# Modular Runtime — Kernel Budget Review 01

Date: 2026-08-01

Status: accepted temporary mechanism-budget exception; the 6,592-line authority kernel exceeds the initial 6,000-line ceiling by 592 logical lines, but the review found no duplicate authority mechanism that can be removed safely before transition.

## Binding rule

The build goal caps the initial authority-bearing kernel at 3,000–6,000 executable lines before provider adapters. It also requires a new subsystem to delete or consolidate an existing mechanism or receive an explicit measured mechanism-budget exception. Moving a file into `adapters/`, compressing syntax, or splitting it into smaller forwarding wrappers does not reduce the kernel.

Current consistent source-shape measurement:

| Surface | Files or logical lines |
|---|---:|
| Authority-bearing kernel, including admission | 6,592 lines |
| Initial ceiling | 6,000 lines |
| Reviewed overage | 592 lines / 9.87% |
| Complete modular package | 85 files / 15,326 lines |
| Moderator production-entry implementation | 3 files / 555 lines |
| Combined production-entry source-shape report | 93 files / average 180 / p90 361 / maximum 494 |
| Local import cycles | 0 |

## Measured failure that earned the review

The pre-entry system passed component canaries but was not a production replacement: its HTTP boundary constructed only a direct executor, so an arbitrary accepted goal could not create a durable graph, select a recipe, resume its plan, or expose graph truth through the normal process. The correction was required by a measured terminal gap, not speculative platform design.

The production-entry seam adds or makes authoritative five cohesive responsibilities:

| Responsibility | Current owner | Why an existing owner cannot absorb it without mixing authority |
|---|---|---|
| Proposal-to-plan policy | `goal-plan-admission.ts` | Sol may propose, but only deterministic code may derive lane signals, inject contract roots, pin versions, enforce authority, and admit a plan. |
| Immutable plan/restart record | `project-plan-store.ts` | Direct attempt state and graph state begin after admission; neither can prove which original Sol plan was authorized across reopen. |
| Direct-versus-graph routing | `planned-project-executor.ts` | The runtime service schedules projects, while lane executors own execution. Keeping the route between them prevents the service from becoming a recipe switchboard. |
| Production graph composition | `graph-project-executor.ts` | Existing graph modules deliberately receive adapters; one composition root must bind real Git, Luna, Sol, browser proof, batching, and the existing coordinator without moving provider setup into graph state. |
| Multi-project process lifecycle | `project-runtime-service.ts` | HTTP routes cannot own durable queueing, workspace collision control, reopen, fault capture, and coordinated shutdown without duplicating lifecycle state across endpoints. |

These owners are independently tested and correspond to distinct state or permission boundaries. None introduces a second scheduler, state writer, retry owner, resource broker, integration queue, graph store, or worker supervisor.

## Reduction attempts rejected by the review

1. **Relabel production composition as an adapter.** Rejected as boundary-shuffling; it still selects and wires authority-bearing execution.
2. **Delete the immutable project-plan store.** Rejected because restart would have to ask Sol again or trust a reconstructed graph, violating exact replay and plan lineage.
3. **Put lane selection in `ProjectRuntimeService`.** Rejected because the one project lifecycle owner would also become a recipe factory and provider composition root.
4. **Merge the five files mechanically.** Rejected because it saves no mechanism and would push unrelated policy, SQL, process lifecycle, and provider wiring above the 500-line review trigger.
5. **Remove matched-shadow comparison immediately.** Its 122 kernel lines do not close the full gap, and deleting the only deterministic comparison reproduction before transition would weaken the authority decision. It becomes removable after the rollback window and frozen audit reproduction.
6. **Remove direct or graph lane wrappers.** Both are live selected paths with independent recovery semantics; collapsing them before selected-entry smokes would increase transition risk.

## Exception decision

A temporary `+592` logical-line mechanism-budget exception is accepted for the initial authority transition because:

- every added responsibility closes a demonstrated production-entry or restart failure;
- the current canary exercised direct, backend graph, and UI graph entry through those exact boundaries;
- all files remain below 500 logical lines, the combined average is 180, and there is no import cycle;
- the system still has one state database, one project lifecycle service, one resource broker, one retry path per lane contract, one integration queue, and at most three active implementation workers per project;
- no seventh recipe, service split, graph database, workflow DSL, nested agent manager, or new polling loop was introduced.

This is not a new permanent target. The 6,000-line ceiling remains the desired steady-state budget.

## Removal triggers and expiry

The exception expires before adding Hermes mutation, a seventh recipe, a second production process, or another kernel mechanism. No such addition may land while the kernel remains above 6,000 without a new measured exception.

After the selector transition and rollback window:

1. preserve the matched comparison inputs and outputs as a frozen replay fixture, then remove the live shadow comparator if no production consumer remains;
2. verify whether `DirectProjectExecutorFactory` has any consumer outside planned routing; fold it into the planned composition root if not, without merging direct state ownership;
3. review three representative selected-runtime projects for duplicate project-plan/read-model construction and remove only duplication observed in those traces;
4. rerun the same line categories, dependency-cycle check, full regression, direct/graph selected-entry smokes, and rollback proof;
5. either return to 6,000 or less or publish a second evidence-backed exception before any Phase 6 work.

## Transition implication

The line-budget review is complete and does not itself block the atomic selector transition. Legacy remains authoritative because transition permission has not been granted, not because the overage was hidden or ignored.