blocker, 0 active
M45 native short-key latency and memory attribution requirements: 12 total, 10 complete, 2 complete with measured blocker, 0 active
WEB-01 yune-web WASM heap and payload requirements: 11 total, 8 complete, 3 complete with measured blocker/no-go, 0 active
M46 Jyutping native and WASM memory attribution requirements: 14 total, 9 complete, 3 complete with measured blocker/no-go, 2 closed by no-go, 0 active
Post-M38 engine performance follow-up requirements: 9 total, 9 complete, 0 draft
M50 Track A launch-readiness completion requirements: 6 total, 4 complete, 2 complete with measured blocker, 0 active
M51 engine support contract and ABI-freeze requirements: 5 total, 5 complete, 0 active
M52 Track A guardrails and blocker disposition requirements: 6 total, 6 complete, 0 active
M53 engine release-readiness audit requirements: 5 total, 5 complete, 0 active
M54 native octagram grammar support requirements: 7 total, 7 complete, 0 active
WEB-02 Jyutping WASM memory-attribution requirements: 3 total, 3 complete, 0 active
WEB-03 public launch and browser latency requirements: 11 total, 11 complete, 0 active
WEB-04 octagram debug harness requirements: 5 total, 5 complete, 0 active
M55 native Track A match-or-beat requirements: 8 total, 8 complete, 0 active
M56 engine productization hardening requirements: 6 total, 6 complete, 0 active
M57 macOS Track A sentence-model parity requirements: 6 total, 6 complete, 0 active
M58 canonical Jyutping oracle and TypeDuck multilingual split requirements: 8 total, 8 complete, 0 active
M59 schema-general reachability, exact-order parity, navigation, deployment, evidence, and closeout requirements: 11 total, 11 complete, 0 active
M60 schema-general reachability capability-formalism requirements: 6 total, 6 complete, 0 active
M61 native Track A memory-owner reduction requirements: 7 total, 7 complete, 0 active
WEB-05 harness control surface requirements: 3 total, 3 complete, 0 active
Mapped to phases: 460
Unmapped current checklist requirements: 0 (the eight non-checklist Deferred, Transferred, And AI-Foundation Requirements entries — six repo-deferred and two transferred frontend entries — are excluded from the current mapping denominator)

Requirements defined: 2026-04-28. Last reviewed: 2026-07-16. M61 has seven complete requirements and closed with disposition D, an evidence-backed measured partial/no-go; no numbered milestone is currently active. Completed outcomes remain in this registry unless a separate future requirement-history split is approved. Current sequencing and evidence boundaries live in the roadmap, support contract, and milestone history.

Uh oh!

FilesExpand file tree

requirements.md

Latest commit

History