Minimal core used by atomic supervisors and pools (engineering record)

This is a deletion audit, not a preservation promise. “Already in core” is not a reason to keep a type, and “the compiler needs a name” is not a semantic law. The atomic actors should expose their own domain protocols while depending on the smallest common actor algebra underneath them.

There are three different questions which must not be collapsed:

1. what is irreducible actor algebra;
2. which existing interpreter carriers are still needed internally; and
3. which names an atomic-actor user must see.

Most of the current names belong only to the second category. They must not be re-exported as supervisor/pool concepts or counted as atomic-template types.

A. Irreducible retained algebra

These existing concepts have independent laws. The five atomic actors use them directly and must not recreate them in actors.

BehaviorBase, User, Births<Child>, NoBirths, CreationKind, Exit, and Crash are current representation/support types for those seven laws. They remain only while the existing algebra and interpreter need them. The atomic actor modules do not wrap, alias, or re-export them merely to make their own signatures look uniform.

This is the minimal retained semantic kernel. It is seven concepts, not the dozens of lifecycle and topology types currently visible in the crate.

B. Existing interpreter carriers used internally

The following values may be used to lower an atomic actor's Actions into the current interpreter. They are not components from which supervisors or pools are composed, and they are not automatically part of ordinary DevX.

None of these rows proves that every current helper trait around the value must survive. SendEffects, SendsFor, InterpretSends, InterpretDelivery, InterpretChildDelivery, InterpretChildInput, and InterpretRequest are implementation machinery to audit as one interpreter equation. Keep only the smallest closed set used by the actual named effect product. Do not mirror it with template-local traits.

Required interpreter-contract replacement

The current InterpretSends contract returns one Interpreter::Error and documents that later lanes remain unconsumed after failure. That is incompatible with the selected ownership law: the source fold has already committed, so every later value still needs a surviving owner.

The replacement must interpret the named effect product into the equally named, ordered per-item settlement product from the solution. Every item is Accepted, Rejected, or NotAttempted after an exact dependency failure. Independent later items are interpreted; dependent later items are returned untouched. All current same-action occurrence-dependent operations must be grouped with their creation prerequisite: ObserveCreation, ObserveEstablishedCreation, ObserveChild, ChildDelivery, ChildInput, and ShutdownChild. The staged sum distinguishes direct dependence on creation from dependence on required-observation acceptance. All required observations are attempted in named order; if several reject, their rejections remain independently owned and later dependent effects cite the first rejection's correlation. No lane index, path, lookup table, or general graph is authorized. ReturnsToEmitter/NoReturnToEmitter cannot be the general answer because the emitter may stop in the same action. They are replaced or narrowed to the live-primary-admission optimization only after typed host settlement is proven. The Driver gives the transitive settlement chain priority before the source's next ordinary user communication, so unresolved batches do not accumulate across separate user turns. This supplies no decreasing measure: the iterative queue alone proves neither bounded memory, termination, fairness, nor eventual return to ordinary traffic.

C. Conditional machinery, not selected core

C.1 Complete disposition of current public core families

This table closes the audit over the families currently re-exported by crates/behavior/src/lib.rs. It is a family-level disposition rather than a promise to preserve every helper name.

Behavior intentionally exposes no finite mailbox reducer. One-turn initialization and event transitions are the algebraic boundary; Bombay owns runtime sequencing. The unpublished testkit alone owns finite test sequencing through drive and reports DriveDisposition::{MailboxDrained, BehaviorStopped(Stopped)} without a semantic boolean.

D. Delete or replace with the legacy templates

These names encode the architecture being replaced or incomplete policy shapes. Widespread use does not make them core.

• old Proxy, Supervisor, DynamicSupervisor, WorkerPool, and KeyedWorkerPool implementations and their aliases;
• ChildTopology, FixedFleetOwnership, slot/fleet ownership state, and wrapper/path-specific WithParent forms;
• SupervisionEvent, SupervisionSends, SupervisorSends, PoolSends, and products whose fields exist only because the old templates are nested;
• WorkerCreationResolved, WorkerStopped, ReplacementRequested, ReplacementResolution, ReportWorkerCreationResolved, ReportWorkerStopped, and ReportProxyUnavailable in their legacy shapes;
• the existing RestartConfiguration/RestartPolicy split if it permits contradictory or meaningless combinations;
• the current RestartDenial if it cannot retain overlap, clock-order, activation, or forced-retirement reasons required by the catalogue; and
• assignment/completion types that expose customer routes or require workers to echo correlation fields.

Deletion happens only after the five replacements have feature and interpreter witnesses and all callers are migrated. No compatibility layer keeps the old concepts alive under new names.

E. Core gaps exposed by the laws

Five requirements are not solved by the retained kernel:

1. Authoritative installation and initialization settlement. The pure init fold must precede host commitment, but initialization Actions must follow commitment of an installed-but-not-ready incarnation. Their partial success cannot be rolled back. The interpreter needs distinct pre-commit init/host rejection and post-commit initialization-effect settlement.
2. Incarnation activation. The selected semantic equation splits committed installation into an actor-retained exact incarnation and a one-shot activation permit. BeginActivation consumes the permit and concrete plan; exact resolved/cancelled/late facts settle readiness. Hydration/I/O remains outside Behavior. The retained algebra and interpreter do not yet realize this equation.
3. Creation-scoped dependency lowering. One creation and the complete current set of same-action occurrence operations—ObserveCreation, ObserveEstablishedCreation, ObserveChild, ChildDelivery, ChildInput, and ShutdownChild—must lower as one named staged bundle, with direct and after-required-observation alternatives. Independent effects stay outside. Existing Actions does not yet prove that grouping without structural paths or runtime lookup.
4. Rejected delivery and terminal projection. The selected semantic equation projects ordered per-item settlement from each named effect-product lane. Every item is accepted, rejected, or not attempted after an exact dependency failure; several failures remain distinct. A not-attempted item references the one authoritative prerequisite settlement rather than cloning its payload. A statically known host owns settlement after source commit or termination and transfers unresolved values outward to a root runner. Current interpretation does not realize that equation, and a committed fold cannot be rolled back. Its root boundary needs total heterogeneous static lifts, duplicate-role provenance, compositional wrapper transfer, and wrapper-depth-independent compiler diagnostics.
5. Residual root lifetime. Actor-side forced retirement may transfer an uncancellable activation or future late incarnation to the root. The run future must remain a live typed owner until those facts resolve and the exact incarnation drains; a finished error value is not an owner. The current runner has no such residual state.

These are foundational interpreter equations, not permission to add a broad “lifecycle engine,” callback, ambient query, or template-local interpreter trait. Their semantic ownership is selected; the smallest concrete association with the retained core still requires a focused end-to-end regression and compile/interpreter witness.

F. Visibility rule

An ordinary user of a supervisor or pool should normally see only:

• the actor's builder and public command/outcome protocol;
• their domain role/key/job/result/worker types;
• selected recovery, actor-specific capacity bounds, shutdown, and diagnostic policies; and
• logical or exact recipients they deliberately provide.

They must not see child routes, occurrence positions, interpreter requests, parent-report plumbing, effect-lane products, nonce/timer issuers, activation joins, completion correlations, or typestate proof markers. If Rust makes an internal proof type appear in diagnostics, that is an implementation problem to measure—not a semantic reason to promote the type into the public model.