From 70d7e288240a97c066c58f8a7abe5ed20ed42faf Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 16:36:30 -0400
Subject: [PATCH 01/18] Generalize int-proxy tokens from u64 to Copy + Ord
 types

The proxy tactics fixed both bridge coordinates at u64; the time-logic
library beneath them (ValueHistory, bilinear_wave, discover_times) was
already generic at V: Copy + Ord, so u64 was an instantiation posing as
the architecture. This makes the tokens backend-chosen associated types:

* `Group: Copy + Ord + 'static` on both backend traits: the granule
  name, commonly a u64 key hash but exactly the key for small Copy keys
  (collisions then impossible), wider hashes for insurance. `'static`
  because groups are the one token that crosses invocations (pending
  times are held per group).
* `Token: Copy + Ord` (per input side on join: Token0/Token1): the
  ephemeral value token, scoped to one invocation.
* `ProxyBridge<G, I, T, R>`; `bilinear_wave` widened to distinct value
  types per side; `KeyView`, `DiscoverScratch`, `discover_times`, and
  `IdHistory` generalized to match.

Tests are invariant under (u64, u64); no in-tree backend impls existed
to migrate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/src/operators/common.rs | 34 +++----
 .../src/operators/int_proxy/history.rs        |  4 +-
 .../src/operators/int_proxy/join.rs           | 60 +++++++-----
 .../src/operators/int_proxy/mod.rs            | 55 ++++++-----
 .../src/operators/int_proxy/reduce.rs         | 95 ++++++++++---------
 5 files changed, 140 insertions(+), 108 deletions(-)

diff --git a/differential-dataflow/src/operators/common.rs b/differential-dataflow/src/operators/common.rs
index aea8e598b..783bd7dff 100644
--- a/differential-dataflow/src/operators/common.rs
+++ b/differential-dataflow/src/operators/common.rs
@@ -103,12 +103,13 @@ impl<T: Lattice + Clone + Ord> TimeHistory<T> {
 /// `emit` receives every produced `(id0, id1, joined time, multiplied diff)`. Both histories
 /// must be pre-loaded (`load`/`load_iter`) and are fully drained. For small histories a plain
 /// cross product is cheaper; callers should gate on size.
-pub fn bilinear_wave<V, T, R0, R1, RO>(
-    h0: &mut ValueHistory<V, T, R0>,
-    h1: &mut ValueHistory<V, T, R1>,
-    mut emit: impl FnMut(V, V, T, RO),
+pub fn bilinear_wave<V0, V1, T, R0, R1, RO>(
+    h0: &mut ValueHistory<V0, T, R0>,
+    h1: &mut ValueHistory<V1, T, R1>,
+    mut emit: impl FnMut(V0, V1, T, RO),
 ) where
-    V: Copy + Ord,
+    V0: Copy + Ord,
+    V1: Copy + Ord,
     T: Ord + Clone + Lattice,
     R0: Semigroup + Multiply<R1, Output = RO> + Clone,
     R1: Semigroup + Clone,
@@ -180,11 +181,11 @@ pub fn tile_descriptions<T: Timestamp + Lattice>(
 }
 
 /// A one-key view into an input presentation: the read-only arguments [`discover_times`] needs
-/// about a single key — its slice `[i0, i1)` of the merged `(id, time, diff)` run `p_in` and
+/// about a single key — its slice `[i0, i1)` of the merged `(token, time, diff)` run `p_in` and
 /// the carried `pending` times.
-pub struct KeyView<'a, T, RIn> {
-    /// The presented `((key_hash, value_id), time, diff)` run the key's records live in.
-    pub p_in: &'a [((u64, u64), T, RIn)],
+pub struct KeyView<'a, G, I, T, RIn> {
+    /// The presented `((group, token), time, diff)` run the key's records live in.
+    pub p_in: &'a [((G, I), T, RIn)],
     /// The key's first record.
     pub i0: usize,
     /// One past the key's last record.
@@ -205,9 +206,9 @@ fn update_meet<T: Lattice + Clone>(meet: &mut Option<T>, other: Option<&T>) {
 
 /// Reusable per-key scratch for [`discover_times`]: held once and threaded through every key,
 /// so replays and time buffers are cleared and refilled rather than reallocated per key.
-pub struct DiscoverScratch<T, RIn> {
+pub struct DiscoverScratch<I, T, RIn> {
     batch_replay: TimeHistory<T>,
-    input_replay: ValueHistory<u64, T, RIn>,
+    input_replay: ValueHistory<I, T, RIn>,
     output_replay: TimeHistory<T>,
     synth: Vec<T>,
     times_current: Vec<T>,
@@ -215,7 +216,7 @@ pub struct DiscoverScratch<T, RIn> {
     meets: Vec<T>,
 }
 
-impl<T: Timestamp + Lattice, RIn: Semigroup + Clone> DiscoverScratch<T, RIn> {
+impl<I: Copy + Ord, T: Timestamp + Lattice, RIn: Semigroup + Clone> DiscoverScratch<I, T, RIn> {
     /// Fresh scratch; hold one per retire and thread it through every key.
     pub fn new() -> Self {
         DiscoverScratch {
@@ -230,7 +231,7 @@ impl<T: Timestamp + Lattice, RIn: Semigroup + Clone> DiscoverScratch<T, RIn> {
     }
 }
 
-impl<T: Timestamp + Lattice, RIn: Semigroup + Clone> Default for DiscoverScratch<T, RIn> {
+impl<I: Copy + Ord, T: Timestamp + Lattice, RIn: Semigroup + Clone> Default for DiscoverScratch<I, T, RIn> {
     fn default() -> Self { Self::new() }
 }
 
@@ -246,15 +247,16 @@ impl<T: Timestamp + Lattice, RIn: Semigroup + Clone> Default for DiscoverScratch
 /// consolidated view is unsound: compaction may advance a history record onto a novel time,
 /// where consolidation cancels the novel update and its interesting time is missed.
 #[allow(clippy::too_many_arguments)]
-pub fn discover_times<T, RIn>(
-    key: KeyView<'_, T, RIn>,
+pub fn discover_times<G, I, T, RIn>(
+    key: KeyView<'_, G, I, T, RIn>,
     seed_times: impl Iterator<Item = T>,
     out_times: impl Iterator<Item = T>,
     upper: &Antichain<T>,
-    scratch: &mut DiscoverScratch<T, RIn>,
+    scratch: &mut DiscoverScratch<I, T, RIn>,
     moments: &mut Vec<T>,
     pended: &mut Vec<T>,
 ) where
+    I: Copy + Ord,
     T: Timestamp + Lattice,
     RIn: Semigroup + Clone,
 {
diff --git a/differential-dataflow/src/operators/int_proxy/history.rs b/differential-dataflow/src/operators/int_proxy/history.rs
index 905614ac0..d03eb3b3c 100644
--- a/differential-dataflow/src/operators/int_proxy/history.rs
+++ b/differential-dataflow/src/operators/int_proxy/history.rs
@@ -1,5 +1,5 @@
 //! Time-ordered replay of proxy update histories, with meet-advancement.
 
-/// A value history suitable for integer proxy values.
-pub(in crate::operators) type IdHistory<T, R> = crate::operators::ValueHistory<u64, T, R>;
+/// A value history over proxy value tokens.
+pub(in crate::operators) type IdHistory<I, T, R> = crate::operators::ValueHistory<I, T, R>;
 
diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index 7a02d1b1f..4b6de2a99 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -1,6 +1,6 @@
 //! The proxy join framework.
 //!
-//! A conventional differential join against `(u64, u64)` values, which are provided by
+//! A conventional differential join against `(group, token)` values, which are provided by
 //! and then interpreted by a backend, who is relieved of lattice-time reasoning.
 
 use timely::progress::{Antichain, Timestamp};
@@ -24,33 +24,42 @@ pub struct JoinInstance<'a, B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     pub lower: AntichainRef<'a, B0::Time>,
 }
 
-/// A type that can interpret and retire pairs of batches, joined by key hashes.
+/// A type that can interpret and retire pairs of batches, joined by group tokens.
 ///
 /// The protocol invokes the `present*` methods with the instance to produce the proxy collection,
 /// and then returns with any number (including zero) calls to `cross` to produce outputs.
 pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
+    /// The group token: names the granule of independence, shared by both inputs.
+    ///
+    /// Commonly a `u64` key hash; exactly the key for small `Copy` keys. `'static` because
+    /// groups are the one token that may cross invocations.
+    type Group: Copy + Ord + 'static;
+    /// The value token for the first input, scoped to one invocation.
+    type Token0: Copy + Ord;
+    /// The value token for the second input, scoped to one invocation.
+    type Token1: Copy + Ord;
     /// Diff type presented for the first input.
     type R0: Semigroup + Multiply<Self::R1, Output = Self::ROut>;
     /// Diff type presented for the second input.
     type R1: Semigroup;
     /// Diff type of matched records (`R0 * R1`), computed by the tactic.
     type ROut: Semigroup;
-    /// The output container built from matched value ids.
+    /// The output container built from matched value tokens.
     type Output;
 
-    /// Prepare a proxy bridge from the instance's first input, optionally key-hash restricted.
+    /// Prepare a proxy bridge from the instance's first input, optionally group restricted.
     ///
-    /// The returned bridge **must be sorted and consolidated** by `((key_hash, value_id), time)`.
-    fn present0(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[u64]>) -> ProxyBridge<B0::Time, Self::R0>;
-    /// Prepare a proxy bridge from the instance's second input, optionally key-hash restricted.
+    /// The returned bridge **must be sorted and consolidated** by `((group, token), time)`.
+    fn present0(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[Self::Group]>) -> ProxyBridge<Self::Group, Self::Token0, B0::Time, Self::R0>;
+    /// Prepare a proxy bridge from the instance's second input, optionally group restricted.
     ///
-    /// The returned bridge **must be sorted and consolidated** by `((key_hash, value_id), time)`.
-    fn present1(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[u64]>) -> ProxyBridge<B0::Time, Self::R1>;
-    /// From a list of left and right identifiers, and corresponding times and diffs, the output.
-    fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(u64, u64)], right: &[(u64, u64)], times: Vec<B0::Time>, diffs: Vec<Self::ROut>) -> Self::Output;
+    /// The returned bridge **must be sorted and consolidated** by `((group, token), time)`.
+    fn present1(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[Self::Group]>) -> ProxyBridge<Self::Group, Self::Token1, B0::Time, Self::R1>;
+    /// From a list of left and right tokens, and corresponding times and diffs, the output.
+    fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: Vec<B0::Time>, diffs: Vec<Self::ROut>) -> Self::Output;
 }
 
-/// A proxy-space [`JoinTactic`]: matches records of the two presented runs by `key_hash`,
+/// A proxy-space [`JoinTactic`]: matches records of the two presented runs by group token,
 pub struct ProxyJoinTactic<B0, B1, Bk> {
     backend: Bk,
     _marker: std::marker::PhantomData<(B0, B1)>,
@@ -99,7 +108,7 @@ where
         Fresh::Input0 => {
             let p0 = backend.present0(&instance, None);
             if p0.is_empty() { return Vec::new(); }
-            let mut keys: Vec<u64> = p0.iter().map(|r| r.0.0).collect();
+            let mut keys: Vec<Bk::Group> = p0.iter().map(|r| r.0.0).collect();
             keys.dedup();
             let p1 = backend.present1(&instance, Some(&keys));
             (p0, p1)
@@ -107,7 +116,7 @@ where
         Fresh::Input1 => {
             let p1 = backend.present1(&instance, None);
             if p1.is_empty() { return Vec::new(); }
-            let mut keys: Vec<u64> = p1.iter().map(|r| r.0.0).collect();
+            let mut keys: Vec<Bk::Group> = p1.iter().map(|r| r.0.0).collect();
             keys.dedup();
             let p0 = backend.present0(&instance, Some(&keys));
             (p0, p1)
@@ -124,7 +133,7 @@ where
     // `backend`/`out` borrow before `out` is returned.
     let mut out: Vec<Bk::Output> = Vec::new();
     {
-        let mut flush = |li: &mut Vec<(u64, u64)>, ri: &mut Vec<(u64, u64)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
+        let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
             out.push(backend.cross(&instance, li.as_slice(), ri.as_slice(), std::mem::take(ot), std::mem::take(od)));
             li.clear();
             ri.clear();
@@ -166,24 +175,27 @@ where
 /// If both histories are large, this replays the histories compacting as it goes in
 /// order to (potentially) avoid quadratic blow-up.
 #[allow(clippy::too_many_arguments)]
-fn join_key<T, R0, R1, RO, F>(
-    kh: u64,
-    p0: &ProxyBridge<T, R0>,
+fn join_key<G, I0, I1, T, R0, R1, RO, F>(
+    kh: G,
+    p0: &ProxyBridge<G, I0, T, R0>,
     r0: std::ops::Range<usize>,
-    p1: &ProxyBridge<T, R1>,
+    p1: &ProxyBridge<G, I1, T, R1>,
     r1: std::ops::Range<usize>,
-    h0: &mut IdHistory<T, R0>,
-    h1: &mut IdHistory<T, R1>,
-    li: &mut Vec<(u64, u64)>,
-    ri: &mut Vec<(u64, u64)>,
+    h0: &mut IdHistory<I0, T, R0>,
+    h1: &mut IdHistory<I1, T, R1>,
+    li: &mut Vec<(G, I0)>,
+    ri: &mut Vec<(G, I1)>,
     ot: &mut Vec<T>,
     od: &mut Vec<RO>,
     flush: &mut F,
 ) where
+    G: Copy + Ord,
+    I0: Copy + Ord,
+    I1: Copy + Ord,
     T: Lattice + Timestamp,
     R0: Semigroup + Multiply<R1, Output = RO> + Clone,
     R1: Semigroup + Clone,
-    F: FnMut(&mut Vec<(u64, u64)>, &mut Vec<(u64, u64)>, &mut Vec<T>, &mut Vec<RO>),
+    F: FnMut(&mut Vec<(G, I0)>, &mut Vec<(G, I1)>, &mut Vec<T>, &mut Vec<RO>),
 {
     // `flush` ships the accumulated batch once it reaches `JOIN_CHUNK` and resets the buffers. It's
     // checked after every produced pair — *including inside the replay wave below* — so even a key
diff --git a/differential-dataflow/src/operators/int_proxy/mod.rs b/differential-dataflow/src/operators/int_proxy/mod.rs
index 9c72ffeab..b2110d289 100644
--- a/differential-dataflow/src/operators/int_proxy/mod.rs
+++ b/differential-dataflow/src/operators/int_proxy/mod.rs
@@ -3,9 +3,12 @@
 //! The tactics are intended to support custom operator implementations without rebuilding
 //! the non-trivial and often non-obvious time-based logic that supports them.
 //!
-//! The tactics here run DD's operator logic over consolidated `[((u64, u64), time, diff)]`
-//! lists, the first integer a hash of the "key" and granule of independence, the second an
-//! ephemeral data identifier understood by the backend but opaque to the operator harness.
+//! The tactics here run DD's operator logic over consolidated `[((group, token), time, diff)]`
+//! lists: the first coordinate names the granule of independence, the second is an ephemeral
+//! value token understood by the backend but opaque to the operator harness. Both are
+//! backend-chosen `Copy + Ord` types — commonly `u64` hashes, but exact values for small
+//! data (`G = u32` node ids, tokens `(u32, u32)` edges), wider hashes for insurance, or
+//! dense ids where exactness is required.
 //! The tactics first elicit proxy identifiers from the backends, perform their necessary time
 //! and difference based computations to stage integer collections, and then re-invoke the
 //! backends with those same identifiers to produce the necessary output.
@@ -13,25 +16,30 @@
 //! The backend is oblivious to the navigation of time, and the operator to the backend's
 //! implementation.
 //!
-//! # The two integers
+//! # The two tokens
 //!
-//! The two integers play the role of key and value to the operator, but their connection
+//! The two tokens play the role of key and value to the operator, but their connection
 //! to the key and value of the intended computation is nuanced.
 //!
-//! *   `key_hash: u64` — a content hash of the intended key.
-//!     This value should be identical for each instance of identical keys.
-//!     The value is not assumed to be a well-distributed quality hash, only distinct.
-//!     There may be collisions, and the next identifier should assist with this.
+//! *   `Group: Copy + Ord + 'static` — the group token, naming the granule of independence.
+//!     This value should be identical for each instance of identical keys. It is the one
+//!     token that crosses invocations (pending work is remembered per group), hence
+//!     `'static`. When it is a content hash of the intended key, it need not be a
+//!     well-distributed quality hash, only distinct; there may be collisions, and the
+//!     next token should assist with this. When it is the key itself (small `Copy` keys),
+//!     collisions are impossible and the cautions below are vacuous.
 //!
-//! *   `value_id: u64` — an ephemeral intra-hash value identifier.
-//!     These values should be distinct for each distinct datum with the same key_hash.
-//!     In particular, they should account for the conventional `(key, val)` data,
-//!     rather than only the value component, to avoid errors due to colliding keys.
+//! *   `Token: Copy + Ord` — an ephemeral intra-group value token, scoped to one
+//!     invocation. These should be distinct for each distinct datum with the same group
+//!     token. When derived by hashing, they should account for the conventional
+//!     `(key, val)` data, rather than only the value component, to avoid errors due to
+//!     colliding groups.
 //!
-//! The key hash acts as an independence marker: keys with different hashes will be isolated,
-//! and their incremental updates performed independently. By forcing the keyspace into `u64`,
-//! there is the risk of hash collision. This means that per-hash logic should be prepared for
-//! this, and should not discard key information that remains semantically important.
+//! The group token acts as an independence marker: keys with different tokens will be isolated,
+//! and their incremental updates performed independently. When the keyspace is compressed
+//! (hashed) into the token, there is the risk of collision. This means that per-group logic
+//! should be prepared for this, and should not discard key information that remains
+//! semantically important.
 //!
 //! Informally, one should mentally rewrite one's `(key, val)` into `(hash(key), (key, val))`.
 //! Retaining the `key` as data provides access to it, and allows one to certainly respond to
@@ -47,18 +55,21 @@ mod history;
 pub mod join;
 pub mod reduce;
 
-/// Integer-only exchange medium: a consolidated collection of `[((hash, id), time, diff)]`.
+/// Token-only exchange medium: a consolidated collection of `[((group, token), time, diff)]`.
+///
+/// `G` is the group token (commonly `u64`, a key hash) and `I` the value token (commonly
+/// `u64`, an id or content hash) — see the backend traits for the obligations each carries.
 ///
 /// The [`debug_assert_sorted_bridge`] method is (and can be) used to validate this property.
-pub type ProxyBridge<T, R> = Vec<((u64, u64), T, R)>;
+pub type ProxyBridge<G, I, T, R> = Vec<((G, I), T, R)>;
 
 /// Debug check that a presented [`ProxyBridge`] is consolidated.
 ///
 /// Operator harnesses use the test to flag backend implementations that do not uphold it.
-pub(crate) fn debug_assert_sorted_bridge<T: Ord, R>(bridge: &ProxyBridge<T, R>, who: &str) {
+pub(crate) fn debug_assert_sorted_bridge<G: Ord, I: Ord, T: Ord, R>(bridge: &ProxyBridge<G, I, T, R>, who: &str) {
     debug_assert!(
-        bridge.windows(2).all(|w| (w[0].0, &w[0].1) < (w[1].0, &w[1].1)),
-        "{}: a presented bridge must be sorted & consolidated by ((key_hash, value_id), time)",
+        bridge.windows(2).all(|w| ((&w[0].0, &w[0].1)) < ((&w[1].0, &w[1].1))),
+        "{}: a presented bridge must be sorted & consolidated by ((group, token), time)",
         who,
     );
 }
diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index ee206a904..323d5031c 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -1,7 +1,7 @@
 //! The proxy reduce framework.
 //!
-//! A conventional differential reduce against `(u64, u64)`, where the backend supplies the
-//! implementation of the interpretation of the integers.
+//! A conventional differential reduce against `(group, token)` values, where the backend
+//! supplies the implementation of the interpretation of the tokens.
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -30,16 +30,16 @@ pub struct ReduceInstance<'a, B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     pub lower: AntichainRef<'a, B1::Time>,
 }
 
-/// One window of a retire's changed keys: a bounded, hash-contiguous snip the backend sizes.
+/// One window of a retire's changed keys: a bounded, group-contiguous snip the backend sizes.
 ///
 /// The window has the input (old and new) and output histories, restricted to the window's keys.
-pub struct ReduceWindow<T, RIn, ROut> {
-    /// The window's key hashes: a contiguous, ascending slice of the retire's `changed` keys.
-    pub keys: Vec<u64>,
-    /// Input presentation for `keys`, sorted & consolidated by `((key_hash, value_id), time)`.
-    pub input: ProxyBridge<T, RIn>,
+pub struct ReduceWindow<G, I, T, RIn, ROut> {
+    /// The window's group tokens: a contiguous, ascending slice of the retire's `changed` keys.
+    pub keys: Vec<G>,
+    /// Input presentation for `keys`, sorted & consolidated by `((group, token), time)`.
+    pub input: ProxyBridge<G, I, T, RIn>,
     /// Output-history presentation for `keys`, same ordering.
-    pub output: ProxyBridge<T, ROut>,
+    pub output: ProxyBridge<G, I, T, ROut>,
 }
 
 /// The reduce backend: value semantics for a proxy-space reduction, driven by [`ProxyReduceTactic`].
@@ -48,15 +48,22 @@ pub struct ReduceWindow<T, RIn, ROut> {
 /// `seed_times begin [ next_window reduce_correction* emit ]* finish`
 /// This should be improved to put the `seed_times` in the per-window loop, or remove it entirely.
 pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>> {
+    /// The group token: names the granule of independence.
+    ///
+    /// Commonly a `u64` key hash; exactly the key for small `Copy` keys. `'static` because
+    /// groups are the one token that crosses invocations (pending times are held per group).
+    type Group: Copy + Ord + 'static;
+    /// The value token, scoped to one invocation; output values share the same token space.
+    type Token: Copy + Ord;
     /// Diff type presented for the input.
     type RIn: Semigroup;
     /// Diff type of the output.
     type ROut: Semigroup + 'static;
 
-    /// Hash keys and associated times in the instance's novel input batches.
+    /// Group tokens and associated times in the instance's novel input batches.
     ///
     /// This is used (with held times) to seed the interesting times for each key.
-    fn seed_times(&self, instance: &ReduceInstance<'_, B1, B2>) -> Vec<(u64, B1::Time)>;
+    fn seed_times(&self, instance: &ReduceInstance<'_, B1, B2>) -> Vec<(Self::Group, B1::Time)>;
 
     /// Initiate a session to create batches for these descriptions, which span `[lower, upper)`.
     ///
@@ -70,7 +77,7 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// The size of the window is up to the backend, where the window should be large enough to
     /// amortize the crossings between the harness and the backend. The proxy bridges for the
     /// whole window will be active at the same time, so tighter windows reduce the required state.
-    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, changed: &[u64], cursor: &mut usize) -> Option<ReduceWindow<B1::Time, Self::RIn, Self::ROut>>;
+    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, changed: &[Self::Group], cursor: &mut usize) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
 
     /// A wave of input-output reconciliation, in which the backend supplies necessary edits.
     ///
@@ -79,38 +86,38 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// with its desires. The `usize` integers upper bound the range for the corresponding key.
     fn reduce_corrections(
         &mut self,
-        keys: &[u64],
+        keys: &[Self::Group],
         in_ends: &[usize],
-        input: &[(u64, Self::RIn)],
+        input: &[(Self::Token, Self::RIn)],
         out_ends: &[usize],
-        output: &[(u64, Self::ROut)],
-    ) -> (Vec<(u64, Self::ROut)>, Vec<usize>);
+        output: &[(Self::Token, Self::ROut)],
+    ) -> (Vec<(Self::Token, Self::ROut)>, Vec<usize>);
 
     /// Commit to a collection of updates at a specific batch in progress.
     ///
     /// The `tile: usize` indexes the list of descriptions provided to `begin()`, and these updates
     /// are aimed at that batch in progress.
-    fn emit(&mut self, tile: usize, records: &[((u64, u64), B1::Time, Self::ROut)]);
+    fn emit(&mut self, tile: usize, records: &[((Self::Group, Self::Token), B1::Time, Self::ROut)]);
 
     /// Complete the session matching `begin`. The outputs correspond to the descriptions it was provided.
     fn finish(&mut self) -> Vec<B2>;
 }
 
-/// A proxy-space [`ReduceTactic`]: matches input and output records by `key_hash`.
-pub struct ProxyReduceTactic<T, Bk> {
+/// A proxy-space [`ReduceTactic`]: matches input and output records by group token.
+pub struct ProxyReduceTactic<G, T, Bk> {
     backend: Bk,
-    /// Pending interesting times beyond the upper frontier, keyed by key hash.
-    pending: BTreeMap<u64, Vec<T>>,
+    /// Pending interesting times beyond the upper frontier, keyed by group token.
+    pending: BTreeMap<G, Vec<T>>,
 }
 
-impl<T, Bk> ProxyReduceTactic<T, Bk> {
+impl<G, T, Bk> ProxyReduceTactic<G, T, Bk> {
     /// A tactic deferring all value semantics to `backend`.
     pub fn new(backend: Bk) -> Self {
         ProxyReduceTactic { backend, pending: BTreeMap::new() }
     }
 }
 
-impl<B1, B2, Bk> ReduceTactic<B1, B2> for ProxyReduceTactic<B1::Time, Bk>
+impl<B1, B2, Bk> ReduceTactic<B1, B2> for ProxyReduceTactic<Bk::Group, B1::Time, Bk>
 where
     B1: BatchReader,
     B2: BatchReader<Time = B1::Time>,
@@ -137,14 +144,14 @@ where
         };
 
         let seeds = self.backend.seed_times(&instance);
-        debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "seed_times must be sorted by key_hash");
-        let mut changed: BTreeSet<u64> = seeds.iter().map(|(k, _)| *k).collect();
+        debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "seed_times must be sorted by group token");
+        let mut changed: BTreeSet<Bk::Group> = seeds.iter().map(|(k, _)| *k).collect();
         changed.extend(self.pending.keys().copied());
         if changed.is_empty() {
             self.pending.clear();
             return (Vec::new(), Antichain::new());
         }
-        let changed: Vec<u64> = changed.into_iter().collect();
+        let changed: Vec<Bk::Group> = changed.into_iter().collect();
 
         // The output tiling (identical to the Abelian tactic): one tile per held time, keeping
         // non-degenerate intervals; `tile_of[i]` maps held time `i` to its tile.
@@ -152,24 +159,24 @@ where
         let (tile_descs, tile_held, tile_of) = tile_descriptions(lower, upper, &held_elems);
         self.backend.begin(&tile_descs);
 
-        let mut new_pending: BTreeMap<u64, Vec<B1::Time>> = BTreeMap::new();
+        let mut new_pending: BTreeMap<Bk::Group, Vec<B1::Time>> = BTreeMap::new();
 
         let mut cursor = 0usize;
         let mut ns = 0usize;
 
         // Retire-wide reusable scratch (cleared per window/round/moment, not reallocated). See the
         // profiling note on `DiscoverScratch`: fresh per-key/per-round `Vec`s were the dominant cost.
-        let mut discover_scratch: DiscoverScratch<B1::Time, Bk::RIn> = DiscoverScratch::new();
-        let mut states: Vec<KeyState<B1::Time, Bk::RIn, Bk::ROut>> = Vec::new();
-        let mut tile_deltas: Vec<Vec<((u64, u64), B1::Time, Bk::ROut)>> = (0..held_elems.len()).map(|_| Vec::new()).collect();
-        let mut batch_keys: Vec<u64> = Vec::new();
+        let mut discover_scratch: DiscoverScratch<Bk::Token, B1::Time, Bk::RIn> = DiscoverScratch::new();
+        let mut states: Vec<KeyState<Bk::Group, Bk::Token, B1::Time, Bk::RIn, Bk::ROut>> = Vec::new();
+        let mut tile_deltas: Vec<Vec<((Bk::Group, Bk::Token), B1::Time, Bk::ROut)>> = (0..held_elems.len()).map(|_| Vec::new()).collect();
+        let mut batch_keys: Vec<Bk::Group> = Vec::new();
         let mut in_ends: Vec<usize> = Vec::new();
-        let mut in_all: Vec<(u64, Bk::RIn)> = Vec::new();
+        let mut in_all: Vec<(Bk::Token, Bk::RIn)> = Vec::new();
         let mut out_ends: Vec<usize> = Vec::new();
-        let mut out_all: Vec<(u64, Bk::ROut)> = Vec::new();
+        let mut out_all: Vec<(Bk::Token, Bk::ROut)> = Vec::new();
         let mut active: Vec<(usize, B1::Time)> = Vec::new();
-        let mut in_accum: Vec<(u64, Bk::RIn)> = Vec::new();
-        let mut cur_out: Vec<(u64, Bk::ROut)> = Vec::new();
+        let mut in_accum: Vec<(Bk::Token, Bk::RIn)> = Vec::new();
+        let mut cur_out: Vec<(Bk::Token, Bk::ROut)> = Vec::new();
         let mut moments_scratch: Vec<B1::Time> = Vec::new();
         let mut pended_scratch: Vec<B1::Time> = Vec::new();
 
@@ -226,7 +233,7 @@ where
                 // Reload slot `n_states` in place (grow the buffer by one only when a window is wider
                 // than any before). `drain` moves the discovered moments in without copy or realloc.
                 if n_states == states.len() {
-                    states.push(KeyState::empty());
+                    states.push(KeyState::empty(key));
                 }
                 let st = &mut states[n_states];
                 st.key = key;
@@ -355,22 +362,22 @@ where
 /// the corrections `produced` this round so far, and a `cursor` into `moments`. Held for all of a
 /// window's keys at once so each round's crossing batches across keys — a key's own moments stay
 /// sequential (each sees its earlier corrections via `produced`), but distinct keys are independent.
-struct KeyState<T, RIn, ROut> {
-    key: u64,
+struct KeyState<G, I, T, RIn, ROut> {
+    key: G,
     moments: Vec<T>,
     meets: Vec<T>,
-    in_replay: IdHistory<T, RIn>,
-    out_replay: IdHistory<T, ROut>,
-    produced: Vec<((u64, T), ROut)>,
+    in_replay: IdHistory<I, T, RIn>,
+    out_replay: IdHistory<I, T, ROut>,
+    produced: Vec<((I, T), ROut)>,
     cursor: usize,
 }
 
-impl<T: Timestamp + Lattice, RIn: Semigroup, ROut: Semigroup> KeyState<T, RIn, ROut> {
+impl<G: Copy + Ord, I: Copy + Ord, T: Timestamp + Lattice, RIn: Semigroup, ROut: Semigroup> KeyState<G, I, T, RIn, ROut> {
     /// An empty slot, to be filled by [`ProxyReduceTactic`]'s phase 1 (`reload`-style). The `states`
     /// vector holds these across windows and reloads them in place, so a key's buffers are allocated
     /// once (per slot) and reused — never dropped per key (which was ~18% of load in `free`).
-    fn empty() -> Self {
-        KeyState { key: 0, moments: Vec::new(), meets: Vec::new(), in_replay: IdHistory::new(), out_replay: IdHistory::new(), produced: Vec::new(), cursor: 0 }
+    fn empty(key: G) -> Self {
+        KeyState { key, moments: Vec::new(), meets: Vec::new(), in_replay: IdHistory::new(), out_replay: IdHistory::new(), produced: Vec::new(), cursor: 0 }
     }
 }
 

From e197207f2f9bf339ba1173738c1648ec0a91ef41 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 16:46:04 -0400
Subject: [PATCH 02/18] Bring both proxy tactics to windowed, streaming
 operation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JOIN materialized whole-instance bridges (present0/present1) and all
outputs eagerly, returning a Vec costumed as Box<dyn Iterator>; REDUCE
was windowed but staged seed_times for the entire invocation up front
(its own doc comment asked for the fix). Both tactics now stream in
ascending group order with peak state O(window):

* JOIN: present0/present1 are replaced by next_window, yielding a
  JoinWindow of both inputs' presentations for a contiguous group
  range. Units are genuinely lazy: JoinUnit owns its batches and
  produces outputs window by window as the join driver's fuel drains
  it — the driver already held units across activations, the proxy
  tactic just never delivered a lazy one. The backend sits behind
  Rc<RefCell<_>> since half-drained units from both input queues
  interleave; per-unit progress lives in the unit's opaque cursor,
  never on the backend. Fresh is now Copy.

* REDUCE: seed_times is deleted; seeds arrive per window on
  ReduceWindow (novel-batch time support, with the discover_times
  seeding contract documented on the field). next_window now takes the
  pending groups (all the harness knows that the backend does not) and
  must cover novel-input groups union pending; a debug_assert checks
  all pending groups were covered. The empty-invocation fast path
  checks batch lengths instead of staged seeds.

No in-tree backends existed to migrate; validation is compile-level
until the reference backends land (next step).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/join.rs           | 221 +++++++++++-------
 .../src/operators/int_proxy/reduce.rs         |  58 +++--
 differential-dataflow/src/operators/join.rs   |   1 +
 3 files changed, 169 insertions(+), 111 deletions(-)

diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index 4b6de2a99..b8f5f50ae 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -24,10 +24,20 @@ pub struct JoinInstance<'a, B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     pub lower: AntichainRef<'a, B0::Time>,
 }
 
+/// One window of a join unit: both inputs presented for a contiguous, ascending group range.
+pub struct JoinWindow<G, I0, I1, T, R0, R1> {
+    /// Window presentation of the first input, sorted & consolidated by `((group, token), time)`.
+    pub input0: ProxyBridge<G, I0, T, R0>,
+    /// Window presentation of the second input, same ordering, over the same group range.
+    pub input1: ProxyBridge<G, I1, T, R1>,
+}
+
 /// A type that can interpret and retire pairs of batches, joined by group tokens.
 ///
-/// The protocol invokes the `present*` methods with the instance to produce the proxy collection,
-/// and then returns with any number (including zero) calls to `cross` to produce outputs.
+/// The protocol repeatedly invokes `next_window` to produce bounded presentations of the two
+/// inputs, matched by group, and calls `cross` (any number of times per window, including zero)
+/// to produce outputs. Windows are produced lazily as the join driver's fuel allows, so at most
+/// one window's presentations are live at a time.
 pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// The group token: names the granule of independence, shared by both inputs.
     ///
@@ -47,126 +57,163 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// The output container built from matched value tokens.
     type Output;
 
-    /// Prepare a proxy bridge from the instance's first input, optionally group restricted.
+    /// Produce the next window of the join unit, and advance `cursor`.
     ///
-    /// The returned bridge **must be sorted and consolidated** by `((group, token), time)`.
-    fn present0(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[Self::Group]>) -> ProxyBridge<Self::Group, Self::Token0, B0::Time, Self::R0>;
-    /// Prepare a proxy bridge from the instance's second input, optionally group restricted.
+    /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
+    /// every group appearing in the `fresh` side's data; groups absent from either side may be
+    /// omitted (they produce no matches). Both bridges **must be sorted and consolidated** by
+    /// `((group, token), time)`.
     ///
-    /// The returned bridge **must be sorted and consolidated** by `((group, token), time)`.
-    fn present1(&mut self, instance: &JoinInstance<'_, B0, B1>, filter: Option<&[Self::Group]>) -> ProxyBridge<Self::Group, Self::Token1, B0::Time, Self::R1>;
+    /// `cursor` is an opaque progress token: zero at the unit's start, thereafter interpreted
+    /// only by the backend (unit progress cannot live on `&mut self`: several half-drained
+    /// units may interleave their windows under the driver's fuel). The backend sizes windows
+    /// to amortize harness crossings; both bridges are live at once, so tighter windows mean
+    /// less state.
+    fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut usize) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
     /// From a list of left and right tokens, and corresponding times and diffs, the output.
     fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: Vec<B0::Time>, diffs: Vec<Self::ROut>) -> Self::Output;
 }
 
-/// A proxy-space [`JoinTactic`]: matches records of the two presented runs by group token,
+/// A proxy-space [`JoinTactic`]: matches records of the presented windows by group token,
+///
+/// The backend sits behind an `Rc<RefCell<_>>` because prepared units are *lazy*: the join
+/// driver holds each unit's iterator across scheduler activations and drains it under fuel,
+/// so several half-drained units (from both input queues) can be live at once, each needing
+/// the backend when polled. Unit progress therefore lives in the unit (the `cursor` token),
+/// never on the backend.
 pub struct ProxyJoinTactic<B0, B1, Bk> {
-    backend: Bk,
+    backend: std::rc::Rc<std::cell::RefCell<Bk>>,
     _marker: std::marker::PhantomData<(B0, B1)>,
 }
 
 impl<B0, B1, Bk> ProxyJoinTactic<B0, B1, Bk> {
     /// A join tactic deferring all value semantics to `backend`.
     pub fn new(backend: Bk) -> Self {
-        ProxyJoinTactic { backend, _marker: std::marker::PhantomData }
+        ProxyJoinTactic { backend: std::rc::Rc::new(std::cell::RefCell::new(backend)), _marker: std::marker::PhantomData }
     }
 }
 
 impl<B0, B1, Bk> JoinTactic<B0, B1, Bk::Output> for ProxyJoinTactic<B0, B1, Bk>
 where
-    B0: BatchReader,
-    B1: BatchReader<Time = B0::Time>,
-    Bk: ProxyJoinBackend<B0, B1>,
+    B0: BatchReader + 'static,
+    B1: BatchReader<Time = B0::Time> + 'static,
+    Bk: ProxyJoinBackend<B0, B1> + 'static,
     Bk::Output: 'static,
 {
     fn prep(&mut self, input0: Vec<B0>, input1: Vec<B1>, fresh: Fresh, meet: B0::Time) -> Box<dyn Iterator<Item = Bk::Output>> {
-        Box::new(join_prep(&mut self.backend, input0, input1, fresh, meet).into_iter())
+        Box::new(JoinUnit {
+            backend: std::rc::Rc::clone(&self.backend),
+            input0,
+            input1,
+            fresh,
+            lower: Antichain::from_elem(meet),
+            cursor: 0,
+            high: None,
+            done: false,
+            h0: IdHistory::new(),
+            h1: IdHistory::new(),
+            ready: std::collections::VecDeque::new(),
+        })
     }
 }
 
 /// Update count threshold used to return to the backend with join output to instantiate.
 const JOIN_CHUNK: usize = 1 << 20;
 
-/// Prepare one join unit: present both sides, merge-match key runs over the sorted hashes, and
-/// cross-product matched records into a sequence of output containers — one per ~[`JOIN_CHUNK`]
-/// matches, flushed wherever the batch fills (including mid-key; parity: their concatenation is the
-/// single-container output). `meet` is a lower bound on the fresh side's times, so the accumulated
-/// side loads compacted (see [`JoinInstance`]); every output is produced under the capability at
-/// `meet`, so advancing loaded times by it leaves the output unchanged.
-fn join_prep<B0, B1, Bk>(backend: &mut Bk, input0: Vec<B0>, input1: Vec<B1>, fresh: Fresh, meet: B0::Time) -> Vec<Bk::Output>
+/// One lazy join unit: owns its batches and streams outputs window by window.
+///
+/// Each `next` first drains `ready`; when empty it asks the backend for the next window,
+/// merge-matches the window's two presented runs by group, and cross-products matched
+/// records into output containers — one per ~[`JOIN_CHUNK`] matches, flushed wherever the
+/// batch fills (including mid-key; parity: their concatenation is the single-container
+/// output). Peak state is one window's presentations plus the containers it produced.
+/// `lower` is the capability's time, a lower bound on the fresh side's times, so the
+/// accumulated side loads compacted (see [`JoinInstance`]); every output is produced under
+/// that capability, so advancing loaded times by it leaves the output unchanged.
+struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoinBackend<B0, B1>> {
+    backend: std::rc::Rc<std::cell::RefCell<Bk>>,
+    input0: Vec<B0>,
+    input1: Vec<B1>,
+    fresh: Fresh,
+    lower: Antichain<B0::Time>,
+    /// Backend-interpreted progress token; zero at the unit's start.
+    cursor: usize,
+    /// Greatest group presented so far, to enforce ascending windows.
+    high: Option<Bk::Group>,
+    done: bool,
+    /// Per-key replay histories, held across the unit and reloaded per key (only the >=16/>=16
+    /// replay-wave path touches them), so a high-fanout join pays no per-key `IdHistory` alloc.
+    h0: IdHistory<Bk::Token0, B0::Time, Bk::R0>,
+    h1: IdHistory<Bk::Token1, B0::Time, Bk::R1>,
+    /// Outputs produced by the current window, not yet handed to the driver.
+    ready: std::collections::VecDeque<Bk::Output>,
+}
+
+impl<B0, B1, Bk> Iterator for JoinUnit<B0, B1, Bk>
 where
     B0: BatchReader,
     B1: BatchReader<Time = B0::Time>,
     Bk: ProxyJoinBackend<B0, B1>,
 {
-    let lower = Antichain::from_elem(meet);
-    let instance = JoinInstance { batches0: &input0, batches1: &input1, lower: lower.borrow() };
-
-    // Prepare work using the keys of the just-received side.
-    // FIXME: Use the smaller of the two instead.
-    let (p0, p1) = match fresh {
-        Fresh::Input0 => {
-            let p0 = backend.present0(&instance, None);
-            if p0.is_empty() { return Vec::new(); }
-            let mut keys: Vec<Bk::Group> = p0.iter().map(|r| r.0.0).collect();
-            keys.dedup();
-            let p1 = backend.present1(&instance, Some(&keys));
-            (p0, p1)
-        }
-        Fresh::Input1 => {
-            let p1 = backend.present1(&instance, None);
-            if p1.is_empty() { return Vec::new(); }
-            let mut keys: Vec<Bk::Group> = p1.iter().map(|r| r.0.0).collect();
-            keys.dedup();
-            let p0 = backend.present0(&instance, Some(&keys));
-            (p0, p1)
-        }
-    };
-    if p0.is_empty() || p1.is_empty() { return Vec::new(); }
-    super::debug_assert_sorted_bridge(&p0, "present0");
-    super::debug_assert_sorted_bridge(&p1, "present1");
-
-    // Merge-join the two presented runs on `key_hash` (both sorted) and cross matched pairs. `flush`
-    // ships the accumulated batch as a container and resets the buffers; `join_key` calls it at each
-    // `JOIN_CHUNK` boundary — including *within* a high-fanout key's wave — so no single key
-    // materializes more than a chunk of its cross product. The closure scope releases its
-    // `backend`/`out` borrow before `out` is returned.
-    let mut out: Vec<Bk::Output> = Vec::new();
-    {
-        let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
-            out.push(backend.cross(&instance, li.as_slice(), ri.as_slice(), std::mem::take(ot), std::mem::take(od)));
-            li.clear();
-            ri.clear();
-        };
-
-        let (mut li, mut ri) = (Vec::new(), Vec::new());
-        let (mut ot, mut od) = (Vec::new(), Vec::new());
-        // Per-key replay histories, held across the unit and reloaded per key (only the >=16/>=16
-        // replay-wave path touches them), so a high-fanout join pays no per-key `IdHistory` alloc.
-        let mut h0 = IdHistory::new();
-        let mut h1 = IdHistory::new();
-        let (mut i, mut j) = (0usize, 0usize);
-        while i < p0.len() && j < p1.len() {
-            let (ki, kj) = (p0[i].0.0, p1[j].0.0);
-            if ki < kj {
-                i += 1;
-            } else if kj < ki {
-                j += 1;
-            } else {
-                let mut e0 = i;
-                while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
-                let mut e1 = j;
-                while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
-                join_key(ki, &p0, i..e0, &p1, j..e1, &mut h0, &mut h1, &mut li, &mut ri, &mut ot, &mut od, &mut flush);
-                i = e0;
-                j = e1;
+    type Item = Bk::Output;
+    fn next(&mut self) -> Option<Bk::Output> {
+        while self.ready.is_empty() && !self.done {
+            let mut backend = self.backend.borrow_mut();
+            let instance = JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() };
+            match backend.next_window(&instance, self.fresh, &mut self.cursor) {
+                None => { self.done = true; }
+                Some(window) => {
+                    let p0 = &window.input0;
+                    let p1 = &window.input1;
+                    super::debug_assert_sorted_bridge(p0, "next_window.input0");
+                    super::debug_assert_sorted_bridge(p1, "next_window.input1");
+                    debug_assert!(
+                        self.high.map_or(true, |h| p0.first().map_or(true, |r| r.0.0 > h) && p1.first().map_or(true, |r| r.0.0 > h)),
+                        "next_window: windows must present strictly ascending group ranges",
+                    );
+                    if let Some(hi) = p0.last().map(|r| r.0.0).into_iter().chain(p1.last().map(|r| r.0.0)).max() {
+                        self.high = Some(hi);
+                    }
+
+                    // Merge-join the window's runs on group token (both sorted) and cross matched
+                    // pairs. `flush` ships the accumulated batch as a container and resets the
+                    // buffers; `join_key` calls it at each `JOIN_CHUNK` boundary — including
+                    // *within* a high-fanout key's wave — so no single key materializes more than
+                    // a chunk of its cross product.
+                    let ready = &mut self.ready;
+                    let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
+                        ready.push_back(backend.cross(&instance, li.as_slice(), ri.as_slice(), std::mem::take(ot), std::mem::take(od)));
+                        li.clear();
+                        ri.clear();
+                    };
+
+                    let (mut li, mut ri) = (Vec::new(), Vec::new());
+                    let (mut ot, mut od) = (Vec::new(), Vec::new());
+                    let (mut i, mut j) = (0usize, 0usize);
+                    while i < p0.len() && j < p1.len() {
+                        let (ki, kj) = (p0[i].0.0, p1[j].0.0);
+                        if ki < kj {
+                            i += 1;
+                        } else if kj < ki {
+                            j += 1;
+                        } else {
+                            let mut e0 = i;
+                            while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
+                            let mut e1 = j;
+                            while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
+                            join_key(ki, p0, i..e0, p1, j..e1, &mut self.h0, &mut self.h1, &mut li, &mut ri, &mut ot, &mut od, &mut flush);
+                            i = e0;
+                            j = e1;
+                        }
+                    }
+                    if !li.is_empty() {
+                        flush(&mut li, &mut ri, &mut ot, &mut od);
+                    }
+                }
             }
         }
-        if !li.is_empty() {
-            flush(&mut li, &mut ri, &mut ot, &mut od);
-        }
+        self.ready.pop_front()
     }
-    out
 }
 
 /// Match one key's records across the two presented runs.
diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index 323d5031c..00a88af00 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -3,7 +3,7 @@
 //! A conventional differential reduce against `(group, token)` values, where the backend
 //! supplies the implementation of the interpretation of the tokens.
 
-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::BTreeMap;
 
 use timely::PartialOrder;
 use timely::progress::{Antichain, Timestamp};
@@ -34,8 +34,16 @@ pub struct ReduceInstance<'a, B1: BatchReader, B2: BatchReader<Time = B1::Time>>
 ///
 /// The window has the input (old and new) and output histories, restricted to the window's keys.
 pub struct ReduceWindow<G, I, T, RIn, ROut> {
-    /// The window's group tokens: a contiguous, ascending slice of the retire's `changed` keys.
+    /// The window's group tokens: a contiguous, ascending run of the groups needing work.
     pub keys: Vec<G>,
+    /// Novel-batch time support for `keys`: `(group, time)` sorted by group, drawn from the
+    /// instance's `input_batches` alone.
+    ///
+    /// These seed the interesting-time discovery, and must be the novel batches' own times,
+    /// not a view consolidated with history: compaction may advance a history record onto a
+    /// novel time, where consolidation cancels the novel update and its interesting time is
+    /// missed (see `discover_times`' seeding contract).
+    pub seeds: Vec<(G, T)>,
     /// Input presentation for `keys`, sorted & consolidated by `((group, token), time)`.
     pub input: ProxyBridge<G, I, T, RIn>,
     /// Output-history presentation for `keys`, same ordering.
@@ -44,9 +52,10 @@ pub struct ReduceWindow<G, I, T, RIn, ROut> {
 
 /// The reduce backend: value semantics for a proxy-space reduction, driven by [`ProxyReduceTactic`].
 ///
-/// The protocol is currently (temporarily) for each round of invocation:
-/// `seed_times begin [ next_window reduce_correction* emit ]* finish`
-/// This should be improved to put the `seed_times` in the per-window loop, or remove it entirely.
+/// The protocol for each round of invocation:
+/// `begin [ next_window reduce_corrections* emit ]* finish`
+/// Seed times arrive per window (on [`ReduceWindow`]), so nothing is staged for the whole
+/// invocation: peak state is one window's presentations.
 pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>> {
     /// The group token: names the granule of independence.
     ///
@@ -60,11 +69,6 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// Diff type of the output.
     type ROut: Semigroup + 'static;
 
-    /// Group tokens and associated times in the instance's novel input batches.
-    ///
-    /// This is used (with held times) to seed the interesting times for each key.
-    fn seed_times(&self, instance: &ReduceInstance<'_, B1, B2>) -> Vec<(Self::Group, B1::Time)>;
-
     /// Initiate a session to create batches for these descriptions, which span `[lower, upper)`.
     ///
     /// It is the backend's job to prepare output batches for each of these descriptions.
@@ -72,12 +76,19 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// work in progress, until `finish()` is called.
     fn begin(&mut self, tiles: &[Description<B1::Time>]);
 
-    /// Produce the next window, resticted to `changed[cursor..]`, and update `cursor` to track.
+    /// Produce the next window of groups needing work, and advance `cursor`.
+    ///
+    /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
+    /// the union of the groups appearing in the instance's novel `input_batches` and the
+    /// supplied `pending` groups (carried interesting times from earlier retires; such a group
+    /// must appear in `keys` even when it has no novel input). `cursor` indexes `pending`:
+    /// the backend advances it past the pending entries its window covers, and tracks its own
+    /// progress through the novel groups (e.g. positions in its batches).
     ///
     /// The size of the window is up to the backend, where the window should be large enough to
     /// amortize the crossings between the harness and the backend. The proxy bridges for the
     /// whole window will be active at the same time, so tighter windows reduce the required state.
-    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, changed: &[Self::Group], cursor: &mut usize) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
+    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, pending: &[Self::Group], cursor: &mut usize) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
 
     /// A wave of input-output reconciliation, in which the backend supplies necessary edits.
     ///
@@ -136,6 +147,12 @@ where
             return (Vec::new(), held.clone());
         }
 
+        // Nothing to do when there are no novel updates and no carried times.
+        if self.pending.is_empty() && input_batches.iter().all(|b| b.len() == 0) {
+            return (Vec::new(), Antichain::new());
+        }
+        let pending_keys: Vec<Bk::Group> = self.pending.keys().copied().collect();
+
         let instance = ReduceInstance {
             source_batches: &source_batches,
             input_batches: &input_batches,
@@ -143,16 +160,6 @@ where
             lower: lower.borrow(),
         };
 
-        let seeds = self.backend.seed_times(&instance);
-        debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "seed_times must be sorted by group token");
-        let mut changed: BTreeSet<Bk::Group> = seeds.iter().map(|(k, _)| *k).collect();
-        changed.extend(self.pending.keys().copied());
-        if changed.is_empty() {
-            self.pending.clear();
-            return (Vec::new(), Antichain::new());
-        }
-        let changed: Vec<Bk::Group> = changed.into_iter().collect();
-
         // The output tiling (identical to the Abelian tactic): one tile per held time, keeping
         // non-degenerate intervals; `tile_of[i]` maps held time `i` to its tile.
         let held_elems: Vec<B1::Time> = held.elements().to_vec();
@@ -162,7 +169,6 @@ where
         let mut new_pending: BTreeMap<Bk::Group, Vec<B1::Time>> = BTreeMap::new();
 
         let mut cursor = 0usize;
-        let mut ns = 0usize;
 
         // Retire-wide reusable scratch (cleared per window/round/moment, not reallocated). See the
         // profiling note on `DiscoverScratch`: fresh per-key/per-round `Vec`s were the dominant cost.
@@ -180,11 +186,14 @@ where
         let mut moments_scratch: Vec<B1::Time> = Vec::new();
         let mut pended_scratch: Vec<B1::Time> = Vec::new();
 
-        while let Some(window) = self.backend.next_window(&instance, &changed, &mut cursor) {
+        while let Some(window) = self.backend.next_window(&instance, &pending_keys, &mut cursor) {
             let p_in = &window.input;
             let p_out = &window.output;
+            let seeds = &window.seeds;
             super::debug_assert_sorted_bridge(p_in, "next_window.input");
             super::debug_assert_sorted_bridge(p_out, "next_window.output");
+            debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "window seeds must be sorted by group token");
+            let mut ns = 0usize;
 
             for deltas in tile_deltas.iter_mut() { deltas.clear(); }
 
@@ -345,6 +354,7 @@ where
             }
         }
 
+        debug_assert_eq!(cursor, pending_keys.len(), "next_window must cover all pending groups before finishing");
         self.pending = new_pending;
         let produced: Vec<(B1::Time, B2)> = tile_held.into_iter().zip(self.backend.finish()).collect();
         let mut frontier = Antichain::new();
diff --git a/differential-dataflow/src/operators/join.rs b/differential-dataflow/src/operators/join.rs
index 413e61d0e..5b70a56e8 100644
--- a/differential-dataflow/src/operators/join.rs
+++ b/differential-dataflow/src/operators/join.rs
@@ -40,6 +40,7 @@ pub trait JoinTactic<B0: BatchReader, B1: BatchReader<Time = B0::Time>, C> {
 /// The fresh batch's times all lie at or beyond the capability, so its side is not advanced by the
 /// capability's meet; the opposing accumulated trace is. The marker also selects which queue a unit
 /// joins, so a burst on one input cannot starve the other.
+#[derive(Clone, Copy, Debug)]
 pub enum Fresh {
     /// The first input (`B0`) contributed the fresh batch.
     Input0,

From 0adc3239cc2ae19b23ee16990f515bc0b7076f57 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 17:01:03 -0400
Subject: [PATCH 03/18] Add the graph reference backend, and the contract fixes
 it forced
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The value-token instantiation from the seam design as a behavioral test
(tests/int_proxy_graphs.rs): edges (src, dst) grouped by source, with
Group = u32 the source itself (exact, no hashing) and the whole edge as
the value token (self-redeeming: cross and finish build outputs from
tokens alone). Oracle tests drive both tactics directly — join against
a naive nested-loop join, reduce (per-source counts, with corrections
and full retractions) against per-time accumulation — at window sizes
down to one group per window.

Writing the backend surfaced two protocol corrections, applied here:

* JOIN: the per-unit resumption state is now `type Cursor: Default` on
  the backend, owned by the unit. A single usize could not carry real
  resumption state (a position per batch per side), and unit progress
  cannot live on `&mut self` since half-drained units interleave.

* REDUCE: next_window loses its cursor parameter entirely — a retire's
  windows all happen within one synchronous begin/finish-bracketed
  call, so the backend keeps progress in its session state. The
  pending-coverage check moves to the harness, which now verifies
  ascending windows and that no pending group is skipped, from
  window.keys alone.

Not yet exercised: the pending path (carried interesting times), which
requires partially ordered time to arise; that belongs to the
partial-order test alongside the hash and ordinal backends.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/join.rs           |  25 +-
 .../src/operators/int_proxy/mod.rs            |   2 +-
 .../src/operators/int_proxy/reduce.rs         |  33 +-
 .../tests/int_proxy_graphs.rs                 | 420 ++++++++++++++++++
 4 files changed, 460 insertions(+), 20 deletions(-)
 create mode 100644 differential-dataflow/tests/int_proxy_graphs.rs

diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index b8f5f50ae..e8b0ede98 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -57,19 +57,22 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// The output container built from matched value tokens.
     type Output;
 
+    /// Per-unit resumption state, owned by the unit and interpreted only by the backend.
+    ///
+    /// Unit progress cannot live on `&mut self`: the driver holds units across scheduler
+    /// activations and drains them under fuel, so several half-drained units (from both input
+    /// queues) may interleave their windows against one shared backend. `Default` is the state
+    /// of a fresh unit; a typical backend records a position per batch per side.
+    type Cursor: Default;
+
     /// Produce the next window of the join unit, and advance `cursor`.
     ///
     /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
     /// every group appearing in the `fresh` side's data; groups absent from either side may be
     /// omitted (they produce no matches). Both bridges **must be sorted and consolidated** by
-    /// `((group, token), time)`.
-    ///
-    /// `cursor` is an opaque progress token: zero at the unit's start, thereafter interpreted
-    /// only by the backend (unit progress cannot live on `&mut self`: several half-drained
-    /// units may interleave their windows under the driver's fuel). The backend sizes windows
-    /// to amortize harness crossings; both bridges are live at once, so tighter windows mean
-    /// less state.
-    fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut usize) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
+    /// `((group, token), time)`. The backend sizes windows to amortize harness crossings; both
+    /// bridges are live at once, so tighter windows mean less state.
+    fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut Self::Cursor) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
     /// From a list of left and right tokens, and corresponding times and diffs, the output.
     fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: Vec<B0::Time>, diffs: Vec<Self::ROut>) -> Self::Output;
 }
@@ -107,7 +110,7 @@ where
             input1,
             fresh,
             lower: Antichain::from_elem(meet),
-            cursor: 0,
+            cursor: Bk::Cursor::default(),
             high: None,
             done: false,
             h0: IdHistory::new(),
@@ -136,8 +139,8 @@ struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoin
     input1: Vec<B1>,
     fresh: Fresh,
     lower: Antichain<B0::Time>,
-    /// Backend-interpreted progress token; zero at the unit's start.
-    cursor: usize,
+    /// Backend-interpreted resumption state; `Default` at the unit's start.
+    cursor: Bk::Cursor,
     /// Greatest group presented so far, to enforce ascending windows.
     high: Option<Bk::Group>,
     done: bool,
diff --git a/differential-dataflow/src/operators/int_proxy/mod.rs b/differential-dataflow/src/operators/int_proxy/mod.rs
index b2110d289..10ad00eba 100644
--- a/differential-dataflow/src/operators/int_proxy/mod.rs
+++ b/differential-dataflow/src/operators/int_proxy/mod.rs
@@ -74,5 +74,5 @@ pub(crate) fn debug_assert_sorted_bridge<G: Ord, I: Ord, T: Ord, R>(bridge: &Pro
     );
 }
 
-pub use join::{JoinInstance, ProxyJoinBackend, ProxyJoinTactic};
+pub use join::{JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic};
 pub use reduce::{ProxyReduceBackend, ProxyReduceTactic, ReduceInstance, ReduceWindow};
diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index 00a88af00..45cf1fa5e 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -76,19 +76,19 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// work in progress, until `finish()` is called.
     fn begin(&mut self, tiles: &[Description<B1::Time>]);
 
-    /// Produce the next window of groups needing work, and advance `cursor`.
+    /// Produce the next window of groups needing work.
     ///
     /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
     /// the union of the groups appearing in the instance's novel `input_batches` and the
     /// supplied `pending` groups (carried interesting times from earlier retires; such a group
-    /// must appear in `keys` even when it has no novel input). `cursor` indexes `pending`:
-    /// the backend advances it past the pending entries its window covers, and tracks its own
-    /// progress through the novel groups (e.g. positions in its batches).
+    /// must appear in `keys` even when it has no novel input). Unlike join, a retire's windows
+    /// all happen within one synchronous call bracketed by `begin`/`finish`, so the backend
+    /// keeps its own progress (batch positions, pending index) in its session state.
     ///
     /// The size of the window is up to the backend, where the window should be large enough to
     /// amortize the crossings between the harness and the backend. The proxy bridges for the
     /// whole window will be active at the same time, so tighter windows reduce the required state.
-    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, pending: &[Self::Group], cursor: &mut usize) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
+    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, pending: &[Self::Group]) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
 
     /// A wave of input-output reconciliation, in which the backend supplies necessary edits.
     ///
@@ -168,7 +168,9 @@ where
 
         let mut new_pending: BTreeMap<Bk::Group, Vec<B1::Time>> = BTreeMap::new();
 
-        let mut cursor = 0usize;
+        // Coverage/monotonicity tracking for the debug contract checks below.
+        let mut pend_idx = 0usize;
+        let mut prev_high: Option<Bk::Group> = None;
 
         // Retire-wide reusable scratch (cleared per window/round/moment, not reallocated). See the
         // profiling note on `DiscoverScratch`: fresh per-key/per-round `Vec`s were the dominant cost.
@@ -186,13 +188,28 @@ where
         let mut moments_scratch: Vec<B1::Time> = Vec::new();
         let mut pended_scratch: Vec<B1::Time> = Vec::new();
 
-        while let Some(window) = self.backend.next_window(&instance, &pending_keys, &mut cursor) {
+        while let Some(window) = self.backend.next_window(&instance, &pending_keys) {
             let p_in = &window.input;
             let p_out = &window.output;
             let seeds = &window.seeds;
             super::debug_assert_sorted_bridge(p_in, "next_window.input");
             super::debug_assert_sorted_bridge(p_out, "next_window.output");
             debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "window seeds must be sorted by group token");
+            debug_assert!(window.keys.windows(2).all(|w| w[0] < w[1]), "window keys must be strictly ascending");
+            debug_assert!(
+                prev_high.map_or(true, |h| window.keys.first().map_or(true, |k| *k > h)),
+                "next_window: windows must present strictly ascending group ranges",
+            );
+            if let Some(last) = window.keys.last() { prev_high = Some(*last); }
+            // Pending coverage: windows ascend, so a pending group below a presented key can
+            // never appear later; it must have been included in this or an earlier window.
+            for key in &window.keys {
+                debug_assert!(
+                    pending_keys.get(pend_idx).map_or(true, |p| p >= key),
+                    "next_window skipped a pending group",
+                );
+                if pending_keys.get(pend_idx) == Some(key) { pend_idx += 1; }
+            }
             let mut ns = 0usize;
 
             for deltas in tile_deltas.iter_mut() { deltas.clear(); }
@@ -354,7 +371,7 @@ where
             }
         }
 
-        debug_assert_eq!(cursor, pending_keys.len(), "next_window must cover all pending groups before finishing");
+        debug_assert_eq!(pend_idx, pending_keys.len(), "next_window must cover all pending groups before finishing");
         self.pending = new_pending;
         let produced: Vec<(B1::Time, B2)> = tile_held.into_iter().zip(self.backend.finish()).collect();
         let mut frontier = Antichain::new();
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
new file mode 100644
index 000000000..2502c9ffc
--- /dev/null
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -0,0 +1,420 @@
+//! Behavioral tests for the proxy tactics against a reference "graph" backend.
+//!
+//! The value-token instantiation from the seam design: data is edges `(src, dst)`,
+//! grouped by source. `Group = u32` is the source itself (exact — no hashing, no
+//! collisions), and the value token is the whole edge (self-redeeming: `cross` and
+//! `finish` build outputs straight from tokens without consulting storage). Batches
+//! are plain sorted update lists; window sizes are kept tiny to force many windows
+//! and exercise the streaming protocols.
+
+use timely::progress::frontier::AntichainRef;
+use timely::progress::Antichain;
+
+use differential_dataflow::consolidation::{consolidate, consolidate_updates};
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
+    ProxyReduceTactic, ReduceInstance, ReduceWindow,
+};
+use differential_dataflow::operators::join::{Fresh, JoinTactic};
+use differential_dataflow::operators::reduce::ReduceTactic;
+use differential_dataflow::trace::{BatchReader, Description};
+
+type Edge = (u32, u32);
+type Time = u64;
+type Diff = isize;
+
+/// A batch of edge updates, sorted by `((src, dst), time)` and consolidated.
+#[derive(Clone)]
+struct GraphBatch {
+    updates: Vec<(Edge, Time, Diff)>,
+    description: Description<Time>,
+}
+
+impl BatchReader for GraphBatch {
+    type Time = Time;
+    fn len(&self) -> usize { self.updates.len() }
+    fn description(&self) -> &Description<Time> { &self.description }
+}
+
+/// Sort, consolidate, and wrap updates as a batch describing `[lower, upper)`.
+fn batch(mut updates: Vec<(Edge, Time, Diff)>, lower: Time, upper: Time) -> GraphBatch {
+    consolidate_updates(&mut updates);
+    GraphBatch {
+        updates,
+        description: Description::new(
+            Antichain::from_elem(lower),
+            Antichain::from_elem(upper),
+            Antichain::from_elem(0),
+        ),
+    }
+}
+
+/// Advance a time to the compaction frontier (total order: max against its element).
+fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
+    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
+}
+
+/// The next group at or after the per-batch positions `pos` into `batches`.
+fn next_group(batches: &[GraphBatch], pos: &[usize]) -> Option<u32> {
+    batches
+        .iter()
+        .zip(pos.iter())
+        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
+        .min()
+}
+
+/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`.
+fn drain_group(
+    batches: &[GraphBatch],
+    pos: &mut [usize],
+    g: u32,
+    mut logic: impl FnMut(Edge, Time, Diff),
+) {
+    for (b, p) in batches.iter().zip(pos.iter_mut()) {
+        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
+            let (edge, t, r) = b.updates[*p];
+            logic(edge, t, r);
+            *p += 1;
+        }
+    }
+}
+
+// ---------------------------------------------------------------- join backend
+
+/// Per-unit resumption: a position per batch per side. This is the state a single
+/// `usize` could not carry — the finding that motivated `type Cursor`.
+#[derive(Default)]
+struct GraphJoinCursor {
+    started: bool,
+    pos0: Vec<usize>,
+    pos1: Vec<usize>,
+}
+
+struct GraphJoinBackend {
+    /// Groups per window; tiny in tests to force many windows.
+    window: usize,
+}
+
+impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
+    type Group = u32;
+    type Token0 = Edge;
+    type Token1 = Edge;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    /// Matched edge pairs with their joined time and multiplied diff.
+    type Output = Vec<(Edge, Edge, Time, Diff)>;
+    type Cursor = GraphJoinCursor;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
+        _fresh: Fresh,
+        cursor: &mut GraphJoinCursor,
+    ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
+        if !cursor.started {
+            cursor.started = true;
+            cursor.pos0 = vec![0; instance.batches0.len()];
+            cursor.pos1 = vec![0; instance.batches1.len()];
+        }
+        let mut input0 = Vec::new();
+        let mut input1 = Vec::new();
+        let mut groups = 0;
+        while groups < self.window {
+            let g0 = next_group(instance.batches0, &cursor.pos0);
+            let g1 = next_group(instance.batches1, &cursor.pos1);
+            let g = match (g0, g1) {
+                (None, None) => break,
+                (a, b) => a.into_iter().chain(b).min().unwrap(),
+            };
+            groups += 1;
+            drain_group(instance.batches0, &mut cursor.pos0, g, |e, t, r| {
+                input0.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.batches1, &mut cursor.pos1, g, |e, t, r| {
+                input1.push(((g, e), advance(t, instance.lower), r));
+            });
+        }
+        if groups == 0 {
+            return None;
+        }
+        consolidate_updates(&mut input0);
+        consolidate_updates(&mut input1);
+        Some(JoinWindow { input0, input1 })
+    }
+
+    fn cross(
+        &mut self,
+        _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
+        left: &[(u32, Edge)],
+        right: &[(u32, Edge)],
+        times: Vec<Time>,
+        diffs: Vec<Diff>,
+    ) -> Self::Output {
+        // Self-redeeming tokens: the output is built from the tokens alone.
+        left.iter()
+            .zip(right)
+            .zip(times)
+            .zip(diffs)
+            .map(|(((l, r), t), d)| (l.1, r.1, t, d))
+            .collect()
+    }
+}
+
+/// Reference join: all pairs with equal source, times joined, diffs multiplied.
+fn naive_join(
+    a: &[(Edge, Time, Diff)],
+    b: &[(Edge, Time, Diff)],
+) -> Vec<((Edge, Edge), Time, Diff)> {
+    let mut out = Vec::new();
+    for (e0, t0, r0) in a {
+        for (e1, t1, r1) in b {
+            if e0.0 == e1.0 {
+                out.push(((*e0, *e1), std::cmp::max(*t0, *t1), r0 * r1));
+            }
+        }
+    }
+    consolidate_updates(&mut out);
+    out
+}
+
+#[test]
+fn join_matches_naive() {
+    // Edges spread over several groups, several batches per side, including a
+    // retraction; window size 1 forces one group per window.
+    let a0 = batch(vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((3, 9), 2, 1)], 0, 3);
+    let a1 = batch(vec![((0, 2), 2, -1), ((2, 4), 2, 1)], 0, 3);
+    let b0 = batch(vec![((0, 7), 1, 1), ((1, 8), 2, 1), ((2, 6), 0, 1)], 0, 3);
+    let b1 = batch(vec![((1, 8), 2, 1), ((4, 4), 0, 1)], 0, 3);
+
+    let all_a: Vec<_> = a0.updates.iter().chain(&a1.updates).cloned().collect();
+    let all_b: Vec<_> = b0.updates.iter().chain(&b1.updates).cloned().collect();
+    let expected = naive_join(&all_a, &all_b);
+
+    for window in [1, 2, 100] {
+        for fresh in [Fresh::Input0, Fresh::Input1] {
+            let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window });
+            let work = tactic.prep(
+                vec![a0.clone(), a1.clone()],
+                vec![b0.clone(), b1.clone()],
+                fresh,
+                0,
+            );
+            let mut got: Vec<((Edge, Edge), Time, Diff)> = work
+                .flatten()
+                .map(|(l, r, t, d)| ((l, r), t, d))
+                .collect();
+            consolidate_updates(&mut got);
+            assert_eq!(got, expected, "window={window}");
+        }
+    }
+}
+
+// -------------------------------------------------------------- reduce backend
+
+/// Counts edges per source: the output value for source `s` is `(s, count)`.
+struct GraphReduceBackend {
+    /// Groups per window; tiny in tests to force many windows.
+    window: usize,
+    // Session state, bracketed by `begin`/`finish`.
+    tiles: Vec<Description<Time>>,
+    emitted: Vec<Vec<(Edge, Time, Diff)>>,
+    started: bool,
+    pos_source: Vec<usize>,
+    pos_input: Vec<usize>,
+    pos_output: Vec<usize>,
+    pend_idx: usize,
+}
+
+impl GraphReduceBackend {
+    fn new(window: usize) -> Self {
+        GraphReduceBackend {
+            window,
+            tiles: Vec::new(),
+            emitted: Vec::new(),
+            started: false,
+            pos_source: Vec::new(),
+            pos_input: Vec::new(),
+            pos_output: Vec::new(),
+            pend_idx: 0,
+        }
+    }
+}
+
+impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
+    type Group = u32;
+    type Token = Edge;
+    type RIn = Diff;
+    type ROut = Diff;
+
+    fn begin(&mut self, tiles: &[Description<Time>]) {
+        self.tiles = tiles.to_vec();
+        self.emitted = vec![Vec::new(); tiles.len()];
+        self.started = false;
+        self.pend_idx = 0;
+    }
+
+    fn next_window(
+        &mut self,
+        instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
+        pending: &[u32],
+    ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
+        if !self.started {
+            self.started = true;
+            self.pos_source = vec![0; instance.source_batches.len()];
+            self.pos_input = vec![0; instance.input_batches.len()];
+            self.pos_output = vec![0; instance.output_batches.len()];
+        }
+        let mut keys = Vec::new();
+        let mut seeds = Vec::new();
+        let mut input = Vec::new();
+        let mut output = Vec::new();
+        while keys.len() < self.window {
+            let g = [
+                next_group(instance.source_batches, &self.pos_source),
+                next_group(instance.input_batches, &self.pos_input),
+                next_group(instance.output_batches, &self.pos_output),
+                pending.get(self.pend_idx).copied(),
+            ]
+            .into_iter()
+            .flatten()
+            .min();
+            let Some(g) = g else { break };
+            keys.push(g);
+            if pending.get(self.pend_idx) == Some(&g) {
+                self.pend_idx += 1;
+            }
+            // Input presentation: accumulated history plus the novel delta, advanced.
+            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
+                // Novel batches also seed interesting times, with their own (raw) times.
+                seeds.push((g, t));
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
+                output.push(((g, e), advance(t, instance.lower), r));
+            });
+        }
+        if keys.is_empty() {
+            return None;
+        }
+        consolidate_updates(&mut input);
+        consolidate_updates(&mut output);
+        seeds.sort();
+        seeds.dedup();
+        Some(ReduceWindow { keys, seeds, input, output })
+    }
+
+    fn reduce_corrections(
+        &mut self,
+        keys: &[u32],
+        in_ends: &[usize],
+        input: &[(Edge, Diff)],
+        out_ends: &[usize],
+        output: &[(Edge, Diff)],
+    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
+        let mut corr = Vec::new();
+        let mut ends = Vec::new();
+        let (mut i0, mut o0) = (0, 0);
+        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
+            assert!(count >= 0, "graph count went negative");
+            // Desired output, minus the tentative output, consolidated.
+            let mut delta: Vec<(Edge, Diff)> = Vec::new();
+            if count > 0 {
+                delta.push(((*k, count as u32), 1));
+            }
+            for (v, d) in &output[o0..o1] {
+                delta.push((*v, -d));
+            }
+            consolidate(&mut delta);
+            corr.extend(delta);
+            ends.push(corr.len());
+            i0 = i1;
+            o0 = o1;
+        }
+        (corr, ends)
+    }
+
+    fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
+        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, *t, *r)));
+    }
+
+    fn finish(&mut self) -> Vec<GraphBatch> {
+        self.tiles
+            .drain(..)
+            .zip(self.emitted.drain(..))
+            .map(|(desc, mut updates)| {
+                consolidate_updates(&mut updates);
+                GraphBatch { updates, description: desc }
+            })
+            .collect()
+    }
+}
+
+/// Accumulate `updates` at times `<= t`.
+fn accumulate(updates: impl Iterator<Item = (Edge, Time, Diff)>, t: Time) -> Vec<(Edge, Diff)> {
+    let mut acc: Vec<(Edge, Diff)> = updates.filter(|(_, ut, _)| *ut <= t).map(|(e, _, r)| (e, r)).collect();
+    consolidate(&mut acc);
+    acc
+}
+
+#[test]
+fn reduce_counts_match_naive() {
+    // Rounds of edge updates, including deletions that drop a source's count to zero
+    // (full retraction) and change another's (correction).
+    let rounds: Vec<Vec<(Edge, Time, Diff)>> = vec![
+        vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((1, 5), 0, 1)],
+        vec![((0, 3), 1, 1), ((2, 7), 1, 1), ((1, 5), 1, -1)],
+        vec![((2, 8), 2, 1), ((0, 2), 2, -1), ((3, 4), 2, 1)],
+    ];
+
+    for window in [1, 2, 100] {
+        let mut tactic = ProxyReduceTactic::new(GraphReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+
+        for (r, updates) in rounds.iter().enumerate() {
+            let r = r as Time;
+            let input = batch(updates.clone(), r, r + 1);
+            let lower = Antichain::from_elem(r);
+            let upper = Antichain::from_elem(r + 1);
+            let held = Antichain::from_elem(r);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+        }
+
+        // Oracle: at each round boundary, the accumulated output is exactly the
+        // per-source counts of the accumulated input.
+        for t in 0..rounds.len() as Time {
+            let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), t);
+            let mut expected: Vec<(Edge, Diff)> = Vec::new();
+            let mut counts: std::collections::BTreeMap<u32, Diff> = std::collections::BTreeMap::new();
+            for ((src, _dst), d) in &input_acc {
+                *counts.entry(*src).or_insert(0) += d;
+            }
+            for (src, c) in counts {
+                assert!(c >= 0);
+                if c > 0 {
+                    expected.push(((src, c as u32), 1));
+                }
+            }
+            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), t);
+            assert_eq!(got, expected, "window={window} at time={t}");
+        }
+    }
+}

From 05c481134e016c49818e90c26a553cb7c4798913 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 17:31:22 -0400
Subject: [PATCH 04/18] Bytes backend, and the adversarial-review fix wave
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tests/int_proxy_bytes.rs: the compressing-token instantiation over
opaque [u8] rows of unknown shape, stored columnar (bytes + bounds +
aligned time/diff columns) with a stored (G, I) token column computed
at formation — presentation is a column read, never a re-hash. Group
collisions are *resolved*, not detected: join's cross re-checks real
key bytes and drops false pairs; reduce partitions each granule by real
key and reduces the parts separately. Weak-hash tests force both
collision kinds: value collisions panic at their T1 site (formation,
redemption, stash); group collisions must yield byte-identical output
to the naive oracle.

A six-angle adversarial review of the branch produced fixes applied
here:

Harness contract completeness:
* Stray records/seeds — anything presented for a group absent from
  window.keys was silently discarded by the skip loops; now hard
  asserts (per-key strays-below, end-of-window trailing).
* Empty-window progress guards: a backend returning Some with nothing
  presented used to hang the retire loop / scheduler; now asserted.
* Ascending-window watermark: one shared checker (assert_ascending_
  window) replaces two divergent inline copies; pending-coverage and
  watermark checks upgraded from debug_assert to hard asserts — the
  failure class (dropped carried times, released capabilities, lost
  matches) is silent corruption, and the checks are O(1)/window.
* Join's fresh-coverage clause documented as uncheckable (the harness
  is data-oblivious); missing it silently loses matches.

Indirection-tax fixes in JoinUnit:
* Yields per key rather than per window: ready holds at most one key's
  containers instead of a whole window's cross product.
* Match buffers and replay histories hoisted onto the unit; cross now
  takes slices, ending the mem::take capacity destruction each flush.
* Reduce phase 2 sweeps a live-key list with swap-remove rather than
  rescanning exhausted slots under moment-count skew.

Reference-backend upgrades:
* Fresh-side driving restored (the old present0-then-filter behavior):
  both join backends window over the fresh side's groups and skip the
  accumulated side's others — O(fresh) presentations, empty fresh side
  free.
* Interleaved-units test: two half-drained units alternately polled
  against one shared backend, the scenario that motivated type Cursor.
* started flags replaced by idempotent resize; RowBatch::form now uses
  consolidate_updates; test-grade patterns (next_group rescan, redeem
  by search) labeled with the real-backend alternative.

Deferred with notes: window-buffer recycling in the protocol, scratch
pooling vs the Token 'static bound (both for SEAM.md open items).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/join.rs           | 173 +++--
 .../src/operators/int_proxy/mod.rs            |  24 +-
 .../src/operators/int_proxy/reduce.rs         |  53 +-
 .../tests/int_proxy_bytes.rs                  | 669 ++++++++++++++++++
 .../tests/int_proxy_graphs.rs                 | 147 ++--
 5 files changed, 948 insertions(+), 118 deletions(-)
 create mode 100644 differential-dataflow/tests/int_proxy_bytes.rs

diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index e8b0ede98..288ff7374 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -68,16 +68,25 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// Produce the next window of the join unit, and advance `cursor`.
     ///
     /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
-    /// every group appearing in the `fresh` side's data; groups absent from either side may be
-    /// omitted (they produce no matches). Both bridges **must be sorted and consolidated** by
-    /// `((group, token), time)`. The backend sizes windows to amortize harness crossings; both
-    /// bridges are live at once, so tighter windows mean less state.
+    /// every group appearing in the `fresh` side's data; groups absent from either side should
+    /// be omitted (they produce no matches, and driving the unit by the fresh side's groups is
+    /// what makes a small fresh batch against a large trace cost `O(fresh)` presentations
+    /// rather than `O(trace)`). Note: the harness is data-oblivious and *cannot check* the
+    /// coverage clause — it checks ordering, progress, and sortedness; missing a fresh group
+    /// silently loses that group's matches. Both bridges **must be sorted and consolidated**
+    /// by `((group, token), time)`. The backend sizes windows to amortize harness crossings;
+    /// both bridges are live at once, so tighter windows mean less state.
     fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut Self::Cursor) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
     /// From a list of left and right tokens, and corresponding times and diffs, the output.
-    fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: Vec<B0::Time>, diffs: Vec<Self::ROut>) -> Self::Output;
+    ///
+    /// All four slices have equal length, entry `n` describing match `n`. The slices are the
+    /// harness's reused buffers: read them, build the output, and take nothing.
+    fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: &[B0::Time], diffs: &[Self::ROut]) -> Self::Output;
 }
 
 /// A proxy-space [`JoinTactic`]: matches records of the presented windows by group token,
+/// crosses matched pairs with joined times and multiplied diffs, and defers all value
+/// semantics to the backend.
 ///
 /// The backend sits behind an `Rc<RefCell<_>>` because prepared units are *lazy*: the join
 /// driver holds each unit's iterator across scheduler activations and drains it under fuel,
@@ -113,8 +122,13 @@ where
             cursor: Bk::Cursor::default(),
             high: None,
             done: false,
+            current: None,
             h0: IdHistory::new(),
             h1: IdHistory::new(),
+            li: Vec::new(),
+            ri: Vec::new(),
+            ot: Vec::new(),
+            od: Vec::new(),
             ready: std::collections::VecDeque::new(),
         })
     }
@@ -123,13 +137,19 @@ where
 /// Update count threshold used to return to the backend with join output to instantiate.
 const JOIN_CHUNK: usize = 1 << 20;
 
-/// One lazy join unit: owns its batches and streams outputs window by window.
+/// One lazy join unit: owns its batches and streams outputs a key at a time.
+///
+/// Each `next` first drains `ready`; when empty it advances the unit by one step —
+/// fetching the next window if none is in progress, or merge-matching **one** key from
+/// the window in progress and crossing its matched records. Containers are cut at
+/// ~[`JOIN_CHUNK`] matches, wherever that lands (mid-key included; parity: their
+/// concatenation is the single-container output), with any remainder flushed when the
+/// unit exhausts. Peak state is one window's presentations plus one key's containers.
+///
+/// The match buffers (`li`/`ri`/`ot`/`od`) and replay histories (`h0`/`h1`) live on the
+/// unit, reused across keys and windows, so steady-state operation allocates only what
+/// the backend's presentations and outputs themselves require.
 ///
-/// Each `next` first drains `ready`; when empty it asks the backend for the next window,
-/// merge-matches the window's two presented runs by group, and cross-products matched
-/// records into output containers — one per ~[`JOIN_CHUNK`] matches, flushed wherever the
-/// batch fills (including mid-key; parity: their concatenation is the single-container
-/// output). Peak state is one window's presentations plus the containers it produced.
 /// `lower` is the capability's time, a lower bound on the fresh side's times, so the
 /// accumulated side loads compacted (see [`JoinInstance`]); every output is produced under
 /// that capability, so advancing loaded times by it leaves the output unchanged.
@@ -144,11 +164,18 @@ struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoin
     /// Greatest group presented so far, to enforce ascending windows.
     high: Option<Bk::Group>,
     done: bool,
+    /// The window in progress and the merge positions into its two bridges.
+    current: Option<(JoinWindow<Bk::Group, Bk::Token0, Bk::Token1, B0::Time, Bk::R0, Bk::R1>, usize, usize)>,
     /// Per-key replay histories, held across the unit and reloaded per key (only the >=16/>=16
     /// replay-wave path touches them), so a high-fanout join pays no per-key `IdHistory` alloc.
     h0: IdHistory<Bk::Token0, B0::Time, Bk::R0>,
     h1: IdHistory<Bk::Token1, B0::Time, Bk::R1>,
-    /// Outputs produced by the current window, not yet handed to the driver.
+    /// Match buffers, held across keys and windows; flushed at `JOIN_CHUNK` and at unit end.
+    li: Vec<(Bk::Group, Bk::Token0)>,
+    ri: Vec<(Bk::Group, Bk::Token1)>,
+    ot: Vec<B0::Time>,
+    od: Vec<Bk::ROut>,
+    /// Outputs produced but not yet handed to the driver: at most one key's containers.
     ready: std::collections::VecDeque<Bk::Output>,
 }
 
@@ -160,59 +187,87 @@ where
 {
     type Item = Bk::Output;
     fn next(&mut self) -> Option<Bk::Output> {
-        while self.ready.is_empty() && !self.done {
-            let mut backend = self.backend.borrow_mut();
+        while self.ready.is_empty() {
+            let backend = self.backend.clone();
+            let mut backend = backend.borrow_mut();
             let instance = JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() };
-            match backend.next_window(&instance, self.fresh, &mut self.cursor) {
-                None => { self.done = true; }
-                Some(window) => {
-                    let p0 = &window.input0;
-                    let p1 = &window.input1;
-                    super::debug_assert_sorted_bridge(p0, "next_window.input0");
-                    super::debug_assert_sorted_bridge(p1, "next_window.input1");
-                    debug_assert!(
-                        self.high.map_or(true, |h| p0.first().map_or(true, |r| r.0.0 > h) && p1.first().map_or(true, |r| r.0.0 > h)),
-                        "next_window: windows must present strictly ascending group ranges",
-                    );
-                    if let Some(hi) = p0.last().map(|r| r.0.0).into_iter().chain(p1.last().map(|r| r.0.0)).max() {
-                        self.high = Some(hi);
-                    }
 
-                    // Merge-join the window's runs on group token (both sorted) and cross matched
-                    // pairs. `flush` ships the accumulated batch as a container and resets the
-                    // buffers; `join_key` calls it at each `JOIN_CHUNK` boundary — including
-                    // *within* a high-fanout key's wave — so no single key materializes more than
-                    // a chunk of its cross product.
-                    let ready = &mut self.ready;
-                    let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
-                        ready.push_back(backend.cross(&instance, li.as_slice(), ri.as_slice(), std::mem::take(ot), std::mem::take(od)));
-                        li.clear();
-                        ri.clear();
-                    };
+            // Exhausted: flush any straggling matches as the final container.
+            if self.done && self.current.is_none() {
+                if self.li.is_empty() {
+                    return None;
+                }
+                let out = backend.cross(&instance, &self.li, &self.ri, &self.ot, &self.od);
+                self.li.clear();
+                self.ri.clear();
+                self.ot.clear();
+                self.od.clear();
+                return Some(out);
+            }
 
-                    let (mut li, mut ri) = (Vec::new(), Vec::new());
-                    let (mut ot, mut od) = (Vec::new(), Vec::new());
-                    let (mut i, mut j) = (0usize, 0usize);
-                    while i < p0.len() && j < p1.len() {
-                        let (ki, kj) = (p0[i].0.0, p1[j].0.0);
-                        if ki < kj {
-                            i += 1;
-                        } else if kj < ki {
-                            j += 1;
-                        } else {
-                            let mut e0 = i;
-                            while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
-                            let mut e1 = j;
-                            while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
-                            join_key(ki, p0, i..e0, p1, j..e1, &mut self.h0, &mut self.h1, &mut li, &mut ri, &mut ot, &mut od, &mut flush);
-                            i = e0;
-                            j = e1;
-                        }
+            // Fetch the next window if none is in progress.
+            if self.current.is_none() {
+                match backend.next_window(&instance, self.fresh, &mut self.cursor) {
+                    None => {
+                        self.done = true;
                     }
-                    if !li.is_empty() {
-                        flush(&mut li, &mut ri, &mut ot, &mut od);
+                    Some(window) => {
+                        super::debug_assert_sorted_bridge(&window.input0, "next_window.input0");
+                        super::debug_assert_sorted_bridge(&window.input1, "next_window.input1");
+                        // Progress guard: an empty window cannot advance the watermark, so a
+                        // backend emitting them repeatedly would spin this loop forever. Skip
+                        // fully-cancelled ranges internally, or return `None`.
+                        assert!(
+                            !window.input0.is_empty() || !window.input1.is_empty(),
+                            "next_window: windows must present at least one record",
+                        );
+                        let first = window.input0.first().map(|r| r.0.0).into_iter().chain(window.input1.first().map(|r| r.0.0)).min();
+                        let last = window.input0.last().map(|r| r.0.0).into_iter().chain(window.input1.last().map(|r| r.0.0)).max();
+                        super::assert_ascending_window(&mut self.high, first, last, "join");
+                        self.current = Some((window, 0, 0));
                     }
                 }
+                continue;
+            }
+
+            // Merge-match at most ONE key from the window in progress, so `ready` holds at
+            // most one key's containers. `flush` ships the accumulated batch as a container
+            // and resets the buffers; `join_key` calls it at each `JOIN_CHUNK` boundary —
+            // including *within* a high-fanout key's wave — so no single key materializes
+            // more than a chunk of its cross product at a time in the match buffers.
+            let (window, i, j) = self.current.as_mut().unwrap();
+            let p0 = &window.input0;
+            let p1 = &window.input1;
+            let (h0, h1) = (&mut self.h0, &mut self.h1);
+            let (li, ri, ot, od) = (&mut self.li, &mut self.ri, &mut self.ot, &mut self.od);
+            let ready = &mut self.ready;
+            let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
+                ready.push_back(backend.cross(&instance, li.as_slice(), ri.as_slice(), ot.as_slice(), od.as_slice()));
+                li.clear();
+                ri.clear();
+                ot.clear();
+                od.clear();
+            };
+            let mut matched = false;
+            while !matched && *i < p0.len() && *j < p1.len() {
+                let (ki, kj) = (p0[*i].0.0, p1[*j].0.0);
+                if ki < kj {
+                    *i += 1;
+                } else if kj < ki {
+                    *j += 1;
+                } else {
+                    let mut e0 = *i;
+                    while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
+                    let mut e1 = *j;
+                    while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
+                    join_key(ki, p0, *i..e0, p1, *j..e1, h0, h1, li, ri, ot, od, &mut flush);
+                    *i = e0;
+                    *j = e1;
+                    matched = true;
+                }
+            }
+            if *i >= p0.len() || *j >= p1.len() {
+                self.current = None;
             }
         }
         self.ready.pop_front()
diff --git a/differential-dataflow/src/operators/int_proxy/mod.rs b/differential-dataflow/src/operators/int_proxy/mod.rs
index 10ad00eba..e30eeee6d 100644
--- a/differential-dataflow/src/operators/int_proxy/mod.rs
+++ b/differential-dataflow/src/operators/int_proxy/mod.rs
@@ -1,4 +1,4 @@
-//! Backend-agnostic operator tactics using integer proxies.
+//! Backend-agnostic operator tactics using token proxies.
 //!
 //! The tactics are intended to support custom operator implementations without rebuilding
 //! the non-trivial and often non-obvious time-based logic that supports them.
@@ -9,9 +9,9 @@
 //! backend-chosen `Copy + Ord` types — commonly `u64` hashes, but exact values for small
 //! data (`G = u32` node ids, tokens `(u32, u32)` edges), wider hashes for insurance, or
 //! dense ids where exactness is required.
-//! The tactics first elicit proxy identifiers from the backends, perform their necessary time
-//! and difference based computations to stage integer collections, and then re-invoke the
-//! backends with those same identifiers to produce the necessary output.
+//! The tactics first elicit proxy tokens from the backends, perform their necessary time
+//! and difference based computations to stage token collections, and then re-invoke the
+//! backends with those same tokens to produce the necessary output.
 //!
 //! The backend is oblivious to the navigation of time, and the operator to the backend's
 //! implementation.
@@ -74,5 +74,21 @@ pub(crate) fn debug_assert_sorted_bridge<G: Ord, I: Ord, T: Ord, R>(bridge: &Pro
     );
 }
 
+/// Contract helper: `first`/`last` are a window's least and greatest group; the window
+/// must sit strictly above the `high` watermark of everything already presented, which
+/// is then advanced.
+///
+/// A hard assert, not a debug assert: the checks are O(1) per window, and the failure
+/// class they catch — a backend presenting overlapping or regressed windows — corrupts
+/// output silently (dropped matches, doubled corrections) rather than crashing.
+pub(crate) fn assert_ascending_window<G: Copy + Ord>(high: &mut Option<G>, first: Option<G>, last: Option<G>, who: &str) {
+    if let (Some(h), Some(f)) = (*high, first) {
+        assert!(f > h, "{}: windows must present strictly ascending group ranges", who);
+    }
+    if last.is_some() {
+        *high = last;
+    }
+}
+
 pub use join::{JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic};
 pub use reduce::{ProxyReduceBackend, ProxyReduceTactic, ReduceInstance, ReduceWindow};
diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index 45cf1fa5e..a88b36acb 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -187,6 +187,7 @@ where
         let mut cur_out: Vec<(Bk::Token, Bk::ROut)> = Vec::new();
         let mut moments_scratch: Vec<B1::Time> = Vec::new();
         let mut pended_scratch: Vec<B1::Time> = Vec::new();
+        let mut live: Vec<usize> = Vec::new();
 
         while let Some(window) = self.backend.next_window(&instance, &pending_keys) {
             let p_in = &window.input;
@@ -196,15 +197,18 @@ where
             super::debug_assert_sorted_bridge(p_out, "next_window.output");
             debug_assert!(seeds.windows(2).all(|w| w[0].0 <= w[1].0), "window seeds must be sorted by group token");
             debug_assert!(window.keys.windows(2).all(|w| w[0] < w[1]), "window keys must be strictly ascending");
-            debug_assert!(
-                prev_high.map_or(true, |h| window.keys.first().map_or(true, |k| *k > h)),
-                "next_window: windows must present strictly ascending group ranges",
-            );
-            if let Some(last) = window.keys.last() { prev_high = Some(*last); }
+            // Progress guard: an empty window cannot advance the watermark, so a backend
+            // emitting them repeatedly would spin this loop forever inside one retire.
+            assert!(!window.keys.is_empty(), "next_window: windows must list at least one key");
+            super::assert_ascending_window(&mut prev_high, window.keys.first().copied(), window.keys.last().copied(), "reduce");
             // Pending coverage: windows ascend, so a pending group below a presented key can
             // never appear later; it must have been included in this or an earlier window.
+            // A hard assert, not debug: a skipped pending group's carried times would be
+            // silently dropped below, collapsing the frontier and releasing the capability
+            // that its deferred correction needs — permanent wrong output. The walk is a few
+            // integer compares per key, noise against the per-key reduction work.
             for key in &window.keys {
-                debug_assert!(
+                assert!(
                     pending_keys.get(pend_idx).map_or(true, |p| p >= key),
                     "next_window skipped a pending group",
                 );
@@ -223,15 +227,19 @@ where
             let mut n_states = 0usize;
             let (mut is, mut os) = (0usize, 0usize);
             for &key in &window.keys {
-                while is < p_in.len() && p_in[is].0.0 < key { is += 1; }
+                // Strays are hard errors: a record or seed whose group is below the current
+                // key belongs to no listed key (earlier keys consumed their runs), and the
+                // old skip-loops would have silently discarded it — wrong output with no
+                // diagnostic. Ascending keys make the check one compare per key.
+                assert!(is >= p_in.len() || p_in[is].0.0 >= key, "next_window presented input records for a group absent from keys");
                 let i0 = is;
                 while is < p_in.len() && p_in[is].0.0 == key { is += 1; }
                 let i1 = is;
-                while os < p_out.len() && p_out[os].0.0 < key { os += 1; }
+                assert!(os >= p_out.len() || p_out[os].0.0 >= key, "next_window presented output records for a group absent from keys");
                 let o0 = os;
                 while os < p_out.len() && p_out[os].0.0 == key { os += 1; }
                 let o1 = os;
-                while ns < seeds.len() && seeds[ns].0 < key { ns += 1; }
+                assert!(ns >= seeds.len() || seeds[ns].0 >= key, "next_window presented seeds for a group absent from keys");
                 let n0 = ns;
                 while ns < seeds.len() && seeds[ns].0 == key { ns += 1; }
                 let n1 = ns;
@@ -277,6 +285,11 @@ where
                 st.out_replay.load_iter((o0..o1).map(|o| (p_out[o].0.1, p_out[o].1.clone(), p_out[o].2.clone())), st.meets.first());
                 n_states += 1;
             }
+            // Everything presented must have belonged to a listed key (the strays-below
+            // case is asserted per key above; this is the trailing case).
+            assert_eq!(is, p_in.len(), "next_window presented trailing input records past the last key");
+            assert_eq!(os, p_out.len(), "next_window presented trailing output records past the last key");
+            assert_eq!(ns, seeds.len(), "next_window presented trailing seeds past the last key");
 
             // Phase 2 (application): walk all keys' moments in ROUNDS. Each round assembles every
             // active key's one-moment-deep input and current-output accumulations and crosses them in
@@ -285,6 +298,8 @@ where
             // call count at O(max moments over keys), not O(sum of moments), with peak materialization
             // one moment deep per key. `produced` is meet-collapsed each round, exactly like the
             // reference — bounded, not the O(times × values) delta history.
+            live.clear();
+            live.extend(0..n_states);
             loop {
                 batch_keys.clear();
                 in_ends.clear();
@@ -292,12 +307,19 @@ where
                 out_ends.clear();
                 out_all.clear();
                 active.clear();
-                let mut advanced = false;
-                for (si, st) in states[..n_states].iter_mut().enumerate() {
+                // Sweep the live keys, retiring exhausted ones by swap-remove, so each round
+                // costs O(live keys) rather than rescanning every exhausted slot under
+                // moment-count skew (order across keys within a round does not matter —
+                // distinct keys are independent; a key's own moments stay sequential).
+                let mut idx = 0;
+                while idx < live.len() {
+                    let si = live[idx];
+                    let st = &mut states[si];
                     if st.cursor >= st.moments.len() {
+                        live.swap_remove(idx);
                         continue;
                     }
-                    advanced = true;
+                    idx += 1;
                     let j = st.cursor;
                     st.cursor += 1;
                     let t = st.moments[j].clone();
@@ -338,7 +360,7 @@ where
                 // Terminate only when every key is EXHAUSTED — not merely when this round produced no
                 // crossing. A round can be empty because every key's current moment is empty-gated
                 // while keys still have later (non-empty) moments; breaking here would drop them.
-                if !advanced {
+                if live.is_empty() {
                     break;
                 }
                 if batch_keys.is_empty() {
@@ -371,7 +393,10 @@ where
             }
         }
 
-        debug_assert_eq!(pend_idx, pending_keys.len(), "next_window must cover all pending groups before finishing");
+        // Hard for the same reason as the per-window pending walk: an uncovered pending
+        // group's carried times would be dropped and its capability released — permanent
+        // silent wrong output in exchange for one integer compare.
+        assert_eq!(pend_idx, pending_keys.len(), "next_window must cover all pending groups before finishing");
         self.pending = new_pending;
         let produced: Vec<(B1::Time, B2)> = tile_held.into_iter().zip(self.backend.finish()).collect();
         let mut frontier = Antichain::new();
diff --git a/differential-dataflow/tests/int_proxy_bytes.rs b/differential-dataflow/tests/int_proxy_bytes.rs
new file mode 100644
index 000000000..15b3b2db5
--- /dev/null
+++ b/differential-dataflow/tests/int_proxy_bytes.rs
@@ -0,0 +1,669 @@
+//! Behavioral tests for the proxy tactics against a byte-rows backend.
+//!
+//! The compressing-token instantiation from the seam design, aimed at data as general
+//! as Materialize's `[u8]` rows of unknown size and shape. Rows are opaque byte strings;
+//! the grouping opinion extracts a key prefix (here: bytes before the first `b'|'`).
+//! Storage is columnar (concatenated bytes + bounds, aligned time/diff columns) with a
+//! **stored token column** `(G, I)` computed once at batch formation — presentation is
+//! a pure column read, never a re-hash. `G = hash(key)`, `I = hash(whole row)` (whole
+//! datum, so value confusion under a group collision needs a double collision).
+//!
+//! Rows are stored in token order — `((G, I), row, time)` — so equal-token rows are
+//! adjacent and batch formation doubles as T1 *value*-collision detection; join's
+//! `redeem` and reduce's key/row stashes re-check at redemption, the other T1 sites.
+//! *Group* collisions (distinct keys, equal `G`) are not errors under compression —
+//! they are **resolved** per the module contract: join's `cross` re-checks real key
+//! bytes and drops false pairs; reduce partitions each granule by real key and reduces
+//! the parts separately. Weak-hash tests force both collision kinds: value collisions
+//! must panic at their detection site; group collisions must yield *correct output*.
+
+use std::collections::BTreeMap;
+
+use timely::progress::frontier::AntichainRef;
+use timely::progress::Antichain;
+
+use differential_dataflow::consolidation::{consolidate, consolidate_updates};
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
+    ProxyReduceTactic, ReduceInstance, ReduceWindow,
+};
+use differential_dataflow::operators::join::{Fresh, JoinTactic};
+use differential_dataflow::operators::reduce::ReduceTactic;
+use differential_dataflow::trace::{BatchReader, Description};
+
+type Time = u64;
+type Diff = isize;
+type Row = Vec<u8>;
+type Hasher = fn(&[u8]) -> u64;
+
+/// The grouping opinion: a row's key is its prefix before the first `b'|'`.
+fn key_of(row: &[u8]) -> &[u8] {
+    match row.iter().position(|b| *b == b'|') {
+        Some(p) => &row[..p],
+        None => row,
+    }
+}
+
+/// A real hash (SipHash via std).
+fn hash(bytes: &[u8]) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    bytes.hash(&mut h);
+    h.finish()
+}
+
+/// A deliberately terrible hash, to force collisions in tests.
+fn weak_hash(bytes: &[u8]) -> u64 {
+    hash(bytes) & 0x3
+}
+
+/// Weak for keys (which never contain `b'|'`), strong for whole rows (which always do):
+/// forces *group* collisions while value tokens stay distinct, so the resolution paths
+/// are exercised rather than the panic paths.
+fn weak_group_hash(bytes: &[u8]) -> u64 {
+    if bytes.contains(&b'|') { hash(bytes) } else { hash(bytes) & 0x3 }
+}
+
+/// A columnar batch of row updates: concatenated bytes with bounds, aligned time,
+/// diff, and token columns, in `((G, I), time)` order with row bytes as tiebreak.
+#[derive(Clone)]
+struct RowBatch {
+    data: Vec<u8>,
+    /// Row `i` is `data[bounds[i]..bounds[i + 1]]`; `bounds.len() == rows + 1`.
+    bounds: Vec<usize>,
+    times: Vec<Time>,
+    diffs: Vec<Diff>,
+    /// The stored token column: `(G, I)` per row, computed at formation.
+    tokens: Vec<(u64, u64)>,
+    description: Description<Time>,
+}
+
+impl BatchReader for RowBatch {
+    type Time = Time;
+    fn len(&self) -> usize { self.times.len() }
+    fn description(&self) -> &Description<Time> { &self.description }
+}
+
+impl RowBatch {
+    fn row(&self, i: usize) -> &[u8] {
+        &self.data[self.bounds[i]..self.bounds[i + 1]]
+    }
+
+    /// Form a batch: tokenize, sort + consolidate by `((G, I), row, time)` (the library's
+    /// `consolidate_updates`, so test batches agree with real DD consolidation), and check
+    /// formation-site T1 — equal tokens must carry equal bytes, which sorting makes adjacent.
+    fn form(updates: Vec<(Row, Time, Diff)>, lower: Time, upper: Time, hasher: Hasher) -> Self {
+        let mut tokenized: Vec<(((u64, u64), Row), Time, Diff)> = updates
+            .into_iter()
+            .map(|(row, t, r)| {
+                let g = hasher(key_of(&row));
+                let i = hasher(&row);
+                (((g, i), row), t, r)
+            })
+            .collect();
+        consolidate_updates(&mut tokenized);
+        for w in tokenized.windows(2) {
+            if w[0].0 .0 == w[1].0 .0 {
+                assert!(w[0].0 .1 == w[1].0 .1, "token collision detected at formation");
+            }
+        }
+        let formed: Vec<((u64, u64), Row, Time, Diff)> =
+            tokenized.into_iter().map(|((tok, row), t, r)| (tok, row, t, r)).collect();
+
+        let mut batch = RowBatch {
+            data: Vec::new(),
+            bounds: vec![0],
+            times: Vec::new(),
+            diffs: Vec::new(),
+            tokens: Vec::new(),
+            description: Description::new(
+                Antichain::from_elem(lower),
+                Antichain::from_elem(upper),
+                Antichain::from_elem(0),
+            ),
+        };
+        for (tok, row, t, r) in formed {
+            batch.data.extend_from_slice(&row);
+            batch.bounds.push(batch.data.len());
+            batch.times.push(t);
+            batch.diffs.push(r);
+            batch.tokens.push(tok);
+        }
+        batch
+    }
+}
+
+/// Advance a time to the compaction frontier (total order: max against its element).
+fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
+    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
+}
+
+/// The next group at or after the per-batch positions `pos` into `batches`.
+///
+/// Test-grade: rescans every batch head per group. A real backend should k-way merge
+/// with a heap over batch cursors.
+fn next_group(batches: &[RowBatch], pos: &[usize]) -> Option<u64> {
+    batches
+        .iter()
+        .zip(pos.iter())
+        .filter_map(|(b, &p)| b.tokens.get(p).map(|t| t.0))
+        .min()
+}
+
+/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`,
+/// straight off the columns — no hashing at presentation time.
+fn drain_group(
+    batches: &[RowBatch],
+    pos: &mut [usize],
+    g: u64,
+    mut logic: impl FnMut(&RowBatch, usize),
+) {
+    for (b, p) in batches.iter().zip(pos.iter_mut()) {
+        while *p < b.tokens.len() && b.tokens[*p].0 == g {
+            logic(b, *p);
+            *p += 1;
+        }
+    }
+}
+
+/// Redeem a token to its row bytes, checking redemption-site T1: every batch holding
+/// the token must agree on the bytes.
+///
+/// Test-grade: binary-searches every batch's token column per redeemed token. A real
+/// backend should redeem from a window-scoped stash harvested during presentation
+/// (as the reduce backend's `minted` demonstrates) rather than search the trace.
+fn redeem<'a>(batches: &'a [RowBatch], token: (u64, u64)) -> &'a [u8] {
+    let mut found: Option<&[u8]> = None;
+    for b in batches {
+        let lo = b.tokens.partition_point(|t| *t < token);
+        let hi = b.tokens.partition_point(|t| *t <= token);
+        for i in lo..hi {
+            match found {
+                None => found = Some(b.row(i)),
+                Some(prev) => assert!(prev == b.row(i), "token collision detected at redemption"),
+            }
+        }
+    }
+    found.expect("token redeemed but never presented")
+}
+
+// ---------------------------------------------------------------- join backend
+
+#[derive(Default)]
+struct RowJoinCursor {
+    pos0: Vec<usize>,
+    pos1: Vec<usize>,
+}
+
+struct RowJoinBackend {
+    /// Groups per window; tiny in tests to force many windows.
+    window: usize,
+}
+
+impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
+    type Group = u64;
+    type Token0 = u64;
+    type Token1 = u64;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    /// Matched row pairs with their joined time and multiplied diff.
+    type Output = Vec<(Row, Row, Time, Diff)>;
+    type Cursor = RowJoinCursor;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, RowBatch, RowBatch>,
+        fresh: Fresh,
+        cursor: &mut RowJoinCursor,
+    ) -> Option<JoinWindow<u64, u64, u64, Time, Diff, Diff>> {
+        cursor.pos0.resize(instance.batches0.len(), 0);
+        cursor.pos1.resize(instance.batches1.len(), 0);
+        // Drive by the fresh side's groups: the accumulated side's other groups are
+        // skipped, never presented (O(fresh) presentations; empty fresh side is free).
+        let (fresh_b, other_b) = match fresh {
+            Fresh::Input0 => (instance.batches0, instance.batches1),
+            Fresh::Input1 => (instance.batches1, instance.batches0),
+        };
+        loop {
+            let mut fresh_run = Vec::new();
+            let mut other_run = Vec::new();
+            let mut groups = 0;
+            while groups < self.window {
+                let (fresh_pos, other_pos) = match fresh {
+                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
+                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
+                };
+                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
+                groups += 1;
+                drain_group(fresh_b, fresh_pos, g, |b, i| {
+                    fresh_run.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
+                });
+                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
+                    while *p < b.tokens.len() && b.tokens[*p].0 < g {
+                        *p += 1;
+                    }
+                }
+                drain_group(other_b, other_pos, g, |b, i| {
+                    other_run.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
+                });
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut fresh_run);
+            consolidate_updates(&mut other_run);
+            // A fully-cancelled quota presents nothing; keep going rather than emit an
+            // empty window (the harness's progress guard forbids those).
+            if fresh_run.is_empty() && other_run.is_empty() {
+                continue;
+            }
+            let (input0, input1) = match fresh {
+                Fresh::Input0 => (fresh_run, other_run),
+                Fresh::Input1 => (other_run, fresh_run),
+            };
+            return Some(JoinWindow { input0, input1 });
+        }
+    }
+
+    fn cross(
+        &mut self,
+        instance: &JoinInstance<'_, RowBatch, RowBatch>,
+        left: &[(u64, u64)],
+        right: &[(u64, u64)],
+        times: &[Time],
+        diffs: &[Diff],
+    ) -> Self::Output {
+        // Not self-redeeming: tokens are redeemed against the columns, T1-checked. Group
+        // collisions are resolved here, per the module contract: matching was by group
+        // token, so re-check real key bytes and drop false pairs.
+        left.iter()
+            .zip(right)
+            .zip(times)
+            .zip(diffs)
+            .filter_map(|(((l, r), t), d)| {
+                let lrow = redeem(instance.batches0, *l);
+                let rrow = redeem(instance.batches1, *r);
+                if key_of(lrow) == key_of(rrow) {
+                    Some((lrow.to_vec(), rrow.to_vec(), *t, *d))
+                } else {
+                    None
+                }
+            })
+            .collect()
+    }
+}
+
+/// Reference join: all row pairs with equal key bytes, times joined, diffs multiplied.
+fn naive_join(
+    a: &[(Row, Time, Diff)],
+    b: &[(Row, Time, Diff)],
+) -> Vec<((Row, Row), Time, Diff)> {
+    let mut out = Vec::new();
+    for (r0, t0, d0) in a {
+        for (r1, t1, d1) in b {
+            if key_of(r0) == key_of(r1) {
+                out.push(((r0.clone(), r1.clone()), std::cmp::max(*t0, *t1), d0 * d1));
+            }
+        }
+    }
+    consolidate_updates(&mut out);
+    out
+}
+
+fn rows(spec: &[(&str, Time, Diff)]) -> Vec<(Row, Time, Diff)> {
+    spec.iter().map(|(s, t, d)| (s.as_bytes().to_vec(), *t, *d)).collect()
+}
+
+/// Drive the proxy join at several window sizes and both `Fresh` choices, comparing
+/// against the byte-level naive join (which compares *real* key bytes).
+fn check_join(hasher: Hasher) {
+    // Variable-length rows, keys of different sizes, a retraction, several batches.
+    // Five distinct keys: under a 2-bit group hash, at least two must collide.
+    let a0 = rows(&[("alice|1", 0, 1), ("alice|22", 1, 1), ("bob|x", 0, 1), ("carol|zzz", 2, 1)]);
+    let a1 = rows(&[("alice|22", 2, -1), ("dave|4", 2, 1)]);
+    let b0 = rows(&[("alice|red", 1, 1), ("bob|blue", 2, 1), ("erin|green", 0, 1)]);
+    let b1 = rows(&[("bob|blue", 2, 1), ("carol|teal", 0, 1), ("dave|gray", 1, 1), ("erin|pink", 2, 1)]);
+
+    let all_a: Vec<_> = a0.iter().chain(&a1).cloned().collect();
+    let all_b: Vec<_> = b0.iter().chain(&b1).cloned().collect();
+    let expected = naive_join(&all_a, &all_b);
+
+    for window in [1, 2, 100] {
+        for fresh in [Fresh::Input0, Fresh::Input1] {
+            let mut tactic = ProxyJoinTactic::new(RowJoinBackend { window });
+            let work = tactic.prep(
+                vec![RowBatch::form(a0.clone(), 0, 3, hasher), RowBatch::form(a1.clone(), 0, 3, hasher)],
+                vec![RowBatch::form(b0.clone(), 0, 3, hasher), RowBatch::form(b1.clone(), 0, 3, hasher)],
+                fresh,
+                0,
+            );
+            let mut got: Vec<((Row, Row), Time, Diff)> =
+                work.flatten().map(|(l, r, t, d)| ((l, r), t, d)).collect();
+            consolidate_updates(&mut got);
+            assert_eq!(got, expected, "window={window}");
+        }
+    }
+}
+
+#[test]
+fn join_rows_matches_naive() {
+    check_join(hash);
+}
+
+#[test]
+fn join_resolves_group_collisions() {
+    // Forced group collisions (weak key hashes, strong row hashes): cross must re-check
+    // real key bytes and drop false pairs, yielding exactly the naive output.
+    check_join(weak_group_hash);
+}
+
+#[test]
+#[should_panic(expected = "token collision detected at formation")]
+fn formation_detects_collisions() {
+    // Two distinct rows under a 2-bit hash must collide within one batch.
+    let updates = rows(&[
+        ("a|0", 0, 1), ("a|1", 0, 1), ("a|2", 0, 1), ("a|3", 0, 1), ("a|4", 0, 1),
+    ]);
+    RowBatch::form(updates, 0, 1, weak_hash);
+}
+
+#[test]
+#[should_panic(expected = "token collision detected at redemption")]
+fn redemption_detects_cross_batch_collisions() {
+    // Find two distinct rows with the same weak token pair: same key (same G) and
+    // colliding 2-bit value hashes. Placed in *separate* batches, formation cannot
+    // see the collision; redemption must.
+    let candidates: Vec<Row> = (0..64).map(|i| format!("k|{i}").into_bytes()).collect();
+    let (r0, r1) = {
+        let mut found = None;
+        'outer: for (x, a) in candidates.iter().enumerate() {
+            for b in &candidates[x + 1..] {
+                if weak_hash(a) == weak_hash(b) {
+                    found = Some((a.clone(), b.clone()));
+                    break 'outer;
+                }
+            }
+        }
+        found.expect("2-bit hashes must collide among 64 rows")
+    };
+    let left0 = RowBatch::form(vec![(r0, 0, 1)], 0, 1, weak_hash);
+    let left1 = RowBatch::form(vec![(r1, 0, 1)], 0, 1, weak_hash);
+    let right = RowBatch::form(rows(&[("k|hit", 0, 1)]), 0, 1, weak_hash);
+
+    let mut tactic = ProxyJoinTactic::new(RowJoinBackend { window: 100 });
+    let work = tactic.prep(vec![left0, left1], vec![right], Fresh::Input0, 0);
+    let _: Vec<_> = work.collect();
+}
+
+// -------------------------------------------------------------- reduce backend
+
+/// Stash `row` under `token`, checking stash-site T1: a token maps to one byte string.
+fn stash_checked(map: &mut BTreeMap<(u64, u64), Row>, token: (u64, u64), row: &[u8]) {
+    match map.entry(token) {
+        std::collections::btree_map::Entry::Occupied(e) => {
+            assert!(e.get() == row, "token collision detected at stash");
+        }
+        std::collections::btree_map::Entry::Vacant(v) => {
+            v.insert(row.to_vec());
+        }
+    }
+}
+
+/// Counts rows per key: the output row for key `k` with count `c` is `k|c`.
+///
+/// Not self-redeeming, which exposes the expected pattern for byte backends: the
+/// window is the redemption scope. `next_window` walks the columns anyway, so it
+/// stashes what later steps need — key bytes per input token, and row bytes per
+/// presented output token; `reduce_corrections` partitions each granule by *real*
+/// key (resolving group collisions per the module contract) and mints tokens for
+/// desired rows it invents; `emit`/`finish` redeem from the stash. Nothing is ever
+/// re-derived from a hash.
+struct RowReduceBackend {
+    window: usize,
+    hasher: Hasher,
+    // Session state, bracketed by `begin`/`finish`.
+    tiles: Vec<Description<Time>>,
+    emitted: Vec<Vec<(Row, Time, Diff)>>,
+    pos_source: Vec<usize>,
+    pos_input: Vec<usize>,
+    pos_output: Vec<usize>,
+    pend_idx: usize,
+    /// Key bytes per input token, harvested while draining windows. (Compares key
+    /// bytes only: an input *value*-token collision merges two same-key rows, which
+    /// count-by-diffs tolerates; logics reading values would stash whole rows.)
+    input_keys: BTreeMap<(u64, u64), Row>,
+    /// Row bytes per output token: presented output rows and minted desired rows.
+    minted: BTreeMap<(u64, u64), Row>,
+}
+
+impl RowReduceBackend {
+    fn new(window: usize, hasher: Hasher) -> Self {
+        RowReduceBackend {
+            window,
+            hasher,
+            tiles: Vec::new(),
+            emitted: Vec::new(),
+            pos_source: Vec::new(),
+            pos_input: Vec::new(),
+            pos_output: Vec::new(),
+            pend_idx: 0,
+            input_keys: BTreeMap::new(),
+            minted: BTreeMap::new(),
+        }
+    }
+}
+
+impl ProxyReduceBackend<RowBatch, RowBatch> for RowReduceBackend {
+    type Group = u64;
+    type Token = u64;
+    type RIn = Diff;
+    type ROut = Diff;
+
+    fn begin(&mut self, tiles: &[Description<Time>]) {
+        self.tiles = tiles.to_vec();
+        self.emitted = vec![Vec::new(); tiles.len()];
+        self.pos_source.clear();
+        self.pos_input.clear();
+        self.pos_output.clear();
+        self.pend_idx = 0;
+        self.input_keys.clear();
+        self.minted.clear();
+    }
+
+    fn next_window(
+        &mut self,
+        instance: &ReduceInstance<'_, RowBatch, RowBatch>,
+        pending: &[u64],
+    ) -> Option<ReduceWindow<u64, u64, Time, Diff, Diff>> {
+        self.pos_source.resize(instance.source_batches.len(), 0);
+        self.pos_input.resize(instance.input_batches.len(), 0);
+        self.pos_output.resize(instance.output_batches.len(), 0);
+        let mut keys = Vec::new();
+        let mut seeds = Vec::new();
+        let mut input = Vec::new();
+        let mut output = Vec::new();
+        while keys.len() < self.window {
+            let g = [
+                next_group(instance.source_batches, &self.pos_source),
+                next_group(instance.input_batches, &self.pos_input),
+                next_group(instance.output_batches, &self.pos_output),
+                pending.get(self.pend_idx).copied(),
+            ]
+            .into_iter()
+            .flatten()
+            .min();
+            let Some(g) = g else { break };
+            keys.push(g);
+            if pending.get(self.pend_idx) == Some(&g) {
+                self.pend_idx += 1;
+            }
+            let input_keys = &mut self.input_keys;
+            drain_group(instance.source_batches, &mut self.pos_source, g, |b, i| {
+                stash_checked(input_keys, b.tokens[i], key_of(b.row(i)));
+                input.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
+            });
+            drain_group(instance.input_batches, &mut self.pos_input, g, |b, i| {
+                stash_checked(input_keys, b.tokens[i], key_of(b.row(i)));
+                seeds.push((g, b.times[i]));
+                input.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
+            });
+            let minted = &mut self.minted;
+            drain_group(instance.output_batches, &mut self.pos_output, g, |b, i| {
+                stash_checked(minted, b.tokens[i], b.row(i));
+                output.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
+            });
+        }
+        if keys.is_empty() {
+            return None;
+        }
+        consolidate_updates(&mut input);
+        consolidate_updates(&mut output);
+        seeds.sort();
+        seeds.dedup();
+        Some(ReduceWindow { keys, seeds, input, output })
+    }
+
+    fn reduce_corrections(
+        &mut self,
+        keys: &[u64],
+        in_ends: &[usize],
+        input: &[(u64, Diff)],
+        out_ends: &[usize],
+        output: &[(u64, Diff)],
+    ) -> (Vec<(u64, Diff)>, Vec<usize>) {
+        let mut corr = Vec::new();
+        let mut ends = Vec::new();
+        let (mut i0, mut o0) = (0, 0);
+        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+            // Partition the granule by REAL key: under compression, distinct keys can
+            // share a group token, and each must be reduced separately (the module
+            // contract's prescription for group collisions).
+            let mut per_key: BTreeMap<Row, (Diff, Vec<(u64, Diff)>)> = BTreeMap::new();
+            for (tok, d) in &input[i0..i1] {
+                let key = self.input_keys.get(&(*k, *tok)).expect("input token missing from key stash");
+                per_key.entry(key.clone()).or_default().0 += d;
+            }
+            for (tok, d) in &output[o0..o1] {
+                let row = self.minted.get(&(*k, *tok)).expect("output token was never presented");
+                per_key.entry(key_of(row).to_vec()).or_default().1.push((*tok, -d));
+            }
+            let mut delta: Vec<(u64, Diff)> = Vec::new();
+            for (key, (count, mut retractions)) in per_key {
+                assert!(count >= 0, "row count went negative");
+                if count > 0 {
+                    // Mint the desired output row and its token.
+                    let mut row = key;
+                    row.push(b'|');
+                    row.extend_from_slice(count.to_string().as_bytes());
+                    let token = (self.hasher)(&row);
+                    stash_checked(&mut self.minted, (*k, token), &row);
+                    delta.push((token, 1));
+                }
+                delta.append(&mut retractions);
+            }
+            consolidate(&mut delta);
+            corr.extend(delta);
+            ends.push(corr.len());
+            i0 = i1;
+            o0 = o1;
+        }
+        (corr, ends)
+    }
+
+    fn emit(&mut self, tile: usize, records: &[((u64, u64), Time, Diff)]) {
+        for ((g, i), t, r) in records {
+            let row = self.minted.get(&(*g, *i)).expect("emitted token was never minted or presented");
+            self.emitted[tile].push((row.clone(), *t, *r));
+        }
+    }
+
+    fn finish(&mut self) -> Vec<RowBatch> {
+        let hasher = self.hasher;
+        self.tiles
+            .drain(..)
+            .zip(self.emitted.drain(..))
+            .map(|(desc, updates)| {
+                let lower = desc.lower().elements()[0];
+                let upper = if desc.upper().elements().is_empty() { lower } else { desc.upper().elements()[0] };
+                let mut b = RowBatch::form(updates, lower, upper, hasher);
+                b.description = desc;
+                b
+            })
+            .collect()
+    }
+}
+
+/// Accumulate row updates at times `<= t`.
+fn accumulate(updates: impl Iterator<Item = (Row, Time, Diff)>, t: Time) -> Vec<(Row, Diff)> {
+    let mut acc: Vec<(Row, Diff)> =
+        updates.filter(|(_, ut, _)| *ut <= t).map(|(r, _, d)| (r, d)).collect();
+    consolidate(&mut acc);
+    acc
+}
+
+/// Drive the proxy reduce over several rounds at several window sizes, comparing
+/// accumulated outputs at every round boundary against byte-level per-key counts.
+fn check_reduce(hasher: Hasher) {
+    // Five distinct keys: under a 2-bit group hash, at least two must collide.
+    let rounds: Vec<Vec<(Row, Time, Diff)>> = vec![
+        rows(&[("alice|1", 0, 1), ("alice|22", 0, 1), ("bob|x", 0, 1), ("erin|e", 0, 1)]),
+        rows(&[("alice|333", 1, 1), ("carol|c", 1, 1), ("bob|x", 1, -1)]),
+        rows(&[("carol|d", 2, 1), ("alice|22", 2, -1), ("dave|9", 2, 1), ("erin|e", 2, -1)]),
+    ];
+
+    for window in [1, 2, 100] {
+        let mut tactic = ProxyReduceTactic::new(RowReduceBackend::new(window, hasher));
+        let mut source: Vec<RowBatch> = Vec::new();
+        let mut outputs: Vec<RowBatch> = Vec::new();
+
+        for (r, updates) in rounds.iter().enumerate() {
+            let r = r as Time;
+            let input = RowBatch::form(updates.clone(), r, r + 1, hasher);
+            let lower = Antichain::from_elem(r);
+            let upper = Antichain::from_elem(r + 1);
+            let held = Antichain::from_elem(r);
+            let (produced, frontier) =
+                tactic.retire(source.clone(), outputs.clone(), vec![input.clone()], &lower, &upper, &held);
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+        }
+
+        for t in 0..rounds.len() as Time {
+            let input_acc = accumulate(source.iter().flat_map(|b| (0..b.len()).map(|i| (b.row(i).to_vec(), b.times[i], b.diffs[i]))), t);
+            let mut counts: BTreeMap<Row, Diff> = BTreeMap::new();
+            for (row, d) in &input_acc {
+                *counts.entry(key_of(row).to_vec()).or_insert(0) += d;
+            }
+            let mut expected: Vec<(Row, Diff)> = Vec::new();
+            for (key, c) in counts {
+                assert!(c >= 0);
+                if c > 0 {
+                    let mut row = key.clone();
+                    row.push(b'|');
+                    row.extend_from_slice(c.to_string().as_bytes());
+                    expected.push((row, 1));
+                }
+            }
+            expected.sort();
+            let got = accumulate(outputs.iter().flat_map(|b| (0..b.len()).map(|i| (b.row(i).to_vec(), b.times[i], b.diffs[i]))), t);
+            assert_eq!(got, expected, "window={window} at time={t}");
+        }
+    }
+}
+
+#[test]
+fn reduce_row_counts_match_naive() {
+    check_reduce(hash);
+}
+
+#[test]
+fn reduce_resolves_group_collisions() {
+    // Forced group collisions: the granule partition by real key must reduce each
+    // colliding key separately, yielding exactly the naive per-key counts.
+    check_reduce(weak_group_hash);
+}
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index 2502c9ffc..3a1b34e70 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -55,6 +55,9 @@ fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
 }
 
 /// The next group at or after the per-batch positions `pos` into `batches`.
+///
+/// Test-grade: rescans every batch head per group. A real backend should k-way merge
+/// with a heap over batch cursors.
 fn next_group(batches: &[GraphBatch], pos: &[usize]) -> Option<u32> {
     batches
         .iter()
@@ -85,7 +88,6 @@ fn drain_group(
 /// `usize` could not carry — the finding that motivated `type Cursor`.
 #[derive(Default)]
 struct GraphJoinCursor {
-    started: bool,
     pos0: Vec<usize>,
     pos1: Vec<usize>,
 }
@@ -109,38 +111,58 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
     fn next_window(
         &mut self,
         instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        _fresh: Fresh,
+        fresh: Fresh,
         cursor: &mut GraphJoinCursor,
     ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
-        if !cursor.started {
-            cursor.started = true;
-            cursor.pos0 = vec![0; instance.batches0.len()];
-            cursor.pos1 = vec![0; instance.batches1.len()];
-        }
-        let mut input0 = Vec::new();
-        let mut input1 = Vec::new();
-        let mut groups = 0;
-        while groups < self.window {
-            let g0 = next_group(instance.batches0, &cursor.pos0);
-            let g1 = next_group(instance.batches1, &cursor.pos1);
-            let g = match (g0, g1) {
-                (None, None) => break,
-                (a, b) => a.into_iter().chain(b).min().unwrap(),
+        cursor.pos0.resize(instance.batches0.len(), 0);
+        cursor.pos1.resize(instance.batches1.len(), 0);
+        // Drive by the fresh side's groups: matches need both sides, so the accumulated
+        // side's other groups are skipped (never presented) — a small fresh batch against
+        // a large trace costs O(fresh) presentations, and an empty fresh side is free.
+        let (fresh_b, other_b) = match fresh {
+            Fresh::Input0 => (instance.batches0, instance.batches1),
+            Fresh::Input1 => (instance.batches1, instance.batches0),
+        };
+        loop {
+            let mut fresh_run = Vec::new();
+            let mut other_run = Vec::new();
+            let mut groups = 0;
+            while groups < self.window {
+                let (fresh_pos, other_pos) = match fresh {
+                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
+                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
+                };
+                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
+                groups += 1;
+                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
+                    fresh_run.push(((g, e), advance(t, instance.lower), r));
+                });
+                // Skip the accumulated side below `g`, then drain its matching group.
+                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
+                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
+                        *p += 1;
+                    }
+                }
+                drain_group(other_b, other_pos, g, |e, t, r| {
+                    other_run.push(((g, e), advance(t, instance.lower), r));
+                });
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut fresh_run);
+            consolidate_updates(&mut other_run);
+            // A fully-cancelled quota presents nothing; keep going rather than emit an
+            // empty window (the harness's progress guard forbids those).
+            if fresh_run.is_empty() && other_run.is_empty() {
+                continue;
+            }
+            let (input0, input1) = match fresh {
+                Fresh::Input0 => (fresh_run, other_run),
+                Fresh::Input1 => (other_run, fresh_run),
             };
-            groups += 1;
-            drain_group(instance.batches0, &mut cursor.pos0, g, |e, t, r| {
-                input0.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.batches1, &mut cursor.pos1, g, |e, t, r| {
-                input1.push(((g, e), advance(t, instance.lower), r));
-            });
-        }
-        if groups == 0 {
-            return None;
+            return Some(JoinWindow { input0, input1 });
         }
-        consolidate_updates(&mut input0);
-        consolidate_updates(&mut input1);
-        Some(JoinWindow { input0, input1 })
     }
 
     fn cross(
@@ -148,15 +170,15 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
         _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
         left: &[(u32, Edge)],
         right: &[(u32, Edge)],
-        times: Vec<Time>,
-        diffs: Vec<Diff>,
+        times: &[Time],
+        diffs: &[Diff],
     ) -> Self::Output {
         // Self-redeeming tokens: the output is built from the tokens alone.
         left.iter()
             .zip(right)
             .zip(times)
             .zip(diffs)
-            .map(|(((l, r), t), d)| (l.1, r.1, t, d))
+            .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
             .collect()
     }
 }
@@ -210,6 +232,52 @@ fn join_matches_naive() {
     }
 }
 
+#[test]
+fn interleaved_units_share_backend() {
+    // Two units prepped from one tactic and drained alternately: the scenario that
+    // motivated per-unit `Cursor` state and the shared `Rc<RefCell>` backend — the
+    // driver holds half-drained units from both queues and polls them under fuel.
+    let a = vec![
+        batch(vec![((0, 1), 0, 1), ((1, 5), 0, 1), ((2, 2), 1, 1)], 0, 2),
+        batch(vec![((3, 3), 1, 1)], 0, 2),
+    ];
+    let b = vec![batch(vec![((0, 7), 1, 1), ((2, 6), 0, 1), ((3, 8), 1, 1)], 0, 2)];
+    let c = vec![batch(vec![((5, 1), 0, 1), ((6, 2), 0, 1)], 0, 2)];
+    let d = vec![
+        batch(vec![((5, 9), 1, 1), ((6, 4), 0, 1)], 0, 2),
+        batch(vec![((5, 9), 1, 1)], 0, 2),
+    ];
+
+    let all = |bs: &[GraphBatch]| bs.iter().flat_map(|b| b.updates.iter().cloned()).collect::<Vec<_>>();
+    let expected1 = naive_join(&all(&a), &all(&b));
+    let expected2 = naive_join(&all(&c), &all(&d));
+
+    let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window: 1 });
+    let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
+    let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
+    let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
+    let mut got2: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
+    let (mut done1, mut done2) = (false, false);
+    while !done1 || !done2 {
+        if !done1 {
+            match u1.next() {
+                Some(out) => got1.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
+                None => done1 = true,
+            }
+        }
+        if !done2 {
+            match u2.next() {
+                Some(out) => got2.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
+                None => done2 = true,
+            }
+        }
+    }
+    consolidate_updates(&mut got1);
+    consolidate_updates(&mut got2);
+    assert_eq!(got1, expected1);
+    assert_eq!(got2, expected2);
+}
+
 // -------------------------------------------------------------- reduce backend
 
 /// Counts edges per source: the output value for source `s` is `(s, count)`.
@@ -219,7 +287,6 @@ struct GraphReduceBackend {
     // Session state, bracketed by `begin`/`finish`.
     tiles: Vec<Description<Time>>,
     emitted: Vec<Vec<(Edge, Time, Diff)>>,
-    started: bool,
     pos_source: Vec<usize>,
     pos_input: Vec<usize>,
     pos_output: Vec<usize>,
@@ -232,7 +299,6 @@ impl GraphReduceBackend {
             window,
             tiles: Vec::new(),
             emitted: Vec::new(),
-            started: false,
             pos_source: Vec::new(),
             pos_input: Vec::new(),
             pos_output: Vec::new(),
@@ -250,7 +316,9 @@ impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
     fn begin(&mut self, tiles: &[Description<Time>]) {
         self.tiles = tiles.to_vec();
         self.emitted = vec![Vec::new(); tiles.len()];
-        self.started = false;
+        self.pos_source.clear();
+        self.pos_input.clear();
+        self.pos_output.clear();
         self.pend_idx = 0;
     }
 
@@ -259,12 +327,9 @@ impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
         instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
         pending: &[u32],
     ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
-        if !self.started {
-            self.started = true;
-            self.pos_source = vec![0; instance.source_batches.len()];
-            self.pos_input = vec![0; instance.input_batches.len()];
-            self.pos_output = vec![0; instance.output_batches.len()];
-        }
+        self.pos_source.resize(instance.source_batches.len(), 0);
+        self.pos_input.resize(instance.input_batches.len(), 0);
+        self.pos_output.resize(instance.output_batches.len(), 0);
         let mut keys = Vec::new();
         let mut seeds = Vec::new();
         let mut input = Vec::new();

From c1b99551056344877e823245bbfe945dfc92596e Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 17:35:51 -0400
Subject: [PATCH 05/18] Benchmark: proxy tactics vs native, value-token
 instantiation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

examples/int_proxy_bench.rs measures the indirection tax where it is
purest: value tokens (G = src, token = edge), so every gap is protocol,
not tokenization. Hand-written merge-join and streaming count over the
same batches are the baselines. Release mode, best of 5.

Numbers at 100k keys, fanout 4 (400k edges/side), window 1024:

  join    native  7.5ms   proxy 16.9ms   2.26x
  reduce  native  0.36ms  proxy 17.3ms   ~48x

Localization by sweeps:

* Window size (64 / 1024 / 65536): join flat at 2.3-2.7x; reduce flat
  through 1024 and WORSE at 65536 (35ms — oversized phase-2 state).
  Harness crossings are not the bottleneck at sane window sizes.
* Values per key (fanout 1 / 4 / 16): reduce per-key cost 85ns -> 173ns
  -> 632ns. The tax scales with replay volume: per-key ValueHistory
  loads, TimeHistory sorts, and discovery machinery — running on data
  with exactly ONE moment, where discovery is pure overhead.

Reading: the join tax (~2.3x) is bridge materialization plus output
allocation — the window-buffer recycling and resumable-wave items on
SEAM.md's open list. The reduce tax is dominated by running the full
interesting-times apparatus per key on single-moment granules; the top
optimization candidate is a single-moment fast path (after advancing,
all times equal -> skip discovery and replay, evaluate once, subtract
output). Native count is also not an incremental operator, so the fair
gap is smaller than 48x — but the snapshot case is common enough that
the fast path should exist before this number is taken at face value.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../examples/int_proxy_bench.rs               | 415 ++++++++++++++++++
 1 file changed, 415 insertions(+)
 create mode 100644 differential-dataflow/examples/int_proxy_bench.rs

diff --git a/differential-dataflow/examples/int_proxy_bench.rs b/differential-dataflow/examples/int_proxy_bench.rs
new file mode 100644
index 000000000..f7476811d
--- /dev/null
+++ b/differential-dataflow/examples/int_proxy_bench.rs
@@ -0,0 +1,415 @@
+//! Measures the indirection tax: proxy tactics vs hand-written native implementations
+//! over identical data, for the value-token (exact, zero-translation) instantiation.
+//!
+//! Data is graph edges `(src: u32, dst: u32)` grouped by source — `G = src`, token =
+//! the edge itself — so every observed gap is protocol overhead (windowing, bridge
+//! materialization, harness crossings), not tokenization.
+//!
+//! Run: `cargo run --release --example int_proxy_bench [-- <keys> <fanout>]`
+
+use std::hint::black_box;
+use std::time::Instant;
+
+use timely::progress::frontier::AntichainRef;
+use timely::progress::Antichain;
+
+use differential_dataflow::consolidation::consolidate_updates;
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
+    ProxyReduceTactic, ReduceInstance, ReduceWindow,
+};
+use differential_dataflow::operators::join::{Fresh, JoinTactic};
+use differential_dataflow::operators::reduce::ReduceTactic;
+use differential_dataflow::trace::{BatchReader, Description};
+
+type Edge = (u32, u32);
+type Time = u64;
+type Diff = isize;
+
+#[derive(Clone)]
+struct GraphBatch {
+    updates: Vec<(Edge, Time, Diff)>,
+    description: Description<Time>,
+}
+
+impl BatchReader for GraphBatch {
+    type Time = Time;
+    fn len(&self) -> usize { self.updates.len() }
+    fn description(&self) -> &Description<Time> { &self.description }
+}
+
+fn batch(mut updates: Vec<(Edge, Time, Diff)>, lower: Time, upper: Time) -> GraphBatch {
+    consolidate_updates(&mut updates);
+    GraphBatch {
+        updates,
+        description: Description::new(
+            Antichain::from_elem(lower),
+            Antichain::from_elem(upper),
+            Antichain::from_elem(0),
+        ),
+    }
+}
+
+fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
+    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
+}
+
+fn next_group(batches: &[GraphBatch], pos: &[usize]) -> Option<u32> {
+    batches
+        .iter()
+        .zip(pos.iter())
+        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
+        .min()
+}
+
+fn drain_group(
+    batches: &[GraphBatch],
+    pos: &mut [usize],
+    g: u32,
+    mut logic: impl FnMut(Edge, Time, Diff),
+) {
+    for (b, p) in batches.iter().zip(pos.iter_mut()) {
+        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
+            let (edge, t, r) = b.updates[*p];
+            logic(edge, t, r);
+            *p += 1;
+        }
+    }
+}
+
+// ------------------------------------------------------------------ proxy join
+
+#[derive(Default)]
+struct GraphJoinCursor {
+    pos0: Vec<usize>,
+    pos1: Vec<usize>,
+}
+
+struct GraphJoinBackend {
+    window: usize,
+}
+
+impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
+    type Group = u32;
+    type Token0 = Edge;
+    type Token1 = Edge;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    type Output = Vec<(Edge, Edge, Time, Diff)>;
+    type Cursor = GraphJoinCursor;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
+        fresh: Fresh,
+        cursor: &mut GraphJoinCursor,
+    ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
+        cursor.pos0.resize(instance.batches0.len(), 0);
+        cursor.pos1.resize(instance.batches1.len(), 0);
+        let (fresh_b, other_b) = match fresh {
+            Fresh::Input0 => (instance.batches0, instance.batches1),
+            Fresh::Input1 => (instance.batches1, instance.batches0),
+        };
+        loop {
+            let mut fresh_run = Vec::new();
+            let mut other_run = Vec::new();
+            let mut groups = 0;
+            while groups < self.window {
+                let (fresh_pos, other_pos) = match fresh {
+                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
+                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
+                };
+                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
+                groups += 1;
+                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
+                    fresh_run.push(((g, e), advance(t, instance.lower), r));
+                });
+                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
+                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
+                        *p += 1;
+                    }
+                }
+                drain_group(other_b, other_pos, g, |e, t, r| {
+                    other_run.push(((g, e), advance(t, instance.lower), r));
+                });
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut fresh_run);
+            consolidate_updates(&mut other_run);
+            if fresh_run.is_empty() && other_run.is_empty() {
+                continue;
+            }
+            let (input0, input1) = match fresh {
+                Fresh::Input0 => (fresh_run, other_run),
+                Fresh::Input1 => (other_run, fresh_run),
+            };
+            return Some(JoinWindow { input0, input1 });
+        }
+    }
+
+    fn cross(
+        &mut self,
+        _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
+        left: &[(u32, Edge)],
+        right: &[(u32, Edge)],
+        times: &[Time],
+        diffs: &[Diff],
+    ) -> Self::Output {
+        left.iter()
+            .zip(right)
+            .zip(times)
+            .zip(diffs)
+            .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
+            .collect()
+    }
+}
+
+// ---------------------------------------------------------------- proxy reduce
+
+struct GraphReduceBackend {
+    window: usize,
+    tiles: Vec<Description<Time>>,
+    emitted: Vec<Vec<(Edge, Time, Diff)>>,
+    pos_source: Vec<usize>,
+    pos_input: Vec<usize>,
+    pos_output: Vec<usize>,
+    pend_idx: usize,
+}
+
+impl GraphReduceBackend {
+    fn new(window: usize) -> Self {
+        GraphReduceBackend {
+            window,
+            tiles: Vec::new(),
+            emitted: Vec::new(),
+            pos_source: Vec::new(),
+            pos_input: Vec::new(),
+            pos_output: Vec::new(),
+            pend_idx: 0,
+        }
+    }
+}
+
+impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
+    type Group = u32;
+    type Token = Edge;
+    type RIn = Diff;
+    type ROut = Diff;
+
+    fn begin(&mut self, tiles: &[Description<Time>]) {
+        self.tiles = tiles.to_vec();
+        self.emitted = vec![Vec::new(); tiles.len()];
+        self.pos_source.clear();
+        self.pos_input.clear();
+        self.pos_output.clear();
+        self.pend_idx = 0;
+    }
+
+    fn next_window(
+        &mut self,
+        instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
+        pending: &[u32],
+    ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
+        self.pos_source.resize(instance.source_batches.len(), 0);
+        self.pos_input.resize(instance.input_batches.len(), 0);
+        self.pos_output.resize(instance.output_batches.len(), 0);
+        let mut keys = Vec::new();
+        let mut seeds = Vec::new();
+        let mut input = Vec::new();
+        let mut output = Vec::new();
+        while keys.len() < self.window {
+            let g = [
+                next_group(instance.source_batches, &self.pos_source),
+                next_group(instance.input_batches, &self.pos_input),
+                next_group(instance.output_batches, &self.pos_output),
+                pending.get(self.pend_idx).copied(),
+            ]
+            .into_iter()
+            .flatten()
+            .min();
+            let Some(g) = g else { break };
+            keys.push(g);
+            if pending.get(self.pend_idx) == Some(&g) {
+                self.pend_idx += 1;
+            }
+            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
+                seeds.push((g, t));
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
+                output.push(((g, e), advance(t, instance.lower), r));
+            });
+        }
+        if keys.is_empty() {
+            return None;
+        }
+        consolidate_updates(&mut input);
+        consolidate_updates(&mut output);
+        seeds.sort();
+        seeds.dedup();
+        Some(ReduceWindow { keys, seeds, input, output })
+    }
+
+    fn reduce_corrections(
+        &mut self,
+        keys: &[u32],
+        in_ends: &[usize],
+        input: &[(Edge, Diff)],
+        out_ends: &[usize],
+        output: &[(Edge, Diff)],
+    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
+        let mut corr = Vec::new();
+        let mut ends = Vec::new();
+        let (mut i0, mut o0) = (0, 0);
+        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
+            let mut delta: Vec<(Edge, Diff)> = Vec::new();
+            if count > 0 {
+                delta.push(((*k, count as u32), 1));
+            }
+            for (v, d) in &output[o0..o1] {
+                delta.push((*v, -d));
+            }
+            differential_dataflow::consolidation::consolidate(&mut delta);
+            corr.extend(delta);
+            ends.push(corr.len());
+            i0 = i1;
+            o0 = o1;
+        }
+        (corr, ends)
+    }
+
+    fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
+        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, *t, *r)));
+    }
+
+    fn finish(&mut self) -> Vec<GraphBatch> {
+        self.tiles
+            .drain(..)
+            .zip(self.emitted.drain(..))
+            .map(|(desc, mut updates)| {
+                consolidate_updates(&mut updates);
+                GraphBatch { updates, description: desc }
+            })
+            .collect()
+    }
+}
+
+// --------------------------------------------------------------------- natives
+
+/// Hand-written merge-join over the same batch lists: the native baseline. Produces
+/// the same containers (chunks of matched pairs) the proxy path produces.
+fn native_join(a: &[GraphBatch], b: &[GraphBatch], chunk: usize) -> Vec<Vec<(Edge, Edge, Time, Diff)>> {
+    let mut out = Vec::new();
+    let mut cur = Vec::new();
+    let mut pos0 = vec![0; a.len()];
+    let mut pos1 = vec![0; b.len()];
+    let (mut e0, mut e1) = (Vec::new(), Vec::new());
+    loop {
+        let (g0, g1) = (next_group(a, &pos0), next_group(b, &pos1));
+        let g = match (g0, g1) {
+            (None, None) => break,
+            (Some(x), None) => x,
+            (None, Some(y)) => y,
+            (Some(x), Some(y)) => x.min(y),
+        };
+        e0.clear();
+        e1.clear();
+        drain_group(a, &mut pos0, g, |e, t, r| e0.push((e, t, r)));
+        drain_group(b, &mut pos1, g, |e, t, r| e1.push((e, t, r)));
+        for (x, t0, r0) in &e0 {
+            for (y, t1, r1) in &e1 {
+                cur.push((*x, *y, std::cmp::max(*t0, *t1), r0 * r1));
+                if cur.len() >= chunk {
+                    out.push(std::mem::replace(&mut cur, Vec::with_capacity(chunk)));
+                }
+            }
+        }
+    }
+    if !cur.is_empty() {
+        out.push(cur);
+    }
+    out
+}
+
+/// Hand-written per-source count over the same batch list: the native baseline.
+fn native_count(a: &[GraphBatch]) -> Vec<(Edge, Time, Diff)> {
+    let mut out = Vec::new();
+    let mut pos = vec![0; a.len()];
+    while let Some(g) = next_group(a, &pos) {
+        let mut count: Diff = 0;
+        let mut time: Time = 0;
+        drain_group(a, &mut pos, g, |_e, t, r| {
+            count += r;
+            time = time.max(t);
+        });
+        if count > 0 {
+            out.push(((g, count as u32), time, 1));
+        }
+    }
+    out
+}
+
+// ----------------------------------------------------------------------- bench
+
+fn time<T>(label: &str, reps: usize, mut f: impl FnMut() -> T) -> f64 {
+    let mut best = f64::INFINITY;
+    for _ in 0..reps {
+        let start = Instant::now();
+        black_box(f());
+        best = best.min(start.elapsed().as_secs_f64());
+    }
+    println!("    {label:<28} {:>10.3} ms", best * 1e3);
+    best
+}
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    let keys: u32 = args.next().and_then(|s| s.parse().ok()).unwrap_or(100_000);
+    let fanout: u32 = args.next().and_then(|s| s.parse().ok()).unwrap_or(4);
+    let window: usize = args.next().and_then(|s| s.parse().ok()).unwrap_or(1024);
+    let reps = 5;
+
+    // Two edge sets over the same key space, `fanout` edges per key each.
+    let edges = |salt: u32| {
+        let mut v = Vec::with_capacity((keys * fanout) as usize);
+        for k in 0..keys {
+            for f in 0..fanout {
+                v.push(((k, salt.wrapping_mul(1_000_003).wrapping_add(k * fanout + f)), 0u64, 1isize));
+            }
+        }
+        v
+    };
+    let a = vec![batch(edges(1), 0, 1)];
+    let b = vec![batch(edges(2), 0, 1)];
+
+    println!(
+        "join: {} x {} edges over {} keys (fanout {}, ~{} matches)",
+        keys * fanout, keys * fanout, keys, fanout, (keys as u64) * (fanout as u64) * (fanout as u64),
+    );
+    let t_native = time("native merge-join", reps, || native_join(&a, &b, 1 << 20));
+    let t_proxy = time("proxy join (value tokens)", reps, || {
+        let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window });
+        let work = tactic.prep(a.clone(), b.clone(), Fresh::Input0, 0);
+        work.collect::<Vec<_>>()
+    });
+    println!("    ratio: {:.2}x\n", t_proxy / t_native);
+
+    let input = vec![batch(edges(1), 0, 1)];
+    println!("reduce (count per key): {} edges over {} keys", keys * fanout, keys);
+    let t_native = time("native count", reps, || native_count(&input));
+    let t_proxy = time("proxy reduce (value tokens)", reps, || {
+        let mut tactic = ProxyReduceTactic::new(GraphReduceBackend::new(window));
+        let lower = Antichain::from_elem(0u64);
+        let upper = Antichain::from_elem(1u64);
+        let held = Antichain::from_elem(0u64);
+        tactic.retire(Vec::new(), Vec::new(), input.clone(), &lower, &upper, &held)
+    });
+    println!("    ratio: {:.2}x", t_proxy / t_native);
+}

From 6a65cedf0a6f208bfc8cb0d4f679658e9bb3b331 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 17:42:17 -0400
Subject: [PATCH 06/18] Partial-order pending test, and the shared test
 scaffold
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tests/int_proxy_pending.rs exercises the last unexercised clause of the
windowed reduce contract: carried interesting times. Updates at
incomparable Pair times (0,1) and (1,0) make their join (1,1) an
interesting time beyond the retire's upper frontier; the test asserts
it is pended (returned in the frontier, holding the capability),
carried by the tactic, and handed back as a pending group next retire —
where it must appear in a window with no novel input, merged in group
order with a novel-only group at window size 1. A grid oracle over the
partial order checks exact per-key counts at every probe, confirming
the deferred correction collapses the two partial counts. The hard
pending-coverage asserts run live throughout.

tests/common/mod.rs extracts the shared scaffold the review prescribed
(EdgeBatch<T>, the value-token join/reduce backends generic over the
timestamp, Pair itself) before this third test could become the third
copy; int_proxy_graphs.rs now uses it. The byte-rows test keeps its own
scaffold deliberately — its columnar layout is the point.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/tests/common/mod.rs     | 409 ++++++++++++++++++
 .../tests/int_proxy_graphs.rs                 | 363 +---------------
 .../tests/int_proxy_pending.rs                | 108 +++++
 3 files changed, 536 insertions(+), 344 deletions(-)
 create mode 100644 differential-dataflow/tests/common/mod.rs
 create mode 100644 differential-dataflow/tests/int_proxy_pending.rs

diff --git a/differential-dataflow/tests/common/mod.rs b/differential-dataflow/tests/common/mod.rs
new file mode 100644
index 000000000..8b69c5fa5
--- /dev/null
+++ b/differential-dataflow/tests/common/mod.rs
@@ -0,0 +1,409 @@
+//! Shared scaffolding for the proxy-tactic reference-backend tests: an edge-update
+//! batch and value-token backends generic over the timestamp, so the total-order
+//! (`u64`) and partial-order (`Pair`) tests drive one implementation. The byte-rows
+//! test keeps its own scaffold deliberately — its columnar layout is the point.
+#![allow(dead_code)]
+
+use timely::progress::frontier::AntichainRef;
+use timely::progress::{Antichain, Timestamp};
+
+use differential_dataflow::consolidation::{consolidate, consolidate_updates};
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyReduceBackend, ReduceInstance,
+    ReduceWindow,
+};
+use differential_dataflow::operators::join::Fresh;
+use differential_dataflow::trace::{BatchReader, Description};
+
+pub type Edge = (u32, u32);
+pub type Diff = isize;
+
+/// A batch of edge updates, sorted and consolidated, `G = src` exact.
+#[derive(Clone)]
+pub struct EdgeBatch<T> {
+    pub updates: Vec<(Edge, T, Diff)>,
+    pub description: Description<T>,
+}
+
+impl<T: Timestamp + Lattice> BatchReader for EdgeBatch<T> {
+    type Time = T;
+    fn len(&self) -> usize { self.updates.len() }
+    fn description(&self) -> &Description<T> { &self.description }
+}
+
+/// Sort, consolidate, and wrap updates as a batch describing `[lower, upper)`.
+pub fn batch<T: Timestamp + Lattice + Ord>(updates: Vec<(Edge, T, Diff)>, lower: T, upper: T) -> EdgeBatch<T> {
+    batch_frontiers(updates, Antichain::from_elem(lower), Antichain::from_elem(upper))
+}
+
+/// As [`batch`], with antichain frontiers for partially ordered intervals.
+pub fn batch_frontiers<T: Timestamp + Lattice + Ord>(
+    mut updates: Vec<(Edge, T, Diff)>,
+    lower: Antichain<T>,
+    upper: Antichain<T>,
+) -> EdgeBatch<T> {
+    consolidate_updates(&mut updates);
+    EdgeBatch {
+        updates,
+        description: Description::new(lower, upper, Antichain::from_elem(T::minimum())),
+    }
+}
+
+/// Advance a time to the compaction frontier (join against its elements).
+pub fn advance<T: Lattice + Clone>(t: T, lower: AntichainRef<'_, T>) -> T {
+    lower.iter().fold(t, |t, l| t.join(l))
+}
+
+/// The next group at or after the per-batch positions `pos` into `batches`.
+///
+/// Test-grade: rescans every batch head per group. A real backend should k-way merge
+/// with a heap over batch cursors.
+pub fn next_group<T>(batches: &[EdgeBatch<T>], pos: &[usize]) -> Option<u32> {
+    batches
+        .iter()
+        .zip(pos.iter())
+        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
+        .min()
+}
+
+/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`.
+pub fn drain_group<T: Clone>(
+    batches: &[EdgeBatch<T>],
+    pos: &mut [usize],
+    g: u32,
+    mut logic: impl FnMut(Edge, T, Diff),
+) {
+    for (b, p) in batches.iter().zip(pos.iter_mut()) {
+        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
+            let (edge, ref t, r) = b.updates[*p];
+            logic(edge, t.clone(), r);
+            *p += 1;
+        }
+    }
+}
+
+// ---------------------------------------------------------------- join backend
+
+/// Per-unit resumption: a position per batch per side. This is the state a single
+/// `usize` could not carry — the finding that motivated `type Cursor`.
+#[derive(Default)]
+pub struct EdgeJoinCursor {
+    pub pos0: Vec<usize>,
+    pub pos1: Vec<usize>,
+}
+
+pub struct EdgeJoinBackend {
+    /// Groups per window; tiny in tests to force many windows.
+    pub window: usize,
+}
+
+impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend {
+    type Group = u32;
+    type Token0 = Edge;
+    type Token1 = Edge;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    /// Matched edge pairs with their joined time and multiplied diff.
+    type Output = Vec<(Edge, Edge, T, Diff)>;
+    type Cursor = EdgeJoinCursor;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        fresh: Fresh,
+        cursor: &mut EdgeJoinCursor,
+    ) -> Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>> {
+        cursor.pos0.resize(instance.batches0.len(), 0);
+        cursor.pos1.resize(instance.batches1.len(), 0);
+        // Drive by the fresh side's groups: the accumulated side's other groups are
+        // skipped, never presented (O(fresh) presentations; empty fresh side is free).
+        let (fresh_b, other_b) = match fresh {
+            Fresh::Input0 => (instance.batches0, instance.batches1),
+            Fresh::Input1 => (instance.batches1, instance.batches0),
+        };
+        loop {
+            let mut fresh_run = Vec::new();
+            let mut other_run = Vec::new();
+            let mut groups = 0;
+            while groups < self.window {
+                let (fresh_pos, other_pos) = match fresh {
+                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
+                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
+                };
+                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
+                groups += 1;
+                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
+                    fresh_run.push(((g, e), advance(t, instance.lower), r));
+                });
+                // Skip the accumulated side below `g`, then drain its matching group.
+                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
+                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
+                        *p += 1;
+                    }
+                }
+                drain_group(other_b, other_pos, g, |e, t, r| {
+                    other_run.push(((g, e), advance(t, instance.lower), r));
+                });
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut fresh_run);
+            consolidate_updates(&mut other_run);
+            // A fully-cancelled quota presents nothing; keep going rather than emit an
+            // empty window (the harness's progress guard forbids those).
+            if fresh_run.is_empty() && other_run.is_empty() {
+                continue;
+            }
+            let (input0, input1) = match fresh {
+                Fresh::Input0 => (fresh_run, other_run),
+                Fresh::Input1 => (other_run, fresh_run),
+            };
+            return Some(JoinWindow { input0, input1 });
+        }
+    }
+
+    fn cross(
+        &mut self,
+        _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        left: &[(u32, Edge)],
+        right: &[(u32, Edge)],
+        times: &[T],
+        diffs: &[Diff],
+    ) -> Self::Output {
+        // Self-redeeming tokens: the output is built from the tokens alone.
+        left.iter()
+            .zip(right)
+            .zip(times)
+            .zip(diffs)
+            .map(|(((l, r), t), d)| (l.1, r.1, t.clone(), *d))
+            .collect()
+    }
+}
+
+/// Reference join: all pairs with equal source, times joined, diffs multiplied.
+pub fn naive_join<T: Timestamp + Lattice + Ord>(
+    a: &[(Edge, T, Diff)],
+    b: &[(Edge, T, Diff)],
+) -> Vec<((Edge, Edge), T, Diff)> {
+    let mut out = Vec::new();
+    for (e0, t0, r0) in a {
+        for (e1, t1, r1) in b {
+            if e0.0 == e1.0 {
+                out.push(((*e0, *e1), t0.join(t1), r0 * r1));
+            }
+        }
+    }
+    consolidate_updates(&mut out);
+    out
+}
+
+// -------------------------------------------------------------- reduce backend
+
+/// Counts edges per source: the output value for source `s` is `(s, count)`.
+pub struct EdgeReduceBackend<T> {
+    /// Groups per window; tiny in tests to force many windows.
+    pub window: usize,
+    // Session state, bracketed by `begin`/`finish`.
+    tiles: Vec<Description<T>>,
+    emitted: Vec<Vec<(Edge, T, Diff)>>,
+    pos_source: Vec<usize>,
+    pos_input: Vec<usize>,
+    pos_output: Vec<usize>,
+    pend_idx: usize,
+}
+
+impl<T> EdgeReduceBackend<T> {
+    pub fn new(window: usize) -> Self {
+        EdgeReduceBackend {
+            window,
+            tiles: Vec::new(),
+            emitted: Vec::new(),
+            pos_source: Vec::new(),
+            pos_input: Vec::new(),
+            pos_output: Vec::new(),
+            pend_idx: 0,
+        }
+    }
+}
+
+impl<T: Timestamp + Lattice + Ord> ProxyReduceBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeReduceBackend<T> {
+    type Group = u32;
+    type Token = Edge;
+    type RIn = Diff;
+    type ROut = Diff;
+
+    fn begin(&mut self, tiles: &[Description<T>]) {
+        self.tiles = tiles.to_vec();
+        self.emitted = vec![Vec::new(); tiles.len()];
+        self.pos_source.clear();
+        self.pos_input.clear();
+        self.pos_output.clear();
+        self.pend_idx = 0;
+    }
+
+    fn next_window(
+        &mut self,
+        instance: &ReduceInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        pending: &[u32],
+    ) -> Option<ReduceWindow<u32, Edge, T, Diff, Diff>> {
+        self.pos_source.resize(instance.source_batches.len(), 0);
+        self.pos_input.resize(instance.input_batches.len(), 0);
+        self.pos_output.resize(instance.output_batches.len(), 0);
+        let mut keys = Vec::new();
+        let mut seeds = Vec::new();
+        let mut input = Vec::new();
+        let mut output = Vec::new();
+        while keys.len() < self.window {
+            let g = [
+                next_group(instance.source_batches, &self.pos_source),
+                next_group(instance.input_batches, &self.pos_input),
+                next_group(instance.output_batches, &self.pos_output),
+                pending.get(self.pend_idx).copied(),
+            ]
+            .into_iter()
+            .flatten()
+            .min();
+            let Some(g) = g else { break };
+            keys.push(g);
+            if pending.get(self.pend_idx) == Some(&g) {
+                self.pend_idx += 1;
+            }
+            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
+                // Novel batches also seed interesting times, with their own (raw) times.
+                seeds.push((g, t.clone()));
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
+                output.push(((g, e), advance(t, instance.lower), r));
+            });
+        }
+        if keys.is_empty() {
+            return None;
+        }
+        consolidate_updates(&mut input);
+        consolidate_updates(&mut output);
+        seeds.sort();
+        seeds.dedup();
+        Some(ReduceWindow { keys, seeds, input, output })
+    }
+
+    fn reduce_corrections(
+        &mut self,
+        keys: &[u32],
+        in_ends: &[usize],
+        input: &[(Edge, Diff)],
+        out_ends: &[usize],
+        output: &[(Edge, Diff)],
+    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
+        let mut corr = Vec::new();
+        let mut ends = Vec::new();
+        let (mut i0, mut o0) = (0, 0);
+        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
+            assert!(count >= 0, "edge count went negative");
+            // Desired output, minus the tentative output, consolidated.
+            let mut delta: Vec<(Edge, Diff)> = Vec::new();
+            if count > 0 {
+                delta.push(((*k, count as u32), 1));
+            }
+            for (v, d) in &output[o0..o1] {
+                delta.push((*v, -d));
+            }
+            consolidate(&mut delta);
+            corr.extend(delta);
+            ends.push(corr.len());
+            i0 = i1;
+            o0 = o1;
+        }
+        (corr, ends)
+    }
+
+    fn emit(&mut self, tile: usize, records: &[((u32, Edge), T, Diff)]) {
+        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, t.clone(), *r)));
+    }
+
+    fn finish(&mut self) -> Vec<EdgeBatch<T>> {
+        self.tiles
+            .drain(..)
+            .zip(self.emitted.drain(..))
+            .map(|(desc, mut updates)| {
+                consolidate_updates(&mut updates);
+                EdgeBatch { updates, description: desc }
+            })
+            .collect()
+    }
+}
+
+/// Accumulate `updates` at times less-or-equal `t` (the partial order's `less_equal`).
+pub fn accumulate<T: Timestamp + Lattice>(
+    updates: impl Iterator<Item = (Edge, T, Diff)>,
+    t: &T,
+) -> Vec<(Edge, Diff)> {
+    let mut acc: Vec<(Edge, Diff)> = updates
+        .filter(|(_, ut, _)| ut.less_equal(t))
+        .map(|(e, _, r)| (e, r))
+        .collect();
+    consolidate(&mut acc);
+    acc
+}
+
+/// The `Pair` partially ordered timestamp (product order on two coordinates).
+pub mod pair {
+
+    #[derive(Hash, Default, Clone, Copy, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
+    pub struct Pair<S, T> { pub first: S, pub second: T }
+
+    impl<S, T> Pair<S, T> {
+        pub fn new(first: S, second: T) -> Self { Pair { first, second } }
+    }
+
+    use timely::order::PartialOrder;
+    impl<S: PartialOrder, T: PartialOrder> PartialOrder for Pair<S, T> {
+        fn less_equal(&self, other: &Self) -> bool {
+            self.first.less_equal(&other.first) && self.second.less_equal(&other.second)
+        }
+    }
+
+    use timely::progress::timestamp::Refines;
+    impl<S: Timestamp, T: Timestamp> Refines<()> for Pair<S, T> {
+        fn to_inner(_outer: ()) -> Self { Self::minimum() }
+        fn to_outer(self) {}
+        fn summarize(_summary: <Self>::Summary) {}
+    }
+
+    use timely::progress::PathSummary;
+    impl<S: Timestamp, T: Timestamp> PathSummary<Pair<S, T>> for () {
+        fn results_in(&self, timestamp: &Pair<S, T>) -> Option<Pair<S, T>> { Some(timestamp.clone()) }
+        fn followed_by(&self, other: &Self) -> Option<Self> { Some(*other) }
+    }
+
+    use timely::progress::Timestamp;
+    impl<S: Timestamp, T: Timestamp> Timestamp for Pair<S, T> {
+        fn minimum() -> Self { Pair { first: S::minimum(), second: T::minimum() } }
+        type Summary = ();
+    }
+
+    use differential_dataflow::lattice::Lattice;
+    impl<S: Lattice, T: Lattice> Lattice for Pair<S, T> {
+        fn join(&self, other: &Self) -> Self {
+            Pair { first: self.first.join(&other.first), second: self.second.join(&other.second) }
+        }
+        fn meet(&self, other: &Self) -> Self {
+            Pair { first: self.first.meet(&other.first), second: self.second.meet(&other.second) }
+        }
+    }
+
+    use serde::{Deserialize, Serialize};
+    use std::fmt::{Debug, Error, Formatter};
+    impl<TOuter: Debug, TInner: Debug> Debug for Pair<TOuter, TInner> {
+        fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
+            f.write_str(&format!("({:?}, {:?})", self.first, self.second))
+        }
+    }
+}
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index 3a1b34e70..e25d560c0 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -1,204 +1,27 @@
-//! Behavioral tests for the proxy tactics against a reference "graph" backend.
+//! Behavioral tests for the proxy tactics against the shared edge-batch backend.
 //!
 //! The value-token instantiation from the seam design: data is edges `(src, dst)`,
 //! grouped by source. `Group = u32` is the source itself (exact — no hashing, no
 //! collisions), and the value token is the whole edge (self-redeeming: `cross` and
-//! `finish` build outputs straight from tokens without consulting storage). Batches
-//! are plain sorted update lists; window sizes are kept tiny to force many windows
-//! and exercise the streaming protocols.
+//! `finish` build outputs straight from tokens without consulting storage). Window
+//! sizes are kept tiny to force many windows and exercise the streaming protocols.
+//! The scaffold lives in `tests/common/mod.rs`, shared with the partial-order test.
+
+mod common;
+
+use std::collections::BTreeMap;
 
-use timely::progress::frontier::AntichainRef;
 use timely::progress::Antichain;
 
-use differential_dataflow::consolidation::{consolidate, consolidate_updates};
-use differential_dataflow::operators::int_proxy::{
-    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
-    ProxyReduceTactic, ReduceInstance, ReduceWindow,
-};
+use differential_dataflow::consolidation::consolidate_updates;
+use differential_dataflow::operators::int_proxy::{ProxyJoinTactic, ProxyReduceTactic};
 use differential_dataflow::operators::join::{Fresh, JoinTactic};
 use differential_dataflow::operators::reduce::ReduceTactic;
-use differential_dataflow::trace::{BatchReader, Description};
 
-type Edge = (u32, u32);
-type Time = u64;
-type Diff = isize;
-
-/// A batch of edge updates, sorted by `((src, dst), time)` and consolidated.
-#[derive(Clone)]
-struct GraphBatch {
-    updates: Vec<(Edge, Time, Diff)>,
-    description: Description<Time>,
-}
-
-impl BatchReader for GraphBatch {
-    type Time = Time;
-    fn len(&self) -> usize { self.updates.len() }
-    fn description(&self) -> &Description<Time> { &self.description }
-}
-
-/// Sort, consolidate, and wrap updates as a batch describing `[lower, upper)`.
-fn batch(mut updates: Vec<(Edge, Time, Diff)>, lower: Time, upper: Time) -> GraphBatch {
-    consolidate_updates(&mut updates);
-    GraphBatch {
-        updates,
-        description: Description::new(
-            Antichain::from_elem(lower),
-            Antichain::from_elem(upper),
-            Antichain::from_elem(0),
-        ),
-    }
-}
-
-/// Advance a time to the compaction frontier (total order: max against its element).
-fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
-    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
-}
-
-/// The next group at or after the per-batch positions `pos` into `batches`.
-///
-/// Test-grade: rescans every batch head per group. A real backend should k-way merge
-/// with a heap over batch cursors.
-fn next_group(batches: &[GraphBatch], pos: &[usize]) -> Option<u32> {
-    batches
-        .iter()
-        .zip(pos.iter())
-        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
-        .min()
-}
-
-/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`.
-fn drain_group(
-    batches: &[GraphBatch],
-    pos: &mut [usize],
-    g: u32,
-    mut logic: impl FnMut(Edge, Time, Diff),
-) {
-    for (b, p) in batches.iter().zip(pos.iter_mut()) {
-        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
-            let (edge, t, r) = b.updates[*p];
-            logic(edge, t, r);
-            *p += 1;
-        }
-    }
-}
-
-// ---------------------------------------------------------------- join backend
-
-/// Per-unit resumption: a position per batch per side. This is the state a single
-/// `usize` could not carry — the finding that motivated `type Cursor`.
-#[derive(Default)]
-struct GraphJoinCursor {
-    pos0: Vec<usize>,
-    pos1: Vec<usize>,
-}
-
-struct GraphJoinBackend {
-    /// Groups per window; tiny in tests to force many windows.
-    window: usize,
-}
-
-impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
-    type Group = u32;
-    type Token0 = Edge;
-    type Token1 = Edge;
-    type R0 = Diff;
-    type R1 = Diff;
-    type ROut = Diff;
-    /// Matched edge pairs with their joined time and multiplied diff.
-    type Output = Vec<(Edge, Edge, Time, Diff)>;
-    type Cursor = GraphJoinCursor;
-
-    fn next_window(
-        &mut self,
-        instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        fresh: Fresh,
-        cursor: &mut GraphJoinCursor,
-    ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
-        cursor.pos0.resize(instance.batches0.len(), 0);
-        cursor.pos1.resize(instance.batches1.len(), 0);
-        // Drive by the fresh side's groups: matches need both sides, so the accumulated
-        // side's other groups are skipped (never presented) — a small fresh batch against
-        // a large trace costs O(fresh) presentations, and an empty fresh side is free.
-        let (fresh_b, other_b) = match fresh {
-            Fresh::Input0 => (instance.batches0, instance.batches1),
-            Fresh::Input1 => (instance.batches1, instance.batches0),
-        };
-        loop {
-            let mut fresh_run = Vec::new();
-            let mut other_run = Vec::new();
-            let mut groups = 0;
-            while groups < self.window {
-                let (fresh_pos, other_pos) = match fresh {
-                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
-                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
-                };
-                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
-                groups += 1;
-                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
-                    fresh_run.push(((g, e), advance(t, instance.lower), r));
-                });
-                // Skip the accumulated side below `g`, then drain its matching group.
-                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
-                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
-                        *p += 1;
-                    }
-                }
-                drain_group(other_b, other_pos, g, |e, t, r| {
-                    other_run.push(((g, e), advance(t, instance.lower), r));
-                });
-            }
-            if groups == 0 {
-                return None;
-            }
-            consolidate_updates(&mut fresh_run);
-            consolidate_updates(&mut other_run);
-            // A fully-cancelled quota presents nothing; keep going rather than emit an
-            // empty window (the harness's progress guard forbids those).
-            if fresh_run.is_empty() && other_run.is_empty() {
-                continue;
-            }
-            let (input0, input1) = match fresh {
-                Fresh::Input0 => (fresh_run, other_run),
-                Fresh::Input1 => (other_run, fresh_run),
-            };
-            return Some(JoinWindow { input0, input1 });
-        }
-    }
-
-    fn cross(
-        &mut self,
-        _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        left: &[(u32, Edge)],
-        right: &[(u32, Edge)],
-        times: &[Time],
-        diffs: &[Diff],
-    ) -> Self::Output {
-        // Self-redeeming tokens: the output is built from the tokens alone.
-        left.iter()
-            .zip(right)
-            .zip(times)
-            .zip(diffs)
-            .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
-            .collect()
-    }
-}
+use common::{accumulate, batch, naive_join, Diff, Edge, EdgeBatch, EdgeJoinBackend, EdgeReduceBackend};
 
-/// Reference join: all pairs with equal source, times joined, diffs multiplied.
-fn naive_join(
-    a: &[(Edge, Time, Diff)],
-    b: &[(Edge, Time, Diff)],
-) -> Vec<((Edge, Edge), Time, Diff)> {
-    let mut out = Vec::new();
-    for (e0, t0, r0) in a {
-        for (e1, t1, r1) in b {
-            if e0.0 == e1.0 {
-                out.push(((*e0, *e1), std::cmp::max(*t0, *t1), r0 * r1));
-            }
-        }
-    }
-    consolidate_updates(&mut out);
-    out
-}
+type Time = u64;
+type GraphBatch = EdgeBatch<Time>;
 
 #[test]
 fn join_matches_naive() {
@@ -215,7 +38,7 @@ fn join_matches_naive() {
 
     for window in [1, 2, 100] {
         for fresh in [Fresh::Input0, Fresh::Input1] {
-            let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window });
+            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend { window });
             let work = tactic.prep(
                 vec![a0.clone(), a1.clone()],
                 vec![b0.clone(), b1.clone()],
@@ -252,7 +75,7 @@ fn interleaved_units_share_backend() {
     let expected1 = naive_join(&all(&a), &all(&b));
     let expected2 = naive_join(&all(&c), &all(&d));
 
-    let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window: 1 });
+    let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend { window: 1 });
     let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
     let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
     let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
@@ -278,154 +101,6 @@ fn interleaved_units_share_backend() {
     assert_eq!(got2, expected2);
 }
 
-// -------------------------------------------------------------- reduce backend
-
-/// Counts edges per source: the output value for source `s` is `(s, count)`.
-struct GraphReduceBackend {
-    /// Groups per window; tiny in tests to force many windows.
-    window: usize,
-    // Session state, bracketed by `begin`/`finish`.
-    tiles: Vec<Description<Time>>,
-    emitted: Vec<Vec<(Edge, Time, Diff)>>,
-    pos_source: Vec<usize>,
-    pos_input: Vec<usize>,
-    pos_output: Vec<usize>,
-    pend_idx: usize,
-}
-
-impl GraphReduceBackend {
-    fn new(window: usize) -> Self {
-        GraphReduceBackend {
-            window,
-            tiles: Vec::new(),
-            emitted: Vec::new(),
-            pos_source: Vec::new(),
-            pos_input: Vec::new(),
-            pos_output: Vec::new(),
-            pend_idx: 0,
-        }
-    }
-}
-
-impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
-    type Group = u32;
-    type Token = Edge;
-    type RIn = Diff;
-    type ROut = Diff;
-
-    fn begin(&mut self, tiles: &[Description<Time>]) {
-        self.tiles = tiles.to_vec();
-        self.emitted = vec![Vec::new(); tiles.len()];
-        self.pos_source.clear();
-        self.pos_input.clear();
-        self.pos_output.clear();
-        self.pend_idx = 0;
-    }
-
-    fn next_window(
-        &mut self,
-        instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
-        pending: &[u32],
-    ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
-        self.pos_source.resize(instance.source_batches.len(), 0);
-        self.pos_input.resize(instance.input_batches.len(), 0);
-        self.pos_output.resize(instance.output_batches.len(), 0);
-        let mut keys = Vec::new();
-        let mut seeds = Vec::new();
-        let mut input = Vec::new();
-        let mut output = Vec::new();
-        while keys.len() < self.window {
-            let g = [
-                next_group(instance.source_batches, &self.pos_source),
-                next_group(instance.input_batches, &self.pos_input),
-                next_group(instance.output_batches, &self.pos_output),
-                pending.get(self.pend_idx).copied(),
-            ]
-            .into_iter()
-            .flatten()
-            .min();
-            let Some(g) = g else { break };
-            keys.push(g);
-            if pending.get(self.pend_idx) == Some(&g) {
-                self.pend_idx += 1;
-            }
-            // Input presentation: accumulated history plus the novel delta, advanced.
-            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
-                // Novel batches also seed interesting times, with their own (raw) times.
-                seeds.push((g, t));
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
-                output.push(((g, e), advance(t, instance.lower), r));
-            });
-        }
-        if keys.is_empty() {
-            return None;
-        }
-        consolidate_updates(&mut input);
-        consolidate_updates(&mut output);
-        seeds.sort();
-        seeds.dedup();
-        Some(ReduceWindow { keys, seeds, input, output })
-    }
-
-    fn reduce_corrections(
-        &mut self,
-        keys: &[u32],
-        in_ends: &[usize],
-        input: &[(Edge, Diff)],
-        out_ends: &[usize],
-        output: &[(Edge, Diff)],
-    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
-        let mut corr = Vec::new();
-        let mut ends = Vec::new();
-        let (mut i0, mut o0) = (0, 0);
-        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
-            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-            assert!(count >= 0, "graph count went negative");
-            // Desired output, minus the tentative output, consolidated.
-            let mut delta: Vec<(Edge, Diff)> = Vec::new();
-            if count > 0 {
-                delta.push(((*k, count as u32), 1));
-            }
-            for (v, d) in &output[o0..o1] {
-                delta.push((*v, -d));
-            }
-            consolidate(&mut delta);
-            corr.extend(delta);
-            ends.push(corr.len());
-            i0 = i1;
-            o0 = o1;
-        }
-        (corr, ends)
-    }
-
-    fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
-        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, *t, *r)));
-    }
-
-    fn finish(&mut self) -> Vec<GraphBatch> {
-        self.tiles
-            .drain(..)
-            .zip(self.emitted.drain(..))
-            .map(|(desc, mut updates)| {
-                consolidate_updates(&mut updates);
-                GraphBatch { updates, description: desc }
-            })
-            .collect()
-    }
-}
-
-/// Accumulate `updates` at times `<= t`.
-fn accumulate(updates: impl Iterator<Item = (Edge, Time, Diff)>, t: Time) -> Vec<(Edge, Diff)> {
-    let mut acc: Vec<(Edge, Diff)> = updates.filter(|(_, ut, _)| *ut <= t).map(|(e, _, r)| (e, r)).collect();
-    consolidate(&mut acc);
-    acc
-}
-
 #[test]
 fn reduce_counts_match_naive() {
     // Rounds of edge updates, including deletions that drop a source's count to zero
@@ -437,7 +112,7 @@ fn reduce_counts_match_naive() {
     ];
 
     for window in [1, 2, 100] {
-        let mut tactic = ProxyReduceTactic::new(GraphReduceBackend::new(window));
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
         let mut source: Vec<GraphBatch> = Vec::new();
         let mut outputs: Vec<GraphBatch> = Vec::new();
 
@@ -466,9 +141,9 @@ fn reduce_counts_match_naive() {
         // Oracle: at each round boundary, the accumulated output is exactly the
         // per-source counts of the accumulated input.
         for t in 0..rounds.len() as Time {
-            let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), t);
+            let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
             let mut expected: Vec<(Edge, Diff)> = Vec::new();
-            let mut counts: std::collections::BTreeMap<u32, Diff> = std::collections::BTreeMap::new();
+            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
             for ((src, _dst), d) in &input_acc {
                 *counts.entry(*src).or_insert(0) += d;
             }
@@ -478,7 +153,7 @@ fn reduce_counts_match_naive() {
                     expected.push(((src, c as u32), 1));
                 }
             }
-            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), t);
+            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
             assert_eq!(got, expected, "window={window} at time={t}");
         }
     }
diff --git a/differential-dataflow/tests/int_proxy_pending.rs b/differential-dataflow/tests/int_proxy_pending.rs
new file mode 100644
index 000000000..94d2ab1dd
--- /dev/null
+++ b/differential-dataflow/tests/int_proxy_pending.rs
@@ -0,0 +1,108 @@
+//! The partial-order test: carried interesting times (the *pending* path), which can
+//! only arise under partially ordered timestamps and was the last unexercised clause
+//! of the windowed reduce contract.
+//!
+//! With `Pair` times, updates at incomparable moments `(0,1)` and `(1,0)` make their
+//! join `(1,1)` an interesting time. When `(1,1)` lies beyond the retire's upper
+//! frontier it must be *pended*: returned in the frontier (holding the capability),
+//! carried by the tactic, handed to the backend as a `pending` group next retire —
+//! where the group must appear in a window even though it has no novel input — and
+//! evaluated there, producing the correction that collapses the two partial counts.
+
+mod common;
+
+use std::collections::BTreeMap;
+
+use timely::progress::Antichain;
+
+use differential_dataflow::operators::int_proxy::ProxyReduceTactic;
+use differential_dataflow::operators::reduce::ReduceTactic;
+
+use common::pair::Pair;
+use common::{accumulate, batch_frontiers, Diff, Edge, EdgeBatch, EdgeReduceBackend};
+
+type Time = Pair<u64, u64>;
+
+fn t(a: u64, b: u64) -> Time {
+    Pair::new(a, b)
+}
+
+#[test]
+fn pending_times_carry_across_retires() {
+    // Key 7 receives updates at incomparable times in round A; key 3 receives novel
+    // input only in round B, so round B's windows must merge a pending-only group
+    // (7) with a novel-only group (3), in group order, at window size 1.
+    for window in [1, 2, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+
+        // Round A: interval [ {(0,0)}, {(1,1)} ), capability held at (0,0).
+        let input_a = batch_frontiers(
+            vec![((7, 100), t(0, 1), 1), ((7, 200), t(1, 0), 1)],
+            Antichain::from_elem(t(0, 0)),
+            Antichain::from_elem(t(1, 1)),
+        );
+        let lower = Antichain::from_elem(t(0, 0));
+        let upper = Antichain::from_elem(t(1, 1));
+        let held = Antichain::from_elem(t(0, 0));
+        let (produced_a, frontier_a) = tactic.retire(
+            Vec::new(),
+            Vec::new(),
+            vec![input_a.clone()],
+            &lower,
+            &upper,
+            &held,
+        );
+        // The joint interesting time (1,1) lies beyond upper: it must be deferred,
+        // and the returned frontier must hold it.
+        assert_eq!(frontier_a, Antichain::from_elem(t(1, 1)), "the join of incomparable updates must be pended");
+
+        let mut outputs: Vec<EdgeBatch<Time>> = produced_a.into_iter().map(|(_, b)| b).collect();
+
+        // Round B: interval [ {(1,1)}, {(2,2)} ), capability held at (1,1). Novel
+        // input only for key 3; key 7 participates as a pending-only group.
+        let input_b = batch_frontiers(
+            vec![((3, 5), t(1, 1), 1)],
+            Antichain::from_elem(t(1, 1)),
+            Antichain::from_elem(t(2, 2)),
+        );
+        let lower = Antichain::from_elem(t(1, 1));
+        let upper = Antichain::from_elem(t(2, 2));
+        let held = Antichain::from_elem(t(1, 1));
+        let (produced_b, frontier_b) = tactic.retire(
+            vec![input_a.clone()],
+            outputs.clone(),
+            vec![input_b.clone()],
+            &lower,
+            &upper,
+            &held,
+        );
+        assert!(frontier_b.is_empty(), "nothing further to defer");
+        outputs.extend(produced_b.into_iter().map(|(_, b)| b));
+
+        // Oracle over a grid of times, using the partial order's less_equal: the
+        // accumulated output at t must be exactly the per-source counts of the
+        // accumulated input at t. At (1,1) this requires round B's correction to
+        // have collapsed the two partial counts of key 7 into one count of 2.
+        let inputs: Vec<(Edge, Time, Diff)> = input_a
+            .updates
+            .iter()
+            .chain(&input_b.updates)
+            .cloned()
+            .collect();
+        for probe in [t(0, 0), t(0, 1), t(1, 0), t(1, 1), t(2, 1), t(2, 2)] {
+            let input_acc = accumulate(inputs.iter().cloned(), &probe);
+            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
+            for ((src, _dst), d) in &input_acc {
+                *counts.entry(*src).or_insert(0) += d;
+            }
+            let mut expected: Vec<(Edge, Diff)> = Vec::new();
+            for (src, c) in counts {
+                if c > 0 {
+                    expected.push(((src, c as u32), 1));
+                }
+            }
+            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &probe);
+            assert_eq!(got, expected, "window={window} at probe={probe:?}");
+        }
+    }
+}

From 9a7a1262a192e9e05c8d390adf3ff2c36dfbbd02 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 17:48:12 -0400
Subject: [PATCH 07/18] Single-moment fast path in the proxy reduce harness
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bench localized the reduce tax to per-key discovery/replay running
on granules with exactly one interesting moment — the steady-state
snapshot shape. This adds the safe fast path: when a key has no pending
times, exactly one distinct seed time t*, and every presented input and
output time at-or-before t*, then discover_times would compute moments
== [t*] with nothing pended (history times before t* pass without
becoming moments; no join can escape t*), so the key is evaluated
directly from its bridge slices — no TimeHistory loads, no ValueHistory
replays, no KeyState. Fast keys batch into one window-wide
reduce_corrections call (round zero); their corrections go straight to
the tiles. Keys with no seeds and no pending are skipped outright.

Bench (100k keys, window 1024, release, best of 5):
  fanout 4:  17.3ms -> 7.6ms   (48x -> 20x vs native count)
  fanout 1:   8.5ms -> 5.2ms   (24x -> 11.5x)

Remaining cost is presentation-side (whole-window consolidate_updates
sorts in the backend, bridge allocation) — the open buffer-recycling
and k-way-merge items, not harness machinery.

tests/int_proxy_graphs.rs gains reduce_multitime_rounds: two distinct
times per retire under total order, so the slow path stays exercised
(a two-seed key cannot take the fast path) and fast and slow keys mix
within one window. The partial-order pending test covers the other
slow-path shapes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/reduce.rs         | 66 +++++++++++++++++++
 .../tests/int_proxy_graphs.rs                 | 58 ++++++++++++++++
 2 files changed, 124 insertions(+)

diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index a88b36acb..056d47a87 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -188,6 +188,14 @@ where
         let mut moments_scratch: Vec<B1::Time> = Vec::new();
         let mut pended_scratch: Vec<B1::Time> = Vec::new();
         let mut live: Vec<usize> = Vec::new();
+        // Fast-path staging: keys evaluated directly from their slices, one batched
+        // `reduce_corrections` for all of them per window (round zero, in effect).
+        let mut fast_keys: Vec<Bk::Group> = Vec::new();
+        let mut fast_times: Vec<B1::Time> = Vec::new();
+        let mut fast_in_ends: Vec<usize> = Vec::new();
+        let mut fast_in_all: Vec<(Bk::Token, Bk::RIn)> = Vec::new();
+        let mut fast_out_ends: Vec<usize> = Vec::new();
+        let mut fast_out_all: Vec<(Bk::Token, Bk::ROut)> = Vec::new();
 
         while let Some(window) = self.backend.next_window(&instance, &pending_keys) {
             let p_in = &window.input;
@@ -244,6 +252,41 @@ where
                 while ns < seeds.len() && seeds[ns].0 == key { ns += 1; }
                 let n1 = ns;
 
+                // Fast path: no pending, one distinct seed time `t*`, and every presented
+                // input/output time at-or-before it. Then `discover_times` would compute
+                // moments == [t*] with nothing pended (history times before `t*` pass
+                // without becoming moments, and no join can escape `t*`), so discovery
+                // and the replay loads are skipped and the key is evaluated directly
+                // from its slices. This is the steady-state snapshot shape, where the
+                // full apparatus was measured as the dominant per-key cost.
+                if self.pending.get(&key).is_none() {
+                    if n0 == n1 {
+                        // No seeds and no pending: no interesting times; nothing to do.
+                        continue;
+                    }
+                    let t_star = seeds[n0].1.clone();
+                    if seeds[n0..n1].iter().all(|s| s.1 == t_star)
+                        && p_in[i0..i1].iter().all(|x| x.1.less_equal(&t_star))
+                        && p_out[o0..o1].iter().all(|x| x.1.less_equal(&t_star))
+                    {
+                        in_accum.clear();
+                        in_accum.extend(p_in[i0..i1].iter().map(|x| (x.0 .1, x.2.clone())));
+                        crate::consolidation::consolidate(&mut in_accum);
+                        cur_out.clear();
+                        cur_out.extend(p_out[o0..o1].iter().map(|x| (x.0 .1, x.2.clone())));
+                        crate::consolidation::consolidate(&mut cur_out);
+                        if !in_accum.is_empty() || !cur_out.is_empty() {
+                            fast_keys.push(key);
+                            fast_times.push(t_star);
+                            fast_in_all.append(&mut in_accum);
+                            fast_in_ends.push(fast_in_all.len());
+                            fast_out_all.append(&mut cur_out);
+                            fast_out_ends.push(fast_out_all.len());
+                        }
+                        continue;
+                    }
+                }
+
                 moments_scratch.clear();
                 pended_scratch.clear();
                 {
@@ -291,6 +334,29 @@ where
             assert_eq!(os, p_out.len(), "next_window presented trailing output records past the last key");
             assert_eq!(ns, seeds.len(), "next_window presented trailing seeds past the last key");
 
+            // Round zero: the window's fast-path keys, one batched crossing. Their
+            // corrections go straight to the tiles — a fast key has no later moments.
+            if !fast_keys.is_empty() {
+                let (corr, corr_ends) = self.backend.reduce_corrections(&fast_keys, &fast_in_ends, &fast_in_all, &fast_out_ends, &fast_out_all);
+                let mut cstart = 0usize;
+                for (fi, t) in fast_times.iter().enumerate() {
+                    let cend = corr_ends[fi];
+                    if cstart != cend {
+                        let idx = held_elems.iter().rposition(|h| h.less_equal(t)).expect("no held capability <= fast-path time");
+                        for (vid, d) in &corr[cstart..cend] {
+                            tile_deltas[idx].push(((fast_keys[fi], *vid), t.clone(), d.clone()));
+                        }
+                    }
+                    cstart = cend;
+                }
+                fast_keys.clear();
+                fast_times.clear();
+                fast_in_ends.clear();
+                fast_in_all.clear();
+                fast_out_ends.clear();
+                fast_out_all.clear();
+            }
+
             // Phase 2 (application): walk all keys' moments in ROUNDS. Each round assembles every
             // active key's one-moment-deep input and current-output accumulations and crosses them in
             // a SINGLE `reduce_corrections` — batching across keys (a key's own moments stay
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index e25d560c0..1746ddf91 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -101,6 +101,64 @@ fn interleaved_units_share_backend() {
     assert_eq!(got2, expected2);
 }
 
+/// Per-time count oracle shared by the reduce tests.
+fn assert_counts(source: &[GraphBatch], outputs: &[GraphBatch], t: Time, label: &str) {
+    let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+    let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
+    for ((src, _dst), d) in &input_acc {
+        *counts.entry(*src).or_insert(0) += d;
+    }
+    let mut expected: Vec<(Edge, Diff)> = Vec::new();
+    for (src, c) in counts {
+        assert!(c >= 0);
+        if c > 0 {
+            expected.push(((src, c as u32), 1));
+        }
+    }
+    let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+    assert_eq!(got, expected, "{label} at time={t}");
+}
+
+#[test]
+fn reduce_multitime_rounds() {
+    // Intervals of width two, two distinct times per batch: under total order this
+    // exercises the slow (discovery) path even with the single-moment fast path in
+    // place — a key with two distinct seed times cannot take it — and mixes fast
+    // and slow keys within one window.
+    let rounds: Vec<(Vec<(Edge, Time, Diff)>, Time, Time)> = vec![
+        (vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((1, 6), 1, 1)], 0, 2),
+        (vec![((0, 3), 2, 1), ((1, 5), 3, -1), ((2, 7), 2, 1), ((2, 8), 3, 1)], 2, 4),
+    ];
+    for window in [1, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+        for (updates, lo, hi) in rounds.iter() {
+            let input = batch(updates.clone(), *lo, *hi);
+            let lower = Antichain::from_elem(*lo);
+            let upper = Antichain::from_elem(*hi);
+            let held = Antichain::from_elem(*lo);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+        }
+        for t in 0..4u64 {
+            assert_counts(&source, &outputs, t, &format!("multitime window={window}"));
+        }
+    }
+}
+
 #[test]
 fn reduce_counts_match_naive() {
     // Rounds of edge updates, including deletions that drop a source's count to zero

From cdaec9d777b93a5919cfae846b611a4054c3f4b4 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 21:32:25 -0400
Subject: [PATCH 08/18] Randomized differential test for the reduce harness

reduce_fuzz_matches_oracle: deterministic LCG-driven rounds of random
insertions and retractions over a small key space, times randomized
within each round's width-3 interval so every round mixes fast-path
keys (one distinct time) with slow-path keys, at window sizes 1/3/100,
checked against exact per-time counting after every round. This is the
empirical half of the fast-path equivalence argument (the analytic
half: under the guard, discover_times computes moments == [t*] with
nothing pended, and the round-zero accumulation equals the slice
consolidation). Retractions draw only from prior rounds' insertions so
every prefix accumulation stays non-negative.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../tests/int_proxy_graphs.rs                 | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index 1746ddf91..74de8624c 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -101,6 +101,71 @@ fn interleaved_units_share_backend() {
     assert_eq!(got2, expected2);
 }
 
+#[test]
+fn reduce_fuzz_matches_oracle() {
+    // Deterministic randomized differential test: random updates over a small key
+    // space, random times within each round's interval (so rounds mix fast-path
+    // keys — one distinct time — with slow-path keys), random retractions of live
+    // edges, several window sizes. The oracle is exact per-time counting.
+    let mut state = 0x853c49e6748fea9bu64;
+    let mut rng = move || {
+        state = state.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+        (state >> 33) as u32
+    };
+
+    for window in [1, 3, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+        let mut live: Vec<Edge> = Vec::new();
+        const ROUNDS: u64 = 8;
+        const WIDTH: u64 = 3;
+        for round in 0..ROUNDS {
+            let lo = round * WIDTH;
+            let hi = lo + WIDTH;
+            let mut updates: Vec<(Edge, Time, Diff)> = Vec::new();
+            // Retract only edges from PRIOR rounds (any time this round is at or after
+            // their insertion, keeping every prefix accumulation non-negative); this
+            // round's insertions join `live` only at round end.
+            let mut fresh: Vec<Edge> = Vec::new();
+            for _ in 0..40 {
+                let t = lo + (rng() as u64) % WIDTH;
+                if !live.is_empty() && rng() % 4 == 0 {
+                    let e = live[(rng() as usize) % live.len()];
+                    live.retain(|x| *x != e);
+                    updates.push((e, t, -1));
+                } else {
+                    let e = (rng() % 16, rng() % 64);
+                    fresh.push(e);
+                    updates.push((e, t, 1));
+                }
+            }
+            live.append(&mut fresh);
+            let input = batch(updates, lo, hi);
+            let lower = Antichain::from_elem(lo);
+            let upper = Antichain::from_elem(hi);
+            let held = Antichain::from_elem(lo);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+            for t in lo..hi {
+                assert_counts(&source, &outputs, t, &format!("fuzz window={window} round={round}"));
+            }
+        }
+    }
+}
+
 /// Per-time count oracle shared by the reduce tests.
 fn assert_counts(source: &[GraphBatch], outputs: &[GraphBatch], t: Time, label: &str) {
     let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);

From a36dda82172e267794abb377a5eaf758e51a1d8d Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 21:45:29 -0400
Subject: [PATCH 09/18] Bench the incumbents: cursor tactics vs proxy on
 identical storage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hand-written natives are a floor; the decision-relevant comparison
is against the shipping cursor tactics on the same real storage. The
bench now builds OrdValBatch inputs and consumes them two ways: the
cursor tactics directly, and the proxy tactics through backends that
present from those same batches via the same cursors — identical
storage access, so the difference is pure protocol.

The cursors modules in join.rs/reduce.rs become public (the tactic
entry points already were; these are the incumbent reference
implementations, and benches and differential tests drive them
directly).

Results (100k keys, window 1024, release, best of 5):

  join    fanout 4:  cursor 14.4ms   proxy 21.6ms   1.50x
          fanout 1:  cursor  3.4ms   proxy  3.9ms   1.16x
  reduce  fanout 4:  cursor 12.0ms   proxy  8.4ms   0.70x
          fanout 1:  cursor  6.8ms   proxy  5.6ms   0.83x

Reading: against the incumbent (rather than the non-incremental native
floor) the join protocol costs 1.2-1.5x — the bridge copy and staging
double-write, partially offset by the proxy's batch-at-a-time group
processing. The proxy REDUCE is 17-30% FASTER than the cursor
incumbent: the single-moment fast path skips per-key interesting-time
machinery the cursor path always runs. The decoupling is not a tax on
reduce at all on snapshot-shaped work; it is currently a modest tax on
join with identified, protocol-level fixes queued (buffer recycling,
cross-by-emit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../examples/int_proxy_bench.rs               | 360 ++++++++++++++++++
 differential-dataflow/src/operators/join.rs   |   6 +-
 differential-dataflow/src/operators/reduce.rs |   5 +-
 3 files changed, 369 insertions(+), 2 deletions(-)

diff --git a/differential-dataflow/examples/int_proxy_bench.rs b/differential-dataflow/examples/int_proxy_bench.rs
index f7476811d..82cbe790a 100644
--- a/differential-dataflow/examples/int_proxy_bench.rs
+++ b/differential-dataflow/examples/int_proxy_bench.rs
@@ -356,6 +356,319 @@ fn native_count(a: &[GraphBatch]) -> Vec<(Edge, Time, Diff)> {
     out
 }
 
+// ------------------------------------------- cursor incumbents, same storage
+
+/// The incumbent comparison: real `OrdValBatch` storage, consumed two ways — the
+/// cursor tactics (the shipping implementations), and the proxy tactics through
+/// backends that present from the same batches via the same cursors. Both pay
+/// identical storage access; the difference is protocol.
+mod ordval {
+    use super::{advance, Diff, Edge, Time};
+
+    use timely::container::CapacityContainerBuilder;
+    use timely::progress::Antichain;
+
+    use differential_dataflow::consolidation::consolidate_updates;
+    use differential_dataflow::operators::int_proxy::{
+        JoinInstance, JoinWindow, ProxyJoinBackend, ProxyReduceBackend, ReduceInstance,
+        ReduceWindow,
+    };
+    use differential_dataflow::operators::join::Fresh;
+    use differential_dataflow::trace::implementations::{ValBuilder, ValSpine};
+    use differential_dataflow::trace::{Builder, Cursor, Description, Navigable, TraceReader};
+
+    pub type Bt = <ValSpine<u32, u32, Time, Diff> as TraceReader>::Batch;
+    pub type Bu = ValBuilder<u32, u32, Time, Diff>;
+    type Cur = <Bt as Navigable>::Cursor;
+    pub type JoinCb = CapacityContainerBuilder<Vec<(Edge, Edge, Time, Diff)>>;
+
+    /// Seal sorted, consolidated updates into one `OrdValBatch`.
+    pub fn seal(mut updates: Vec<((u32, u32), Time, Diff)>, lower: Time, upper: Time) -> Bt {
+        consolidate_updates(&mut updates);
+        let description = Description::new(
+            Antichain::from_elem(lower),
+            Antichain::from_elem(upper),
+            Antichain::from_elem(0),
+        );
+        <Bu as Builder>::seal(&mut vec![updates], description)
+    }
+
+    /// The cursor-tactic closures for per-key counting, matching the proxy semantics.
+    pub fn count_logic(
+        _key: &u32,
+        input: &[(&u32, Diff)],
+        output: &mut Vec<(u32, Diff)>,
+        change: &mut Vec<(u32, Diff)>,
+    ) {
+        let count: Diff = input.iter().map(|(_, d)| *d).sum();
+        if count > 0 {
+            change.push((count as u32, 1));
+        }
+        change.extend(output.drain(..).map(|(x, d)| (x, -d)));
+        differential_dataflow::consolidation::consolidate(change);
+    }
+
+    /// Shared group-order scanning state over a set of batch cursors.
+    #[derive(Default)]
+    pub struct Cursors {
+        cursors: Vec<Cur>,
+        started: bool,
+    }
+
+    impl Cursors {
+        fn start(&mut self, batches: &[Bt]) {
+            if !self.started {
+                self.started = true;
+                self.cursors = batches.iter().map(|b| b.cursor()).collect();
+            }
+        }
+        fn next_group(&mut self, batches: &[Bt]) -> Option<u32> {
+            self.cursors
+                .iter()
+                .zip(batches)
+                .filter_map(|(c, b)| c.get_key(b).copied())
+                .min()
+        }
+        /// Visit every (val, time, diff) of group `g`, advancing past it.
+        fn drain_group(&mut self, batches: &[Bt], g: u32, mut logic: impl FnMut(u32, Time, Diff)) {
+            for (c, b) in self.cursors.iter_mut().zip(batches) {
+                if c.get_key(b) == Some(&g) {
+                    while let Some(v) = c.get_val(b) {
+                        let v = *v;
+                        c.map_times(b, |t, d| logic(v, *t, *d));
+                        c.step_val(b);
+                    }
+                    c.step_key(b);
+                }
+            }
+        }
+        /// Skip groups below `g`.
+        fn seek(&mut self, batches: &[Bt], g: u32) {
+            for (c, b) in self.cursors.iter_mut().zip(batches) {
+                c.seek_key(b, &g);
+            }
+        }
+    }
+
+    // ------------------------------------------------------------- proxy join
+
+    #[derive(Default)]
+    pub struct OrdJoinCursor {
+        c0: Cursors,
+        c1: Cursors,
+    }
+
+    pub struct OrdJoinBackend {
+        pub window: usize,
+    }
+
+    impl ProxyJoinBackend<Bt, Bt> for OrdJoinBackend {
+        type Group = u32;
+        type Token0 = Edge;
+        type Token1 = Edge;
+        type R0 = Diff;
+        type R1 = Diff;
+        type ROut = Diff;
+        type Output = Vec<(Edge, Edge, Time, Diff)>;
+        type Cursor = OrdJoinCursor;
+
+        fn next_window(
+            &mut self,
+            instance: &JoinInstance<'_, Bt, Bt>,
+            fresh: Fresh,
+            cursor: &mut OrdJoinCursor,
+        ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
+            cursor.c0.start(instance.batches0);
+            cursor.c1.start(instance.batches1);
+            loop {
+                let mut fresh_run = Vec::new();
+                let mut other_run = Vec::new();
+                let mut groups = 0;
+                while groups < self.window {
+                    let (fc, ob, oc, fb) = match fresh {
+                        Fresh::Input0 => (&mut cursor.c0, instance.batches1, &mut cursor.c1, instance.batches0),
+                        Fresh::Input1 => (&mut cursor.c1, instance.batches0, &mut cursor.c0, instance.batches1),
+                    };
+                    let Some(g) = fc.next_group(fb) else { break };
+                    groups += 1;
+                    fc.drain_group(fb, g, |v, t, r| {
+                        fresh_run.push(((g, (g, v)), advance(t, instance.lower), r));
+                    });
+                    oc.seek(ob, g);
+                    oc.drain_group(ob, g, |v, t, r| {
+                        other_run.push(((g, (g, v)), advance(t, instance.lower), r));
+                    });
+                }
+                if groups == 0 {
+                    return None;
+                }
+                consolidate_updates(&mut fresh_run);
+                consolidate_updates(&mut other_run);
+                if fresh_run.is_empty() && other_run.is_empty() {
+                    continue;
+                }
+                let (input0, input1) = match fresh {
+                    Fresh::Input0 => (fresh_run, other_run),
+                    Fresh::Input1 => (other_run, fresh_run),
+                };
+                return Some(JoinWindow { input0, input1 });
+            }
+        }
+
+        fn cross(
+            &mut self,
+            _instance: &JoinInstance<'_, Bt, Bt>,
+            left: &[(u32, Edge)],
+            right: &[(u32, Edge)],
+            times: &[Time],
+            diffs: &[Diff],
+        ) -> Self::Output {
+            left.iter()
+                .zip(right)
+                .zip(times)
+                .zip(diffs)
+                .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
+                .collect()
+        }
+    }
+
+    // ----------------------------------------------------------- proxy reduce
+
+    pub struct OrdReduceBackend {
+        pub window: usize,
+        tiles: Vec<Description<Time>>,
+        emitted: Vec<Vec<((u32, u32), Time, Diff)>>,
+        source: Cursors,
+        input: Cursors,
+        output: Cursors,
+        pend_idx: usize,
+    }
+
+    impl OrdReduceBackend {
+        pub fn new(window: usize) -> Self {
+            OrdReduceBackend {
+                window,
+                tiles: Vec::new(),
+                emitted: Vec::new(),
+                source: Cursors::default(),
+                input: Cursors::default(),
+                output: Cursors::default(),
+                pend_idx: 0,
+            }
+        }
+    }
+
+    impl ProxyReduceBackend<Bt, Bt> for OrdReduceBackend {
+        type Group = u32;
+        type Token = Edge;
+        type RIn = Diff;
+        type ROut = Diff;
+
+        fn begin(&mut self, tiles: &[Description<Time>]) {
+            self.tiles = tiles.to_vec();
+            self.emitted = vec![Vec::new(); tiles.len()];
+            self.source = Cursors::default();
+            self.input = Cursors::default();
+            self.output = Cursors::default();
+            self.pend_idx = 0;
+        }
+
+        fn next_window(
+            &mut self,
+            instance: &ReduceInstance<'_, Bt, Bt>,
+            pending: &[u32],
+        ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
+            self.source.start(instance.source_batches);
+            self.input.start(instance.input_batches);
+            self.output.start(instance.output_batches);
+            let mut keys = Vec::new();
+            let mut seeds = Vec::new();
+            let mut input = Vec::new();
+            let mut output = Vec::new();
+            while keys.len() < self.window {
+                let g = [
+                    self.source.next_group(instance.source_batches),
+                    self.input.next_group(instance.input_batches),
+                    self.output.next_group(instance.output_batches),
+                    pending.get(self.pend_idx).copied(),
+                ]
+                .into_iter()
+                .flatten()
+                .min();
+                let Some(g) = g else { break };
+                keys.push(g);
+                if pending.get(self.pend_idx) == Some(&g) {
+                    self.pend_idx += 1;
+                }
+                self.source.drain_group(instance.source_batches, g, |v, t, r| {
+                    input.push(((g, (g, v)), advance(t, instance.lower), r));
+                });
+                self.input.drain_group(instance.input_batches, g, |v, t, r| {
+                    seeds.push((g, t));
+                    input.push(((g, (g, v)), advance(t, instance.lower), r));
+                });
+                self.output.drain_group(instance.output_batches, g, |v, t, r| {
+                    output.push(((g, (g, v)), advance(t, instance.lower), r));
+                });
+            }
+            if keys.is_empty() {
+                return None;
+            }
+            consolidate_updates(&mut input);
+            consolidate_updates(&mut output);
+            seeds.sort();
+            seeds.dedup();
+            Some(ReduceWindow { keys, seeds, input, output })
+        }
+
+        fn reduce_corrections(
+            &mut self,
+            keys: &[u32],
+            in_ends: &[usize],
+            input: &[(Edge, Diff)],
+            out_ends: &[usize],
+            output: &[(Edge, Diff)],
+        ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
+            let mut corr = Vec::new();
+            let mut ends = Vec::new();
+            let (mut i0, mut o0) = (0, 0);
+            for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+                let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
+                let mut delta: Vec<(Edge, Diff)> = Vec::new();
+                if count > 0 {
+                    delta.push(((*k, count as u32), 1));
+                }
+                for (v, d) in &output[o0..o1] {
+                    delta.push((*v, -d));
+                }
+                differential_dataflow::consolidation::consolidate(&mut delta);
+                corr.extend(delta);
+                ends.push(corr.len());
+                i0 = i1;
+                o0 = o1;
+            }
+            (corr, ends)
+        }
+
+        fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
+            self.emitted[tile].extend(records.iter().map(|((g, e), t, r)| ((*g, e.1), *t, *r)));
+        }
+
+        fn finish(&mut self) -> Vec<Bt> {
+            self.tiles
+                .drain(..)
+                .zip(self.emitted.drain(..))
+                .map(|(desc, mut updates)| {
+                    consolidate_updates(&mut updates);
+                    let mut chain = vec![updates];
+                    <Bu as Builder>::seal(&mut chain, desc)
+                })
+                .collect()
+        }
+    }
+
+}
+
 // ----------------------------------------------------------------------- bench
 
 fn time<T>(label: &str, reps: usize, mut f: impl FnMut() -> T) -> f64 {
@@ -412,4 +725,51 @@ fn main() {
         tactic.retire(Vec::new(), Vec::new(), input.clone(), &lower, &upper, &held)
     });
     println!("    ratio: {:.2}x", t_proxy / t_native);
+
+    // ---- incumbent comparison: identical OrdValBatch storage, cursor vs proxy ----
+
+    use differential_dataflow::operators::reduce::cursors::CursorTactic as ReduceCursorTactic;
+    use differential_dataflow::operators::join::cursors::CursorTactic as JoinCursorTactic;
+
+    let a_ord = vec![ordval::seal(edges(1), 0, 1)];
+    let b_ord = vec![ordval::seal(edges(2), 0, 1)];
+
+    println!("\njoin on OrdValBatch storage (cursor incumbent vs proxy protocol):");
+    let t_cursor = time("cursor JoinTactic", reps, || {
+        let mut tactic = JoinCursorTactic::<ordval::Bt, ordval::Bt, _, ordval::JoinCb>::new(
+            |k: &u32, v0: &u32, v1: &u32, t: Time, d0: &Diff, d1: &Diff, cb: &mut ordval::JoinCb| {
+                use timely::container::PushInto;
+                cb.push_into(((*k, *v0), (*k, *v1), t, d0 * d1));
+            },
+        );
+        let work = tactic.prep(a_ord.clone(), b_ord.clone(), Fresh::Input0, 0);
+        work.collect::<Vec<_>>()
+    });
+    let t_proxy = time("proxy join (cursor backend)", reps, || {
+        let mut tactic = ProxyJoinTactic::new(ordval::OrdJoinBackend { window });
+        let work = tactic.prep(a_ord.clone(), b_ord.clone(), Fresh::Input0, 0);
+        work.collect::<Vec<_>>()
+    });
+    println!("    ratio: {:.2}x", t_proxy / t_cursor);
+
+    println!("\nreduce on OrdValBatch storage (cursor incumbent vs proxy protocol):");
+    let input_ord = vec![ordval::seal(edges(1), 0, 1)];
+    let lower = Antichain::from_elem(0u64);
+    let upper = Antichain::from_elem(1u64);
+    let held = Antichain::from_elem(0u64);
+    let t_cursor = time("cursor ReduceTactic", reps, || {
+        let mut tactic = ReduceCursorTactic::<ordval::Bt, ordval::Bt, ordval::Bu, _, _>::new(
+            ordval::count_logic,
+            |vec: &mut Vec<((u32, u32), Time, Diff)>, key: &u32, upds: &mut Vec<(u32, Time, Diff)>| {
+                vec.clear();
+                vec.extend(upds.drain(..).map(|(v, t, r)| ((*key, v), t, r)));
+            },
+        );
+        tactic.retire(Vec::new(), Vec::new(), input_ord.clone(), &lower, &upper, &held)
+    });
+    let t_proxy = time("proxy reduce (cursor backend)", reps, || {
+        let mut tactic = ProxyReduceTactic::new(ordval::OrdReduceBackend::new(window));
+        tactic.retire(Vec::new(), Vec::new(), input_ord.clone(), &lower, &upper, &held)
+    });
+    println!("    ratio: {:.2}x", t_proxy / t_cursor);
 }
diff --git a/differential-dataflow/src/operators/join.rs b/differential-dataflow/src/operators/join.rs
index 5b70a56e8..f81c3479c 100644
--- a/differential-dataflow/src/operators/join.rs
+++ b/differential-dataflow/src/operators/join.rs
@@ -382,7 +382,11 @@ where
 }
 
 /// Cursor-based join: the conventional [`JoinTactic`] implementation and its per-batch worker.
-mod cursors {
+/// The conventional cursor-based [`JoinTactic`] implementation.
+///
+/// Public since the tactic entry points are: it is the incumbent reference
+/// implementation, and benchmarks and differential tests drive it directly.
+pub mod cursors {
 
     use std::cell::RefCell;
     use std::rc::Rc;
diff --git a/differential-dataflow/src/operators/reduce.rs b/differential-dataflow/src/operators/reduce.rs
index 83238105a..d30fa2864 100644
--- a/differential-dataflow/src/operators/reduce.rs
+++ b/differential-dataflow/src/operators/reduce.rs
@@ -260,7 +260,10 @@ where
 /// updates and replays them together per key, applying `logic` and shaping output with `push`. It holds
 /// the outstanding synthetic interesting `(key, time)` moments across activations, and reasons only
 /// about times: capabilities are the driver's concern.
-mod cursors {
+///
+/// Public since the tactic entry points are: it is the incumbent reference implementation,
+/// and benchmarks and differential tests drive it directly.
+pub mod cursors {
 
     use super::*;
 

From b52cac66f95b6a7fced50db1102c65c065b1e10f Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 21:58:31 -0400
Subject: [PATCH 10/18] Cross-by-emit and window-buffer recycling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The two measured per-record taxes in the join protocol, removed:

* cross (staged slices) becomes absorb + flush: each match goes
  straight from the merge to the backend, which accumulates into its
  own output representation and yields containers at its own size
  target (JOIN_CHUNK leaves the harness — container granularity is the
  backend's decision). The li/ri/ot/od staging buffers are deleted
  outright: the double-write goes away, not just its allocation.
  join_key emits through a closure; the wave path feeds absorb
  directly.

* next_window (both tactics) gains a reuse parameter returning the
  previous, fully-processed window, so backends clear() and refill
  with retained capacity instead of allocating fresh bridges per
  window — the steady-state allocation churn item from the review.

Bench movement (100k keys, window 1024, release, best of 5):

  join vs native:            2.7x  -> 1.49x  (fanout 4)
  join vs cursor incumbent:  1.50x -> 0.94x  (fanout 4)
                             1.16x -> 0.90x  (fanout 1)
  reduce vs cursor:          0.70x -> 0.68x

Both proxy tactics are now FASTER than the shipping cursor tactics on
identical OrdValBatch storage. The remaining gap to the hand-written
native floor (1.49x) is the bridge presentation copy itself, which is
the present-by-reference / lens territory deliberately parked in
SEAM.md.

All backends updated (graphs/common, bytes, bench x2); the bytes
absorb keeps the group-collision key re-check per match. Tests
unchanged in behavior; test backends use small container targets to
exercise multi-container yields.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../examples/int_proxy_bench.rs               | 118 +++++++++++------
 .../src/operators/int_proxy/join.rs           | 119 ++++++++----------
 .../src/operators/int_proxy/reduce.rs         |  10 +-
 differential-dataflow/tests/common/mod.rs     |  71 ++++++++---
 .../tests/int_proxy_bytes.rs                  |  84 ++++++++-----
 .../tests/int_proxy_graphs.rs                 |   4 +-
 6 files changed, 246 insertions(+), 160 deletions(-)

diff --git a/differential-dataflow/examples/int_proxy_bench.rs b/differential-dataflow/examples/int_proxy_bench.rs
index 82cbe790a..65e7c3261 100644
--- a/differential-dataflow/examples/int_proxy_bench.rs
+++ b/differential-dataflow/examples/int_proxy_bench.rs
@@ -87,6 +87,14 @@ struct GraphJoinCursor {
 
 struct GraphJoinBackend {
     window: usize,
+    target: usize,
+    staged: Vec<(Edge, Edge, Time, Diff)>,
+}
+
+impl GraphJoinBackend {
+    fn new(window: usize) -> Self {
+        GraphJoinBackend { window, target: 1 << 20, staged: Vec::new() }
+    }
 }
 
 impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
@@ -104,6 +112,7 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
         instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
         fresh: Fresh,
         cursor: &mut GraphJoinCursor,
+        reuse: Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>>,
     ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
         cursor.pos0.resize(instance.batches0.len(), 0);
         cursor.pos1.resize(instance.batches1.len(), 0);
@@ -111,9 +120,13 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
             Fresh::Input0 => (instance.batches0, instance.batches1),
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
+        let (mut fresh_run, mut other_run) = match reuse {
+            Some(JoinWindow { input0, input1 }) => (input0, input1),
+            None => (Vec::new(), Vec::new()),
+        };
         loop {
-            let mut fresh_run = Vec::new();
-            let mut other_run = Vec::new();
+            fresh_run.clear();
+            other_run.clear();
             let mut groups = 0;
             while groups < self.window {
                 let (fresh_pos, other_pos) = match fresh {
@@ -150,20 +163,24 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
         }
     }
 
-    fn cross(
+    fn absorb(
         &mut self,
         _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        left: &[(u32, Edge)],
-        right: &[(u32, Edge)],
-        times: &[Time],
-        diffs: &[Diff],
-    ) -> Self::Output {
-        left.iter()
-            .zip(right)
-            .zip(times)
-            .zip(diffs)
-            .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
-            .collect()
+        left: (u32, Edge),
+        right: (u32, Edge),
+        time: Time,
+        diff: Diff,
+    ) -> Option<Self::Output> {
+        self.staged.push((left.1, right.1, time, diff));
+        if self.staged.len() >= self.target {
+            Some(std::mem::take(&mut self.staged))
+        } else {
+            None
+        }
+    }
+
+    fn flush(&mut self, _instance: &JoinInstance<'_, GraphBatch, GraphBatch>) -> Option<Self::Output> {
+        if self.staged.is_empty() { None } else { Some(std::mem::take(&mut self.staged)) }
     }
 }
 
@@ -212,14 +229,18 @@ impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
         &mut self,
         instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
         pending: &[u32],
+        reuse: Option<ReduceWindow<u32, Edge, Time, Diff, Diff>>,
     ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
         self.pos_source.resize(instance.source_batches.len(), 0);
         self.pos_input.resize(instance.input_batches.len(), 0);
         self.pos_output.resize(instance.output_batches.len(), 0);
-        let mut keys = Vec::new();
-        let mut seeds = Vec::new();
-        let mut input = Vec::new();
-        let mut output = Vec::new();
+        let (mut keys, mut seeds, mut input, mut output) = match reuse {
+            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
+                keys.clear(); seeds.clear(); input.clear(); output.clear();
+                (keys, seeds, input, output)
+            }
+            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
+        };
         while keys.len() < self.window {
             let g = [
                 next_group(instance.source_batches, &self.pos_source),
@@ -460,6 +481,14 @@ mod ordval {
 
     pub struct OrdJoinBackend {
         pub window: usize,
+        pub target: usize,
+        staged: Vec<(Edge, Edge, Time, Diff)>,
+    }
+
+    impl OrdJoinBackend {
+        pub fn new(window: usize) -> Self {
+            OrdJoinBackend { window, target: 1 << 20, staged: Vec::new() }
+        }
     }
 
     impl ProxyJoinBackend<Bt, Bt> for OrdJoinBackend {
@@ -477,12 +506,17 @@ mod ordval {
             instance: &JoinInstance<'_, Bt, Bt>,
             fresh: Fresh,
             cursor: &mut OrdJoinCursor,
+            reuse: Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>>,
         ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
             cursor.c0.start(instance.batches0);
             cursor.c1.start(instance.batches1);
+            let (mut fresh_run, mut other_run) = match reuse {
+                Some(JoinWindow { input0, input1 }) => (input0, input1),
+                None => (Vec::new(), Vec::new()),
+            };
             loop {
-                let mut fresh_run = Vec::new();
-                let mut other_run = Vec::new();
+                fresh_run.clear();
+                other_run.clear();
                 let mut groups = 0;
                 while groups < self.window {
                     let (fc, ob, oc, fb) = match fresh {
@@ -515,20 +549,24 @@ mod ordval {
             }
         }
 
-        fn cross(
+        fn absorb(
             &mut self,
             _instance: &JoinInstance<'_, Bt, Bt>,
-            left: &[(u32, Edge)],
-            right: &[(u32, Edge)],
-            times: &[Time],
-            diffs: &[Diff],
-        ) -> Self::Output {
-            left.iter()
-                .zip(right)
-                .zip(times)
-                .zip(diffs)
-                .map(|(((l, r), t), d)| (l.1, r.1, *t, *d))
-                .collect()
+            left: (u32, Edge),
+            right: (u32, Edge),
+            time: Time,
+            diff: Diff,
+        ) -> Option<Self::Output> {
+            self.staged.push((left.1, right.1, time, diff));
+            if self.staged.len() >= self.target {
+                Some(std::mem::take(&mut self.staged))
+            } else {
+                None
+            }
+        }
+
+        fn flush(&mut self, _instance: &JoinInstance<'_, Bt, Bt>) -> Option<Self::Output> {
+            if self.staged.is_empty() { None } else { Some(std::mem::take(&mut self.staged)) }
         }
     }
 
@@ -577,14 +615,18 @@ mod ordval {
             &mut self,
             instance: &ReduceInstance<'_, Bt, Bt>,
             pending: &[u32],
+            reuse: Option<ReduceWindow<u32, Edge, Time, Diff, Diff>>,
         ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
             self.source.start(instance.source_batches);
             self.input.start(instance.input_batches);
             self.output.start(instance.output_batches);
-            let mut keys = Vec::new();
-            let mut seeds = Vec::new();
-            let mut input = Vec::new();
-            let mut output = Vec::new();
+            let (mut keys, mut seeds, mut input, mut output) = match reuse {
+                Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
+                    keys.clear(); seeds.clear(); input.clear(); output.clear();
+                    (keys, seeds, input, output)
+                }
+                None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
+            };
             while keys.len() < self.window {
                 let g = [
                     self.source.next_group(instance.source_batches),
@@ -708,7 +750,7 @@ fn main() {
     );
     let t_native = time("native merge-join", reps, || native_join(&a, &b, 1 << 20));
     let t_proxy = time("proxy join (value tokens)", reps, || {
-        let mut tactic = ProxyJoinTactic::new(GraphJoinBackend { window });
+        let mut tactic = ProxyJoinTactic::new(GraphJoinBackend::new(window));
         let work = tactic.prep(a.clone(), b.clone(), Fresh::Input0, 0);
         work.collect::<Vec<_>>()
     });
@@ -746,7 +788,7 @@ fn main() {
         work.collect::<Vec<_>>()
     });
     let t_proxy = time("proxy join (cursor backend)", reps, || {
-        let mut tactic = ProxyJoinTactic::new(ordval::OrdJoinBackend { window });
+        let mut tactic = ProxyJoinTactic::new(ordval::OrdJoinBackend::new(window));
         let work = tactic.prep(a_ord.clone(), b_ord.clone(), Fresh::Input0, 0);
         work.collect::<Vec<_>>()
     });
diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index 288ff7374..8108ecdee 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -76,12 +76,23 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// silently loses that group's matches. Both bridges **must be sorted and consolidated**
     /// by `((group, token), time)`. The backend sizes windows to amortize harness crossings;
     /// both bridges are live at once, so tighter windows mean less state.
-    fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut Self::Cursor) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
-    /// From a list of left and right tokens, and corresponding times and diffs, the output.
     ///
-    /// All four slices have equal length, entry `n` describing match `n`. The slices are the
-    /// harness's reused buffers: read them, build the output, and take nothing.
-    fn cross(&mut self, instance: &JoinInstance<'_, B0, B1>, left: &[(Self::Group, Self::Token0)], right: &[(Self::Group, Self::Token1)], times: &[B0::Time], diffs: &[Self::ROut]) -> Self::Output;
+    /// `reuse` returns the previous, fully-processed window: reclaim its bridge capacity
+    /// (`clear()` and refill) rather than allocating fresh, so steady-state windowing does
+    /// not churn allocation proportional to data volume.
+    fn next_window(&mut self, instance: &JoinInstance<'_, B0, B1>, fresh: Fresh, cursor: &mut Self::Cursor, reuse: Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>) -> Option<JoinWindow<Self::Group, Self::Token0, Self::Token1, B0::Time, Self::R0, Self::R1>>;
+
+    /// Absorb one match: left and right tokens, joined time, multiplied diff.
+    ///
+    /// The backend accumulates matches into its own output representation and returns a
+    /// finished container whenever its own size target is reached (the backend, not the
+    /// harness, decides container granularity). Matches arrive grouped by key, keys in
+    /// window order. Called at most once per match: there is no staging in the harness,
+    /// so this is the only time the match exists outside the backend.
+    fn absorb(&mut self, instance: &JoinInstance<'_, B0, B1>, left: (Self::Group, Self::Token0), right: (Self::Group, Self::Token1), time: B0::Time, diff: Self::ROut) -> Option<Self::Output>;
+
+    /// Yield the final partial container, if any. Called once, after the last window.
+    fn flush(&mut self, instance: &JoinInstance<'_, B0, B1>) -> Option<Self::Output>;
 }
 
 /// A proxy-space [`JoinTactic`]: matches records of the presented windows by group token,
@@ -122,33 +133,28 @@ where
             cursor: Bk::Cursor::default(),
             high: None,
             done: false,
+            flushed: false,
             current: None,
+            spent: None,
             h0: IdHistory::new(),
             h1: IdHistory::new(),
-            li: Vec::new(),
-            ri: Vec::new(),
-            ot: Vec::new(),
-            od: Vec::new(),
             ready: std::collections::VecDeque::new(),
         })
     }
 }
 
-/// Update count threshold used to return to the backend with join output to instantiate.
-const JOIN_CHUNK: usize = 1 << 20;
-
 /// One lazy join unit: owns its batches and streams outputs a key at a time.
 ///
 /// Each `next` first drains `ready`; when empty it advances the unit by one step —
 /// fetching the next window if none is in progress, or merge-matching **one** key from
-/// the window in progress and crossing its matched records. Containers are cut at
-/// ~[`JOIN_CHUNK`] matches, wherever that lands (mid-key included; parity: their
-/// concatenation is the single-container output), with any remainder flushed when the
-/// unit exhausts. Peak state is one window's presentations plus one key's containers.
+/// the window in progress, feeding each match to the backend's `absorb` (which yields
+/// containers at its own granularity; the final remainder comes from `flush` when the
+/// unit exhausts). Matches are never staged in the harness: peak state is one window's
+/// presentations plus whatever the backend buffers toward its next container.
 ///
-/// The match buffers (`li`/`ri`/`ot`/`od`) and replay histories (`h0`/`h1`) live on the
-/// unit, reused across keys and windows, so steady-state operation allocates only what
-/// the backend's presentations and outputs themselves require.
+/// Spent windows are handed back to the backend through `next_window`'s `reuse`
+/// argument, and the replay histories (`h0`/`h1`) live on the unit, so steady-state
+/// operation allocates only what the backend's own representations require.
 ///
 /// `lower` is the capability's time, a lower bound on the fresh side's times, so the
 /// accumulated side loads compacted (see [`JoinInstance`]); every output is produced under
@@ -164,17 +170,16 @@ struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoin
     /// Greatest group presented so far, to enforce ascending windows.
     high: Option<Bk::Group>,
     done: bool,
+    /// Whether the end-of-unit `flush` has been taken.
+    flushed: bool,
     /// The window in progress and the merge positions into its two bridges.
     current: Option<(JoinWindow<Bk::Group, Bk::Token0, Bk::Token1, B0::Time, Bk::R0, Bk::R1>, usize, usize)>,
+    /// The previous, fully-processed window, awaiting return to the backend for reuse.
+    spent: Option<JoinWindow<Bk::Group, Bk::Token0, Bk::Token1, B0::Time, Bk::R0, Bk::R1>>,
     /// Per-key replay histories, held across the unit and reloaded per key (only the >=16/>=16
     /// replay-wave path touches them), so a high-fanout join pays no per-key `IdHistory` alloc.
     h0: IdHistory<Bk::Token0, B0::Time, Bk::R0>,
     h1: IdHistory<Bk::Token1, B0::Time, Bk::R1>,
-    /// Match buffers, held across keys and windows; flushed at `JOIN_CHUNK` and at unit end.
-    li: Vec<(Bk::Group, Bk::Token0)>,
-    ri: Vec<(Bk::Group, Bk::Token1)>,
-    ot: Vec<B0::Time>,
-    od: Vec<Bk::ROut>,
     /// Outputs produced but not yet handed to the driver: at most one key's containers.
     ready: std::collections::VecDeque<Bk::Output>,
 }
@@ -192,22 +197,18 @@ where
             let mut backend = backend.borrow_mut();
             let instance = JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() };
 
-            // Exhausted: flush any straggling matches as the final container.
+            // Exhausted: take the backend's final partial container, exactly once.
             if self.done && self.current.is_none() {
-                if self.li.is_empty() {
+                if self.flushed {
                     return None;
                 }
-                let out = backend.cross(&instance, &self.li, &self.ri, &self.ot, &self.od);
-                self.li.clear();
-                self.ri.clear();
-                self.ot.clear();
-                self.od.clear();
-                return Some(out);
+                self.flushed = true;
+                return backend.flush(&instance);
             }
 
-            // Fetch the next window if none is in progress.
+            // Fetch the next window if none is in progress, returning the spent one.
             if self.current.is_none() {
-                match backend.next_window(&instance, self.fresh, &mut self.cursor) {
+                match backend.next_window(&instance, self.fresh, &mut self.cursor, self.spent.take()) {
                     None => {
                         self.done = true;
                     }
@@ -231,22 +232,18 @@ where
             }
 
             // Merge-match at most ONE key from the window in progress, so `ready` holds at
-            // most one key's containers. `flush` ships the accumulated batch as a container
-            // and resets the buffers; `join_key` calls it at each `JOIN_CHUNK` boundary —
-            // including *within* a high-fanout key's wave — so no single key materializes
-            // more than a chunk of its cross product at a time in the match buffers.
+            // most one key's containers. Each match goes straight to the backend's `absorb`
+            // — no staging — which yields containers at its own granularity, including
+            // *within* a high-fanout key's wave.
             let (window, i, j) = self.current.as_mut().unwrap();
             let p0 = &window.input0;
             let p1 = &window.input1;
             let (h0, h1) = (&mut self.h0, &mut self.h1);
-            let (li, ri, ot, od) = (&mut self.li, &mut self.ri, &mut self.ot, &mut self.od);
             let ready = &mut self.ready;
-            let mut flush = |li: &mut Vec<(Bk::Group, Bk::Token0)>, ri: &mut Vec<(Bk::Group, Bk::Token1)>, ot: &mut Vec<B0::Time>, od: &mut Vec<Bk::ROut>| {
-                ready.push_back(backend.cross(&instance, li.as_slice(), ri.as_slice(), ot.as_slice(), od.as_slice()));
-                li.clear();
-                ri.clear();
-                ot.clear();
-                od.clear();
+            let mut emit = |l: (Bk::Group, Bk::Token0), r: (Bk::Group, Bk::Token1), t: B0::Time, d: Bk::ROut| {
+                if let Some(out) = backend.absorb(&instance, l, r, t, d) {
+                    ready.push_back(out);
+                }
             };
             let mut matched = false;
             while !matched && *i < p0.len() && *j < p1.len() {
@@ -260,26 +257,25 @@ where
                     while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
                     let mut e1 = *j;
                     while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
-                    join_key(ki, p0, *i..e0, p1, *j..e1, h0, h1, li, ri, ot, od, &mut flush);
+                    join_key(ki, p0, *i..e0, p1, *j..e1, h0, h1, &mut emit);
                     *i = e0;
                     *j = e1;
                     matched = true;
                 }
             }
             if *i >= p0.len() || *j >= p1.len() {
-                self.current = None;
+                self.spent = self.current.take().map(|(w, _, _)| w);
             }
         }
         self.ready.pop_front()
     }
 }
 
-/// Match one key's records across the two presented runs.
+/// Match one key's records across the two presented runs, emitting each match.
 ///
 /// If either history is small, this performs a simple cross product.
 /// If both histories are large, this replays the histories compacting as it goes in
 /// order to (potentially) avoid quadratic blow-up.
-#[allow(clippy::too_many_arguments)]
 fn join_key<G, I0, I1, T, R0, R1, RO, F>(
     kh: G,
     p0: &ProxyBridge<G, I0, T, R0>,
@@ -288,11 +284,7 @@ fn join_key<G, I0, I1, T, R0, R1, RO, F>(
     r1: std::ops::Range<usize>,
     h0: &mut IdHistory<I0, T, R0>,
     h1: &mut IdHistory<I1, T, R1>,
-    li: &mut Vec<(G, I0)>,
-    ri: &mut Vec<(G, I1)>,
-    ot: &mut Vec<T>,
-    od: &mut Vec<RO>,
-    flush: &mut F,
+    emit: &mut F,
 ) where
     G: Copy + Ord,
     I0: Copy + Ord,
@@ -300,19 +292,12 @@ fn join_key<G, I0, I1, T, R0, R1, RO, F>(
     T: Lattice + Timestamp,
     R0: Semigroup + Multiply<R1, Output = RO> + Clone,
     R1: Semigroup + Clone,
-    F: FnMut(&mut Vec<(G, I0)>, &mut Vec<(G, I1)>, &mut Vec<T>, &mut Vec<RO>),
+    F: FnMut((G, I0), (G, I1), T, RO),
 {
-    // `flush` ships the accumulated batch once it reaches `JOIN_CHUNK` and resets the buffers. It's
-    // checked after every produced pair — *including inside the replay wave below* — so even a key
-    // whose fanout dwarfs `JOIN_CHUNK` never materializes more than a chunk of its cross product.
     if r0.len() < 16 || r1.len() < 16 {
         for a in r0 {
             for b in r1.clone() {
-                li.push((kh, p0[a].0.1));
-                ri.push((kh, p1[b].0.1));
-                ot.push(p0[a].1.join(&p1[b].1));
-                od.push(p0[a].2.clone().multiply(&p1[b].2));
-                if li.len() >= JOIN_CHUNK { flush(li, ri, ot, od); }
+                emit((kh, p0[a].0.1), (kh, p1[b].0.1), p0[a].1.join(&p1[b].1), p0[a].2.clone().multiply(&p1[b].2));
             }
         }
         return;
@@ -324,12 +309,6 @@ fn join_key<G, I0, I1, T, R0, R1, RO, F>(
     h1.load_iter(r1.map(|i| (p1[i].0.1, p1[i].1.clone(), p1[i].2.clone())), None);
 
     crate::operators::common::bilinear_wave(h0, h1, |v0, v1, t, d| {
-        li.push((kh, v0));
-        ri.push((kh, v1));
-        ot.push(t);
-        od.push(d);
-        if li.len() >= JOIN_CHUNK {
-            flush(li, ri, ot, od);
-        }
+        emit((kh, v0), (kh, v1), t, d);
     });
 }
diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index 056d47a87..e11c64877 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -88,7 +88,11 @@ pub trait ProxyReduceBackend<B1: BatchReader, B2: BatchReader<Time = B1::Time>>
     /// The size of the window is up to the backend, where the window should be large enough to
     /// amortize the crossings between the harness and the backend. The proxy bridges for the
     /// whole window will be active at the same time, so tighter windows reduce the required state.
-    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, pending: &[Self::Group]) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
+    ///
+    /// `reuse` returns the previous, fully-processed window: reclaim its buffer capacity
+    /// (`clear()` and refill) rather than allocating fresh, so steady-state windowing does
+    /// not churn allocation proportional to data volume.
+    fn next_window(&mut self, instance: &ReduceInstance<'_, B1, B2>, pending: &[Self::Group], reuse: Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>) -> Option<ReduceWindow<Self::Group, Self::Token, B1::Time, Self::RIn, Self::ROut>>;
 
     /// A wave of input-output reconciliation, in which the backend supplies necessary edits.
     ///
@@ -197,7 +201,8 @@ where
         let mut fast_out_ends: Vec<usize> = Vec::new();
         let mut fast_out_all: Vec<(Bk::Token, Bk::ROut)> = Vec::new();
 
-        while let Some(window) = self.backend.next_window(&instance, &pending_keys) {
+        let mut spent: Option<ReduceWindow<Bk::Group, Bk::Token, B1::Time, Bk::RIn, Bk::ROut>> = None;
+        while let Some(window) = self.backend.next_window(&instance, &pending_keys, spent.take()) {
             let p_in = &window.input;
             let p_out = &window.output;
             let seeds = &window.seeds;
@@ -457,6 +462,7 @@ where
                     self.backend.emit(tile, &deltas[..]);
                 }
             }
+            spent = Some(window);
         }
 
         // Hard for the same reason as the per-window pending walk: an uncovered pending
diff --git a/differential-dataflow/tests/common/mod.rs b/differential-dataflow/tests/common/mod.rs
index 8b69c5fa5..91153dc84 100644
--- a/differential-dataflow/tests/common/mod.rs
+++ b/differential-dataflow/tests/common/mod.rs
@@ -93,12 +93,21 @@ pub struct EdgeJoinCursor {
     pub pos1: Vec<usize>,
 }
 
-pub struct EdgeJoinBackend {
+pub struct EdgeJoinBackend<T> {
     /// Groups per window; tiny in tests to force many windows.
     pub window: usize,
+    /// Matches per output container; tiny in tests to force many containers.
+    pub target: usize,
+    staged: Vec<(Edge, Edge, T, Diff)>,
 }
 
-impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend {
+impl<T> EdgeJoinBackend<T> {
+    pub fn new(window: usize) -> Self {
+        EdgeJoinBackend { window, target: 8, staged: Vec::new() }
+    }
+}
+
+impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend<T> {
     type Group = u32;
     type Token0 = Edge;
     type Token1 = Edge;
@@ -114,6 +123,7 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
         instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
         fresh: Fresh,
         cursor: &mut EdgeJoinCursor,
+        reuse: Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>>,
     ) -> Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>> {
         cursor.pos0.resize(instance.batches0.len(), 0);
         cursor.pos1.resize(instance.batches1.len(), 0);
@@ -123,9 +133,14 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
             Fresh::Input0 => (instance.batches0, instance.batches1),
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
+        // Reclaim the spent window's bridge capacity.
+        let (mut fresh_run, mut other_run) = match reuse {
+            Some(JoinWindow { input0, input1 }) => (input0, input1),
+            None => (Vec::new(), Vec::new()),
+        };
         loop {
-            let mut fresh_run = Vec::new();
-            let mut other_run = Vec::new();
+            fresh_run.clear();
+            other_run.clear();
             let mut groups = 0;
             while groups < self.window {
                 let (fresh_pos, other_pos) = match fresh {
@@ -165,21 +180,29 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
         }
     }
 
-    fn cross(
+    fn absorb(
         &mut self,
         _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
-        left: &[(u32, Edge)],
-        right: &[(u32, Edge)],
-        times: &[T],
-        diffs: &[Diff],
-    ) -> Self::Output {
+        left: (u32, Edge),
+        right: (u32, Edge),
+        time: T,
+        diff: Diff,
+    ) -> Option<Self::Output> {
         // Self-redeeming tokens: the output is built from the tokens alone.
-        left.iter()
-            .zip(right)
-            .zip(times)
-            .zip(diffs)
-            .map(|(((l, r), t), d)| (l.1, r.1, t.clone(), *d))
-            .collect()
+        self.staged.push((left.1, right.1, time, diff));
+        if self.staged.len() >= self.target {
+            Some(std::mem::take(&mut self.staged))
+        } else {
+            None
+        }
+    }
+
+    fn flush(&mut self, _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>) -> Option<Self::Output> {
+        if self.staged.is_empty() {
+            None
+        } else {
+            Some(std::mem::take(&mut self.staged))
+        }
     }
 }
 
@@ -248,14 +271,22 @@ impl<T: Timestamp + Lattice + Ord> ProxyReduceBackend<EdgeBatch<T>, EdgeBatch<T>
         &mut self,
         instance: &ReduceInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
         pending: &[u32],
+        reuse: Option<ReduceWindow<u32, Edge, T, Diff, Diff>>,
     ) -> Option<ReduceWindow<u32, Edge, T, Diff, Diff>> {
         self.pos_source.resize(instance.source_batches.len(), 0);
         self.pos_input.resize(instance.input_batches.len(), 0);
         self.pos_output.resize(instance.output_batches.len(), 0);
-        let mut keys = Vec::new();
-        let mut seeds = Vec::new();
-        let mut input = Vec::new();
-        let mut output = Vec::new();
+        // Reclaim the spent window's buffer capacity.
+        let (mut keys, mut seeds, mut input, mut output) = match reuse {
+            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
+                keys.clear();
+                seeds.clear();
+                input.clear();
+                output.clear();
+                (keys, seeds, input, output)
+            }
+            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
+        };
         while keys.len() < self.window {
             let g = [
                 next_group(instance.source_batches, &self.pos_source),
diff --git a/differential-dataflow/tests/int_proxy_bytes.rs b/differential-dataflow/tests/int_proxy_bytes.rs
index 15b3b2db5..92168d4ea 100644
--- a/differential-dataflow/tests/int_proxy_bytes.rs
+++ b/differential-dataflow/tests/int_proxy_bytes.rs
@@ -198,6 +198,15 @@ struct RowJoinCursor {
 struct RowJoinBackend {
     /// Groups per window; tiny in tests to force many windows.
     window: usize,
+    /// Matches per output container; tiny in tests to force many containers.
+    target: usize,
+    staged: Vec<(Row, Row, Time, Diff)>,
+}
+
+impl RowJoinBackend {
+    fn new(window: usize) -> Self {
+        RowJoinBackend { window, target: 8, staged: Vec::new() }
+    }
 }
 
 impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
@@ -216,6 +225,7 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
         instance: &JoinInstance<'_, RowBatch, RowBatch>,
         fresh: Fresh,
         cursor: &mut RowJoinCursor,
+        reuse: Option<JoinWindow<u64, u64, u64, Time, Diff, Diff>>,
     ) -> Option<JoinWindow<u64, u64, u64, Time, Diff, Diff>> {
         cursor.pos0.resize(instance.batches0.len(), 0);
         cursor.pos1.resize(instance.batches1.len(), 0);
@@ -225,9 +235,14 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
             Fresh::Input0 => (instance.batches0, instance.batches1),
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
+        // Reclaim the spent window's bridge capacity.
+        let (mut fresh_run, mut other_run) = match reuse {
+            Some(JoinWindow { input0, input1 }) => (input0, input1),
+            None => (Vec::new(), Vec::new()),
+        };
         loop {
-            let mut fresh_run = Vec::new();
-            let mut other_run = Vec::new();
+            fresh_run.clear();
+            other_run.clear();
             let mut groups = 0;
             while groups < self.window {
                 let (fresh_pos, other_pos) = match fresh {
@@ -266,31 +281,36 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
         }
     }
 
-    fn cross(
+    fn absorb(
         &mut self,
         instance: &JoinInstance<'_, RowBatch, RowBatch>,
-        left: &[(u64, u64)],
-        right: &[(u64, u64)],
-        times: &[Time],
-        diffs: &[Diff],
-    ) -> Self::Output {
+        left: (u64, u64),
+        right: (u64, u64),
+        time: Time,
+        diff: Diff,
+    ) -> Option<Self::Output> {
         // Not self-redeeming: tokens are redeemed against the columns, T1-checked. Group
         // collisions are resolved here, per the module contract: matching was by group
         // token, so re-check real key bytes and drop false pairs.
-        left.iter()
-            .zip(right)
-            .zip(times)
-            .zip(diffs)
-            .filter_map(|(((l, r), t), d)| {
-                let lrow = redeem(instance.batches0, *l);
-                let rrow = redeem(instance.batches1, *r);
-                if key_of(lrow) == key_of(rrow) {
-                    Some((lrow.to_vec(), rrow.to_vec(), *t, *d))
-                } else {
-                    None
-                }
-            })
-            .collect()
+        let lrow = redeem(instance.batches0, left);
+        let rrow = redeem(instance.batches1, right);
+        if key_of(lrow) == key_of(rrow) {
+            let (lrow, rrow) = (lrow.to_vec(), rrow.to_vec());
+            self.staged.push((lrow, rrow, time, diff));
+        }
+        if self.staged.len() >= self.target {
+            Some(std::mem::take(&mut self.staged))
+        } else {
+            None
+        }
+    }
+
+    fn flush(&mut self, _instance: &JoinInstance<'_, RowBatch, RowBatch>) -> Option<Self::Output> {
+        if self.staged.is_empty() {
+            None
+        } else {
+            Some(std::mem::take(&mut self.staged))
+        }
     }
 }
 
@@ -331,7 +351,7 @@ fn check_join(hasher: Hasher) {
 
     for window in [1, 2, 100] {
         for fresh in [Fresh::Input0, Fresh::Input1] {
-            let mut tactic = ProxyJoinTactic::new(RowJoinBackend { window });
+            let mut tactic = ProxyJoinTactic::new(RowJoinBackend::new(window));
             let work = tactic.prep(
                 vec![RowBatch::form(a0.clone(), 0, 3, hasher), RowBatch::form(a1.clone(), 0, 3, hasher)],
                 vec![RowBatch::form(b0.clone(), 0, 3, hasher), RowBatch::form(b1.clone(), 0, 3, hasher)],
@@ -391,7 +411,7 @@ fn redemption_detects_cross_batch_collisions() {
     let left1 = RowBatch::form(vec![(r1, 0, 1)], 0, 1, weak_hash);
     let right = RowBatch::form(rows(&[("k|hit", 0, 1)]), 0, 1, weak_hash);
 
-    let mut tactic = ProxyJoinTactic::new(RowJoinBackend { window: 100 });
+    let mut tactic = ProxyJoinTactic::new(RowJoinBackend::new(100));
     let work = tactic.prep(vec![left0, left1], vec![right], Fresh::Input0, 0);
     let _: Vec<_> = work.collect();
 }
@@ -475,14 +495,22 @@ impl ProxyReduceBackend<RowBatch, RowBatch> for RowReduceBackend {
         &mut self,
         instance: &ReduceInstance<'_, RowBatch, RowBatch>,
         pending: &[u64],
+        reuse: Option<ReduceWindow<u64, u64, Time, Diff, Diff>>,
     ) -> Option<ReduceWindow<u64, u64, Time, Diff, Diff>> {
         self.pos_source.resize(instance.source_batches.len(), 0);
         self.pos_input.resize(instance.input_batches.len(), 0);
         self.pos_output.resize(instance.output_batches.len(), 0);
-        let mut keys = Vec::new();
-        let mut seeds = Vec::new();
-        let mut input = Vec::new();
-        let mut output = Vec::new();
+        // Reclaim the spent window's buffer capacity.
+        let (mut keys, mut seeds, mut input, mut output) = match reuse {
+            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
+                keys.clear();
+                seeds.clear();
+                input.clear();
+                output.clear();
+                (keys, seeds, input, output)
+            }
+            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
+        };
         while keys.len() < self.window {
             let g = [
                 next_group(instance.source_batches, &self.pos_source),
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index 74de8624c..e6c5c9cbd 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -38,7 +38,7 @@ fn join_matches_naive() {
 
     for window in [1, 2, 100] {
         for fresh in [Fresh::Input0, Fresh::Input1] {
-            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend { window });
+            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(window));
             let work = tactic.prep(
                 vec![a0.clone(), a1.clone()],
                 vec![b0.clone(), b1.clone()],
@@ -75,7 +75,7 @@ fn interleaved_units_share_backend() {
     let expected1 = naive_join(&all(&a), &all(&b));
     let expected2 = naive_join(&all(&c), &all(&d));
 
-    let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend { window: 1 });
+    let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(1));
     let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
     let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
     let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();

From 3945cb8e88a4689a613b26502229e31e3ed22999 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Wed, 22 Jul 2026 23:36:53 -0400
Subject: [PATCH 11/18] Unit-owned Sink: fix cross-unit output contamination in
 absorb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The adversarial review of the absorb/flush protocol found a real bug
in it: staged output lived on the backend, which all live units share
(Rc<RefCell>, and the driver interleaves half-drained units under
fuel). Unit A could pause holding a partial container in the shared
buffer; unit B's next container would then ship A's matches — under
B's capability, into B's output stream — and a unit dropped at
shutdown would leave residue poisoning every later unit.

The fix is the write-side twin of the Cursor finding: `type Sink:
Default` on ProxyJoinBackend, owned by the unit, passed to absorb and
flush. Per-unit state now has both halves — read progress (Cursor) and
output staging (Sink) — and neither can live on `&mut self`.

The review also caught that the interleaving regression test was
blind: with target = 1 staging empties at every yield, so the bug
shape passes. The test now uses target = 2 with a 3-match key, so a
unit pauses mid-stream holding a straddling partial container; the
bug shape was temporarily re-injected to confirm the test fails
against it, then removed.

Also from the review: docs reconciled to the absorb/flush protocol
(the trait narrative and the bytes/graphs module headers still named
`cross`; the container-boundary parity clause is now stated on absorb;
JoinUnit's peak-state claim now counts one key's containers in
`ready`); reuse vecs route back to the side they served (they
alternated duties under Fresh::Input1, growing both to max capacity);
two rustdoc links introduced by publishing `cursors` fixed; bench
reduce backends hoist a per-key allocation off the proxy side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../examples/int_proxy_bench.rs               | 58 +++++++++++--------
 .../src/operators/int_proxy/join.rs           | 39 +++++++++----
 .../src/operators/int_proxy/mod.rs            |  7 ++-
 differential-dataflow/src/operators/join.rs   |  2 +-
 differential-dataflow/tests/common/mod.rs     | 32 +++++-----
 .../tests/int_proxy_bytes.rs                  | 34 ++++++-----
 .../tests/int_proxy_graphs.rs                 | 14 ++++-
 7 files changed, 115 insertions(+), 71 deletions(-)

diff --git a/differential-dataflow/examples/int_proxy_bench.rs b/differential-dataflow/examples/int_proxy_bench.rs
index 65e7c3261..36cce94f2 100644
--- a/differential-dataflow/examples/int_proxy_bench.rs
+++ b/differential-dataflow/examples/int_proxy_bench.rs
@@ -88,12 +88,11 @@ struct GraphJoinCursor {
 struct GraphJoinBackend {
     window: usize,
     target: usize,
-    staged: Vec<(Edge, Edge, Time, Diff)>,
 }
 
 impl GraphJoinBackend {
     fn new(window: usize) -> Self {
-        GraphJoinBackend { window, target: 1 << 20, staged: Vec::new() }
+        GraphJoinBackend { window, target: 1 << 20 }
     }
 }
 
@@ -106,6 +105,7 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
     type ROut = Diff;
     type Output = Vec<(Edge, Edge, Time, Diff)>;
     type Cursor = GraphJoinCursor;
+    type Sink = Vec<(Edge, Edge, Time, Diff)>;
 
     fn next_window(
         &mut self,
@@ -120,9 +120,12 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
             Fresh::Input0 => (instance.batches0, instance.batches1),
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
-        let (mut fresh_run, mut other_run) = match reuse {
-            Some(JoinWindow { input0, input1 }) => (input0, input1),
-            None => (Vec::new(), Vec::new()),
+        // Route each reclaimed vec back to the side it served, so capacities stay
+        // side-stable rather than alternating duties across round trips.
+        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
+            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
+            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
+            (None, _) => (Vec::new(), Vec::new()),
         };
         loop {
             fresh_run.clear();
@@ -166,21 +169,22 @@ impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
     fn absorb(
         &mut self,
         _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
+        sink: &mut Self::Sink,
         left: (u32, Edge),
         right: (u32, Edge),
         time: Time,
         diff: Diff,
     ) -> Option<Self::Output> {
-        self.staged.push((left.1, right.1, time, diff));
-        if self.staged.len() >= self.target {
-            Some(std::mem::take(&mut self.staged))
+        sink.push((left.1, right.1, time, diff));
+        if sink.len() >= self.target {
+            Some(std::mem::take(sink))
         } else {
             None
         }
     }
 
-    fn flush(&mut self, _instance: &JoinInstance<'_, GraphBatch, GraphBatch>) -> Option<Self::Output> {
-        if self.staged.is_empty() { None } else { Some(std::mem::take(&mut self.staged)) }
+    fn flush(&mut self, _instance: &JoinInstance<'_, GraphBatch, GraphBatch>, sink: &mut Self::Sink) -> Option<Self::Output> {
+        if sink.is_empty() { None } else { Some(std::mem::take(sink)) }
     }
 }
 
@@ -287,10 +291,11 @@ impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
     ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
         let mut corr = Vec::new();
         let mut ends = Vec::new();
+        let mut delta: Vec<(Edge, Diff)> = Vec::new();
         let (mut i0, mut o0) = (0, 0);
         for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
             let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-            let mut delta: Vec<(Edge, Diff)> = Vec::new();
+            delta.clear();
             if count > 0 {
                 delta.push(((*k, count as u32), 1));
             }
@@ -298,7 +303,7 @@ impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
                 delta.push((*v, -d));
             }
             differential_dataflow::consolidation::consolidate(&mut delta);
-            corr.extend(delta);
+            corr.extend(delta.drain(..));
             ends.push(corr.len());
             i0 = i1;
             o0 = o1;
@@ -482,12 +487,11 @@ mod ordval {
     pub struct OrdJoinBackend {
         pub window: usize,
         pub target: usize,
-        staged: Vec<(Edge, Edge, Time, Diff)>,
     }
 
     impl OrdJoinBackend {
         pub fn new(window: usize) -> Self {
-            OrdJoinBackend { window, target: 1 << 20, staged: Vec::new() }
+            OrdJoinBackend { window, target: 1 << 20 }
         }
     }
 
@@ -500,6 +504,7 @@ mod ordval {
         type ROut = Diff;
         type Output = Vec<(Edge, Edge, Time, Diff)>;
         type Cursor = OrdJoinCursor;
+        type Sink = Vec<(Edge, Edge, Time, Diff)>;
 
         fn next_window(
             &mut self,
@@ -510,9 +515,12 @@ mod ordval {
         ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
             cursor.c0.start(instance.batches0);
             cursor.c1.start(instance.batches1);
-            let (mut fresh_run, mut other_run) = match reuse {
-                Some(JoinWindow { input0, input1 }) => (input0, input1),
-                None => (Vec::new(), Vec::new()),
+            // Route each reclaimed vec back to the side it served, so capacities stay
+            // side-stable rather than alternating duties across round trips.
+            let (mut fresh_run, mut other_run) = match (reuse, fresh) {
+                (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
+                (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
+                (None, _) => (Vec::new(), Vec::new()),
             };
             loop {
                 fresh_run.clear();
@@ -552,21 +560,22 @@ mod ordval {
         fn absorb(
             &mut self,
             _instance: &JoinInstance<'_, Bt, Bt>,
+            sink: &mut Self::Sink,
             left: (u32, Edge),
             right: (u32, Edge),
             time: Time,
             diff: Diff,
         ) -> Option<Self::Output> {
-            self.staged.push((left.1, right.1, time, diff));
-            if self.staged.len() >= self.target {
-                Some(std::mem::take(&mut self.staged))
+            sink.push((left.1, right.1, time, diff));
+            if sink.len() >= self.target {
+                Some(std::mem::take(sink))
             } else {
                 None
             }
         }
 
-        fn flush(&mut self, _instance: &JoinInstance<'_, Bt, Bt>) -> Option<Self::Output> {
-            if self.staged.is_empty() { None } else { Some(std::mem::take(&mut self.staged)) }
+        fn flush(&mut self, _instance: &JoinInstance<'_, Bt, Bt>, sink: &mut Self::Sink) -> Option<Self::Output> {
+            if sink.is_empty() { None } else { Some(std::mem::take(sink)) }
         }
     }
 
@@ -673,10 +682,11 @@ mod ordval {
         ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
             let mut corr = Vec::new();
             let mut ends = Vec::new();
+            let mut delta: Vec<(Edge, Diff)> = Vec::new();
             let (mut i0, mut o0) = (0, 0);
             for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
                 let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-                let mut delta: Vec<(Edge, Diff)> = Vec::new();
+                delta.clear();
                 if count > 0 {
                     delta.push(((*k, count as u32), 1));
                 }
@@ -684,7 +694,7 @@ mod ordval {
                     delta.push((*v, -d));
                 }
                 differential_dataflow::consolidation::consolidate(&mut delta);
-                corr.extend(delta);
+                corr.extend(delta.drain(..));
                 ends.push(corr.len());
                 i0 = i1;
                 o0 = o1;
diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index 8108ecdee..aa2bf3da5 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -35,8 +35,8 @@ pub struct JoinWindow<G, I0, I1, T, R0, R1> {
 /// A type that can interpret and retire pairs of batches, joined by group tokens.
 ///
 /// The protocol repeatedly invokes `next_window` to produce bounded presentations of the two
-/// inputs, matched by group, and calls `cross` (any number of times per window, including zero)
-/// to produce outputs. Windows are produced lazily as the join driver's fuel allows, so at most
+/// inputs, matched by group; each match is handed to `absorb`, and `flush` yields the final
+/// partial container. Windows are produced lazily as the join driver's fuel allows, so at most
 /// one window's presentations are live at a time.
 pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// The group token: names the granule of independence, shared by both inputs.
@@ -65,6 +65,15 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
     /// of a fresh unit; a typical backend records a position per batch per side.
     type Cursor: Default;
 
+    /// Per-unit output staging, owned by the unit — the write-side twin of [`Cursor`](Self::Cursor).
+    ///
+    /// Staging cannot live on `&mut self` for the same reason unit progress cannot: two
+    /// half-drained units interleave `absorb` calls against one shared backend, and a
+    /// shared buffer would ship one unit's matches in another unit's containers — under
+    /// the wrong capability. `Default` is empty staging; a typical backend uses its
+    /// partially-built output container.
+    type Sink: Default;
+
     /// Produce the next window of the join unit, and advance `cursor`.
     ///
     /// Windows must cover contiguous, strictly ascending group ranges, and together must cover
@@ -84,15 +93,17 @@ pub trait ProxyJoinBackend<B0: BatchReader, B1: BatchReader<Time = B0::Time>> {
 
     /// Absorb one match: left and right tokens, joined time, multiplied diff.
     ///
-    /// The backend accumulates matches into its own output representation and returns a
+    /// The backend accumulates matches into `sink` (this unit's staging) and returns a
     /// finished container whenever its own size target is reached (the backend, not the
     /// harness, decides container granularity). Matches arrive grouped by key, keys in
     /// window order. Called at most once per match: there is no staging in the harness,
-    /// so this is the only time the match exists outside the backend.
-    fn absorb(&mut self, instance: &JoinInstance<'_, B0, B1>, left: (Self::Group, Self::Token0), right: (Self::Group, Self::Token1), time: B0::Time, diff: Self::ROut) -> Option<Self::Output>;
+    /// so this is the only time the match exists outside the sink. Container boundaries
+    /// must be semantically invisible — the concatenation of all yielded containers
+    /// (including `flush`'s) must equal the single-container output.
+    fn absorb(&mut self, instance: &JoinInstance<'_, B0, B1>, sink: &mut Self::Sink, left: (Self::Group, Self::Token0), right: (Self::Group, Self::Token1), time: B0::Time, diff: Self::ROut) -> Option<Self::Output>;
 
-    /// Yield the final partial container, if any. Called once, after the last window.
-    fn flush(&mut self, instance: &JoinInstance<'_, B0, B1>) -> Option<Self::Output>;
+    /// Yield `sink`'s final partial container, if any. Called once, after the last window.
+    fn flush(&mut self, instance: &JoinInstance<'_, B0, B1>, sink: &mut Self::Sink) -> Option<Self::Output>;
 }
 
 /// A proxy-space [`JoinTactic`]: matches records of the presented windows by group token,
@@ -131,6 +142,7 @@ where
             fresh,
             lower: Antichain::from_elem(meet),
             cursor: Bk::Cursor::default(),
+            sink: Bk::Sink::default(),
             high: None,
             done: false,
             flushed: false,
@@ -150,7 +162,8 @@ where
 /// the window in progress, feeding each match to the backend's `absorb` (which yields
 /// containers at its own granularity; the final remainder comes from `flush` when the
 /// unit exhausts). Matches are never staged in the harness: peak state is one window's
-/// presentations plus whatever the backend buffers toward its next container.
+/// presentations, plus one key's yielded containers in `ready` (a fanout-F key at
+/// container target t enqueues F/t containers in one step), plus the sink's partial.
 ///
 /// Spent windows are handed back to the backend through `next_window`'s `reuse`
 /// argument, and the replay histories (`h0`/`h1`) live on the unit, so steady-state
@@ -167,6 +180,9 @@ struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoin
     lower: Antichain<B0::Time>,
     /// Backend-interpreted resumption state; `Default` at the unit's start.
     cursor: Bk::Cursor,
+    /// Backend-interpreted output staging; unit-owned so interleaved units cannot
+    /// contaminate each other's containers (see [`ProxyJoinBackend::Sink`]).
+    sink: Bk::Sink,
     /// Greatest group presented so far, to enforce ascending windows.
     high: Option<Bk::Group>,
     done: bool,
@@ -197,13 +213,13 @@ where
             let mut backend = backend.borrow_mut();
             let instance = JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() };
 
-            // Exhausted: take the backend's final partial container, exactly once.
+            // Exhausted: take this unit's final partial container, exactly once.
             if self.done && self.current.is_none() {
                 if self.flushed {
                     return None;
                 }
                 self.flushed = true;
-                return backend.flush(&instance);
+                return backend.flush(&instance, &mut self.sink);
             }
 
             // Fetch the next window if none is in progress, returning the spent one.
@@ -240,8 +256,9 @@ where
             let p1 = &window.input1;
             let (h0, h1) = (&mut self.h0, &mut self.h1);
             let ready = &mut self.ready;
+            let sink = &mut self.sink;
             let mut emit = |l: (Bk::Group, Bk::Token0), r: (Bk::Group, Bk::Token1), t: B0::Time, d: Bk::ROut| {
-                if let Some(out) = backend.absorb(&instance, l, r, t, d) {
+                if let Some(out) = backend.absorb(&instance, sink, l, r, t, d) {
                     ready.push_back(out);
                 }
             };
diff --git a/differential-dataflow/src/operators/int_proxy/mod.rs b/differential-dataflow/src/operators/int_proxy/mod.rs
index e30eeee6d..66cc915b8 100644
--- a/differential-dataflow/src/operators/int_proxy/mod.rs
+++ b/differential-dataflow/src/operators/int_proxy/mod.rs
@@ -10,8 +10,9 @@
 //! data (`G = u32` node ids, tokens `(u32, u32)` edges), wider hashes for insurance, or
 //! dense ids where exactness is required.
 //! The tactics first elicit proxy tokens from the backends, perform their necessary time
-//! and difference based computations to stage token collections, and then re-invoke the
-//! backends with those same tokens to produce the necessary output.
+//! and difference based computations, and then hand results back in token form — reduce
+//! re-invokes its backend with staged token collections; join feeds its backend matches
+//! one at a time — for the backend to produce the necessary output.
 //!
 //! The backend is oblivious to the navigation of time, and the operator to the backend's
 //! implementation.
@@ -60,7 +61,7 @@ pub mod reduce;
 /// `G` is the group token (commonly `u64`, a key hash) and `I` the value token (commonly
 /// `u64`, an id or content hash) — see the backend traits for the obligations each carries.
 ///
-/// The [`debug_assert_sorted_bridge`] method is (and can be) used to validate this property.
+/// The `debug_assert_sorted_bridge` check (crate-internal) validates this property.
 pub type ProxyBridge<G, I, T, R> = Vec<((G, I), T, R)>;
 
 /// Debug check that a presented [`ProxyBridge`] is consolidated.
diff --git a/differential-dataflow/src/operators/join.rs b/differential-dataflow/src/operators/join.rs
index f81c3479c..bf6581a24 100644
--- a/differential-dataflow/src/operators/join.rs
+++ b/differential-dataflow/src/operators/join.rs
@@ -395,7 +395,7 @@ pub mod cursors {
 
     /// The conventional cursor-based [`JoinTactic`].
     ///
-    /// It builds a [`CursorList`] over each input batch list and plays the merge-join out at whatever rate
+    /// It builds a [`CursorList`](crate::trace::cursor::CursorList) over each input batch list and plays the merge-join out at whatever rate
     /// the driver's fuel allows. Each prepared unit joins a `B0`-side cursor against a `B1`-side cursor,
     /// emitting `(val0, val1)` to `logic` and yielding the output containers `logic` fills. `logic` is
     /// shared across all outstanding units (an `Rc<RefCell<_>>`), preserving the single mutable-state
diff --git a/differential-dataflow/tests/common/mod.rs b/differential-dataflow/tests/common/mod.rs
index 91153dc84..f6716cf6f 100644
--- a/differential-dataflow/tests/common/mod.rs
+++ b/differential-dataflow/tests/common/mod.rs
@@ -93,21 +93,20 @@ pub struct EdgeJoinCursor {
     pub pos1: Vec<usize>,
 }
 
-pub struct EdgeJoinBackend<T> {
+pub struct EdgeJoinBackend {
     /// Groups per window; tiny in tests to force many windows.
     pub window: usize,
     /// Matches per output container; tiny in tests to force many containers.
     pub target: usize,
-    staged: Vec<(Edge, Edge, T, Diff)>,
 }
 
-impl<T> EdgeJoinBackend<T> {
+impl EdgeJoinBackend {
     pub fn new(window: usize) -> Self {
-        EdgeJoinBackend { window, target: 8, staged: Vec::new() }
+        EdgeJoinBackend { window, target: 8 }
     }
 }
 
-impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend<T> {
+impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend {
     type Group = u32;
     type Token0 = Edge;
     type Token1 = Edge;
@@ -117,6 +116,7 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
     /// Matched edge pairs with their joined time and multiplied diff.
     type Output = Vec<(Edge, Edge, T, Diff)>;
     type Cursor = EdgeJoinCursor;
+    type Sink = Vec<(Edge, Edge, T, Diff)>;
 
     fn next_window(
         &mut self,
@@ -134,9 +134,12 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
         // Reclaim the spent window's bridge capacity.
-        let (mut fresh_run, mut other_run) = match reuse {
-            Some(JoinWindow { input0, input1 }) => (input0, input1),
-            None => (Vec::new(), Vec::new()),
+        // Route each reclaimed vec back to the side it served, so capacities stay
+        // side-stable rather than alternating duties across round trips.
+        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
+            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
+            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
+            (None, _) => (Vec::new(), Vec::new()),
         };
         loop {
             fresh_run.clear();
@@ -183,25 +186,26 @@ impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>>
     fn absorb(
         &mut self,
         _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        sink: &mut Self::Sink,
         left: (u32, Edge),
         right: (u32, Edge),
         time: T,
         diff: Diff,
     ) -> Option<Self::Output> {
         // Self-redeeming tokens: the output is built from the tokens alone.
-        self.staged.push((left.1, right.1, time, diff));
-        if self.staged.len() >= self.target {
-            Some(std::mem::take(&mut self.staged))
+        sink.push((left.1, right.1, time, diff));
+        if sink.len() >= self.target {
+            Some(std::mem::take(sink))
         } else {
             None
         }
     }
 
-    fn flush(&mut self, _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>) -> Option<Self::Output> {
-        if self.staged.is_empty() {
+    fn flush(&mut self, _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>, sink: &mut Self::Sink) -> Option<Self::Output> {
+        if sink.is_empty() {
             None
         } else {
-            Some(std::mem::take(&mut self.staged))
+            Some(std::mem::take(sink))
         }
     }
 }
diff --git a/differential-dataflow/tests/int_proxy_bytes.rs b/differential-dataflow/tests/int_proxy_bytes.rs
index 92168d4ea..86084c2ef 100644
--- a/differential-dataflow/tests/int_proxy_bytes.rs
+++ b/differential-dataflow/tests/int_proxy_bytes.rs
@@ -12,9 +12,9 @@
 //! adjacent and batch formation doubles as T1 *value*-collision detection; join's
 //! `redeem` and reduce's key/row stashes re-check at redemption, the other T1 sites.
 //! *Group* collisions (distinct keys, equal `G`) are not errors under compression —
-//! they are **resolved** per the module contract: join's `cross` re-checks real key
-//! bytes and drops false pairs; reduce partitions each granule by real key and reduces
-//! the parts separately. Weak-hash tests force both collision kinds: value collisions
+//! they are **resolved** per the module contract: join's `absorb` re-checks real key
+//! bytes per match and drops false pairs; reduce partitions each granule by real key
+//! and reduces the parts separately. Weak-hash tests force both collision kinds: value collisions
 //! must panic at their detection site; group collisions must yield *correct output*.
 
 use std::collections::BTreeMap;
@@ -200,12 +200,11 @@ struct RowJoinBackend {
     window: usize,
     /// Matches per output container; tiny in tests to force many containers.
     target: usize,
-    staged: Vec<(Row, Row, Time, Diff)>,
 }
 
 impl RowJoinBackend {
     fn new(window: usize) -> Self {
-        RowJoinBackend { window, target: 8, staged: Vec::new() }
+        RowJoinBackend { window, target: 8 }
     }
 }
 
@@ -219,6 +218,7 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
     /// Matched row pairs with their joined time and multiplied diff.
     type Output = Vec<(Row, Row, Time, Diff)>;
     type Cursor = RowJoinCursor;
+    type Sink = Vec<(Row, Row, Time, Diff)>;
 
     fn next_window(
         &mut self,
@@ -236,9 +236,12 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
             Fresh::Input1 => (instance.batches1, instance.batches0),
         };
         // Reclaim the spent window's bridge capacity.
-        let (mut fresh_run, mut other_run) = match reuse {
-            Some(JoinWindow { input0, input1 }) => (input0, input1),
-            None => (Vec::new(), Vec::new()),
+        // Route each reclaimed vec back to the side it served, so capacities stay
+        // side-stable rather than alternating duties across round trips.
+        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
+            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
+            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
+            (None, _) => (Vec::new(), Vec::new()),
         };
         loop {
             fresh_run.clear();
@@ -284,6 +287,7 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
     fn absorb(
         &mut self,
         instance: &JoinInstance<'_, RowBatch, RowBatch>,
+        sink: &mut Self::Sink,
         left: (u64, u64),
         right: (u64, u64),
         time: Time,
@@ -296,20 +300,20 @@ impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
         let rrow = redeem(instance.batches1, right);
         if key_of(lrow) == key_of(rrow) {
             let (lrow, rrow) = (lrow.to_vec(), rrow.to_vec());
-            self.staged.push((lrow, rrow, time, diff));
+            sink.push((lrow, rrow, time, diff));
         }
-        if self.staged.len() >= self.target {
-            Some(std::mem::take(&mut self.staged))
+        if sink.len() >= self.target {
+            Some(std::mem::take(sink))
         } else {
             None
         }
     }
 
-    fn flush(&mut self, _instance: &JoinInstance<'_, RowBatch, RowBatch>) -> Option<Self::Output> {
-        if self.staged.is_empty() {
+    fn flush(&mut self, _instance: &JoinInstance<'_, RowBatch, RowBatch>, sink: &mut Self::Sink) -> Option<Self::Output> {
+        if sink.is_empty() {
             None
         } else {
-            Some(std::mem::take(&mut self.staged))
+            Some(std::mem::take(sink))
         }
     }
 }
@@ -373,7 +377,7 @@ fn join_rows_matches_naive() {
 
 #[test]
 fn join_resolves_group_collisions() {
-    // Forced group collisions (weak key hashes, strong row hashes): cross must re-check
+    // Forced group collisions (weak key hashes, strong row hashes): absorb must re-check
     // real key bytes and drop false pairs, yielding exactly the naive output.
     check_join(weak_group_hash);
 }
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
index e6c5c9cbd..2d84ee514 100644
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ b/differential-dataflow/tests/int_proxy_graphs.rs
@@ -2,7 +2,7 @@
 //!
 //! The value-token instantiation from the seam design: data is edges `(src, dst)`,
 //! grouped by source. `Group = u32` is the source itself (exact — no hashing, no
-//! collisions), and the value token is the whole edge (self-redeeming: `cross` and
+//! collisions), and the value token is the whole edge (self-redeeming: `absorb` and
 //! `finish` build outputs straight from tokens without consulting storage). Window
 //! sizes are kept tiny to force many windows and exercise the streaming protocols.
 //! The scaffold lives in `tests/common/mod.rs`, shared with the partial-order test.
@@ -61,7 +61,7 @@ fn interleaved_units_share_backend() {
     // motivated per-unit `Cursor` state and the shared `Rc<RefCell>` backend — the
     // driver holds half-drained units from both queues and polls them under fuel.
     let a = vec![
-        batch(vec![((0, 1), 0, 1), ((1, 5), 0, 1), ((2, 2), 1, 1)], 0, 2),
+        batch(vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((0, 3), 1, 1), ((1, 5), 0, 1), ((2, 2), 1, 1)], 0, 2),
         batch(vec![((3, 3), 1, 1)], 0, 2),
     ];
     let b = vec![batch(vec![((0, 7), 1, 1), ((2, 6), 0, 1), ((3, 8), 1, 1)], 0, 2)];
@@ -75,7 +75,15 @@ fn interleaved_units_share_backend() {
     let expected1 = naive_join(&all(&a), &all(&b));
     let expected2 = naive_join(&all(&c), &all(&d));
 
-    let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(1));
+    // target = 2 with a 3-match key (key 0): unit 1 yields a full container and PAUSES
+    // holding one staged match, then unit 2 absorbs against the same shared backend.
+    // Staging must be unit-owned (`Sink`): with a shared buffer — the bug shape this
+    // test pins — unit 1's held match ships inside unit 2's next container, under
+    // unit 2's capability. target = 1 would NOT catch this (staging empty at every
+    // yield); the straddling partial container is the point.
+    let mut backend = EdgeJoinBackend::new(1);
+    backend.target = 2;
+    let mut tactic = ProxyJoinTactic::new(backend);
     let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
     let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
     let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();

From 1bc0752274f65ed8bc6076878780873b0ac0610e Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 00:37:53 -0400
Subject: [PATCH 12/18] SCC with proxy joins: the first in-dataflow exercise,
 at parity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

examples/scc_proxy.rs runs the stock SCC computation with trim_edges'
two joins substituted through join_with_tactic and a value-token proxy
backend over the same ValSpine arrangements (Group = the key itself,
tokens = the values; time-generic, so it runs at the nested
Product<usize, usize> of the iterative scope). propagate and all other
stages are stock; SCC_VALIDATE=1 runs stock strongly_connected
alongside and asserts exact agreement at every time (verified through
load plus incremental rounds).

This is the proxy tactics' first run inside a real dataflow, and a
deliberately hostile one: nested iteration, Product timestamps,
regions, and many fuel-interleaved lazy units live at once — the
scenario the unit-owned Cursor/Sink state exists for. The harness's
hard asserts (ascending windows, progress) ran throughout.

Numbers (1 worker, release, batch 1000, 5 rounds), stock vs proxy:

  100k nodes / 200k edges:  load 4.35s vs 4.28s; rounds ~2.71s vs ~2.67s
  200k nodes / 400k edges:  load 10.33s vs 10.04s; rounds ~4.38s vs ~4.31s

Parity with a consistent slight edge — as the microbenchmarks predict
(join at 0.90-0.95x of the cursor tactic) once diluted by the rest of
the dataflow. One comparison hazard worth recording: an earlier draft
accidentally used propagate_at's label-staggering variant and appeared
7-20x faster; the numbers above use |_| 0 exactly as stock, and the
validation mode exists so that mistake class gets caught by an oracle
rather than by suspicion.

The backend needed no cursor-bound vocabulary at all: plain Data
bounds and the projections normalize. (Asserting redundant Key<'a> =
&'a K equalities actually breaks the trait solver — deleting them was
the fix.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/examples/scc_proxy.rs | 399 ++++++++++++++++++++
 1 file changed, 399 insertions(+)
 create mode 100644 differential-dataflow/examples/scc_proxy.rs

diff --git a/differential-dataflow/examples/scc_proxy.rs b/differential-dataflow/examples/scc_proxy.rs
new file mode 100644
index 000000000..f164278da
--- /dev/null
+++ b/differential-dataflow/examples/scc_proxy.rs
@@ -0,0 +1,399 @@
+//! SCC with the proxy join tactic substituted for the cursor tactic.
+//!
+//! Identical computation to `examples/scc.rs` — same `propagate_at`, same dataflow
+//! shape, same filter/map stages — except `trim_edges`' two joins run through
+//! `join_with_tactic` with a value-token proxy backend over the same `ValSpine`
+//! arrangements. This is the proxy tactics' first exercise inside a real dataflow:
+//! nested iterative scopes, `Product` timestamps, fuel-drained interleaved units.
+//!
+//! Usage: scc_proxy [timely args] [nodes [edges [batch [rounds]]]]
+
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
+use std::mem;
+
+use timely::dataflow::operators::probe::Handle;
+use timely::order::Product;
+use timely::progress::frontier::AntichainRef;
+use timely::progress::Timestamp;
+
+use differential_dataflow::algorithms::graphs::propagate::propagate_at;
+use differential_dataflow::consolidation::consolidate_updates;
+use differential_dataflow::input::Input;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::operators::arrange::arrangement::Arranged;
+use differential_dataflow::operators::arrange::TraceAgent;
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic,
+};
+use differential_dataflow::operators::iterate::Variable;
+use differential_dataflow::operators::join::{join_with_tactic, Fresh};
+use differential_dataflow::trace::implementations::ValSpine;
+use differential_dataflow::trace::{Cursor, Navigable, TraceReader};
+use differential_dataflow::collection::AsCollection;
+use differential_dataflow::VecCollection;
+
+use mimalloc::MiMalloc;
+
+#[global_allocator]
+static GLOBAL: MiMalloc = MiMalloc;
+
+type Diff = isize;
+
+/// The batch type of a `ValSpine` arrangement.
+type BatchOf<K, V, T> = <ValSpine<K, V, T, Diff> as TraceReader>::Batch;
+
+/// A value-token proxy join backend over two `ValSpine` arrangements sharing key `K`:
+/// `Group = K` (exact — no hashing), tokens are the values themselves, and `logic`
+/// shapes output exactly as `join_core`'s closure would.
+struct SpineJoinBackend<K, V1, V2, T, D, L> {
+    window: usize,
+    target: usize,
+    logic: L,
+    phantom: std::marker::PhantomData<(K, V1, V2, T, D)>,
+}
+
+impl<K, V1, V2, T, D, L> SpineJoinBackend<K, V1, V2, T, D, L> {
+    fn new(logic: L) -> Self {
+        SpineJoinBackend { window: 1024, target: 1 << 16, logic, phantom: std::marker::PhantomData }
+    }
+}
+
+/// Group-ordered scanning state over one side's batch cursors.
+struct SideCursors<C> {
+    cursors: Vec<C>,
+}
+
+impl<C> Default for SideCursors<C> {
+    fn default() -> Self {
+        SideCursors { cursors: Vec::new() }
+    }
+}
+
+impl<C> SideCursors<C> {
+    fn start<B>(&mut self, batches: &[B])
+    where
+        B: Navigable<Cursor = C>,
+    {
+        if self.cursors.len() != batches.len() {
+            self.cursors = batches.iter().map(|b| b.cursor()).collect();
+        }
+    }
+}
+
+/// Advance a time to the (singleton, per the tactic) lower frontier.
+fn advance<T: Lattice + Clone>(t: &T, lower: AntichainRef<'_, T>) -> T {
+    lower.iter().fold(t.clone(), |t, l| t.join(l))
+}
+
+/// Per-unit cursor state: a batch-cursor per batch per side.
+struct SpineJoinCursor<C0, C1> {
+    c0: SideCursors<C0>,
+    c1: SideCursors<C1>,
+}
+
+impl<C0, C1> Default for SpineJoinCursor<C0, C1> {
+    fn default() -> Self {
+        SpineJoinCursor { c0: SideCursors::default(), c1: SideCursors::default() }
+    }
+}
+
+impl<K, V1, V2, T, D, L, I> ProxyJoinBackend<BatchOf<K, V1, T>, BatchOf<K, V2, T>>
+    for SpineJoinBackend<K, V1, V2, T, D, L>
+where
+    K: differential_dataflow::Data + Copy,
+    V1: differential_dataflow::Data + Copy,
+    V2: differential_dataflow::Data + Copy,
+    T: Timestamp + Lattice + Ord + differential_dataflow::Data,
+    D: 'static,
+    I: IntoIterator<Item = D>,
+    L: FnMut(&K, &V1, &V2) -> I + 'static,
+{
+    type Group = K;
+    type Token0 = V1;
+    type Token1 = V2;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    type Output = Vec<(D, T, Diff)>;
+    type Cursor = SpineJoinCursor<
+        <BatchOf<K, V1, T> as Navigable>::Cursor,
+        <BatchOf<K, V2, T> as Navigable>::Cursor,
+    >;
+    type Sink = Vec<(D, T, Diff)>;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
+        fresh: Fresh,
+        cursor: &mut Self::Cursor,
+        reuse: Option<JoinWindow<K, V1, V2, T, Diff, Diff>>,
+    ) -> Option<JoinWindow<K, V1, V2, T, Diff, Diff>> {
+        cursor.c0.start(instance.batches0);
+        cursor.c1.start(instance.batches1);
+        let (mut run0, mut run1) = match reuse {
+            Some(JoinWindow { input0, input1 }) => (input0, input1),
+            None => (Vec::new(), Vec::new()),
+        };
+        loop {
+            run0.clear();
+            run1.clear();
+            let mut groups = 0;
+            while groups < self.window {
+                // The fresh side's next group; the accumulated side seeks to it.
+                let g = match fresh {
+                    Fresh::Input0 => cursor
+                        .c0
+                        .cursors
+                        .iter()
+                        .zip(instance.batches0)
+                        .filter_map(|(c, b)| c.get_key(b).copied())
+                        .min(),
+                    Fresh::Input1 => cursor
+                        .c1
+                        .cursors
+                        .iter()
+                        .zip(instance.batches1)
+                        .filter_map(|(c, b)| c.get_key(b).copied())
+                        .min(),
+                };
+                let Some(g) = g else { break };
+                groups += 1;
+                // Drain group g from side 0 (seeking first when it is the accumulated side).
+                for (c, b) in cursor.c0.cursors.iter_mut().zip(instance.batches0) {
+                    if matches!(fresh, Fresh::Input1) {
+                        c.seek_key(b, &g);
+                    }
+                    if c.get_key(b) == Some(&g) {
+                        while let Some(v) = c.get_val(b) {
+                            let v = *v;
+                            c.map_times(b, |t, d| run0.push(((g, v), advance(t, instance.lower), *d)));
+                            c.step_val(b);
+                        }
+                        c.step_key(b);
+                    }
+                }
+                for (c, b) in cursor.c1.cursors.iter_mut().zip(instance.batches1) {
+                    if matches!(fresh, Fresh::Input0) {
+                        c.seek_key(b, &g);
+                    }
+                    if c.get_key(b) == Some(&g) {
+                        while let Some(v) = c.get_val(b) {
+                            let v = *v;
+                            c.map_times(b, |t, d| run1.push(((g, v), advance(t, instance.lower), *d)));
+                            c.step_val(b);
+                        }
+                        c.step_key(b);
+                    }
+                }
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut run0);
+            consolidate_updates(&mut run1);
+            if run0.is_empty() && run1.is_empty() {
+                continue;
+            }
+            return Some(JoinWindow { input0: run0, input1: run1 });
+        }
+    }
+
+    fn absorb(
+        &mut self,
+        _instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
+        sink: &mut Self::Sink,
+        left: (K, V1),
+        right: (K, V2),
+        time: T,
+        diff: Diff,
+    ) -> Option<Self::Output> {
+        for d in (self.logic)(&left.0, &left.1, &right.1) {
+            sink.push((d, time.clone(), diff));
+        }
+        if sink.len() >= self.target {
+            Some(std::mem::take(sink))
+        } else {
+            None
+        }
+    }
+
+    fn flush(
+        &mut self,
+        _instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
+        sink: &mut Self::Sink,
+    ) -> Option<Self::Output> {
+        if sink.is_empty() {
+            None
+        } else {
+            Some(std::mem::take(sink))
+        }
+    }
+}
+
+/// `join_core` by way of the proxy tactic: same arrangements, same logic shape.
+fn proxy_join<'scope, K, V1, V2, T, D, L, I>(
+    arranged1: Arranged<'scope, TraceAgent<ValSpine<K, V1, T, Diff>>>,
+    arranged2: Arranged<'scope, TraceAgent<ValSpine<K, V2, T, Diff>>>,
+    logic: L,
+) -> VecCollection<'scope, T, D, Diff>
+where
+    K: Copy + Ord + Hash + differential_dataflow::ExchangeData,
+    V1: Copy + Ord + differential_dataflow::ExchangeData,
+    V2: Copy + Ord + differential_dataflow::ExchangeData,
+    T: Timestamp + Lattice + Ord + Clone + 'static,
+    D: differential_dataflow::Data,
+    I: IntoIterator<Item = D> + 'static,
+    L: FnMut(&K, &V1, &V2) -> I + 'static,
+{
+    join_with_tactic(arranged1, arranged2, ProxyJoinTactic::new(SpineJoinBackend::new(logic)))
+        .as_collection()
+}
+
+/// `strongly_connected`, with `trim_edges`' joins run through the proxy tactic.
+fn strongly_connected_proxy<'scope, T>(
+    graph: VecCollection<'scope, T, (usize, usize), Diff>,
+) -> VecCollection<'scope, T, (usize, usize), Diff>
+where
+    T: Timestamp + Lattice + Hash + Ord,
+{
+    let outer = graph.scope();
+    outer.scoped::<Product<_, usize>, _, _>("StronglyConnectedProxy", |scope| {
+        let edges = graph.enter(scope);
+        let trans = edges.clone().map_in_place(|x| mem::swap(&mut x.0, &mut x.1));
+        let (variable, inner) = Variable::new_from(edges.clone(), Product::new(Default::default(), 1));
+        let result = trim_edges_proxy(trim_edges_proxy(inner, edges), trans);
+        variable.set(result.clone());
+        result.leave(outer)
+    })
+}
+
+fn trim_edges_proxy<'scope, T>(
+    cycle: VecCollection<'scope, T, (usize, usize), Diff>,
+    edges: VecCollection<'scope, T, (usize, usize), Diff>,
+) -> VecCollection<'scope, T, (usize, usize), Diff>
+where
+    T: Timestamp + Lattice + Hash + Ord,
+{
+    let outer = edges.inner.scope();
+    outer.region_named("TrimEdgesProxy", |region| {
+        let cycle = cycle.enter_region(region);
+        let edges = edges.enter_region(region);
+
+        let nodes = edges
+            .clone()
+            .map_in_place(|x| x.0 = x.1)
+            .consolidate();
+
+        // `|_| 0` (no label staggering), matching stock `strongly_connected` exactly.
+        let labels = propagate_at(cycle, nodes, |_| 0).arrange_by_key();
+
+        let step1 = proxy_join(
+            edges.arrange_by_key(),
+            labels.clone(),
+            |e1: &usize, e2: &usize, l1: &usize| [(*e2, (*e1, *l1))],
+        );
+        proxy_join(
+            step1.arrange_by_key(),
+            labels,
+            |e2: &usize, (e1, l1): &(usize, usize), l2: &usize| [((*e1, *e2), (*l1, *l2))],
+        )
+        .filter(|(_, (l1, l2))| l1 == l2)
+        .map(|((x1, x2), _)| (x2, x1))
+        .leave_region(outer)
+    })
+}
+
+fn hash_to_u64<T: Hash>(value: &T) -> u64 {
+    let mut hasher = DefaultHasher::new();
+    value.hash(&mut hasher);
+    hasher.finish()
+}
+
+fn edge_for(index: usize, nodes: usize) -> (usize, usize) {
+    let h1 = hash_to_u64(&index);
+    let h2 = hash_to_u64(&h1);
+    ((h1 as usize) % nodes, (h2 as usize) % nodes)
+}
+
+fn main() {
+    let timer = std::time::Instant::now();
+
+    timely::execute_from_args(std::env::args(), move |worker| {
+        let positional: Vec<String> = std::env::args()
+            .skip(1)
+            .filter(|a| !a.starts_with('-'))
+            .collect();
+        let nodes: usize = positional.get(0).and_then(|s| s.parse().ok()).unwrap_or(100_000);
+        let edges: usize = positional.get(1).and_then(|s| s.parse().ok()).unwrap_or(200_000);
+        let batch: usize = positional.get(2).and_then(|s| s.parse().ok()).unwrap_or(1_000);
+        let rounds: usize = positional.get(3).and_then(|s| s.parse().ok()).unwrap_or(usize::MAX);
+
+        if worker.index() == 0 {
+            println!(
+                "proxy scc — nodes: {nodes}, edges: {edges}, batch: {batch}, rounds: {}, workers: {}",
+                if rounds == usize::MAX { "∞".to_string() } else { rounds.to_string() },
+                worker.peers()
+            );
+        }
+
+        let validate = std::env::var("SCC_VALIDATE").is_ok();
+        let mut probe = Handle::new();
+        let mut input = worker.dataflow(|scope| {
+            let (input, graph) = scope.new_collection::<(usize, usize), Diff>();
+            let scc = strongly_connected_proxy(graph.clone());
+            if validate {
+                // Oracle: stock and proxy SCC must agree exactly, at every time.
+                use differential_dataflow::algorithms::graphs::scc::strongly_connected;
+                strongly_connected(graph)
+                    .negate()
+                    .concat(scc.clone())
+                    .consolidate()
+                    .inspect(|x| panic!("proxy scc diverged from stock: {:?}", x))
+                    .probe_with(&mut probe);
+            }
+            scc.probe_with(&mut probe);
+            input
+        });
+
+        let index = worker.index();
+        let peers = worker.peers();
+
+        let timer_load = std::time::Instant::now();
+        for i in (0..edges).filter(|i| i % peers == index) {
+            input.insert(edge_for(i, nodes));
+        }
+        input.advance_to(1);
+        input.flush();
+        while probe.less_than(input.time()) {
+            worker.step();
+        }
+        if index == 0 {
+            println!("{:?}\t{:?}\tloaded {edges} edges", timer.elapsed(), timer_load.elapsed());
+        }
+
+        for round in 0..rounds {
+            let timer_round = std::time::Instant::now();
+            for i in (0..batch).filter(|i| i % peers == index) {
+                input.remove(edge_for(round * batch + i, nodes));
+                input.insert(edge_for(edges + round * batch + i, nodes));
+            }
+            input.advance_to(round + 2);
+            input.flush();
+            while probe.less_than(input.time()) {
+                worker.step();
+            }
+            if index == 0 {
+                println!(
+                    "{:?}\t{:?}\tround {round} ({} changes)",
+                    timer.elapsed(),
+                    timer_round.elapsed(),
+                    batch * 2
+                );
+            }
+        }
+    })
+    .unwrap();
+
+    println!("{:?}\tshut down", timer.elapsed());
+}

From fb06f91f0f0b43fcfdc07e10253a9bd019024144 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 00:55:27 -0400
Subject: [PATCH 13/18] Prune the validation apparatus to its property core
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PR carried ~2.7k lines of tests and benches against a ~280-line
net library change. Pruned by the criterion: keep tests that check
general properties against oracles, drop demonstrations and anything
that locks in current behavior.

Removed:
* examples/int_proxy_bench.rs — a benchmark, not an example. Its
  numbers and their analysis are recorded in the branch's commit
  messages; the harness is recoverable from history when next needed.
* tests/int_proxy_bytes.rs — the [u8]-rows recipe was a demonstration
  wearing a test costume. Its genuinely general content (collision
  resolution under compressing tokens) goes with it for now; the
  hashed-token instantiation is currently uncovered, noted as a gap
  for a slimmer future test.

Consolidated tests/{common/mod.rs, int_proxy_graphs.rs,
int_proxy_pending.rs} into one tests/int_proxy.rs (821 lines) keeping
the property tests: join vs a naive oracle, reduce vs exact per-time
counting, the randomized differential fuzz, the multi-time slow-path
oracle, the partial-order pending contract, and interleaved-unit
isolation (which pinned the Sink bug and is verified to fail against
the bug shape).

examples/scc_proxy.rs stays: it is an actual example (how to write a
backend and mount the tactic in a dataflow), and its SCC_VALIDATE
oracle is the deepest integration check we have.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../examples/int_proxy_bench.rs               | 827 ------------------
 differential-dataflow/tests/common/mod.rs     | 444 ----------
 differential-dataflow/tests/int_proxy.rs      | 821 +++++++++++++++++
 .../tests/int_proxy_bytes.rs                  | 701 ---------------
 .../tests/int_proxy_graphs.rs                 | 291 ------
 .../tests/int_proxy_pending.rs                | 108 ---
 6 files changed, 821 insertions(+), 2371 deletions(-)
 delete mode 100644 differential-dataflow/examples/int_proxy_bench.rs
 delete mode 100644 differential-dataflow/tests/common/mod.rs
 create mode 100644 differential-dataflow/tests/int_proxy.rs
 delete mode 100644 differential-dataflow/tests/int_proxy_bytes.rs
 delete mode 100644 differential-dataflow/tests/int_proxy_graphs.rs
 delete mode 100644 differential-dataflow/tests/int_proxy_pending.rs

diff --git a/differential-dataflow/examples/int_proxy_bench.rs b/differential-dataflow/examples/int_proxy_bench.rs
deleted file mode 100644
index 36cce94f2..000000000
--- a/differential-dataflow/examples/int_proxy_bench.rs
+++ /dev/null
@@ -1,827 +0,0 @@
-//! Measures the indirection tax: proxy tactics vs hand-written native implementations
-//! over identical data, for the value-token (exact, zero-translation) instantiation.
-//!
-//! Data is graph edges `(src: u32, dst: u32)` grouped by source — `G = src`, token =
-//! the edge itself — so every observed gap is protocol overhead (windowing, bridge
-//! materialization, harness crossings), not tokenization.
-//!
-//! Run: `cargo run --release --example int_proxy_bench [-- <keys> <fanout>]`
-
-use std::hint::black_box;
-use std::time::Instant;
-
-use timely::progress::frontier::AntichainRef;
-use timely::progress::Antichain;
-
-use differential_dataflow::consolidation::consolidate_updates;
-use differential_dataflow::operators::int_proxy::{
-    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
-    ProxyReduceTactic, ReduceInstance, ReduceWindow,
-};
-use differential_dataflow::operators::join::{Fresh, JoinTactic};
-use differential_dataflow::operators::reduce::ReduceTactic;
-use differential_dataflow::trace::{BatchReader, Description};
-
-type Edge = (u32, u32);
-type Time = u64;
-type Diff = isize;
-
-#[derive(Clone)]
-struct GraphBatch {
-    updates: Vec<(Edge, Time, Diff)>,
-    description: Description<Time>,
-}
-
-impl BatchReader for GraphBatch {
-    type Time = Time;
-    fn len(&self) -> usize { self.updates.len() }
-    fn description(&self) -> &Description<Time> { &self.description }
-}
-
-fn batch(mut updates: Vec<(Edge, Time, Diff)>, lower: Time, upper: Time) -> GraphBatch {
-    consolidate_updates(&mut updates);
-    GraphBatch {
-        updates,
-        description: Description::new(
-            Antichain::from_elem(lower),
-            Antichain::from_elem(upper),
-            Antichain::from_elem(0),
-        ),
-    }
-}
-
-fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
-    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
-}
-
-fn next_group(batches: &[GraphBatch], pos: &[usize]) -> Option<u32> {
-    batches
-        .iter()
-        .zip(pos.iter())
-        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
-        .min()
-}
-
-fn drain_group(
-    batches: &[GraphBatch],
-    pos: &mut [usize],
-    g: u32,
-    mut logic: impl FnMut(Edge, Time, Diff),
-) {
-    for (b, p) in batches.iter().zip(pos.iter_mut()) {
-        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
-            let (edge, t, r) = b.updates[*p];
-            logic(edge, t, r);
-            *p += 1;
-        }
-    }
-}
-
-// ------------------------------------------------------------------ proxy join
-
-#[derive(Default)]
-struct GraphJoinCursor {
-    pos0: Vec<usize>,
-    pos1: Vec<usize>,
-}
-
-struct GraphJoinBackend {
-    window: usize,
-    target: usize,
-}
-
-impl GraphJoinBackend {
-    fn new(window: usize) -> Self {
-        GraphJoinBackend { window, target: 1 << 20 }
-    }
-}
-
-impl ProxyJoinBackend<GraphBatch, GraphBatch> for GraphJoinBackend {
-    type Group = u32;
-    type Token0 = Edge;
-    type Token1 = Edge;
-    type R0 = Diff;
-    type R1 = Diff;
-    type ROut = Diff;
-    type Output = Vec<(Edge, Edge, Time, Diff)>;
-    type Cursor = GraphJoinCursor;
-    type Sink = Vec<(Edge, Edge, Time, Diff)>;
-
-    fn next_window(
-        &mut self,
-        instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        fresh: Fresh,
-        cursor: &mut GraphJoinCursor,
-        reuse: Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>>,
-    ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
-        cursor.pos0.resize(instance.batches0.len(), 0);
-        cursor.pos1.resize(instance.batches1.len(), 0);
-        let (fresh_b, other_b) = match fresh {
-            Fresh::Input0 => (instance.batches0, instance.batches1),
-            Fresh::Input1 => (instance.batches1, instance.batches0),
-        };
-        // Route each reclaimed vec back to the side it served, so capacities stay
-        // side-stable rather than alternating duties across round trips.
-        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
-            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
-            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
-            (None, _) => (Vec::new(), Vec::new()),
-        };
-        loop {
-            fresh_run.clear();
-            other_run.clear();
-            let mut groups = 0;
-            while groups < self.window {
-                let (fresh_pos, other_pos) = match fresh {
-                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
-                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
-                };
-                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
-                groups += 1;
-                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
-                    fresh_run.push(((g, e), advance(t, instance.lower), r));
-                });
-                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
-                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
-                        *p += 1;
-                    }
-                }
-                drain_group(other_b, other_pos, g, |e, t, r| {
-                    other_run.push(((g, e), advance(t, instance.lower), r));
-                });
-            }
-            if groups == 0 {
-                return None;
-            }
-            consolidate_updates(&mut fresh_run);
-            consolidate_updates(&mut other_run);
-            if fresh_run.is_empty() && other_run.is_empty() {
-                continue;
-            }
-            let (input0, input1) = match fresh {
-                Fresh::Input0 => (fresh_run, other_run),
-                Fresh::Input1 => (other_run, fresh_run),
-            };
-            return Some(JoinWindow { input0, input1 });
-        }
-    }
-
-    fn absorb(
-        &mut self,
-        _instance: &JoinInstance<'_, GraphBatch, GraphBatch>,
-        sink: &mut Self::Sink,
-        left: (u32, Edge),
-        right: (u32, Edge),
-        time: Time,
-        diff: Diff,
-    ) -> Option<Self::Output> {
-        sink.push((left.1, right.1, time, diff));
-        if sink.len() >= self.target {
-            Some(std::mem::take(sink))
-        } else {
-            None
-        }
-    }
-
-    fn flush(&mut self, _instance: &JoinInstance<'_, GraphBatch, GraphBatch>, sink: &mut Self::Sink) -> Option<Self::Output> {
-        if sink.is_empty() { None } else { Some(std::mem::take(sink)) }
-    }
-}
-
-// ---------------------------------------------------------------- proxy reduce
-
-struct GraphReduceBackend {
-    window: usize,
-    tiles: Vec<Description<Time>>,
-    emitted: Vec<Vec<(Edge, Time, Diff)>>,
-    pos_source: Vec<usize>,
-    pos_input: Vec<usize>,
-    pos_output: Vec<usize>,
-    pend_idx: usize,
-}
-
-impl GraphReduceBackend {
-    fn new(window: usize) -> Self {
-        GraphReduceBackend {
-            window,
-            tiles: Vec::new(),
-            emitted: Vec::new(),
-            pos_source: Vec::new(),
-            pos_input: Vec::new(),
-            pos_output: Vec::new(),
-            pend_idx: 0,
-        }
-    }
-}
-
-impl ProxyReduceBackend<GraphBatch, GraphBatch> for GraphReduceBackend {
-    type Group = u32;
-    type Token = Edge;
-    type RIn = Diff;
-    type ROut = Diff;
-
-    fn begin(&mut self, tiles: &[Description<Time>]) {
-        self.tiles = tiles.to_vec();
-        self.emitted = vec![Vec::new(); tiles.len()];
-        self.pos_source.clear();
-        self.pos_input.clear();
-        self.pos_output.clear();
-        self.pend_idx = 0;
-    }
-
-    fn next_window(
-        &mut self,
-        instance: &ReduceInstance<'_, GraphBatch, GraphBatch>,
-        pending: &[u32],
-        reuse: Option<ReduceWindow<u32, Edge, Time, Diff, Diff>>,
-    ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
-        self.pos_source.resize(instance.source_batches.len(), 0);
-        self.pos_input.resize(instance.input_batches.len(), 0);
-        self.pos_output.resize(instance.output_batches.len(), 0);
-        let (mut keys, mut seeds, mut input, mut output) = match reuse {
-            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
-                keys.clear(); seeds.clear(); input.clear(); output.clear();
-                (keys, seeds, input, output)
-            }
-            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
-        };
-        while keys.len() < self.window {
-            let g = [
-                next_group(instance.source_batches, &self.pos_source),
-                next_group(instance.input_batches, &self.pos_input),
-                next_group(instance.output_batches, &self.pos_output),
-                pending.get(self.pend_idx).copied(),
-            ]
-            .into_iter()
-            .flatten()
-            .min();
-            let Some(g) = g else { break };
-            keys.push(g);
-            if pending.get(self.pend_idx) == Some(&g) {
-                self.pend_idx += 1;
-            }
-            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
-                seeds.push((g, t));
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
-                output.push(((g, e), advance(t, instance.lower), r));
-            });
-        }
-        if keys.is_empty() {
-            return None;
-        }
-        consolidate_updates(&mut input);
-        consolidate_updates(&mut output);
-        seeds.sort();
-        seeds.dedup();
-        Some(ReduceWindow { keys, seeds, input, output })
-    }
-
-    fn reduce_corrections(
-        &mut self,
-        keys: &[u32],
-        in_ends: &[usize],
-        input: &[(Edge, Diff)],
-        out_ends: &[usize],
-        output: &[(Edge, Diff)],
-    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
-        let mut corr = Vec::new();
-        let mut ends = Vec::new();
-        let mut delta: Vec<(Edge, Diff)> = Vec::new();
-        let (mut i0, mut o0) = (0, 0);
-        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
-            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-            delta.clear();
-            if count > 0 {
-                delta.push(((*k, count as u32), 1));
-            }
-            for (v, d) in &output[o0..o1] {
-                delta.push((*v, -d));
-            }
-            differential_dataflow::consolidation::consolidate(&mut delta);
-            corr.extend(delta.drain(..));
-            ends.push(corr.len());
-            i0 = i1;
-            o0 = o1;
-        }
-        (corr, ends)
-    }
-
-    fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
-        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, *t, *r)));
-    }
-
-    fn finish(&mut self) -> Vec<GraphBatch> {
-        self.tiles
-            .drain(..)
-            .zip(self.emitted.drain(..))
-            .map(|(desc, mut updates)| {
-                consolidate_updates(&mut updates);
-                GraphBatch { updates, description: desc }
-            })
-            .collect()
-    }
-}
-
-// --------------------------------------------------------------------- natives
-
-/// Hand-written merge-join over the same batch lists: the native baseline. Produces
-/// the same containers (chunks of matched pairs) the proxy path produces.
-fn native_join(a: &[GraphBatch], b: &[GraphBatch], chunk: usize) -> Vec<Vec<(Edge, Edge, Time, Diff)>> {
-    let mut out = Vec::new();
-    let mut cur = Vec::new();
-    let mut pos0 = vec![0; a.len()];
-    let mut pos1 = vec![0; b.len()];
-    let (mut e0, mut e1) = (Vec::new(), Vec::new());
-    loop {
-        let (g0, g1) = (next_group(a, &pos0), next_group(b, &pos1));
-        let g = match (g0, g1) {
-            (None, None) => break,
-            (Some(x), None) => x,
-            (None, Some(y)) => y,
-            (Some(x), Some(y)) => x.min(y),
-        };
-        e0.clear();
-        e1.clear();
-        drain_group(a, &mut pos0, g, |e, t, r| e0.push((e, t, r)));
-        drain_group(b, &mut pos1, g, |e, t, r| e1.push((e, t, r)));
-        for (x, t0, r0) in &e0 {
-            for (y, t1, r1) in &e1 {
-                cur.push((*x, *y, std::cmp::max(*t0, *t1), r0 * r1));
-                if cur.len() >= chunk {
-                    out.push(std::mem::replace(&mut cur, Vec::with_capacity(chunk)));
-                }
-            }
-        }
-    }
-    if !cur.is_empty() {
-        out.push(cur);
-    }
-    out
-}
-
-/// Hand-written per-source count over the same batch list: the native baseline.
-fn native_count(a: &[GraphBatch]) -> Vec<(Edge, Time, Diff)> {
-    let mut out = Vec::new();
-    let mut pos = vec![0; a.len()];
-    while let Some(g) = next_group(a, &pos) {
-        let mut count: Diff = 0;
-        let mut time: Time = 0;
-        drain_group(a, &mut pos, g, |_e, t, r| {
-            count += r;
-            time = time.max(t);
-        });
-        if count > 0 {
-            out.push(((g, count as u32), time, 1));
-        }
-    }
-    out
-}
-
-// ------------------------------------------- cursor incumbents, same storage
-
-/// The incumbent comparison: real `OrdValBatch` storage, consumed two ways — the
-/// cursor tactics (the shipping implementations), and the proxy tactics through
-/// backends that present from the same batches via the same cursors. Both pay
-/// identical storage access; the difference is protocol.
-mod ordval {
-    use super::{advance, Diff, Edge, Time};
-
-    use timely::container::CapacityContainerBuilder;
-    use timely::progress::Antichain;
-
-    use differential_dataflow::consolidation::consolidate_updates;
-    use differential_dataflow::operators::int_proxy::{
-        JoinInstance, JoinWindow, ProxyJoinBackend, ProxyReduceBackend, ReduceInstance,
-        ReduceWindow,
-    };
-    use differential_dataflow::operators::join::Fresh;
-    use differential_dataflow::trace::implementations::{ValBuilder, ValSpine};
-    use differential_dataflow::trace::{Builder, Cursor, Description, Navigable, TraceReader};
-
-    pub type Bt = <ValSpine<u32, u32, Time, Diff> as TraceReader>::Batch;
-    pub type Bu = ValBuilder<u32, u32, Time, Diff>;
-    type Cur = <Bt as Navigable>::Cursor;
-    pub type JoinCb = CapacityContainerBuilder<Vec<(Edge, Edge, Time, Diff)>>;
-
-    /// Seal sorted, consolidated updates into one `OrdValBatch`.
-    pub fn seal(mut updates: Vec<((u32, u32), Time, Diff)>, lower: Time, upper: Time) -> Bt {
-        consolidate_updates(&mut updates);
-        let description = Description::new(
-            Antichain::from_elem(lower),
-            Antichain::from_elem(upper),
-            Antichain::from_elem(0),
-        );
-        <Bu as Builder>::seal(&mut vec![updates], description)
-    }
-
-    /// The cursor-tactic closures for per-key counting, matching the proxy semantics.
-    pub fn count_logic(
-        _key: &u32,
-        input: &[(&u32, Diff)],
-        output: &mut Vec<(u32, Diff)>,
-        change: &mut Vec<(u32, Diff)>,
-    ) {
-        let count: Diff = input.iter().map(|(_, d)| *d).sum();
-        if count > 0 {
-            change.push((count as u32, 1));
-        }
-        change.extend(output.drain(..).map(|(x, d)| (x, -d)));
-        differential_dataflow::consolidation::consolidate(change);
-    }
-
-    /// Shared group-order scanning state over a set of batch cursors.
-    #[derive(Default)]
-    pub struct Cursors {
-        cursors: Vec<Cur>,
-        started: bool,
-    }
-
-    impl Cursors {
-        fn start(&mut self, batches: &[Bt]) {
-            if !self.started {
-                self.started = true;
-                self.cursors = batches.iter().map(|b| b.cursor()).collect();
-            }
-        }
-        fn next_group(&mut self, batches: &[Bt]) -> Option<u32> {
-            self.cursors
-                .iter()
-                .zip(batches)
-                .filter_map(|(c, b)| c.get_key(b).copied())
-                .min()
-        }
-        /// Visit every (val, time, diff) of group `g`, advancing past it.
-        fn drain_group(&mut self, batches: &[Bt], g: u32, mut logic: impl FnMut(u32, Time, Diff)) {
-            for (c, b) in self.cursors.iter_mut().zip(batches) {
-                if c.get_key(b) == Some(&g) {
-                    while let Some(v) = c.get_val(b) {
-                        let v = *v;
-                        c.map_times(b, |t, d| logic(v, *t, *d));
-                        c.step_val(b);
-                    }
-                    c.step_key(b);
-                }
-            }
-        }
-        /// Skip groups below `g`.
-        fn seek(&mut self, batches: &[Bt], g: u32) {
-            for (c, b) in self.cursors.iter_mut().zip(batches) {
-                c.seek_key(b, &g);
-            }
-        }
-    }
-
-    // ------------------------------------------------------------- proxy join
-
-    #[derive(Default)]
-    pub struct OrdJoinCursor {
-        c0: Cursors,
-        c1: Cursors,
-    }
-
-    pub struct OrdJoinBackend {
-        pub window: usize,
-        pub target: usize,
-    }
-
-    impl OrdJoinBackend {
-        pub fn new(window: usize) -> Self {
-            OrdJoinBackend { window, target: 1 << 20 }
-        }
-    }
-
-    impl ProxyJoinBackend<Bt, Bt> for OrdJoinBackend {
-        type Group = u32;
-        type Token0 = Edge;
-        type Token1 = Edge;
-        type R0 = Diff;
-        type R1 = Diff;
-        type ROut = Diff;
-        type Output = Vec<(Edge, Edge, Time, Diff)>;
-        type Cursor = OrdJoinCursor;
-        type Sink = Vec<(Edge, Edge, Time, Diff)>;
-
-        fn next_window(
-            &mut self,
-            instance: &JoinInstance<'_, Bt, Bt>,
-            fresh: Fresh,
-            cursor: &mut OrdJoinCursor,
-            reuse: Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>>,
-        ) -> Option<JoinWindow<u32, Edge, Edge, Time, Diff, Diff>> {
-            cursor.c0.start(instance.batches0);
-            cursor.c1.start(instance.batches1);
-            // Route each reclaimed vec back to the side it served, so capacities stay
-            // side-stable rather than alternating duties across round trips.
-            let (mut fresh_run, mut other_run) = match (reuse, fresh) {
-                (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
-                (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
-                (None, _) => (Vec::new(), Vec::new()),
-            };
-            loop {
-                fresh_run.clear();
-                other_run.clear();
-                let mut groups = 0;
-                while groups < self.window {
-                    let (fc, ob, oc, fb) = match fresh {
-                        Fresh::Input0 => (&mut cursor.c0, instance.batches1, &mut cursor.c1, instance.batches0),
-                        Fresh::Input1 => (&mut cursor.c1, instance.batches0, &mut cursor.c0, instance.batches1),
-                    };
-                    let Some(g) = fc.next_group(fb) else { break };
-                    groups += 1;
-                    fc.drain_group(fb, g, |v, t, r| {
-                        fresh_run.push(((g, (g, v)), advance(t, instance.lower), r));
-                    });
-                    oc.seek(ob, g);
-                    oc.drain_group(ob, g, |v, t, r| {
-                        other_run.push(((g, (g, v)), advance(t, instance.lower), r));
-                    });
-                }
-                if groups == 0 {
-                    return None;
-                }
-                consolidate_updates(&mut fresh_run);
-                consolidate_updates(&mut other_run);
-                if fresh_run.is_empty() && other_run.is_empty() {
-                    continue;
-                }
-                let (input0, input1) = match fresh {
-                    Fresh::Input0 => (fresh_run, other_run),
-                    Fresh::Input1 => (other_run, fresh_run),
-                };
-                return Some(JoinWindow { input0, input1 });
-            }
-        }
-
-        fn absorb(
-            &mut self,
-            _instance: &JoinInstance<'_, Bt, Bt>,
-            sink: &mut Self::Sink,
-            left: (u32, Edge),
-            right: (u32, Edge),
-            time: Time,
-            diff: Diff,
-        ) -> Option<Self::Output> {
-            sink.push((left.1, right.1, time, diff));
-            if sink.len() >= self.target {
-                Some(std::mem::take(sink))
-            } else {
-                None
-            }
-        }
-
-        fn flush(&mut self, _instance: &JoinInstance<'_, Bt, Bt>, sink: &mut Self::Sink) -> Option<Self::Output> {
-            if sink.is_empty() { None } else { Some(std::mem::take(sink)) }
-        }
-    }
-
-    // ----------------------------------------------------------- proxy reduce
-
-    pub struct OrdReduceBackend {
-        pub window: usize,
-        tiles: Vec<Description<Time>>,
-        emitted: Vec<Vec<((u32, u32), Time, Diff)>>,
-        source: Cursors,
-        input: Cursors,
-        output: Cursors,
-        pend_idx: usize,
-    }
-
-    impl OrdReduceBackend {
-        pub fn new(window: usize) -> Self {
-            OrdReduceBackend {
-                window,
-                tiles: Vec::new(),
-                emitted: Vec::new(),
-                source: Cursors::default(),
-                input: Cursors::default(),
-                output: Cursors::default(),
-                pend_idx: 0,
-            }
-        }
-    }
-
-    impl ProxyReduceBackend<Bt, Bt> for OrdReduceBackend {
-        type Group = u32;
-        type Token = Edge;
-        type RIn = Diff;
-        type ROut = Diff;
-
-        fn begin(&mut self, tiles: &[Description<Time>]) {
-            self.tiles = tiles.to_vec();
-            self.emitted = vec![Vec::new(); tiles.len()];
-            self.source = Cursors::default();
-            self.input = Cursors::default();
-            self.output = Cursors::default();
-            self.pend_idx = 0;
-        }
-
-        fn next_window(
-            &mut self,
-            instance: &ReduceInstance<'_, Bt, Bt>,
-            pending: &[u32],
-            reuse: Option<ReduceWindow<u32, Edge, Time, Diff, Diff>>,
-        ) -> Option<ReduceWindow<u32, Edge, Time, Diff, Diff>> {
-            self.source.start(instance.source_batches);
-            self.input.start(instance.input_batches);
-            self.output.start(instance.output_batches);
-            let (mut keys, mut seeds, mut input, mut output) = match reuse {
-                Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
-                    keys.clear(); seeds.clear(); input.clear(); output.clear();
-                    (keys, seeds, input, output)
-                }
-                None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
-            };
-            while keys.len() < self.window {
-                let g = [
-                    self.source.next_group(instance.source_batches),
-                    self.input.next_group(instance.input_batches),
-                    self.output.next_group(instance.output_batches),
-                    pending.get(self.pend_idx).copied(),
-                ]
-                .into_iter()
-                .flatten()
-                .min();
-                let Some(g) = g else { break };
-                keys.push(g);
-                if pending.get(self.pend_idx) == Some(&g) {
-                    self.pend_idx += 1;
-                }
-                self.source.drain_group(instance.source_batches, g, |v, t, r| {
-                    input.push(((g, (g, v)), advance(t, instance.lower), r));
-                });
-                self.input.drain_group(instance.input_batches, g, |v, t, r| {
-                    seeds.push((g, t));
-                    input.push(((g, (g, v)), advance(t, instance.lower), r));
-                });
-                self.output.drain_group(instance.output_batches, g, |v, t, r| {
-                    output.push(((g, (g, v)), advance(t, instance.lower), r));
-                });
-            }
-            if keys.is_empty() {
-                return None;
-            }
-            consolidate_updates(&mut input);
-            consolidate_updates(&mut output);
-            seeds.sort();
-            seeds.dedup();
-            Some(ReduceWindow { keys, seeds, input, output })
-        }
-
-        fn reduce_corrections(
-            &mut self,
-            keys: &[u32],
-            in_ends: &[usize],
-            input: &[(Edge, Diff)],
-            out_ends: &[usize],
-            output: &[(Edge, Diff)],
-        ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
-            let mut corr = Vec::new();
-            let mut ends = Vec::new();
-            let mut delta: Vec<(Edge, Diff)> = Vec::new();
-            let (mut i0, mut o0) = (0, 0);
-            for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
-                let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-                delta.clear();
-                if count > 0 {
-                    delta.push(((*k, count as u32), 1));
-                }
-                for (v, d) in &output[o0..o1] {
-                    delta.push((*v, -d));
-                }
-                differential_dataflow::consolidation::consolidate(&mut delta);
-                corr.extend(delta.drain(..));
-                ends.push(corr.len());
-                i0 = i1;
-                o0 = o1;
-            }
-            (corr, ends)
-        }
-
-        fn emit(&mut self, tile: usize, records: &[((u32, Edge), Time, Diff)]) {
-            self.emitted[tile].extend(records.iter().map(|((g, e), t, r)| ((*g, e.1), *t, *r)));
-        }
-
-        fn finish(&mut self) -> Vec<Bt> {
-            self.tiles
-                .drain(..)
-                .zip(self.emitted.drain(..))
-                .map(|(desc, mut updates)| {
-                    consolidate_updates(&mut updates);
-                    let mut chain = vec![updates];
-                    <Bu as Builder>::seal(&mut chain, desc)
-                })
-                .collect()
-        }
-    }
-
-}
-
-// ----------------------------------------------------------------------- bench
-
-fn time<T>(label: &str, reps: usize, mut f: impl FnMut() -> T) -> f64 {
-    let mut best = f64::INFINITY;
-    for _ in 0..reps {
-        let start = Instant::now();
-        black_box(f());
-        best = best.min(start.elapsed().as_secs_f64());
-    }
-    println!("    {label:<28} {:>10.3} ms", best * 1e3);
-    best
-}
-
-fn main() {
-    let mut args = std::env::args().skip(1);
-    let keys: u32 = args.next().and_then(|s| s.parse().ok()).unwrap_or(100_000);
-    let fanout: u32 = args.next().and_then(|s| s.parse().ok()).unwrap_or(4);
-    let window: usize = args.next().and_then(|s| s.parse().ok()).unwrap_or(1024);
-    let reps = 5;
-
-    // Two edge sets over the same key space, `fanout` edges per key each.
-    let edges = |salt: u32| {
-        let mut v = Vec::with_capacity((keys * fanout) as usize);
-        for k in 0..keys {
-            for f in 0..fanout {
-                v.push(((k, salt.wrapping_mul(1_000_003).wrapping_add(k * fanout + f)), 0u64, 1isize));
-            }
-        }
-        v
-    };
-    let a = vec![batch(edges(1), 0, 1)];
-    let b = vec![batch(edges(2), 0, 1)];
-
-    println!(
-        "join: {} x {} edges over {} keys (fanout {}, ~{} matches)",
-        keys * fanout, keys * fanout, keys, fanout, (keys as u64) * (fanout as u64) * (fanout as u64),
-    );
-    let t_native = time("native merge-join", reps, || native_join(&a, &b, 1 << 20));
-    let t_proxy = time("proxy join (value tokens)", reps, || {
-        let mut tactic = ProxyJoinTactic::new(GraphJoinBackend::new(window));
-        let work = tactic.prep(a.clone(), b.clone(), Fresh::Input0, 0);
-        work.collect::<Vec<_>>()
-    });
-    println!("    ratio: {:.2}x\n", t_proxy / t_native);
-
-    let input = vec![batch(edges(1), 0, 1)];
-    println!("reduce (count per key): {} edges over {} keys", keys * fanout, keys);
-    let t_native = time("native count", reps, || native_count(&input));
-    let t_proxy = time("proxy reduce (value tokens)", reps, || {
-        let mut tactic = ProxyReduceTactic::new(GraphReduceBackend::new(window));
-        let lower = Antichain::from_elem(0u64);
-        let upper = Antichain::from_elem(1u64);
-        let held = Antichain::from_elem(0u64);
-        tactic.retire(Vec::new(), Vec::new(), input.clone(), &lower, &upper, &held)
-    });
-    println!("    ratio: {:.2}x", t_proxy / t_native);
-
-    // ---- incumbent comparison: identical OrdValBatch storage, cursor vs proxy ----
-
-    use differential_dataflow::operators::reduce::cursors::CursorTactic as ReduceCursorTactic;
-    use differential_dataflow::operators::join::cursors::CursorTactic as JoinCursorTactic;
-
-    let a_ord = vec![ordval::seal(edges(1), 0, 1)];
-    let b_ord = vec![ordval::seal(edges(2), 0, 1)];
-
-    println!("\njoin on OrdValBatch storage (cursor incumbent vs proxy protocol):");
-    let t_cursor = time("cursor JoinTactic", reps, || {
-        let mut tactic = JoinCursorTactic::<ordval::Bt, ordval::Bt, _, ordval::JoinCb>::new(
-            |k: &u32, v0: &u32, v1: &u32, t: Time, d0: &Diff, d1: &Diff, cb: &mut ordval::JoinCb| {
-                use timely::container::PushInto;
-                cb.push_into(((*k, *v0), (*k, *v1), t, d0 * d1));
-            },
-        );
-        let work = tactic.prep(a_ord.clone(), b_ord.clone(), Fresh::Input0, 0);
-        work.collect::<Vec<_>>()
-    });
-    let t_proxy = time("proxy join (cursor backend)", reps, || {
-        let mut tactic = ProxyJoinTactic::new(ordval::OrdJoinBackend::new(window));
-        let work = tactic.prep(a_ord.clone(), b_ord.clone(), Fresh::Input0, 0);
-        work.collect::<Vec<_>>()
-    });
-    println!("    ratio: {:.2}x", t_proxy / t_cursor);
-
-    println!("\nreduce on OrdValBatch storage (cursor incumbent vs proxy protocol):");
-    let input_ord = vec![ordval::seal(edges(1), 0, 1)];
-    let lower = Antichain::from_elem(0u64);
-    let upper = Antichain::from_elem(1u64);
-    let held = Antichain::from_elem(0u64);
-    let t_cursor = time("cursor ReduceTactic", reps, || {
-        let mut tactic = ReduceCursorTactic::<ordval::Bt, ordval::Bt, ordval::Bu, _, _>::new(
-            ordval::count_logic,
-            |vec: &mut Vec<((u32, u32), Time, Diff)>, key: &u32, upds: &mut Vec<(u32, Time, Diff)>| {
-                vec.clear();
-                vec.extend(upds.drain(..).map(|(v, t, r)| ((*key, v), t, r)));
-            },
-        );
-        tactic.retire(Vec::new(), Vec::new(), input_ord.clone(), &lower, &upper, &held)
-    });
-    let t_proxy = time("proxy reduce (cursor backend)", reps, || {
-        let mut tactic = ProxyReduceTactic::new(ordval::OrdReduceBackend::new(window));
-        tactic.retire(Vec::new(), Vec::new(), input_ord.clone(), &lower, &upper, &held)
-    });
-    println!("    ratio: {:.2}x", t_proxy / t_cursor);
-}
diff --git a/differential-dataflow/tests/common/mod.rs b/differential-dataflow/tests/common/mod.rs
deleted file mode 100644
index f6716cf6f..000000000
--- a/differential-dataflow/tests/common/mod.rs
+++ /dev/null
@@ -1,444 +0,0 @@
-//! Shared scaffolding for the proxy-tactic reference-backend tests: an edge-update
-//! batch and value-token backends generic over the timestamp, so the total-order
-//! (`u64`) and partial-order (`Pair`) tests drive one implementation. The byte-rows
-//! test keeps its own scaffold deliberately — its columnar layout is the point.
-#![allow(dead_code)]
-
-use timely::progress::frontier::AntichainRef;
-use timely::progress::{Antichain, Timestamp};
-
-use differential_dataflow::consolidation::{consolidate, consolidate_updates};
-use differential_dataflow::lattice::Lattice;
-use differential_dataflow::operators::int_proxy::{
-    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyReduceBackend, ReduceInstance,
-    ReduceWindow,
-};
-use differential_dataflow::operators::join::Fresh;
-use differential_dataflow::trace::{BatchReader, Description};
-
-pub type Edge = (u32, u32);
-pub type Diff = isize;
-
-/// A batch of edge updates, sorted and consolidated, `G = src` exact.
-#[derive(Clone)]
-pub struct EdgeBatch<T> {
-    pub updates: Vec<(Edge, T, Diff)>,
-    pub description: Description<T>,
-}
-
-impl<T: Timestamp + Lattice> BatchReader for EdgeBatch<T> {
-    type Time = T;
-    fn len(&self) -> usize { self.updates.len() }
-    fn description(&self) -> &Description<T> { &self.description }
-}
-
-/// Sort, consolidate, and wrap updates as a batch describing `[lower, upper)`.
-pub fn batch<T: Timestamp + Lattice + Ord>(updates: Vec<(Edge, T, Diff)>, lower: T, upper: T) -> EdgeBatch<T> {
-    batch_frontiers(updates, Antichain::from_elem(lower), Antichain::from_elem(upper))
-}
-
-/// As [`batch`], with antichain frontiers for partially ordered intervals.
-pub fn batch_frontiers<T: Timestamp + Lattice + Ord>(
-    mut updates: Vec<(Edge, T, Diff)>,
-    lower: Antichain<T>,
-    upper: Antichain<T>,
-) -> EdgeBatch<T> {
-    consolidate_updates(&mut updates);
-    EdgeBatch {
-        updates,
-        description: Description::new(lower, upper, Antichain::from_elem(T::minimum())),
-    }
-}
-
-/// Advance a time to the compaction frontier (join against its elements).
-pub fn advance<T: Lattice + Clone>(t: T, lower: AntichainRef<'_, T>) -> T {
-    lower.iter().fold(t, |t, l| t.join(l))
-}
-
-/// The next group at or after the per-batch positions `pos` into `batches`.
-///
-/// Test-grade: rescans every batch head per group. A real backend should k-way merge
-/// with a heap over batch cursors.
-pub fn next_group<T>(batches: &[EdgeBatch<T>], pos: &[usize]) -> Option<u32> {
-    batches
-        .iter()
-        .zip(pos.iter())
-        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
-        .min()
-}
-
-/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`.
-pub fn drain_group<T: Clone>(
-    batches: &[EdgeBatch<T>],
-    pos: &mut [usize],
-    g: u32,
-    mut logic: impl FnMut(Edge, T, Diff),
-) {
-    for (b, p) in batches.iter().zip(pos.iter_mut()) {
-        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
-            let (edge, ref t, r) = b.updates[*p];
-            logic(edge, t.clone(), r);
-            *p += 1;
-        }
-    }
-}
-
-// ---------------------------------------------------------------- join backend
-
-/// Per-unit resumption: a position per batch per side. This is the state a single
-/// `usize` could not carry — the finding that motivated `type Cursor`.
-#[derive(Default)]
-pub struct EdgeJoinCursor {
-    pub pos0: Vec<usize>,
-    pub pos1: Vec<usize>,
-}
-
-pub struct EdgeJoinBackend {
-    /// Groups per window; tiny in tests to force many windows.
-    pub window: usize,
-    /// Matches per output container; tiny in tests to force many containers.
-    pub target: usize,
-}
-
-impl EdgeJoinBackend {
-    pub fn new(window: usize) -> Self {
-        EdgeJoinBackend { window, target: 8 }
-    }
-}
-
-impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend {
-    type Group = u32;
-    type Token0 = Edge;
-    type Token1 = Edge;
-    type R0 = Diff;
-    type R1 = Diff;
-    type ROut = Diff;
-    /// Matched edge pairs with their joined time and multiplied diff.
-    type Output = Vec<(Edge, Edge, T, Diff)>;
-    type Cursor = EdgeJoinCursor;
-    type Sink = Vec<(Edge, Edge, T, Diff)>;
-
-    fn next_window(
-        &mut self,
-        instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
-        fresh: Fresh,
-        cursor: &mut EdgeJoinCursor,
-        reuse: Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>>,
-    ) -> Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>> {
-        cursor.pos0.resize(instance.batches0.len(), 0);
-        cursor.pos1.resize(instance.batches1.len(), 0);
-        // Drive by the fresh side's groups: the accumulated side's other groups are
-        // skipped, never presented (O(fresh) presentations; empty fresh side is free).
-        let (fresh_b, other_b) = match fresh {
-            Fresh::Input0 => (instance.batches0, instance.batches1),
-            Fresh::Input1 => (instance.batches1, instance.batches0),
-        };
-        // Reclaim the spent window's bridge capacity.
-        // Route each reclaimed vec back to the side it served, so capacities stay
-        // side-stable rather than alternating duties across round trips.
-        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
-            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
-            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
-            (None, _) => (Vec::new(), Vec::new()),
-        };
-        loop {
-            fresh_run.clear();
-            other_run.clear();
-            let mut groups = 0;
-            while groups < self.window {
-                let (fresh_pos, other_pos) = match fresh {
-                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
-                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
-                };
-                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
-                groups += 1;
-                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
-                    fresh_run.push(((g, e), advance(t, instance.lower), r));
-                });
-                // Skip the accumulated side below `g`, then drain its matching group.
-                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
-                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
-                        *p += 1;
-                    }
-                }
-                drain_group(other_b, other_pos, g, |e, t, r| {
-                    other_run.push(((g, e), advance(t, instance.lower), r));
-                });
-            }
-            if groups == 0 {
-                return None;
-            }
-            consolidate_updates(&mut fresh_run);
-            consolidate_updates(&mut other_run);
-            // A fully-cancelled quota presents nothing; keep going rather than emit an
-            // empty window (the harness's progress guard forbids those).
-            if fresh_run.is_empty() && other_run.is_empty() {
-                continue;
-            }
-            let (input0, input1) = match fresh {
-                Fresh::Input0 => (fresh_run, other_run),
-                Fresh::Input1 => (other_run, fresh_run),
-            };
-            return Some(JoinWindow { input0, input1 });
-        }
-    }
-
-    fn absorb(
-        &mut self,
-        _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
-        sink: &mut Self::Sink,
-        left: (u32, Edge),
-        right: (u32, Edge),
-        time: T,
-        diff: Diff,
-    ) -> Option<Self::Output> {
-        // Self-redeeming tokens: the output is built from the tokens alone.
-        sink.push((left.1, right.1, time, diff));
-        if sink.len() >= self.target {
-            Some(std::mem::take(sink))
-        } else {
-            None
-        }
-    }
-
-    fn flush(&mut self, _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>, sink: &mut Self::Sink) -> Option<Self::Output> {
-        if sink.is_empty() {
-            None
-        } else {
-            Some(std::mem::take(sink))
-        }
-    }
-}
-
-/// Reference join: all pairs with equal source, times joined, diffs multiplied.
-pub fn naive_join<T: Timestamp + Lattice + Ord>(
-    a: &[(Edge, T, Diff)],
-    b: &[(Edge, T, Diff)],
-) -> Vec<((Edge, Edge), T, Diff)> {
-    let mut out = Vec::new();
-    for (e0, t0, r0) in a {
-        for (e1, t1, r1) in b {
-            if e0.0 == e1.0 {
-                out.push(((*e0, *e1), t0.join(t1), r0 * r1));
-            }
-        }
-    }
-    consolidate_updates(&mut out);
-    out
-}
-
-// -------------------------------------------------------------- reduce backend
-
-/// Counts edges per source: the output value for source `s` is `(s, count)`.
-pub struct EdgeReduceBackend<T> {
-    /// Groups per window; tiny in tests to force many windows.
-    pub window: usize,
-    // Session state, bracketed by `begin`/`finish`.
-    tiles: Vec<Description<T>>,
-    emitted: Vec<Vec<(Edge, T, Diff)>>,
-    pos_source: Vec<usize>,
-    pos_input: Vec<usize>,
-    pos_output: Vec<usize>,
-    pend_idx: usize,
-}
-
-impl<T> EdgeReduceBackend<T> {
-    pub fn new(window: usize) -> Self {
-        EdgeReduceBackend {
-            window,
-            tiles: Vec::new(),
-            emitted: Vec::new(),
-            pos_source: Vec::new(),
-            pos_input: Vec::new(),
-            pos_output: Vec::new(),
-            pend_idx: 0,
-        }
-    }
-}
-
-impl<T: Timestamp + Lattice + Ord> ProxyReduceBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeReduceBackend<T> {
-    type Group = u32;
-    type Token = Edge;
-    type RIn = Diff;
-    type ROut = Diff;
-
-    fn begin(&mut self, tiles: &[Description<T>]) {
-        self.tiles = tiles.to_vec();
-        self.emitted = vec![Vec::new(); tiles.len()];
-        self.pos_source.clear();
-        self.pos_input.clear();
-        self.pos_output.clear();
-        self.pend_idx = 0;
-    }
-
-    fn next_window(
-        &mut self,
-        instance: &ReduceInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
-        pending: &[u32],
-        reuse: Option<ReduceWindow<u32, Edge, T, Diff, Diff>>,
-    ) -> Option<ReduceWindow<u32, Edge, T, Diff, Diff>> {
-        self.pos_source.resize(instance.source_batches.len(), 0);
-        self.pos_input.resize(instance.input_batches.len(), 0);
-        self.pos_output.resize(instance.output_batches.len(), 0);
-        // Reclaim the spent window's buffer capacity.
-        let (mut keys, mut seeds, mut input, mut output) = match reuse {
-            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
-                keys.clear();
-                seeds.clear();
-                input.clear();
-                output.clear();
-                (keys, seeds, input, output)
-            }
-            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
-        };
-        while keys.len() < self.window {
-            let g = [
-                next_group(instance.source_batches, &self.pos_source),
-                next_group(instance.input_batches, &self.pos_input),
-                next_group(instance.output_batches, &self.pos_output),
-                pending.get(self.pend_idx).copied(),
-            ]
-            .into_iter()
-            .flatten()
-            .min();
-            let Some(g) = g else { break };
-            keys.push(g);
-            if pending.get(self.pend_idx) == Some(&g) {
-                self.pend_idx += 1;
-            }
-            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
-                // Novel batches also seed interesting times, with their own (raw) times.
-                seeds.push((g, t.clone()));
-                input.push(((g, e), advance(t, instance.lower), r));
-            });
-            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
-                output.push(((g, e), advance(t, instance.lower), r));
-            });
-        }
-        if keys.is_empty() {
-            return None;
-        }
-        consolidate_updates(&mut input);
-        consolidate_updates(&mut output);
-        seeds.sort();
-        seeds.dedup();
-        Some(ReduceWindow { keys, seeds, input, output })
-    }
-
-    fn reduce_corrections(
-        &mut self,
-        keys: &[u32],
-        in_ends: &[usize],
-        input: &[(Edge, Diff)],
-        out_ends: &[usize],
-        output: &[(Edge, Diff)],
-    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
-        let mut corr = Vec::new();
-        let mut ends = Vec::new();
-        let (mut i0, mut o0) = (0, 0);
-        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
-            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
-            assert!(count >= 0, "edge count went negative");
-            // Desired output, minus the tentative output, consolidated.
-            let mut delta: Vec<(Edge, Diff)> = Vec::new();
-            if count > 0 {
-                delta.push(((*k, count as u32), 1));
-            }
-            for (v, d) in &output[o0..o1] {
-                delta.push((*v, -d));
-            }
-            consolidate(&mut delta);
-            corr.extend(delta);
-            ends.push(corr.len());
-            i0 = i1;
-            o0 = o1;
-        }
-        (corr, ends)
-    }
-
-    fn emit(&mut self, tile: usize, records: &[((u32, Edge), T, Diff)]) {
-        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, t.clone(), *r)));
-    }
-
-    fn finish(&mut self) -> Vec<EdgeBatch<T>> {
-        self.tiles
-            .drain(..)
-            .zip(self.emitted.drain(..))
-            .map(|(desc, mut updates)| {
-                consolidate_updates(&mut updates);
-                EdgeBatch { updates, description: desc }
-            })
-            .collect()
-    }
-}
-
-/// Accumulate `updates` at times less-or-equal `t` (the partial order's `less_equal`).
-pub fn accumulate<T: Timestamp + Lattice>(
-    updates: impl Iterator<Item = (Edge, T, Diff)>,
-    t: &T,
-) -> Vec<(Edge, Diff)> {
-    let mut acc: Vec<(Edge, Diff)> = updates
-        .filter(|(_, ut, _)| ut.less_equal(t))
-        .map(|(e, _, r)| (e, r))
-        .collect();
-    consolidate(&mut acc);
-    acc
-}
-
-/// The `Pair` partially ordered timestamp (product order on two coordinates).
-pub mod pair {
-
-    #[derive(Hash, Default, Clone, Copy, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
-    pub struct Pair<S, T> { pub first: S, pub second: T }
-
-    impl<S, T> Pair<S, T> {
-        pub fn new(first: S, second: T) -> Self { Pair { first, second } }
-    }
-
-    use timely::order::PartialOrder;
-    impl<S: PartialOrder, T: PartialOrder> PartialOrder for Pair<S, T> {
-        fn less_equal(&self, other: &Self) -> bool {
-            self.first.less_equal(&other.first) && self.second.less_equal(&other.second)
-        }
-    }
-
-    use timely::progress::timestamp::Refines;
-    impl<S: Timestamp, T: Timestamp> Refines<()> for Pair<S, T> {
-        fn to_inner(_outer: ()) -> Self { Self::minimum() }
-        fn to_outer(self) {}
-        fn summarize(_summary: <Self>::Summary) {}
-    }
-
-    use timely::progress::PathSummary;
-    impl<S: Timestamp, T: Timestamp> PathSummary<Pair<S, T>> for () {
-        fn results_in(&self, timestamp: &Pair<S, T>) -> Option<Pair<S, T>> { Some(timestamp.clone()) }
-        fn followed_by(&self, other: &Self) -> Option<Self> { Some(*other) }
-    }
-
-    use timely::progress::Timestamp;
-    impl<S: Timestamp, T: Timestamp> Timestamp for Pair<S, T> {
-        fn minimum() -> Self { Pair { first: S::minimum(), second: T::minimum() } }
-        type Summary = ();
-    }
-
-    use differential_dataflow::lattice::Lattice;
-    impl<S: Lattice, T: Lattice> Lattice for Pair<S, T> {
-        fn join(&self, other: &Self) -> Self {
-            Pair { first: self.first.join(&other.first), second: self.second.join(&other.second) }
-        }
-        fn meet(&self, other: &Self) -> Self {
-            Pair { first: self.first.meet(&other.first), second: self.second.meet(&other.second) }
-        }
-    }
-
-    use serde::{Deserialize, Serialize};
-    use std::fmt::{Debug, Error, Formatter};
-    impl<TOuter: Debug, TInner: Debug> Debug for Pair<TOuter, TInner> {
-        fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
-            f.write_str(&format!("({:?}, {:?})", self.first, self.second))
-        }
-    }
-}
diff --git a/differential-dataflow/tests/int_proxy.rs b/differential-dataflow/tests/int_proxy.rs
new file mode 100644
index 000000000..ce89b35c2
--- /dev/null
+++ b/differential-dataflow/tests/int_proxy.rs
@@ -0,0 +1,821 @@
+//! Property tests for the proxy tactics, against a value-token edge backend.
+//!
+//! Every test here checks a general property against an oracle, not current
+//! behavior: join against a naive nested-loop join; reduce against exact
+//! per-time counting (including a randomized differential test); the pending
+//! contract against a partial-order grid; and unit isolation under interleaved
+//! draining (which pinned a real bug). The scaffold is the value-token
+//! instantiation from the seam design: `Group = src` exact, token = the edge.
+
+use std::collections::BTreeMap;
+
+use timely::progress::Antichain;
+
+use differential_dataflow::consolidation::consolidate_updates;
+use differential_dataflow::operators::int_proxy::{ProxyJoinTactic, ProxyReduceTactic};
+use differential_dataflow::operators::join::{Fresh, JoinTactic};
+use differential_dataflow::operators::reduce::ReduceTactic;
+
+use pair::Pair;
+
+type Time = u64;
+type GraphBatch = EdgeBatch<Time>;
+
+// ------------------------------------------------------------------- scaffold
+
+
+use timely::progress::frontier::AntichainRef;
+use timely::progress::Timestamp;
+
+use differential_dataflow::consolidation::consolidate;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::operators::int_proxy::{
+    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyReduceBackend, ReduceInstance,
+    ReduceWindow,
+};
+use differential_dataflow::trace::{BatchReader, Description};
+
+pub type Edge = (u32, u32);
+pub type Diff = isize;
+
+/// A batch of edge updates, sorted and consolidated, `G = src` exact.
+#[derive(Clone)]
+pub struct EdgeBatch<T> {
+    pub updates: Vec<(Edge, T, Diff)>,
+    pub description: Description<T>,
+}
+
+impl<T: Timestamp + Lattice> BatchReader for EdgeBatch<T> {
+    type Time = T;
+    fn len(&self) -> usize { self.updates.len() }
+    fn description(&self) -> &Description<T> { &self.description }
+}
+
+/// Sort, consolidate, and wrap updates as a batch describing `[lower, upper)`.
+pub fn batch<T: Timestamp + Lattice + Ord>(updates: Vec<(Edge, T, Diff)>, lower: T, upper: T) -> EdgeBatch<T> {
+    batch_frontiers(updates, Antichain::from_elem(lower), Antichain::from_elem(upper))
+}
+
+/// As [`batch`], with antichain frontiers for partially ordered intervals.
+pub fn batch_frontiers<T: Timestamp + Lattice + Ord>(
+    mut updates: Vec<(Edge, T, Diff)>,
+    lower: Antichain<T>,
+    upper: Antichain<T>,
+) -> EdgeBatch<T> {
+    consolidate_updates(&mut updates);
+    EdgeBatch {
+        updates,
+        description: Description::new(lower, upper, Antichain::from_elem(T::minimum())),
+    }
+}
+
+/// Advance a time to the compaction frontier (join against its elements).
+pub fn advance<T: Lattice + Clone>(t: T, lower: AntichainRef<'_, T>) -> T {
+    lower.iter().fold(t, |t, l| t.join(l))
+}
+
+/// The next group at or after the per-batch positions `pos` into `batches`.
+///
+/// Test-grade: rescans every batch head per group. A real backend should k-way merge
+/// with a heap over batch cursors.
+pub fn next_group<T>(batches: &[EdgeBatch<T>], pos: &[usize]) -> Option<u32> {
+    batches
+        .iter()
+        .zip(pos.iter())
+        .filter_map(|(b, &p)| b.updates.get(p).map(|u| u.0 .0))
+        .min()
+}
+
+/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`.
+pub fn drain_group<T: Clone>(
+    batches: &[EdgeBatch<T>],
+    pos: &mut [usize],
+    g: u32,
+    mut logic: impl FnMut(Edge, T, Diff),
+) {
+    for (b, p) in batches.iter().zip(pos.iter_mut()) {
+        while *p < b.updates.len() && b.updates[*p].0 .0 == g {
+            let (edge, ref t, r) = b.updates[*p];
+            logic(edge, t.clone(), r);
+            *p += 1;
+        }
+    }
+}
+
+// ---------------------------------------------------------------- join backend
+
+/// Per-unit resumption: a position per batch per side. This is the state a single
+/// `usize` could not carry — the finding that motivated `type Cursor`.
+#[derive(Default)]
+pub struct EdgeJoinCursor {
+    pub pos0: Vec<usize>,
+    pub pos1: Vec<usize>,
+}
+
+pub struct EdgeJoinBackend {
+    /// Groups per window; tiny in tests to force many windows.
+    pub window: usize,
+    /// Matches per output container; tiny in tests to force many containers.
+    pub target: usize,
+}
+
+impl EdgeJoinBackend {
+    pub fn new(window: usize) -> Self {
+        EdgeJoinBackend { window, target: 8 }
+    }
+}
+
+impl<T: Timestamp + Lattice + Ord> ProxyJoinBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeJoinBackend {
+    type Group = u32;
+    type Token0 = Edge;
+    type Token1 = Edge;
+    type R0 = Diff;
+    type R1 = Diff;
+    type ROut = Diff;
+    /// Matched edge pairs with their joined time and multiplied diff.
+    type Output = Vec<(Edge, Edge, T, Diff)>;
+    type Cursor = EdgeJoinCursor;
+    type Sink = Vec<(Edge, Edge, T, Diff)>;
+
+    fn next_window(
+        &mut self,
+        instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        fresh: Fresh,
+        cursor: &mut EdgeJoinCursor,
+        reuse: Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>>,
+    ) -> Option<JoinWindow<u32, Edge, Edge, T, Diff, Diff>> {
+        cursor.pos0.resize(instance.batches0.len(), 0);
+        cursor.pos1.resize(instance.batches1.len(), 0);
+        // Drive by the fresh side's groups: the accumulated side's other groups are
+        // skipped, never presented (O(fresh) presentations; empty fresh side is free).
+        let (fresh_b, other_b) = match fresh {
+            Fresh::Input0 => (instance.batches0, instance.batches1),
+            Fresh::Input1 => (instance.batches1, instance.batches0),
+        };
+        // Reclaim the spent window's bridge capacity.
+        // Route each reclaimed vec back to the side it served, so capacities stay
+        // side-stable rather than alternating duties across round trips.
+        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
+            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
+            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
+            (None, _) => (Vec::new(), Vec::new()),
+        };
+        loop {
+            fresh_run.clear();
+            other_run.clear();
+            let mut groups = 0;
+            while groups < self.window {
+                let (fresh_pos, other_pos) = match fresh {
+                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
+                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
+                };
+                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
+                groups += 1;
+                drain_group(fresh_b, fresh_pos, g, |e, t, r| {
+                    fresh_run.push(((g, e), advance(t, instance.lower), r));
+                });
+                // Skip the accumulated side below `g`, then drain its matching group.
+                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
+                    while *p < b.updates.len() && b.updates[*p].0 .0 < g {
+                        *p += 1;
+                    }
+                }
+                drain_group(other_b, other_pos, g, |e, t, r| {
+                    other_run.push(((g, e), advance(t, instance.lower), r));
+                });
+            }
+            if groups == 0 {
+                return None;
+            }
+            consolidate_updates(&mut fresh_run);
+            consolidate_updates(&mut other_run);
+            // A fully-cancelled quota presents nothing; keep going rather than emit an
+            // empty window (the harness's progress guard forbids those).
+            if fresh_run.is_empty() && other_run.is_empty() {
+                continue;
+            }
+            let (input0, input1) = match fresh {
+                Fresh::Input0 => (fresh_run, other_run),
+                Fresh::Input1 => (other_run, fresh_run),
+            };
+            return Some(JoinWindow { input0, input1 });
+        }
+    }
+
+    fn absorb(
+        &mut self,
+        _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        sink: &mut Self::Sink,
+        left: (u32, Edge),
+        right: (u32, Edge),
+        time: T,
+        diff: Diff,
+    ) -> Option<Self::Output> {
+        // Self-redeeming tokens: the output is built from the tokens alone.
+        sink.push((left.1, right.1, time, diff));
+        if sink.len() >= self.target {
+            Some(std::mem::take(sink))
+        } else {
+            None
+        }
+    }
+
+    fn flush(&mut self, _instance: &JoinInstance<'_, EdgeBatch<T>, EdgeBatch<T>>, sink: &mut Self::Sink) -> Option<Self::Output> {
+        if sink.is_empty() {
+            None
+        } else {
+            Some(std::mem::take(sink))
+        }
+    }
+}
+
+/// Reference join: all pairs with equal source, times joined, diffs multiplied.
+pub fn naive_join<T: Timestamp + Lattice + Ord>(
+    a: &[(Edge, T, Diff)],
+    b: &[(Edge, T, Diff)],
+) -> Vec<((Edge, Edge), T, Diff)> {
+    let mut out = Vec::new();
+    for (e0, t0, r0) in a {
+        for (e1, t1, r1) in b {
+            if e0.0 == e1.0 {
+                out.push(((*e0, *e1), t0.join(t1), r0 * r1));
+            }
+        }
+    }
+    consolidate_updates(&mut out);
+    out
+}
+
+// -------------------------------------------------------------- reduce backend
+
+/// Counts edges per source: the output value for source `s` is `(s, count)`.
+pub struct EdgeReduceBackend<T> {
+    /// Groups per window; tiny in tests to force many windows.
+    pub window: usize,
+    // Session state, bracketed by `begin`/`finish`.
+    tiles: Vec<Description<T>>,
+    emitted: Vec<Vec<(Edge, T, Diff)>>,
+    pos_source: Vec<usize>,
+    pos_input: Vec<usize>,
+    pos_output: Vec<usize>,
+    pend_idx: usize,
+}
+
+impl<T> EdgeReduceBackend<T> {
+    pub fn new(window: usize) -> Self {
+        EdgeReduceBackend {
+            window,
+            tiles: Vec::new(),
+            emitted: Vec::new(),
+            pos_source: Vec::new(),
+            pos_input: Vec::new(),
+            pos_output: Vec::new(),
+            pend_idx: 0,
+        }
+    }
+}
+
+impl<T: Timestamp + Lattice + Ord> ProxyReduceBackend<EdgeBatch<T>, EdgeBatch<T>> for EdgeReduceBackend<T> {
+    type Group = u32;
+    type Token = Edge;
+    type RIn = Diff;
+    type ROut = Diff;
+
+    fn begin(&mut self, tiles: &[Description<T>]) {
+        self.tiles = tiles.to_vec();
+        self.emitted = vec![Vec::new(); tiles.len()];
+        self.pos_source.clear();
+        self.pos_input.clear();
+        self.pos_output.clear();
+        self.pend_idx = 0;
+    }
+
+    fn next_window(
+        &mut self,
+        instance: &ReduceInstance<'_, EdgeBatch<T>, EdgeBatch<T>>,
+        pending: &[u32],
+        reuse: Option<ReduceWindow<u32, Edge, T, Diff, Diff>>,
+    ) -> Option<ReduceWindow<u32, Edge, T, Diff, Diff>> {
+        self.pos_source.resize(instance.source_batches.len(), 0);
+        self.pos_input.resize(instance.input_batches.len(), 0);
+        self.pos_output.resize(instance.output_batches.len(), 0);
+        // Reclaim the spent window's buffer capacity.
+        let (mut keys, mut seeds, mut input, mut output) = match reuse {
+            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
+                keys.clear();
+                seeds.clear();
+                input.clear();
+                output.clear();
+                (keys, seeds, input, output)
+            }
+            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
+        };
+        while keys.len() < self.window {
+            let g = [
+                next_group(instance.source_batches, &self.pos_source),
+                next_group(instance.input_batches, &self.pos_input),
+                next_group(instance.output_batches, &self.pos_output),
+                pending.get(self.pend_idx).copied(),
+            ]
+            .into_iter()
+            .flatten()
+            .min();
+            let Some(g) = g else { break };
+            keys.push(g);
+            if pending.get(self.pend_idx) == Some(&g) {
+                self.pend_idx += 1;
+            }
+            drain_group(instance.source_batches, &mut self.pos_source, g, |e, t, r| {
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.input_batches, &mut self.pos_input, g, |e, t, r| {
+                // Novel batches also seed interesting times, with their own (raw) times.
+                seeds.push((g, t.clone()));
+                input.push(((g, e), advance(t, instance.lower), r));
+            });
+            drain_group(instance.output_batches, &mut self.pos_output, g, |e, t, r| {
+                output.push(((g, e), advance(t, instance.lower), r));
+            });
+        }
+        if keys.is_empty() {
+            return None;
+        }
+        consolidate_updates(&mut input);
+        consolidate_updates(&mut output);
+        seeds.sort();
+        seeds.dedup();
+        Some(ReduceWindow { keys, seeds, input, output })
+    }
+
+    fn reduce_corrections(
+        &mut self,
+        keys: &[u32],
+        in_ends: &[usize],
+        input: &[(Edge, Diff)],
+        out_ends: &[usize],
+        output: &[(Edge, Diff)],
+    ) -> (Vec<(Edge, Diff)>, Vec<usize>) {
+        let mut corr = Vec::new();
+        let mut ends = Vec::new();
+        let (mut i0, mut o0) = (0, 0);
+        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
+            let count: Diff = input[i0..i1].iter().map(|(_, d)| d).sum();
+            assert!(count >= 0, "edge count went negative");
+            // Desired output, minus the tentative output, consolidated.
+            let mut delta: Vec<(Edge, Diff)> = Vec::new();
+            if count > 0 {
+                delta.push(((*k, count as u32), 1));
+            }
+            for (v, d) in &output[o0..o1] {
+                delta.push((*v, -d));
+            }
+            consolidate(&mut delta);
+            corr.extend(delta);
+            ends.push(corr.len());
+            i0 = i1;
+            o0 = o1;
+        }
+        (corr, ends)
+    }
+
+    fn emit(&mut self, tile: usize, records: &[((u32, Edge), T, Diff)]) {
+        self.emitted[tile].extend(records.iter().map(|((_g, e), t, r)| (*e, t.clone(), *r)));
+    }
+
+    fn finish(&mut self) -> Vec<EdgeBatch<T>> {
+        self.tiles
+            .drain(..)
+            .zip(self.emitted.drain(..))
+            .map(|(desc, mut updates)| {
+                consolidate_updates(&mut updates);
+                EdgeBatch { updates, description: desc }
+            })
+            .collect()
+    }
+}
+
+/// Accumulate `updates` at times less-or-equal `t` (the partial order's `less_equal`).
+pub fn accumulate<T: Timestamp + Lattice>(
+    updates: impl Iterator<Item = (Edge, T, Diff)>,
+    t: &T,
+) -> Vec<(Edge, Diff)> {
+    let mut acc: Vec<(Edge, Diff)> = updates
+        .filter(|(_, ut, _)| ut.less_equal(t))
+        .map(|(e, _, r)| (e, r))
+        .collect();
+    consolidate(&mut acc);
+    acc
+}
+
+/// The `Pair` partially ordered timestamp (product order on two coordinates).
+pub mod pair {
+
+    #[derive(Hash, Default, Clone, Copy, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
+    pub struct Pair<S, T> { pub first: S, pub second: T }
+
+    impl<S, T> Pair<S, T> {
+        pub fn new(first: S, second: T) -> Self { Pair { first, second } }
+    }
+
+    use timely::order::PartialOrder;
+    impl<S: PartialOrder, T: PartialOrder> PartialOrder for Pair<S, T> {
+        fn less_equal(&self, other: &Self) -> bool {
+            self.first.less_equal(&other.first) && self.second.less_equal(&other.second)
+        }
+    }
+
+    use timely::progress::timestamp::Refines;
+    impl<S: Timestamp, T: Timestamp> Refines<()> for Pair<S, T> {
+        fn to_inner(_outer: ()) -> Self { Self::minimum() }
+        fn to_outer(self) {}
+        fn summarize(_summary: <Self>::Summary) {}
+    }
+
+    use timely::progress::PathSummary;
+    impl<S: Timestamp, T: Timestamp> PathSummary<Pair<S, T>> for () {
+        fn results_in(&self, timestamp: &Pair<S, T>) -> Option<Pair<S, T>> { Some(timestamp.clone()) }
+        fn followed_by(&self, other: &Self) -> Option<Self> { Some(*other) }
+    }
+
+    use timely::progress::Timestamp;
+    impl<S: Timestamp, T: Timestamp> Timestamp for Pair<S, T> {
+        fn minimum() -> Self { Pair { first: S::minimum(), second: T::minimum() } }
+        type Summary = ();
+    }
+
+    use differential_dataflow::lattice::Lattice;
+    impl<S: Lattice, T: Lattice> Lattice for Pair<S, T> {
+        fn join(&self, other: &Self) -> Self {
+            Pair { first: self.first.join(&other.first), second: self.second.join(&other.second) }
+        }
+        fn meet(&self, other: &Self) -> Self {
+            Pair { first: self.first.meet(&other.first), second: self.second.meet(&other.second) }
+        }
+    }
+
+    use serde::{Deserialize, Serialize};
+    use std::fmt::{Debug, Error, Formatter};
+    impl<TOuter: Debug, TInner: Debug> Debug for Pair<TOuter, TInner> {
+        fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
+            f.write_str(&format!("({:?}, {:?})", self.first, self.second))
+        }
+    }
+}
+
+// ----------------------------------------------------------------- the tests
+
+
+#[test]
+fn join_matches_naive() {
+    // Edges spread over several groups, several batches per side, including a
+    // retraction; window size 1 forces one group per window.
+    let a0 = batch(vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((3, 9), 2, 1)], 0, 3);
+    let a1 = batch(vec![((0, 2), 2, -1), ((2, 4), 2, 1)], 0, 3);
+    let b0 = batch(vec![((0, 7), 1, 1), ((1, 8), 2, 1), ((2, 6), 0, 1)], 0, 3);
+    let b1 = batch(vec![((1, 8), 2, 1), ((4, 4), 0, 1)], 0, 3);
+
+    let all_a: Vec<_> = a0.updates.iter().chain(&a1.updates).cloned().collect();
+    let all_b: Vec<_> = b0.updates.iter().chain(&b1.updates).cloned().collect();
+    let expected = naive_join(&all_a, &all_b);
+
+    for window in [1, 2, 100] {
+        for fresh in [Fresh::Input0, Fresh::Input1] {
+            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(window));
+            let work = tactic.prep(
+                vec![a0.clone(), a1.clone()],
+                vec![b0.clone(), b1.clone()],
+                fresh,
+                0,
+            );
+            let mut got: Vec<((Edge, Edge), Time, Diff)> = work
+                .flatten()
+                .map(|(l, r, t, d)| ((l, r), t, d))
+                .collect();
+            consolidate_updates(&mut got);
+            assert_eq!(got, expected, "window={window}");
+        }
+    }
+}
+
+#[test]
+fn interleaved_units_share_backend() {
+    // Two units prepped from one tactic and drained alternately: the scenario that
+    // motivated per-unit `Cursor` state and the shared `Rc<RefCell>` backend — the
+    // driver holds half-drained units from both queues and polls them under fuel.
+    let a = vec![
+        batch(vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((0, 3), 1, 1), ((1, 5), 0, 1), ((2, 2), 1, 1)], 0, 2),
+        batch(vec![((3, 3), 1, 1)], 0, 2),
+    ];
+    let b = vec![batch(vec![((0, 7), 1, 1), ((2, 6), 0, 1), ((3, 8), 1, 1)], 0, 2)];
+    let c = vec![batch(vec![((5, 1), 0, 1), ((6, 2), 0, 1)], 0, 2)];
+    let d = vec![
+        batch(vec![((5, 9), 1, 1), ((6, 4), 0, 1)], 0, 2),
+        batch(vec![((5, 9), 1, 1)], 0, 2),
+    ];
+
+    let all = |bs: &[GraphBatch]| bs.iter().flat_map(|b| b.updates.iter().cloned()).collect::<Vec<_>>();
+    let expected1 = naive_join(&all(&a), &all(&b));
+    let expected2 = naive_join(&all(&c), &all(&d));
+
+    // target = 2 with a 3-match key (key 0): unit 1 yields a full container and PAUSES
+    // holding one staged match, then unit 2 absorbs against the same shared backend.
+    // Staging must be unit-owned (`Sink`): with a shared buffer — the bug shape this
+    // test pins — unit 1's held match ships inside unit 2's next container, under
+    // unit 2's capability. target = 1 would NOT catch this (staging empty at every
+    // yield); the straddling partial container is the point.
+    let mut backend = EdgeJoinBackend::new(1);
+    backend.target = 2;
+    let mut tactic = ProxyJoinTactic::new(backend);
+    let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
+    let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
+    let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
+    let mut got2: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
+    let (mut done1, mut done2) = (false, false);
+    while !done1 || !done2 {
+        if !done1 {
+            match u1.next() {
+                Some(out) => got1.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
+                None => done1 = true,
+            }
+        }
+        if !done2 {
+            match u2.next() {
+                Some(out) => got2.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
+                None => done2 = true,
+            }
+        }
+    }
+    consolidate_updates(&mut got1);
+    consolidate_updates(&mut got2);
+    assert_eq!(got1, expected1);
+    assert_eq!(got2, expected2);
+}
+
+#[test]
+fn reduce_fuzz_matches_oracle() {
+    // Deterministic randomized differential test: random updates over a small key
+    // space, random times within each round's interval (so rounds mix fast-path
+    // keys — one distinct time — with slow-path keys), random retractions of live
+    // edges, several window sizes. The oracle is exact per-time counting.
+    let mut state = 0x853c49e6748fea9bu64;
+    let mut rng = move || {
+        state = state.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+        (state >> 33) as u32
+    };
+
+    for window in [1, 3, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+        let mut live: Vec<Edge> = Vec::new();
+        const ROUNDS: u64 = 8;
+        const WIDTH: u64 = 3;
+        for round in 0..ROUNDS {
+            let lo = round * WIDTH;
+            let hi = lo + WIDTH;
+            let mut updates: Vec<(Edge, Time, Diff)> = Vec::new();
+            // Retract only edges from PRIOR rounds (any time this round is at or after
+            // their insertion, keeping every prefix accumulation non-negative); this
+            // round's insertions join `live` only at round end.
+            let mut fresh: Vec<Edge> = Vec::new();
+            for _ in 0..40 {
+                let t = lo + (rng() as u64) % WIDTH;
+                if !live.is_empty() && rng() % 4 == 0 {
+                    let e = live[(rng() as usize) % live.len()];
+                    live.retain(|x| *x != e);
+                    updates.push((e, t, -1));
+                } else {
+                    let e = (rng() % 16, rng() % 64);
+                    fresh.push(e);
+                    updates.push((e, t, 1));
+                }
+            }
+            live.append(&mut fresh);
+            let input = batch(updates, lo, hi);
+            let lower = Antichain::from_elem(lo);
+            let upper = Antichain::from_elem(hi);
+            let held = Antichain::from_elem(lo);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+            for t in lo..hi {
+                assert_counts(&source, &outputs, t, &format!("fuzz window={window} round={round}"));
+            }
+        }
+    }
+}
+
+/// Per-time count oracle shared by the reduce tests.
+fn assert_counts(source: &[GraphBatch], outputs: &[GraphBatch], t: Time, label: &str) {
+    let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+    let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
+    for ((src, _dst), d) in &input_acc {
+        *counts.entry(*src).or_insert(0) += d;
+    }
+    let mut expected: Vec<(Edge, Diff)> = Vec::new();
+    for (src, c) in counts {
+        assert!(c >= 0);
+        if c > 0 {
+            expected.push(((src, c as u32), 1));
+        }
+    }
+    let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+    assert_eq!(got, expected, "{label} at time={t}");
+}
+
+#[test]
+fn reduce_multitime_rounds() {
+    // Intervals of width two, two distinct times per batch: under total order this
+    // exercises the slow (discovery) path even with the single-moment fast path in
+    // place — a key with two distinct seed times cannot take it — and mixes fast
+    // and slow keys within one window.
+    let rounds: Vec<(Vec<(Edge, Time, Diff)>, Time, Time)> = vec![
+        (vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((1, 6), 1, 1)], 0, 2),
+        (vec![((0, 3), 2, 1), ((1, 5), 3, -1), ((2, 7), 2, 1), ((2, 8), 3, 1)], 2, 4),
+    ];
+    for window in [1, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+        for (updates, lo, hi) in rounds.iter() {
+            let input = batch(updates.clone(), *lo, *hi);
+            let lower = Antichain::from_elem(*lo);
+            let upper = Antichain::from_elem(*hi);
+            let held = Antichain::from_elem(*lo);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+        }
+        for t in 0..4u64 {
+            assert_counts(&source, &outputs, t, &format!("multitime window={window}"));
+        }
+    }
+}
+
+#[test]
+fn reduce_counts_match_naive() {
+    // Rounds of edge updates, including deletions that drop a source's count to zero
+    // (full retraction) and change another's (correction).
+    let rounds: Vec<Vec<(Edge, Time, Diff)>> = vec![
+        vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((1, 5), 0, 1)],
+        vec![((0, 3), 1, 1), ((2, 7), 1, 1), ((1, 5), 1, -1)],
+        vec![((2, 8), 2, 1), ((0, 2), 2, -1), ((3, 4), 2, 1)],
+    ];
+
+    for window in [1, 2, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+        let mut source: Vec<GraphBatch> = Vec::new();
+        let mut outputs: Vec<GraphBatch> = Vec::new();
+
+        for (r, updates) in rounds.iter().enumerate() {
+            let r = r as Time;
+            let input = batch(updates.clone(), r, r + 1);
+            let lower = Antichain::from_elem(r);
+            let upper = Antichain::from_elem(r + 1);
+            let held = Antichain::from_elem(r);
+            let (produced, frontier) = tactic.retire(
+                source.clone(),
+                outputs.clone(),
+                vec![input.clone()],
+                &lower,
+                &upper,
+                &held,
+            );
+            assert!(frontier.is_empty(), "total order should defer nothing");
+            for (time, b) in produced {
+                assert!(held.elements().contains(&time));
+                outputs.push(b);
+            }
+            source.push(input);
+        }
+
+        // Oracle: at each round boundary, the accumulated output is exactly the
+        // per-source counts of the accumulated input.
+        for t in 0..rounds.len() as Time {
+            let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+            let mut expected: Vec<(Edge, Diff)> = Vec::new();
+            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
+            for ((src, _dst), d) in &input_acc {
+                *counts.entry(*src).or_insert(0) += d;
+            }
+            for (src, c) in counts {
+                assert!(c >= 0);
+                if c > 0 {
+                    expected.push(((src, c as u32), 1));
+                }
+            }
+            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
+            assert_eq!(got, expected, "window={window} at time={t}");
+        }
+    }
+}
+
+// ---------------------------------------------------- partial order (pending)
+
+type PTime = Pair<u64, u64>;
+
+fn t(a: u64, b: u64) -> PTime {
+    Pair::new(a, b)
+}
+
+#[test]
+fn pending_times_carry_across_retires() {
+    // Key 7 receives updates at incomparable times in round A; key 3 receives novel
+    // input only in round B, so round B's windows must merge a pending-only group
+    // (7) with a novel-only group (3), in group order, at window size 1.
+    for window in [1, 2, 100] {
+        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
+
+        // Round A: interval [ {(0,0)}, {(1,1)} ), capability held at (0,0).
+        let input_a = batch_frontiers(
+            vec![((7, 100), t(0, 1), 1), ((7, 200), t(1, 0), 1)],
+            Antichain::from_elem(t(0, 0)),
+            Antichain::from_elem(t(1, 1)),
+        );
+        let lower = Antichain::from_elem(t(0, 0));
+        let upper = Antichain::from_elem(t(1, 1));
+        let held = Antichain::from_elem(t(0, 0));
+        let (produced_a, frontier_a) = tactic.retire(
+            Vec::new(),
+            Vec::new(),
+            vec![input_a.clone()],
+            &lower,
+            &upper,
+            &held,
+        );
+        // The joint interesting time (1,1) lies beyond upper: it must be deferred,
+        // and the returned frontier must hold it.
+        assert_eq!(frontier_a, Antichain::from_elem(t(1, 1)), "the join of incomparable updates must be pended");
+
+        let mut outputs: Vec<EdgeBatch<PTime>> = produced_a.into_iter().map(|(_, b)| b).collect();
+
+        // Round B: interval [ {(1,1)}, {(2,2)} ), capability held at (1,1). Novel
+        // input only for key 3; key 7 participates as a pending-only group.
+        let input_b = batch_frontiers(
+            vec![((3, 5), t(1, 1), 1)],
+            Antichain::from_elem(t(1, 1)),
+            Antichain::from_elem(t(2, 2)),
+        );
+        let lower = Antichain::from_elem(t(1, 1));
+        let upper = Antichain::from_elem(t(2, 2));
+        let held = Antichain::from_elem(t(1, 1));
+        let (produced_b, frontier_b) = tactic.retire(
+            vec![input_a.clone()],
+            outputs.clone(),
+            vec![input_b.clone()],
+            &lower,
+            &upper,
+            &held,
+        );
+        assert!(frontier_b.is_empty(), "nothing further to defer");
+        outputs.extend(produced_b.into_iter().map(|(_, b)| b));
+
+        // Oracle over a grid of times, using the partial order's less_equal: the
+        // accumulated output at t must be exactly the per-source counts of the
+        // accumulated input at t. At (1,1) this requires round B's correction to
+        // have collapsed the two partial counts of key 7 into one count of 2.
+        let inputs: Vec<(Edge, PTime, Diff)> = input_a
+            .updates
+            .iter()
+            .chain(&input_b.updates)
+            .cloned()
+            .collect();
+        for probe in [t(0, 0), t(0, 1), t(1, 0), t(1, 1), t(2, 1), t(2, 2)] {
+            let input_acc = accumulate(inputs.iter().cloned(), &probe);
+            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
+            for ((src, _dst), d) in &input_acc {
+                *counts.entry(*src).or_insert(0) += d;
+            }
+            let mut expected: Vec<(Edge, Diff)> = Vec::new();
+            for (src, c) in counts {
+                if c > 0 {
+                    expected.push(((src, c as u32), 1));
+                }
+            }
+            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &probe);
+            assert_eq!(got, expected, "window={window} at probe={probe:?}");
+        }
+    }
+}
diff --git a/differential-dataflow/tests/int_proxy_bytes.rs b/differential-dataflow/tests/int_proxy_bytes.rs
deleted file mode 100644
index 86084c2ef..000000000
--- a/differential-dataflow/tests/int_proxy_bytes.rs
+++ /dev/null
@@ -1,701 +0,0 @@
-//! Behavioral tests for the proxy tactics against a byte-rows backend.
-//!
-//! The compressing-token instantiation from the seam design, aimed at data as general
-//! as Materialize's `[u8]` rows of unknown size and shape. Rows are opaque byte strings;
-//! the grouping opinion extracts a key prefix (here: bytes before the first `b'|'`).
-//! Storage is columnar (concatenated bytes + bounds, aligned time/diff columns) with a
-//! **stored token column** `(G, I)` computed once at batch formation — presentation is
-//! a pure column read, never a re-hash. `G = hash(key)`, `I = hash(whole row)` (whole
-//! datum, so value confusion under a group collision needs a double collision).
-//!
-//! Rows are stored in token order — `((G, I), row, time)` — so equal-token rows are
-//! adjacent and batch formation doubles as T1 *value*-collision detection; join's
-//! `redeem` and reduce's key/row stashes re-check at redemption, the other T1 sites.
-//! *Group* collisions (distinct keys, equal `G`) are not errors under compression —
-//! they are **resolved** per the module contract: join's `absorb` re-checks real key
-//! bytes per match and drops false pairs; reduce partitions each granule by real key
-//! and reduces the parts separately. Weak-hash tests force both collision kinds: value collisions
-//! must panic at their detection site; group collisions must yield *correct output*.
-
-use std::collections::BTreeMap;
-
-use timely::progress::frontier::AntichainRef;
-use timely::progress::Antichain;
-
-use differential_dataflow::consolidation::{consolidate, consolidate_updates};
-use differential_dataflow::operators::int_proxy::{
-    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic, ProxyReduceBackend,
-    ProxyReduceTactic, ReduceInstance, ReduceWindow,
-};
-use differential_dataflow::operators::join::{Fresh, JoinTactic};
-use differential_dataflow::operators::reduce::ReduceTactic;
-use differential_dataflow::trace::{BatchReader, Description};
-
-type Time = u64;
-type Diff = isize;
-type Row = Vec<u8>;
-type Hasher = fn(&[u8]) -> u64;
-
-/// The grouping opinion: a row's key is its prefix before the first `b'|'`.
-fn key_of(row: &[u8]) -> &[u8] {
-    match row.iter().position(|b| *b == b'|') {
-        Some(p) => &row[..p],
-        None => row,
-    }
-}
-
-/// A real hash (SipHash via std).
-fn hash(bytes: &[u8]) -> u64 {
-    use std::hash::{Hash, Hasher};
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    bytes.hash(&mut h);
-    h.finish()
-}
-
-/// A deliberately terrible hash, to force collisions in tests.
-fn weak_hash(bytes: &[u8]) -> u64 {
-    hash(bytes) & 0x3
-}
-
-/// Weak for keys (which never contain `b'|'`), strong for whole rows (which always do):
-/// forces *group* collisions while value tokens stay distinct, so the resolution paths
-/// are exercised rather than the panic paths.
-fn weak_group_hash(bytes: &[u8]) -> u64 {
-    if bytes.contains(&b'|') { hash(bytes) } else { hash(bytes) & 0x3 }
-}
-
-/// A columnar batch of row updates: concatenated bytes with bounds, aligned time,
-/// diff, and token columns, in `((G, I), time)` order with row bytes as tiebreak.
-#[derive(Clone)]
-struct RowBatch {
-    data: Vec<u8>,
-    /// Row `i` is `data[bounds[i]..bounds[i + 1]]`; `bounds.len() == rows + 1`.
-    bounds: Vec<usize>,
-    times: Vec<Time>,
-    diffs: Vec<Diff>,
-    /// The stored token column: `(G, I)` per row, computed at formation.
-    tokens: Vec<(u64, u64)>,
-    description: Description<Time>,
-}
-
-impl BatchReader for RowBatch {
-    type Time = Time;
-    fn len(&self) -> usize { self.times.len() }
-    fn description(&self) -> &Description<Time> { &self.description }
-}
-
-impl RowBatch {
-    fn row(&self, i: usize) -> &[u8] {
-        &self.data[self.bounds[i]..self.bounds[i + 1]]
-    }
-
-    /// Form a batch: tokenize, sort + consolidate by `((G, I), row, time)` (the library's
-    /// `consolidate_updates`, so test batches agree with real DD consolidation), and check
-    /// formation-site T1 — equal tokens must carry equal bytes, which sorting makes adjacent.
-    fn form(updates: Vec<(Row, Time, Diff)>, lower: Time, upper: Time, hasher: Hasher) -> Self {
-        let mut tokenized: Vec<(((u64, u64), Row), Time, Diff)> = updates
-            .into_iter()
-            .map(|(row, t, r)| {
-                let g = hasher(key_of(&row));
-                let i = hasher(&row);
-                (((g, i), row), t, r)
-            })
-            .collect();
-        consolidate_updates(&mut tokenized);
-        for w in tokenized.windows(2) {
-            if w[0].0 .0 == w[1].0 .0 {
-                assert!(w[0].0 .1 == w[1].0 .1, "token collision detected at formation");
-            }
-        }
-        let formed: Vec<((u64, u64), Row, Time, Diff)> =
-            tokenized.into_iter().map(|((tok, row), t, r)| (tok, row, t, r)).collect();
-
-        let mut batch = RowBatch {
-            data: Vec::new(),
-            bounds: vec![0],
-            times: Vec::new(),
-            diffs: Vec::new(),
-            tokens: Vec::new(),
-            description: Description::new(
-                Antichain::from_elem(lower),
-                Antichain::from_elem(upper),
-                Antichain::from_elem(0),
-            ),
-        };
-        for (tok, row, t, r) in formed {
-            batch.data.extend_from_slice(&row);
-            batch.bounds.push(batch.data.len());
-            batch.times.push(t);
-            batch.diffs.push(r);
-            batch.tokens.push(tok);
-        }
-        batch
-    }
-}
-
-/// Advance a time to the compaction frontier (total order: max against its element).
-fn advance(t: Time, lower: AntichainRef<'_, Time>) -> Time {
-    lower.iter().fold(t, |t, l| std::cmp::max(t, *l))
-}
-
-/// The next group at or after the per-batch positions `pos` into `batches`.
-///
-/// Test-grade: rescans every batch head per group. A real backend should k-way merge
-/// with a heap over batch cursors.
-fn next_group(batches: &[RowBatch], pos: &[usize]) -> Option<u64> {
-    batches
-        .iter()
-        .zip(pos.iter())
-        .filter_map(|(b, &p)| b.tokens.get(p).map(|t| t.0))
-        .min()
-}
-
-/// Drain every update of group `g` from `batches` (advancing `pos`) into `logic`,
-/// straight off the columns — no hashing at presentation time.
-fn drain_group(
-    batches: &[RowBatch],
-    pos: &mut [usize],
-    g: u64,
-    mut logic: impl FnMut(&RowBatch, usize),
-) {
-    for (b, p) in batches.iter().zip(pos.iter_mut()) {
-        while *p < b.tokens.len() && b.tokens[*p].0 == g {
-            logic(b, *p);
-            *p += 1;
-        }
-    }
-}
-
-/// Redeem a token to its row bytes, checking redemption-site T1: every batch holding
-/// the token must agree on the bytes.
-///
-/// Test-grade: binary-searches every batch's token column per redeemed token. A real
-/// backend should redeem from a window-scoped stash harvested during presentation
-/// (as the reduce backend's `minted` demonstrates) rather than search the trace.
-fn redeem<'a>(batches: &'a [RowBatch], token: (u64, u64)) -> &'a [u8] {
-    let mut found: Option<&[u8]> = None;
-    for b in batches {
-        let lo = b.tokens.partition_point(|t| *t < token);
-        let hi = b.tokens.partition_point(|t| *t <= token);
-        for i in lo..hi {
-            match found {
-                None => found = Some(b.row(i)),
-                Some(prev) => assert!(prev == b.row(i), "token collision detected at redemption"),
-            }
-        }
-    }
-    found.expect("token redeemed but never presented")
-}
-
-// ---------------------------------------------------------------- join backend
-
-#[derive(Default)]
-struct RowJoinCursor {
-    pos0: Vec<usize>,
-    pos1: Vec<usize>,
-}
-
-struct RowJoinBackend {
-    /// Groups per window; tiny in tests to force many windows.
-    window: usize,
-    /// Matches per output container; tiny in tests to force many containers.
-    target: usize,
-}
-
-impl RowJoinBackend {
-    fn new(window: usize) -> Self {
-        RowJoinBackend { window, target: 8 }
-    }
-}
-
-impl ProxyJoinBackend<RowBatch, RowBatch> for RowJoinBackend {
-    type Group = u64;
-    type Token0 = u64;
-    type Token1 = u64;
-    type R0 = Diff;
-    type R1 = Diff;
-    type ROut = Diff;
-    /// Matched row pairs with their joined time and multiplied diff.
-    type Output = Vec<(Row, Row, Time, Diff)>;
-    type Cursor = RowJoinCursor;
-    type Sink = Vec<(Row, Row, Time, Diff)>;
-
-    fn next_window(
-        &mut self,
-        instance: &JoinInstance<'_, RowBatch, RowBatch>,
-        fresh: Fresh,
-        cursor: &mut RowJoinCursor,
-        reuse: Option<JoinWindow<u64, u64, u64, Time, Diff, Diff>>,
-    ) -> Option<JoinWindow<u64, u64, u64, Time, Diff, Diff>> {
-        cursor.pos0.resize(instance.batches0.len(), 0);
-        cursor.pos1.resize(instance.batches1.len(), 0);
-        // Drive by the fresh side's groups: the accumulated side's other groups are
-        // skipped, never presented (O(fresh) presentations; empty fresh side is free).
-        let (fresh_b, other_b) = match fresh {
-            Fresh::Input0 => (instance.batches0, instance.batches1),
-            Fresh::Input1 => (instance.batches1, instance.batches0),
-        };
-        // Reclaim the spent window's bridge capacity.
-        // Route each reclaimed vec back to the side it served, so capacities stay
-        // side-stable rather than alternating duties across round trips.
-        let (mut fresh_run, mut other_run) = match (reuse, fresh) {
-            (Some(JoinWindow { input0, input1 }), Fresh::Input0) => (input0, input1),
-            (Some(JoinWindow { input0, input1 }), Fresh::Input1) => (input1, input0),
-            (None, _) => (Vec::new(), Vec::new()),
-        };
-        loop {
-            fresh_run.clear();
-            other_run.clear();
-            let mut groups = 0;
-            while groups < self.window {
-                let (fresh_pos, other_pos) = match fresh {
-                    Fresh::Input0 => (&mut cursor.pos0, &mut cursor.pos1),
-                    Fresh::Input1 => (&mut cursor.pos1, &mut cursor.pos0),
-                };
-                let Some(g) = next_group(fresh_b, fresh_pos) else { break };
-                groups += 1;
-                drain_group(fresh_b, fresh_pos, g, |b, i| {
-                    fresh_run.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
-                });
-                for (b, p) in other_b.iter().zip(other_pos.iter_mut()) {
-                    while *p < b.tokens.len() && b.tokens[*p].0 < g {
-                        *p += 1;
-                    }
-                }
-                drain_group(other_b, other_pos, g, |b, i| {
-                    other_run.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
-                });
-            }
-            if groups == 0 {
-                return None;
-            }
-            consolidate_updates(&mut fresh_run);
-            consolidate_updates(&mut other_run);
-            // A fully-cancelled quota presents nothing; keep going rather than emit an
-            // empty window (the harness's progress guard forbids those).
-            if fresh_run.is_empty() && other_run.is_empty() {
-                continue;
-            }
-            let (input0, input1) = match fresh {
-                Fresh::Input0 => (fresh_run, other_run),
-                Fresh::Input1 => (other_run, fresh_run),
-            };
-            return Some(JoinWindow { input0, input1 });
-        }
-    }
-
-    fn absorb(
-        &mut self,
-        instance: &JoinInstance<'_, RowBatch, RowBatch>,
-        sink: &mut Self::Sink,
-        left: (u64, u64),
-        right: (u64, u64),
-        time: Time,
-        diff: Diff,
-    ) -> Option<Self::Output> {
-        // Not self-redeeming: tokens are redeemed against the columns, T1-checked. Group
-        // collisions are resolved here, per the module contract: matching was by group
-        // token, so re-check real key bytes and drop false pairs.
-        let lrow = redeem(instance.batches0, left);
-        let rrow = redeem(instance.batches1, right);
-        if key_of(lrow) == key_of(rrow) {
-            let (lrow, rrow) = (lrow.to_vec(), rrow.to_vec());
-            sink.push((lrow, rrow, time, diff));
-        }
-        if sink.len() >= self.target {
-            Some(std::mem::take(sink))
-        } else {
-            None
-        }
-    }
-
-    fn flush(&mut self, _instance: &JoinInstance<'_, RowBatch, RowBatch>, sink: &mut Self::Sink) -> Option<Self::Output> {
-        if sink.is_empty() {
-            None
-        } else {
-            Some(std::mem::take(sink))
-        }
-    }
-}
-
-/// Reference join: all row pairs with equal key bytes, times joined, diffs multiplied.
-fn naive_join(
-    a: &[(Row, Time, Diff)],
-    b: &[(Row, Time, Diff)],
-) -> Vec<((Row, Row), Time, Diff)> {
-    let mut out = Vec::new();
-    for (r0, t0, d0) in a {
-        for (r1, t1, d1) in b {
-            if key_of(r0) == key_of(r1) {
-                out.push(((r0.clone(), r1.clone()), std::cmp::max(*t0, *t1), d0 * d1));
-            }
-        }
-    }
-    consolidate_updates(&mut out);
-    out
-}
-
-fn rows(spec: &[(&str, Time, Diff)]) -> Vec<(Row, Time, Diff)> {
-    spec.iter().map(|(s, t, d)| (s.as_bytes().to_vec(), *t, *d)).collect()
-}
-
-/// Drive the proxy join at several window sizes and both `Fresh` choices, comparing
-/// against the byte-level naive join (which compares *real* key bytes).
-fn check_join(hasher: Hasher) {
-    // Variable-length rows, keys of different sizes, a retraction, several batches.
-    // Five distinct keys: under a 2-bit group hash, at least two must collide.
-    let a0 = rows(&[("alice|1", 0, 1), ("alice|22", 1, 1), ("bob|x", 0, 1), ("carol|zzz", 2, 1)]);
-    let a1 = rows(&[("alice|22", 2, -1), ("dave|4", 2, 1)]);
-    let b0 = rows(&[("alice|red", 1, 1), ("bob|blue", 2, 1), ("erin|green", 0, 1)]);
-    let b1 = rows(&[("bob|blue", 2, 1), ("carol|teal", 0, 1), ("dave|gray", 1, 1), ("erin|pink", 2, 1)]);
-
-    let all_a: Vec<_> = a0.iter().chain(&a1).cloned().collect();
-    let all_b: Vec<_> = b0.iter().chain(&b1).cloned().collect();
-    let expected = naive_join(&all_a, &all_b);
-
-    for window in [1, 2, 100] {
-        for fresh in [Fresh::Input0, Fresh::Input1] {
-            let mut tactic = ProxyJoinTactic::new(RowJoinBackend::new(window));
-            let work = tactic.prep(
-                vec![RowBatch::form(a0.clone(), 0, 3, hasher), RowBatch::form(a1.clone(), 0, 3, hasher)],
-                vec![RowBatch::form(b0.clone(), 0, 3, hasher), RowBatch::form(b1.clone(), 0, 3, hasher)],
-                fresh,
-                0,
-            );
-            let mut got: Vec<((Row, Row), Time, Diff)> =
-                work.flatten().map(|(l, r, t, d)| ((l, r), t, d)).collect();
-            consolidate_updates(&mut got);
-            assert_eq!(got, expected, "window={window}");
-        }
-    }
-}
-
-#[test]
-fn join_rows_matches_naive() {
-    check_join(hash);
-}
-
-#[test]
-fn join_resolves_group_collisions() {
-    // Forced group collisions (weak key hashes, strong row hashes): absorb must re-check
-    // real key bytes and drop false pairs, yielding exactly the naive output.
-    check_join(weak_group_hash);
-}
-
-#[test]
-#[should_panic(expected = "token collision detected at formation")]
-fn formation_detects_collisions() {
-    // Two distinct rows under a 2-bit hash must collide within one batch.
-    let updates = rows(&[
-        ("a|0", 0, 1), ("a|1", 0, 1), ("a|2", 0, 1), ("a|3", 0, 1), ("a|4", 0, 1),
-    ]);
-    RowBatch::form(updates, 0, 1, weak_hash);
-}
-
-#[test]
-#[should_panic(expected = "token collision detected at redemption")]
-fn redemption_detects_cross_batch_collisions() {
-    // Find two distinct rows with the same weak token pair: same key (same G) and
-    // colliding 2-bit value hashes. Placed in *separate* batches, formation cannot
-    // see the collision; redemption must.
-    let candidates: Vec<Row> = (0..64).map(|i| format!("k|{i}").into_bytes()).collect();
-    let (r0, r1) = {
-        let mut found = None;
-        'outer: for (x, a) in candidates.iter().enumerate() {
-            for b in &candidates[x + 1..] {
-                if weak_hash(a) == weak_hash(b) {
-                    found = Some((a.clone(), b.clone()));
-                    break 'outer;
-                }
-            }
-        }
-        found.expect("2-bit hashes must collide among 64 rows")
-    };
-    let left0 = RowBatch::form(vec![(r0, 0, 1)], 0, 1, weak_hash);
-    let left1 = RowBatch::form(vec![(r1, 0, 1)], 0, 1, weak_hash);
-    let right = RowBatch::form(rows(&[("k|hit", 0, 1)]), 0, 1, weak_hash);
-
-    let mut tactic = ProxyJoinTactic::new(RowJoinBackend::new(100));
-    let work = tactic.prep(vec![left0, left1], vec![right], Fresh::Input0, 0);
-    let _: Vec<_> = work.collect();
-}
-
-// -------------------------------------------------------------- reduce backend
-
-/// Stash `row` under `token`, checking stash-site T1: a token maps to one byte string.
-fn stash_checked(map: &mut BTreeMap<(u64, u64), Row>, token: (u64, u64), row: &[u8]) {
-    match map.entry(token) {
-        std::collections::btree_map::Entry::Occupied(e) => {
-            assert!(e.get() == row, "token collision detected at stash");
-        }
-        std::collections::btree_map::Entry::Vacant(v) => {
-            v.insert(row.to_vec());
-        }
-    }
-}
-
-/// Counts rows per key: the output row for key `k` with count `c` is `k|c`.
-///
-/// Not self-redeeming, which exposes the expected pattern for byte backends: the
-/// window is the redemption scope. `next_window` walks the columns anyway, so it
-/// stashes what later steps need — key bytes per input token, and row bytes per
-/// presented output token; `reduce_corrections` partitions each granule by *real*
-/// key (resolving group collisions per the module contract) and mints tokens for
-/// desired rows it invents; `emit`/`finish` redeem from the stash. Nothing is ever
-/// re-derived from a hash.
-struct RowReduceBackend {
-    window: usize,
-    hasher: Hasher,
-    // Session state, bracketed by `begin`/`finish`.
-    tiles: Vec<Description<Time>>,
-    emitted: Vec<Vec<(Row, Time, Diff)>>,
-    pos_source: Vec<usize>,
-    pos_input: Vec<usize>,
-    pos_output: Vec<usize>,
-    pend_idx: usize,
-    /// Key bytes per input token, harvested while draining windows. (Compares key
-    /// bytes only: an input *value*-token collision merges two same-key rows, which
-    /// count-by-diffs tolerates; logics reading values would stash whole rows.)
-    input_keys: BTreeMap<(u64, u64), Row>,
-    /// Row bytes per output token: presented output rows and minted desired rows.
-    minted: BTreeMap<(u64, u64), Row>,
-}
-
-impl RowReduceBackend {
-    fn new(window: usize, hasher: Hasher) -> Self {
-        RowReduceBackend {
-            window,
-            hasher,
-            tiles: Vec::new(),
-            emitted: Vec::new(),
-            pos_source: Vec::new(),
-            pos_input: Vec::new(),
-            pos_output: Vec::new(),
-            pend_idx: 0,
-            input_keys: BTreeMap::new(),
-            minted: BTreeMap::new(),
-        }
-    }
-}
-
-impl ProxyReduceBackend<RowBatch, RowBatch> for RowReduceBackend {
-    type Group = u64;
-    type Token = u64;
-    type RIn = Diff;
-    type ROut = Diff;
-
-    fn begin(&mut self, tiles: &[Description<Time>]) {
-        self.tiles = tiles.to_vec();
-        self.emitted = vec![Vec::new(); tiles.len()];
-        self.pos_source.clear();
-        self.pos_input.clear();
-        self.pos_output.clear();
-        self.pend_idx = 0;
-        self.input_keys.clear();
-        self.minted.clear();
-    }
-
-    fn next_window(
-        &mut self,
-        instance: &ReduceInstance<'_, RowBatch, RowBatch>,
-        pending: &[u64],
-        reuse: Option<ReduceWindow<u64, u64, Time, Diff, Diff>>,
-    ) -> Option<ReduceWindow<u64, u64, Time, Diff, Diff>> {
-        self.pos_source.resize(instance.source_batches.len(), 0);
-        self.pos_input.resize(instance.input_batches.len(), 0);
-        self.pos_output.resize(instance.output_batches.len(), 0);
-        // Reclaim the spent window's buffer capacity.
-        let (mut keys, mut seeds, mut input, mut output) = match reuse {
-            Some(ReduceWindow { mut keys, mut seeds, mut input, mut output }) => {
-                keys.clear();
-                seeds.clear();
-                input.clear();
-                output.clear();
-                (keys, seeds, input, output)
-            }
-            None => (Vec::new(), Vec::new(), Vec::new(), Vec::new()),
-        };
-        while keys.len() < self.window {
-            let g = [
-                next_group(instance.source_batches, &self.pos_source),
-                next_group(instance.input_batches, &self.pos_input),
-                next_group(instance.output_batches, &self.pos_output),
-                pending.get(self.pend_idx).copied(),
-            ]
-            .into_iter()
-            .flatten()
-            .min();
-            let Some(g) = g else { break };
-            keys.push(g);
-            if pending.get(self.pend_idx) == Some(&g) {
-                self.pend_idx += 1;
-            }
-            let input_keys = &mut self.input_keys;
-            drain_group(instance.source_batches, &mut self.pos_source, g, |b, i| {
-                stash_checked(input_keys, b.tokens[i], key_of(b.row(i)));
-                input.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
-            });
-            drain_group(instance.input_batches, &mut self.pos_input, g, |b, i| {
-                stash_checked(input_keys, b.tokens[i], key_of(b.row(i)));
-                seeds.push((g, b.times[i]));
-                input.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
-            });
-            let minted = &mut self.minted;
-            drain_group(instance.output_batches, &mut self.pos_output, g, |b, i| {
-                stash_checked(minted, b.tokens[i], b.row(i));
-                output.push((b.tokens[i], advance(b.times[i], instance.lower), b.diffs[i]));
-            });
-        }
-        if keys.is_empty() {
-            return None;
-        }
-        consolidate_updates(&mut input);
-        consolidate_updates(&mut output);
-        seeds.sort();
-        seeds.dedup();
-        Some(ReduceWindow { keys, seeds, input, output })
-    }
-
-    fn reduce_corrections(
-        &mut self,
-        keys: &[u64],
-        in_ends: &[usize],
-        input: &[(u64, Diff)],
-        out_ends: &[usize],
-        output: &[(u64, Diff)],
-    ) -> (Vec<(u64, Diff)>, Vec<usize>) {
-        let mut corr = Vec::new();
-        let mut ends = Vec::new();
-        let (mut i0, mut o0) = (0, 0);
-        for (k, (&i1, &o1)) in keys.iter().zip(in_ends.iter().zip(out_ends)) {
-            // Partition the granule by REAL key: under compression, distinct keys can
-            // share a group token, and each must be reduced separately (the module
-            // contract's prescription for group collisions).
-            let mut per_key: BTreeMap<Row, (Diff, Vec<(u64, Diff)>)> = BTreeMap::new();
-            for (tok, d) in &input[i0..i1] {
-                let key = self.input_keys.get(&(*k, *tok)).expect("input token missing from key stash");
-                per_key.entry(key.clone()).or_default().0 += d;
-            }
-            for (tok, d) in &output[o0..o1] {
-                let row = self.minted.get(&(*k, *tok)).expect("output token was never presented");
-                per_key.entry(key_of(row).to_vec()).or_default().1.push((*tok, -d));
-            }
-            let mut delta: Vec<(u64, Diff)> = Vec::new();
-            for (key, (count, mut retractions)) in per_key {
-                assert!(count >= 0, "row count went negative");
-                if count > 0 {
-                    // Mint the desired output row and its token.
-                    let mut row = key;
-                    row.push(b'|');
-                    row.extend_from_slice(count.to_string().as_bytes());
-                    let token = (self.hasher)(&row);
-                    stash_checked(&mut self.minted, (*k, token), &row);
-                    delta.push((token, 1));
-                }
-                delta.append(&mut retractions);
-            }
-            consolidate(&mut delta);
-            corr.extend(delta);
-            ends.push(corr.len());
-            i0 = i1;
-            o0 = o1;
-        }
-        (corr, ends)
-    }
-
-    fn emit(&mut self, tile: usize, records: &[((u64, u64), Time, Diff)]) {
-        for ((g, i), t, r) in records {
-            let row = self.minted.get(&(*g, *i)).expect("emitted token was never minted or presented");
-            self.emitted[tile].push((row.clone(), *t, *r));
-        }
-    }
-
-    fn finish(&mut self) -> Vec<RowBatch> {
-        let hasher = self.hasher;
-        self.tiles
-            .drain(..)
-            .zip(self.emitted.drain(..))
-            .map(|(desc, updates)| {
-                let lower = desc.lower().elements()[0];
-                let upper = if desc.upper().elements().is_empty() { lower } else { desc.upper().elements()[0] };
-                let mut b = RowBatch::form(updates, lower, upper, hasher);
-                b.description = desc;
-                b
-            })
-            .collect()
-    }
-}
-
-/// Accumulate row updates at times `<= t`.
-fn accumulate(updates: impl Iterator<Item = (Row, Time, Diff)>, t: Time) -> Vec<(Row, Diff)> {
-    let mut acc: Vec<(Row, Diff)> =
-        updates.filter(|(_, ut, _)| *ut <= t).map(|(r, _, d)| (r, d)).collect();
-    consolidate(&mut acc);
-    acc
-}
-
-/// Drive the proxy reduce over several rounds at several window sizes, comparing
-/// accumulated outputs at every round boundary against byte-level per-key counts.
-fn check_reduce(hasher: Hasher) {
-    // Five distinct keys: under a 2-bit group hash, at least two must collide.
-    let rounds: Vec<Vec<(Row, Time, Diff)>> = vec![
-        rows(&[("alice|1", 0, 1), ("alice|22", 0, 1), ("bob|x", 0, 1), ("erin|e", 0, 1)]),
-        rows(&[("alice|333", 1, 1), ("carol|c", 1, 1), ("bob|x", 1, -1)]),
-        rows(&[("carol|d", 2, 1), ("alice|22", 2, -1), ("dave|9", 2, 1), ("erin|e", 2, -1)]),
-    ];
-
-    for window in [1, 2, 100] {
-        let mut tactic = ProxyReduceTactic::new(RowReduceBackend::new(window, hasher));
-        let mut source: Vec<RowBatch> = Vec::new();
-        let mut outputs: Vec<RowBatch> = Vec::new();
-
-        for (r, updates) in rounds.iter().enumerate() {
-            let r = r as Time;
-            let input = RowBatch::form(updates.clone(), r, r + 1, hasher);
-            let lower = Antichain::from_elem(r);
-            let upper = Antichain::from_elem(r + 1);
-            let held = Antichain::from_elem(r);
-            let (produced, frontier) =
-                tactic.retire(source.clone(), outputs.clone(), vec![input.clone()], &lower, &upper, &held);
-            assert!(frontier.is_empty(), "total order should defer nothing");
-            for (time, b) in produced {
-                assert!(held.elements().contains(&time));
-                outputs.push(b);
-            }
-            source.push(input);
-        }
-
-        for t in 0..rounds.len() as Time {
-            let input_acc = accumulate(source.iter().flat_map(|b| (0..b.len()).map(|i| (b.row(i).to_vec(), b.times[i], b.diffs[i]))), t);
-            let mut counts: BTreeMap<Row, Diff> = BTreeMap::new();
-            for (row, d) in &input_acc {
-                *counts.entry(key_of(row).to_vec()).or_insert(0) += d;
-            }
-            let mut expected: Vec<(Row, Diff)> = Vec::new();
-            for (key, c) in counts {
-                assert!(c >= 0);
-                if c > 0 {
-                    let mut row = key.clone();
-                    row.push(b'|');
-                    row.extend_from_slice(c.to_string().as_bytes());
-                    expected.push((row, 1));
-                }
-            }
-            expected.sort();
-            let got = accumulate(outputs.iter().flat_map(|b| (0..b.len()).map(|i| (b.row(i).to_vec(), b.times[i], b.diffs[i]))), t);
-            assert_eq!(got, expected, "window={window} at time={t}");
-        }
-    }
-}
-
-#[test]
-fn reduce_row_counts_match_naive() {
-    check_reduce(hash);
-}
-
-#[test]
-fn reduce_resolves_group_collisions() {
-    // Forced group collisions: the granule partition by real key must reduce each
-    // colliding key separately, yielding exactly the naive per-key counts.
-    check_reduce(weak_group_hash);
-}
diff --git a/differential-dataflow/tests/int_proxy_graphs.rs b/differential-dataflow/tests/int_proxy_graphs.rs
deleted file mode 100644
index 2d84ee514..000000000
--- a/differential-dataflow/tests/int_proxy_graphs.rs
+++ /dev/null
@@ -1,291 +0,0 @@
-//! Behavioral tests for the proxy tactics against the shared edge-batch backend.
-//!
-//! The value-token instantiation from the seam design: data is edges `(src, dst)`,
-//! grouped by source. `Group = u32` is the source itself (exact — no hashing, no
-//! collisions), and the value token is the whole edge (self-redeeming: `absorb` and
-//! `finish` build outputs straight from tokens without consulting storage). Window
-//! sizes are kept tiny to force many windows and exercise the streaming protocols.
-//! The scaffold lives in `tests/common/mod.rs`, shared with the partial-order test.
-
-mod common;
-
-use std::collections::BTreeMap;
-
-use timely::progress::Antichain;
-
-use differential_dataflow::consolidation::consolidate_updates;
-use differential_dataflow::operators::int_proxy::{ProxyJoinTactic, ProxyReduceTactic};
-use differential_dataflow::operators::join::{Fresh, JoinTactic};
-use differential_dataflow::operators::reduce::ReduceTactic;
-
-use common::{accumulate, batch, naive_join, Diff, Edge, EdgeBatch, EdgeJoinBackend, EdgeReduceBackend};
-
-type Time = u64;
-type GraphBatch = EdgeBatch<Time>;
-
-#[test]
-fn join_matches_naive() {
-    // Edges spread over several groups, several batches per side, including a
-    // retraction; window size 1 forces one group per window.
-    let a0 = batch(vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((3, 9), 2, 1)], 0, 3);
-    let a1 = batch(vec![((0, 2), 2, -1), ((2, 4), 2, 1)], 0, 3);
-    let b0 = batch(vec![((0, 7), 1, 1), ((1, 8), 2, 1), ((2, 6), 0, 1)], 0, 3);
-    let b1 = batch(vec![((1, 8), 2, 1), ((4, 4), 0, 1)], 0, 3);
-
-    let all_a: Vec<_> = a0.updates.iter().chain(&a1.updates).cloned().collect();
-    let all_b: Vec<_> = b0.updates.iter().chain(&b1.updates).cloned().collect();
-    let expected = naive_join(&all_a, &all_b);
-
-    for window in [1, 2, 100] {
-        for fresh in [Fresh::Input0, Fresh::Input1] {
-            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(window));
-            let work = tactic.prep(
-                vec![a0.clone(), a1.clone()],
-                vec![b0.clone(), b1.clone()],
-                fresh,
-                0,
-            );
-            let mut got: Vec<((Edge, Edge), Time, Diff)> = work
-                .flatten()
-                .map(|(l, r, t, d)| ((l, r), t, d))
-                .collect();
-            consolidate_updates(&mut got);
-            assert_eq!(got, expected, "window={window}");
-        }
-    }
-}
-
-#[test]
-fn interleaved_units_share_backend() {
-    // Two units prepped from one tactic and drained alternately: the scenario that
-    // motivated per-unit `Cursor` state and the shared `Rc<RefCell>` backend — the
-    // driver holds half-drained units from both queues and polls them under fuel.
-    let a = vec![
-        batch(vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((0, 3), 1, 1), ((1, 5), 0, 1), ((2, 2), 1, 1)], 0, 2),
-        batch(vec![((3, 3), 1, 1)], 0, 2),
-    ];
-    let b = vec![batch(vec![((0, 7), 1, 1), ((2, 6), 0, 1), ((3, 8), 1, 1)], 0, 2)];
-    let c = vec![batch(vec![((5, 1), 0, 1), ((6, 2), 0, 1)], 0, 2)];
-    let d = vec![
-        batch(vec![((5, 9), 1, 1), ((6, 4), 0, 1)], 0, 2),
-        batch(vec![((5, 9), 1, 1)], 0, 2),
-    ];
-
-    let all = |bs: &[GraphBatch]| bs.iter().flat_map(|b| b.updates.iter().cloned()).collect::<Vec<_>>();
-    let expected1 = naive_join(&all(&a), &all(&b));
-    let expected2 = naive_join(&all(&c), &all(&d));
-
-    // target = 2 with a 3-match key (key 0): unit 1 yields a full container and PAUSES
-    // holding one staged match, then unit 2 absorbs against the same shared backend.
-    // Staging must be unit-owned (`Sink`): with a shared buffer — the bug shape this
-    // test pins — unit 1's held match ships inside unit 2's next container, under
-    // unit 2's capability. target = 1 would NOT catch this (staging empty at every
-    // yield); the straddling partial container is the point.
-    let mut backend = EdgeJoinBackend::new(1);
-    backend.target = 2;
-    let mut tactic = ProxyJoinTactic::new(backend);
-    let mut u1 = tactic.prep(a, b, Fresh::Input0, 0);
-    let mut u2 = tactic.prep(c, d, Fresh::Input1, 0);
-    let mut got1: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
-    let mut got2: Vec<((Edge, Edge), Time, Diff)> = Vec::new();
-    let (mut done1, mut done2) = (false, false);
-    while !done1 || !done2 {
-        if !done1 {
-            match u1.next() {
-                Some(out) => got1.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
-                None => done1 = true,
-            }
-        }
-        if !done2 {
-            match u2.next() {
-                Some(out) => got2.extend(out.into_iter().map(|(l, r, t, d)| ((l, r), t, d))),
-                None => done2 = true,
-            }
-        }
-    }
-    consolidate_updates(&mut got1);
-    consolidate_updates(&mut got2);
-    assert_eq!(got1, expected1);
-    assert_eq!(got2, expected2);
-}
-
-#[test]
-fn reduce_fuzz_matches_oracle() {
-    // Deterministic randomized differential test: random updates over a small key
-    // space, random times within each round's interval (so rounds mix fast-path
-    // keys — one distinct time — with slow-path keys), random retractions of live
-    // edges, several window sizes. The oracle is exact per-time counting.
-    let mut state = 0x853c49e6748fea9bu64;
-    let mut rng = move || {
-        state = state.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
-        (state >> 33) as u32
-    };
-
-    for window in [1, 3, 100] {
-        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
-        let mut source: Vec<GraphBatch> = Vec::new();
-        let mut outputs: Vec<GraphBatch> = Vec::new();
-        let mut live: Vec<Edge> = Vec::new();
-        const ROUNDS: u64 = 8;
-        const WIDTH: u64 = 3;
-        for round in 0..ROUNDS {
-            let lo = round * WIDTH;
-            let hi = lo + WIDTH;
-            let mut updates: Vec<(Edge, Time, Diff)> = Vec::new();
-            // Retract only edges from PRIOR rounds (any time this round is at or after
-            // their insertion, keeping every prefix accumulation non-negative); this
-            // round's insertions join `live` only at round end.
-            let mut fresh: Vec<Edge> = Vec::new();
-            for _ in 0..40 {
-                let t = lo + (rng() as u64) % WIDTH;
-                if !live.is_empty() && rng() % 4 == 0 {
-                    let e = live[(rng() as usize) % live.len()];
-                    live.retain(|x| *x != e);
-                    updates.push((e, t, -1));
-                } else {
-                    let e = (rng() % 16, rng() % 64);
-                    fresh.push(e);
-                    updates.push((e, t, 1));
-                }
-            }
-            live.append(&mut fresh);
-            let input = batch(updates, lo, hi);
-            let lower = Antichain::from_elem(lo);
-            let upper = Antichain::from_elem(hi);
-            let held = Antichain::from_elem(lo);
-            let (produced, frontier) = tactic.retire(
-                source.clone(),
-                outputs.clone(),
-                vec![input.clone()],
-                &lower,
-                &upper,
-                &held,
-            );
-            assert!(frontier.is_empty(), "total order should defer nothing");
-            for (time, b) in produced {
-                assert!(held.elements().contains(&time));
-                outputs.push(b);
-            }
-            source.push(input);
-            for t in lo..hi {
-                assert_counts(&source, &outputs, t, &format!("fuzz window={window} round={round}"));
-            }
-        }
-    }
-}
-
-/// Per-time count oracle shared by the reduce tests.
-fn assert_counts(source: &[GraphBatch], outputs: &[GraphBatch], t: Time, label: &str) {
-    let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
-    let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
-    for ((src, _dst), d) in &input_acc {
-        *counts.entry(*src).or_insert(0) += d;
-    }
-    let mut expected: Vec<(Edge, Diff)> = Vec::new();
-    for (src, c) in counts {
-        assert!(c >= 0);
-        if c > 0 {
-            expected.push(((src, c as u32), 1));
-        }
-    }
-    let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
-    assert_eq!(got, expected, "{label} at time={t}");
-}
-
-#[test]
-fn reduce_multitime_rounds() {
-    // Intervals of width two, two distinct times per batch: under total order this
-    // exercises the slow (discovery) path even with the single-moment fast path in
-    // place — a key with two distinct seed times cannot take it — and mixes fast
-    // and slow keys within one window.
-    let rounds: Vec<(Vec<(Edge, Time, Diff)>, Time, Time)> = vec![
-        (vec![((0, 1), 0, 1), ((0, 2), 1, 1), ((1, 5), 0, 1), ((1, 6), 1, 1)], 0, 2),
-        (vec![((0, 3), 2, 1), ((1, 5), 3, -1), ((2, 7), 2, 1), ((2, 8), 3, 1)], 2, 4),
-    ];
-    for window in [1, 100] {
-        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
-        let mut source: Vec<GraphBatch> = Vec::new();
-        let mut outputs: Vec<GraphBatch> = Vec::new();
-        for (updates, lo, hi) in rounds.iter() {
-            let input = batch(updates.clone(), *lo, *hi);
-            let lower = Antichain::from_elem(*lo);
-            let upper = Antichain::from_elem(*hi);
-            let held = Antichain::from_elem(*lo);
-            let (produced, frontier) = tactic.retire(
-                source.clone(),
-                outputs.clone(),
-                vec![input.clone()],
-                &lower,
-                &upper,
-                &held,
-            );
-            assert!(frontier.is_empty(), "total order should defer nothing");
-            for (time, b) in produced {
-                assert!(held.elements().contains(&time));
-                outputs.push(b);
-            }
-            source.push(input);
-        }
-        for t in 0..4u64 {
-            assert_counts(&source, &outputs, t, &format!("multitime window={window}"));
-        }
-    }
-}
-
-#[test]
-fn reduce_counts_match_naive() {
-    // Rounds of edge updates, including deletions that drop a source's count to zero
-    // (full retraction) and change another's (correction).
-    let rounds: Vec<Vec<(Edge, Time, Diff)>> = vec![
-        vec![((0, 1), 0, 1), ((0, 2), 0, 1), ((1, 5), 0, 1)],
-        vec![((0, 3), 1, 1), ((2, 7), 1, 1), ((1, 5), 1, -1)],
-        vec![((2, 8), 2, 1), ((0, 2), 2, -1), ((3, 4), 2, 1)],
-    ];
-
-    for window in [1, 2, 100] {
-        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
-        let mut source: Vec<GraphBatch> = Vec::new();
-        let mut outputs: Vec<GraphBatch> = Vec::new();
-
-        for (r, updates) in rounds.iter().enumerate() {
-            let r = r as Time;
-            let input = batch(updates.clone(), r, r + 1);
-            let lower = Antichain::from_elem(r);
-            let upper = Antichain::from_elem(r + 1);
-            let held = Antichain::from_elem(r);
-            let (produced, frontier) = tactic.retire(
-                source.clone(),
-                outputs.clone(),
-                vec![input.clone()],
-                &lower,
-                &upper,
-                &held,
-            );
-            assert!(frontier.is_empty(), "total order should defer nothing");
-            for (time, b) in produced {
-                assert!(held.elements().contains(&time));
-                outputs.push(b);
-            }
-            source.push(input);
-        }
-
-        // Oracle: at each round boundary, the accumulated output is exactly the
-        // per-source counts of the accumulated input.
-        for t in 0..rounds.len() as Time {
-            let input_acc = accumulate(source.iter().flat_map(|b| b.updates.iter().cloned()), &t);
-            let mut expected: Vec<(Edge, Diff)> = Vec::new();
-            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
-            for ((src, _dst), d) in &input_acc {
-                *counts.entry(*src).or_insert(0) += d;
-            }
-            for (src, c) in counts {
-                assert!(c >= 0);
-                if c > 0 {
-                    expected.push(((src, c as u32), 1));
-                }
-            }
-            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &t);
-            assert_eq!(got, expected, "window={window} at time={t}");
-        }
-    }
-}
diff --git a/differential-dataflow/tests/int_proxy_pending.rs b/differential-dataflow/tests/int_proxy_pending.rs
deleted file mode 100644
index 94d2ab1dd..000000000
--- a/differential-dataflow/tests/int_proxy_pending.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-//! The partial-order test: carried interesting times (the *pending* path), which can
-//! only arise under partially ordered timestamps and was the last unexercised clause
-//! of the windowed reduce contract.
-//!
-//! With `Pair` times, updates at incomparable moments `(0,1)` and `(1,0)` make their
-//! join `(1,1)` an interesting time. When `(1,1)` lies beyond the retire's upper
-//! frontier it must be *pended*: returned in the frontier (holding the capability),
-//! carried by the tactic, handed to the backend as a `pending` group next retire —
-//! where the group must appear in a window even though it has no novel input — and
-//! evaluated there, producing the correction that collapses the two partial counts.
-
-mod common;
-
-use std::collections::BTreeMap;
-
-use timely::progress::Antichain;
-
-use differential_dataflow::operators::int_proxy::ProxyReduceTactic;
-use differential_dataflow::operators::reduce::ReduceTactic;
-
-use common::pair::Pair;
-use common::{accumulate, batch_frontiers, Diff, Edge, EdgeBatch, EdgeReduceBackend};
-
-type Time = Pair<u64, u64>;
-
-fn t(a: u64, b: u64) -> Time {
-    Pair::new(a, b)
-}
-
-#[test]
-fn pending_times_carry_across_retires() {
-    // Key 7 receives updates at incomparable times in round A; key 3 receives novel
-    // input only in round B, so round B's windows must merge a pending-only group
-    // (7) with a novel-only group (3), in group order, at window size 1.
-    for window in [1, 2, 100] {
-        let mut tactic = ProxyReduceTactic::new(EdgeReduceBackend::new(window));
-
-        // Round A: interval [ {(0,0)}, {(1,1)} ), capability held at (0,0).
-        let input_a = batch_frontiers(
-            vec![((7, 100), t(0, 1), 1), ((7, 200), t(1, 0), 1)],
-            Antichain::from_elem(t(0, 0)),
-            Antichain::from_elem(t(1, 1)),
-        );
-        let lower = Antichain::from_elem(t(0, 0));
-        let upper = Antichain::from_elem(t(1, 1));
-        let held = Antichain::from_elem(t(0, 0));
-        let (produced_a, frontier_a) = tactic.retire(
-            Vec::new(),
-            Vec::new(),
-            vec![input_a.clone()],
-            &lower,
-            &upper,
-            &held,
-        );
-        // The joint interesting time (1,1) lies beyond upper: it must be deferred,
-        // and the returned frontier must hold it.
-        assert_eq!(frontier_a, Antichain::from_elem(t(1, 1)), "the join of incomparable updates must be pended");
-
-        let mut outputs: Vec<EdgeBatch<Time>> = produced_a.into_iter().map(|(_, b)| b).collect();
-
-        // Round B: interval [ {(1,1)}, {(2,2)} ), capability held at (1,1). Novel
-        // input only for key 3; key 7 participates as a pending-only group.
-        let input_b = batch_frontiers(
-            vec![((3, 5), t(1, 1), 1)],
-            Antichain::from_elem(t(1, 1)),
-            Antichain::from_elem(t(2, 2)),
-        );
-        let lower = Antichain::from_elem(t(1, 1));
-        let upper = Antichain::from_elem(t(2, 2));
-        let held = Antichain::from_elem(t(1, 1));
-        let (produced_b, frontier_b) = tactic.retire(
-            vec![input_a.clone()],
-            outputs.clone(),
-            vec![input_b.clone()],
-            &lower,
-            &upper,
-            &held,
-        );
-        assert!(frontier_b.is_empty(), "nothing further to defer");
-        outputs.extend(produced_b.into_iter().map(|(_, b)| b));
-
-        // Oracle over a grid of times, using the partial order's less_equal: the
-        // accumulated output at t must be exactly the per-source counts of the
-        // accumulated input at t. At (1,1) this requires round B's correction to
-        // have collapsed the two partial counts of key 7 into one count of 2.
-        let inputs: Vec<(Edge, Time, Diff)> = input_a
-            .updates
-            .iter()
-            .chain(&input_b.updates)
-            .cloned()
-            .collect();
-        for probe in [t(0, 0), t(0, 1), t(1, 0), t(1, 1), t(2, 1), t(2, 2)] {
-            let input_acc = accumulate(inputs.iter().cloned(), &probe);
-            let mut counts: BTreeMap<u32, Diff> = BTreeMap::new();
-            for ((src, _dst), d) in &input_acc {
-                *counts.entry(*src).or_insert(0) += d;
-            }
-            let mut expected: Vec<(Edge, Diff)> = Vec::new();
-            for (src, c) in counts {
-                if c > 0 {
-                    expected.push(((src, c as u32), 1));
-                }
-            }
-            let got = accumulate(outputs.iter().flat_map(|b| b.updates.iter().cloned()), &probe);
-            assert_eq!(got, expected, "window={window} at probe={probe:?}");
-        }
-    }
-}

From ed19240e36999c002d4232b8aedc2b72f659bbcb Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 01:39:17 -0400
Subject: [PATCH 14/18] scc_proxy: SCC_STAGGER mode, pointing the #801 trigger
 at proxy joins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Audit of whether the int-proxy join carries the bug fixed in #802
(in-flight batches overtaken by advance_upper, silently dropped):

* The bug lived in join_with_tactic's driver — the acknowledged-
  frontier admission guard — which both tactics share, and this branch
  is based past the fix (59dfd3df, f8f1645c); its only diffs to
  join.rs are a derive and module visibility. The proxy path inherits
  the fix.
* The tactic-level assumptions survive the fix's new admission rule:
  `meet` is the timely message capability, which lower-bounds the
  fresh batch's times on the overtaken path exactly as elsewhere
  (overtaking changes which batches are admitted and what the opposing
  trace reads through, not the capability relationship), so the
  backend's advance-by-lower algebra and the exactly-once argument
  (driver-level, tactic-agnostic) are unaffected.
* Empirically: SCC_STAGGER=1 switches both the proxy trim and the
  oracle to the prioritized strongly_connected_at shape (labels
  introduced in rounds — the #801 trigger), and the oracle-validated
  runs at the regression suite's sizes (10/20 x 1000 single-edge
  rounds, 100/200 x 10, 100/2000) with three workers all pass: exact
  agreement at every time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/examples/scc_proxy.rs | 30 ++++++++++++++++-----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/differential-dataflow/examples/scc_proxy.rs b/differential-dataflow/examples/scc_proxy.rs
index f164278da..baf9890c1 100644
--- a/differential-dataflow/examples/scc_proxy.rs
+++ b/differential-dataflow/examples/scc_proxy.rs
@@ -251,8 +251,14 @@ where
 }
 
 /// `strongly_connected`, with `trim_edges`' joins run through the proxy tactic.
+///
+/// `stagger` selects the label-introduction logic: `false` is `|_| 0` (stock
+/// `strongly_connected`); `true` is `|x| x as u64` (the prioritized
+/// `strongly_connected_at` shape — the #801 trigger, with labels completing
+/// their propagation in rounds while later labels are still being introduced).
 fn strongly_connected_proxy<'scope, T>(
     graph: VecCollection<'scope, T, (usize, usize), Diff>,
+    stagger: bool,
 ) -> VecCollection<'scope, T, (usize, usize), Diff>
 where
     T: Timestamp + Lattice + Hash + Ord,
@@ -262,7 +268,7 @@ where
         let edges = graph.enter(scope);
         let trans = edges.clone().map_in_place(|x| mem::swap(&mut x.0, &mut x.1));
         let (variable, inner) = Variable::new_from(edges.clone(), Product::new(Default::default(), 1));
-        let result = trim_edges_proxy(trim_edges_proxy(inner, edges), trans);
+        let result = trim_edges_proxy(trim_edges_proxy(inner, edges, stagger), trans, stagger);
         variable.set(result.clone());
         result.leave(outer)
     })
@@ -271,6 +277,7 @@ where
 fn trim_edges_proxy<'scope, T>(
     cycle: VecCollection<'scope, T, (usize, usize), Diff>,
     edges: VecCollection<'scope, T, (usize, usize), Diff>,
+    stagger: bool,
 ) -> VecCollection<'scope, T, (usize, usize), Diff>
 where
     T: Timestamp + Lattice + Hash + Ord,
@@ -285,8 +292,13 @@ where
             .map_in_place(|x| x.0 = x.1)
             .consolidate();
 
-        // `|_| 0` (no label staggering), matching stock `strongly_connected` exactly.
-        let labels = propagate_at(cycle, nodes, |_| 0).arrange_by_key();
+        let labels = if stagger {
+            propagate_at(cycle, nodes, |x| *x as u64)
+        } else {
+            // `|_| 0` (no label staggering), matching stock `strongly_connected` exactly.
+            propagate_at(cycle, nodes, |_| 0)
+        }
+        .arrange_by_key();
 
         let step1 = proxy_join(
             edges.arrange_by_key(),
@@ -338,14 +350,20 @@ fn main() {
         }
 
         let validate = std::env::var("SCC_VALIDATE").is_ok();
+        let stagger = std::env::var("SCC_STAGGER").is_ok();
         let mut probe = Handle::new();
         let mut input = worker.dataflow(|scope| {
             let (input, graph) = scope.new_collection::<(usize, usize), Diff>();
-            let scc = strongly_connected_proxy(graph.clone());
+            let scc = strongly_connected_proxy(graph.clone(), stagger);
             if validate {
                 // Oracle: stock and proxy SCC must agree exactly, at every time.
-                use differential_dataflow::algorithms::graphs::scc::strongly_connected;
-                strongly_connected(graph)
+                use differential_dataflow::algorithms::graphs::scc::{strongly_connected, strongly_connected_at};
+                let oracle = if stagger {
+                    strongly_connected_at(graph, |x| *x as u64)
+                } else {
+                    strongly_connected(graph)
+                };
+                oracle
                     .negate()
                     .concat(scc.clone())
                     .consolidate()

From 50a32e2d5a4091945426ea86dcd29324b27c9caf Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 02:03:49 -0400
Subject: [PATCH 15/18] Re-privatize the cursor tactic modules

They were made public solely so the (since pruned) benchmark could
drive them directly; with that gone, nothing outside the crate names
them, and the public surface shrinks back. The intra-doc link fix
stays.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/src/operators/join.rs   | 6 +-----
 differential-dataflow/src/operators/reduce.rs | 5 +----
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/differential-dataflow/src/operators/join.rs b/differential-dataflow/src/operators/join.rs
index bf6581a24..d2a6b5b42 100644
--- a/differential-dataflow/src/operators/join.rs
+++ b/differential-dataflow/src/operators/join.rs
@@ -382,11 +382,7 @@ where
 }
 
 /// Cursor-based join: the conventional [`JoinTactic`] implementation and its per-batch worker.
-/// The conventional cursor-based [`JoinTactic`] implementation.
-///
-/// Public since the tactic entry points are: it is the incumbent reference
-/// implementation, and benchmarks and differential tests drive it directly.
-pub mod cursors {
+mod cursors {
 
     use std::cell::RefCell;
     use std::rc::Rc;
diff --git a/differential-dataflow/src/operators/reduce.rs b/differential-dataflow/src/operators/reduce.rs
index d30fa2864..83238105a 100644
--- a/differential-dataflow/src/operators/reduce.rs
+++ b/differential-dataflow/src/operators/reduce.rs
@@ -260,10 +260,7 @@ where
 /// updates and replays them together per key, applying `logic` and shaping output with `push`. It holds
 /// the outstanding synthetic interesting `(key, time)` moments across activations, and reasons only
 /// about times: capabilities are the driver's concern.
-///
-/// Public since the tactic entry points are: it is the incumbent reference implementation,
-/// and benchmarks and differential tests drive it directly.
-pub mod cursors {
+mod cursors {
 
     use super::*;
 

From f1a0310a89c6204a1e34e19dd88d78f75babf651 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 10:48:53 -0400
Subject: [PATCH 16/18] Thin to substrate: remove the SCC example in favor of
 the Corgi gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR's role is the protocol substrate for the Corgi/DDIR work
(#795): the reshaped int-proxy tactics that its columnar backends
port onto. Under that lens the SCC example's job — in-dataflow
validation against a real backend — is superseded by the Corgi
backend's differential gate (whole .ddp programs vs the vec
reference), which is the stronger version of the same check.

The example's findings stay on the record in its commits (1bc07522,
ed19240e): proxy joins at parity with join_core end-to-end,
oracle-validated including under the #801 trigger shape at the
regression suite's sizes. What remains in-tree is the harness's own
property suite (tests/int_proxy.rs), which guards the contract the
Corgi port will code against and is the one thing the downstream gate
does not cover.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 differential-dataflow/examples/scc_proxy.rs | 417 --------------------
 1 file changed, 417 deletions(-)
 delete mode 100644 differential-dataflow/examples/scc_proxy.rs

diff --git a/differential-dataflow/examples/scc_proxy.rs b/differential-dataflow/examples/scc_proxy.rs
deleted file mode 100644
index baf9890c1..000000000
--- a/differential-dataflow/examples/scc_proxy.rs
+++ /dev/null
@@ -1,417 +0,0 @@
-//! SCC with the proxy join tactic substituted for the cursor tactic.
-//!
-//! Identical computation to `examples/scc.rs` — same `propagate_at`, same dataflow
-//! shape, same filter/map stages — except `trim_edges`' two joins run through
-//! `join_with_tactic` with a value-token proxy backend over the same `ValSpine`
-//! arrangements. This is the proxy tactics' first exercise inside a real dataflow:
-//! nested iterative scopes, `Product` timestamps, fuel-drained interleaved units.
-//!
-//! Usage: scc_proxy [timely args] [nodes [edges [batch [rounds]]]]
-
-use std::collections::hash_map::DefaultHasher;
-use std::hash::{Hash, Hasher};
-use std::mem;
-
-use timely::dataflow::operators::probe::Handle;
-use timely::order::Product;
-use timely::progress::frontier::AntichainRef;
-use timely::progress::Timestamp;
-
-use differential_dataflow::algorithms::graphs::propagate::propagate_at;
-use differential_dataflow::consolidation::consolidate_updates;
-use differential_dataflow::input::Input;
-use differential_dataflow::lattice::Lattice;
-use differential_dataflow::operators::arrange::arrangement::Arranged;
-use differential_dataflow::operators::arrange::TraceAgent;
-use differential_dataflow::operators::int_proxy::{
-    JoinInstance, JoinWindow, ProxyJoinBackend, ProxyJoinTactic,
-};
-use differential_dataflow::operators::iterate::Variable;
-use differential_dataflow::operators::join::{join_with_tactic, Fresh};
-use differential_dataflow::trace::implementations::ValSpine;
-use differential_dataflow::trace::{Cursor, Navigable, TraceReader};
-use differential_dataflow::collection::AsCollection;
-use differential_dataflow::VecCollection;
-
-use mimalloc::MiMalloc;
-
-#[global_allocator]
-static GLOBAL: MiMalloc = MiMalloc;
-
-type Diff = isize;
-
-/// The batch type of a `ValSpine` arrangement.
-type BatchOf<K, V, T> = <ValSpine<K, V, T, Diff> as TraceReader>::Batch;
-
-/// A value-token proxy join backend over two `ValSpine` arrangements sharing key `K`:
-/// `Group = K` (exact — no hashing), tokens are the values themselves, and `logic`
-/// shapes output exactly as `join_core`'s closure would.
-struct SpineJoinBackend<K, V1, V2, T, D, L> {
-    window: usize,
-    target: usize,
-    logic: L,
-    phantom: std::marker::PhantomData<(K, V1, V2, T, D)>,
-}
-
-impl<K, V1, V2, T, D, L> SpineJoinBackend<K, V1, V2, T, D, L> {
-    fn new(logic: L) -> Self {
-        SpineJoinBackend { window: 1024, target: 1 << 16, logic, phantom: std::marker::PhantomData }
-    }
-}
-
-/// Group-ordered scanning state over one side's batch cursors.
-struct SideCursors<C> {
-    cursors: Vec<C>,
-}
-
-impl<C> Default for SideCursors<C> {
-    fn default() -> Self {
-        SideCursors { cursors: Vec::new() }
-    }
-}
-
-impl<C> SideCursors<C> {
-    fn start<B>(&mut self, batches: &[B])
-    where
-        B: Navigable<Cursor = C>,
-    {
-        if self.cursors.len() != batches.len() {
-            self.cursors = batches.iter().map(|b| b.cursor()).collect();
-        }
-    }
-}
-
-/// Advance a time to the (singleton, per the tactic) lower frontier.
-fn advance<T: Lattice + Clone>(t: &T, lower: AntichainRef<'_, T>) -> T {
-    lower.iter().fold(t.clone(), |t, l| t.join(l))
-}
-
-/// Per-unit cursor state: a batch-cursor per batch per side.
-struct SpineJoinCursor<C0, C1> {
-    c0: SideCursors<C0>,
-    c1: SideCursors<C1>,
-}
-
-impl<C0, C1> Default for SpineJoinCursor<C0, C1> {
-    fn default() -> Self {
-        SpineJoinCursor { c0: SideCursors::default(), c1: SideCursors::default() }
-    }
-}
-
-impl<K, V1, V2, T, D, L, I> ProxyJoinBackend<BatchOf<K, V1, T>, BatchOf<K, V2, T>>
-    for SpineJoinBackend<K, V1, V2, T, D, L>
-where
-    K: differential_dataflow::Data + Copy,
-    V1: differential_dataflow::Data + Copy,
-    V2: differential_dataflow::Data + Copy,
-    T: Timestamp + Lattice + Ord + differential_dataflow::Data,
-    D: 'static,
-    I: IntoIterator<Item = D>,
-    L: FnMut(&K, &V1, &V2) -> I + 'static,
-{
-    type Group = K;
-    type Token0 = V1;
-    type Token1 = V2;
-    type R0 = Diff;
-    type R1 = Diff;
-    type ROut = Diff;
-    type Output = Vec<(D, T, Diff)>;
-    type Cursor = SpineJoinCursor<
-        <BatchOf<K, V1, T> as Navigable>::Cursor,
-        <BatchOf<K, V2, T> as Navigable>::Cursor,
-    >;
-    type Sink = Vec<(D, T, Diff)>;
-
-    fn next_window(
-        &mut self,
-        instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
-        fresh: Fresh,
-        cursor: &mut Self::Cursor,
-        reuse: Option<JoinWindow<K, V1, V2, T, Diff, Diff>>,
-    ) -> Option<JoinWindow<K, V1, V2, T, Diff, Diff>> {
-        cursor.c0.start(instance.batches0);
-        cursor.c1.start(instance.batches1);
-        let (mut run0, mut run1) = match reuse {
-            Some(JoinWindow { input0, input1 }) => (input0, input1),
-            None => (Vec::new(), Vec::new()),
-        };
-        loop {
-            run0.clear();
-            run1.clear();
-            let mut groups = 0;
-            while groups < self.window {
-                // The fresh side's next group; the accumulated side seeks to it.
-                let g = match fresh {
-                    Fresh::Input0 => cursor
-                        .c0
-                        .cursors
-                        .iter()
-                        .zip(instance.batches0)
-                        .filter_map(|(c, b)| c.get_key(b).copied())
-                        .min(),
-                    Fresh::Input1 => cursor
-                        .c1
-                        .cursors
-                        .iter()
-                        .zip(instance.batches1)
-                        .filter_map(|(c, b)| c.get_key(b).copied())
-                        .min(),
-                };
-                let Some(g) = g else { break };
-                groups += 1;
-                // Drain group g from side 0 (seeking first when it is the accumulated side).
-                for (c, b) in cursor.c0.cursors.iter_mut().zip(instance.batches0) {
-                    if matches!(fresh, Fresh::Input1) {
-                        c.seek_key(b, &g);
-                    }
-                    if c.get_key(b) == Some(&g) {
-                        while let Some(v) = c.get_val(b) {
-                            let v = *v;
-                            c.map_times(b, |t, d| run0.push(((g, v), advance(t, instance.lower), *d)));
-                            c.step_val(b);
-                        }
-                        c.step_key(b);
-                    }
-                }
-                for (c, b) in cursor.c1.cursors.iter_mut().zip(instance.batches1) {
-                    if matches!(fresh, Fresh::Input0) {
-                        c.seek_key(b, &g);
-                    }
-                    if c.get_key(b) == Some(&g) {
-                        while let Some(v) = c.get_val(b) {
-                            let v = *v;
-                            c.map_times(b, |t, d| run1.push(((g, v), advance(t, instance.lower), *d)));
-                            c.step_val(b);
-                        }
-                        c.step_key(b);
-                    }
-                }
-            }
-            if groups == 0 {
-                return None;
-            }
-            consolidate_updates(&mut run0);
-            consolidate_updates(&mut run1);
-            if run0.is_empty() && run1.is_empty() {
-                continue;
-            }
-            return Some(JoinWindow { input0: run0, input1: run1 });
-        }
-    }
-
-    fn absorb(
-        &mut self,
-        _instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
-        sink: &mut Self::Sink,
-        left: (K, V1),
-        right: (K, V2),
-        time: T,
-        diff: Diff,
-    ) -> Option<Self::Output> {
-        for d in (self.logic)(&left.0, &left.1, &right.1) {
-            sink.push((d, time.clone(), diff));
-        }
-        if sink.len() >= self.target {
-            Some(std::mem::take(sink))
-        } else {
-            None
-        }
-    }
-
-    fn flush(
-        &mut self,
-        _instance: &JoinInstance<'_, BatchOf<K, V1, T>, BatchOf<K, V2, T>>,
-        sink: &mut Self::Sink,
-    ) -> Option<Self::Output> {
-        if sink.is_empty() {
-            None
-        } else {
-            Some(std::mem::take(sink))
-        }
-    }
-}
-
-/// `join_core` by way of the proxy tactic: same arrangements, same logic shape.
-fn proxy_join<'scope, K, V1, V2, T, D, L, I>(
-    arranged1: Arranged<'scope, TraceAgent<ValSpine<K, V1, T, Diff>>>,
-    arranged2: Arranged<'scope, TraceAgent<ValSpine<K, V2, T, Diff>>>,
-    logic: L,
-) -> VecCollection<'scope, T, D, Diff>
-where
-    K: Copy + Ord + Hash + differential_dataflow::ExchangeData,
-    V1: Copy + Ord + differential_dataflow::ExchangeData,
-    V2: Copy + Ord + differential_dataflow::ExchangeData,
-    T: Timestamp + Lattice + Ord + Clone + 'static,
-    D: differential_dataflow::Data,
-    I: IntoIterator<Item = D> + 'static,
-    L: FnMut(&K, &V1, &V2) -> I + 'static,
-{
-    join_with_tactic(arranged1, arranged2, ProxyJoinTactic::new(SpineJoinBackend::new(logic)))
-        .as_collection()
-}
-
-/// `strongly_connected`, with `trim_edges`' joins run through the proxy tactic.
-///
-/// `stagger` selects the label-introduction logic: `false` is `|_| 0` (stock
-/// `strongly_connected`); `true` is `|x| x as u64` (the prioritized
-/// `strongly_connected_at` shape — the #801 trigger, with labels completing
-/// their propagation in rounds while later labels are still being introduced).
-fn strongly_connected_proxy<'scope, T>(
-    graph: VecCollection<'scope, T, (usize, usize), Diff>,
-    stagger: bool,
-) -> VecCollection<'scope, T, (usize, usize), Diff>
-where
-    T: Timestamp + Lattice + Hash + Ord,
-{
-    let outer = graph.scope();
-    outer.scoped::<Product<_, usize>, _, _>("StronglyConnectedProxy", |scope| {
-        let edges = graph.enter(scope);
-        let trans = edges.clone().map_in_place(|x| mem::swap(&mut x.0, &mut x.1));
-        let (variable, inner) = Variable::new_from(edges.clone(), Product::new(Default::default(), 1));
-        let result = trim_edges_proxy(trim_edges_proxy(inner, edges, stagger), trans, stagger);
-        variable.set(result.clone());
-        result.leave(outer)
-    })
-}
-
-fn trim_edges_proxy<'scope, T>(
-    cycle: VecCollection<'scope, T, (usize, usize), Diff>,
-    edges: VecCollection<'scope, T, (usize, usize), Diff>,
-    stagger: bool,
-) -> VecCollection<'scope, T, (usize, usize), Diff>
-where
-    T: Timestamp + Lattice + Hash + Ord,
-{
-    let outer = edges.inner.scope();
-    outer.region_named("TrimEdgesProxy", |region| {
-        let cycle = cycle.enter_region(region);
-        let edges = edges.enter_region(region);
-
-        let nodes = edges
-            .clone()
-            .map_in_place(|x| x.0 = x.1)
-            .consolidate();
-
-        let labels = if stagger {
-            propagate_at(cycle, nodes, |x| *x as u64)
-        } else {
-            // `|_| 0` (no label staggering), matching stock `strongly_connected` exactly.
-            propagate_at(cycle, nodes, |_| 0)
-        }
-        .arrange_by_key();
-
-        let step1 = proxy_join(
-            edges.arrange_by_key(),
-            labels.clone(),
-            |e1: &usize, e2: &usize, l1: &usize| [(*e2, (*e1, *l1))],
-        );
-        proxy_join(
-            step1.arrange_by_key(),
-            labels,
-            |e2: &usize, (e1, l1): &(usize, usize), l2: &usize| [((*e1, *e2), (*l1, *l2))],
-        )
-        .filter(|(_, (l1, l2))| l1 == l2)
-        .map(|((x1, x2), _)| (x2, x1))
-        .leave_region(outer)
-    })
-}
-
-fn hash_to_u64<T: Hash>(value: &T) -> u64 {
-    let mut hasher = DefaultHasher::new();
-    value.hash(&mut hasher);
-    hasher.finish()
-}
-
-fn edge_for(index: usize, nodes: usize) -> (usize, usize) {
-    let h1 = hash_to_u64(&index);
-    let h2 = hash_to_u64(&h1);
-    ((h1 as usize) % nodes, (h2 as usize) % nodes)
-}
-
-fn main() {
-    let timer = std::time::Instant::now();
-
-    timely::execute_from_args(std::env::args(), move |worker| {
-        let positional: Vec<String> = std::env::args()
-            .skip(1)
-            .filter(|a| !a.starts_with('-'))
-            .collect();
-        let nodes: usize = positional.get(0).and_then(|s| s.parse().ok()).unwrap_or(100_000);
-        let edges: usize = positional.get(1).and_then(|s| s.parse().ok()).unwrap_or(200_000);
-        let batch: usize = positional.get(2).and_then(|s| s.parse().ok()).unwrap_or(1_000);
-        let rounds: usize = positional.get(3).and_then(|s| s.parse().ok()).unwrap_or(usize::MAX);
-
-        if worker.index() == 0 {
-            println!(
-                "proxy scc — nodes: {nodes}, edges: {edges}, batch: {batch}, rounds: {}, workers: {}",
-                if rounds == usize::MAX { "∞".to_string() } else { rounds.to_string() },
-                worker.peers()
-            );
-        }
-
-        let validate = std::env::var("SCC_VALIDATE").is_ok();
-        let stagger = std::env::var("SCC_STAGGER").is_ok();
-        let mut probe = Handle::new();
-        let mut input = worker.dataflow(|scope| {
-            let (input, graph) = scope.new_collection::<(usize, usize), Diff>();
-            let scc = strongly_connected_proxy(graph.clone(), stagger);
-            if validate {
-                // Oracle: stock and proxy SCC must agree exactly, at every time.
-                use differential_dataflow::algorithms::graphs::scc::{strongly_connected, strongly_connected_at};
-                let oracle = if stagger {
-                    strongly_connected_at(graph, |x| *x as u64)
-                } else {
-                    strongly_connected(graph)
-                };
-                oracle
-                    .negate()
-                    .concat(scc.clone())
-                    .consolidate()
-                    .inspect(|x| panic!("proxy scc diverged from stock: {:?}", x))
-                    .probe_with(&mut probe);
-            }
-            scc.probe_with(&mut probe);
-            input
-        });
-
-        let index = worker.index();
-        let peers = worker.peers();
-
-        let timer_load = std::time::Instant::now();
-        for i in (0..edges).filter(|i| i % peers == index) {
-            input.insert(edge_for(i, nodes));
-        }
-        input.advance_to(1);
-        input.flush();
-        while probe.less_than(input.time()) {
-            worker.step();
-        }
-        if index == 0 {
-            println!("{:?}\t{:?}\tloaded {edges} edges", timer.elapsed(), timer_load.elapsed());
-        }
-
-        for round in 0..rounds {
-            let timer_round = std::time::Instant::now();
-            for i in (0..batch).filter(|i| i % peers == index) {
-                input.remove(edge_for(round * batch + i, nodes));
-                input.insert(edge_for(edges + round * batch + i, nodes));
-            }
-            input.advance_to(round + 2);
-            input.flush();
-            while probe.less_than(input.time()) {
-                worker.step();
-            }
-            if index == 0 {
-                println!(
-                    "{:?}\t{:?}\tround {round} ({} changes)",
-                    timer.elapsed(),
-                    timer_round.elapsed(),
-                    batch * 2
-                );
-            }
-        }
-    })
-    .unwrap();
-
-    println!("{:?}\tshut down", timer.elapsed());
-}

From 6c5a1a578cb0851b62f553e04adc5047f671b334 Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 12:05:46 -0400
Subject: [PATCH 17/18] Review fixes: assert finish() batch count; exercise the
 wave path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two items from downstream (#795) review of the substrate:

* retire's final zip would silently truncate a backend returning the
  wrong number of batches from finish(), shipping batches at the wrong
  held times. Now a hard assert (one batch per tile description),
  consistent with the harness's fail-loudly posture.

* join_key's >=16x>=16 bilinear_wave path had no in-tree exercise —
  every key in the property suite was small, and the SCC example that
  covered the path was pruned. join_wave_path_matches_naive builds one
  deliberately fat key (20 presented records per side: spread-time
  insertions plus non-cancelling retractions, so consolidation keeps
  all of them) alongside a small key, so both join_key paths run in
  one unit, against the naive oracle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/reduce.rs         |  6 ++-
 differential-dataflow/tests/int_proxy.rs      | 42 +++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/differential-dataflow/src/operators/int_proxy/reduce.rs b/differential-dataflow/src/operators/int_proxy/reduce.rs
index e11c64877..688ada2d6 100644
--- a/differential-dataflow/src/operators/int_proxy/reduce.rs
+++ b/differential-dataflow/src/operators/int_proxy/reduce.rs
@@ -470,7 +470,11 @@ where
         // silent wrong output in exchange for one integer compare.
         assert_eq!(pend_idx, pending_keys.len(), "next_window must cover all pending groups before finishing");
         self.pending = new_pending;
-        let produced: Vec<(B1::Time, B2)> = tile_held.into_iter().zip(self.backend.finish()).collect();
+        let finished = self.backend.finish();
+        // Hard for the same reason as the other contract asserts: `zip` would silently
+        // truncate a miscounting backend, shipping batches at the wrong held times.
+        assert_eq!(finished.len(), tile_held.len(), "finish() must return exactly one batch per tile description");
+        let produced: Vec<(B1::Time, B2)> = tile_held.into_iter().zip(finished).collect();
         let mut frontier = Antichain::new();
         for times in self.pending.values() {
             for t in times {
diff --git a/differential-dataflow/tests/int_proxy.rs b/differential-dataflow/tests/int_proxy.rs
index ce89b35c2..95482cda5 100644
--- a/differential-dataflow/tests/int_proxy.rs
+++ b/differential-dataflow/tests/int_proxy.rs
@@ -464,6 +464,48 @@ pub mod pair {
 
 // ----------------------------------------------------------------- the tests
 
+#[test]
+fn join_wave_path_matches_naive() {
+    // `join_key` switches implementations at 16 records per side: below, a nested-loop
+    // cross product; at or above (on BOTH sides), the `bilinear_wave` time-ordered
+    // compacting replay. Every other key in this suite is small, so this test exists to
+    // run the wave path at all: one deliberately fat key (20 presented records per
+    // side — insertions at spread times plus non-cancelling retractions at later
+    // times, so consolidation keeps all of them), alongside a small key so the two
+    // paths mix within one unit, checked against the naive oracle.
+    let mut a_upds: Vec<(Edge, Time, Diff)> = Vec::new();
+    let mut b_upds: Vec<(Edge, Time, Diff)> = Vec::new();
+    for v in 0..12u32 {
+        a_upds.push(((0, v), (v % 4) as Time, 1));
+        b_upds.push(((0, 100 + v), (v % 3) as Time, 1));
+    }
+    for v in 0..8u32 {
+        // Retractions at times distinct from the insertions: two bridge records each,
+        // netting to zero late — cancellation the wave must navigate, not lose.
+        a_upds.push(((0, v), 4 + (v % 2) as Time, -1));
+        b_upds.push(((0, 100 + v), 4 + (v % 3) as Time, -1));
+    }
+    // A small key too, so nested-loop and wave paths run in the same unit.
+    a_upds.push(((1, 7), 0, 1));
+    b_upds.push(((1, 9), 2, 1));
+
+    let a = batch(a_upds.clone(), 0, 8);
+    let b = batch(b_upds.clone(), 0, 8);
+    assert!(a.updates.iter().filter(|u| u.0 .0 == 0).count() >= 16, "fat key must reach the wave threshold");
+    assert!(b.updates.iter().filter(|u| u.0 .0 == 0).count() >= 16, "fat key must reach the wave threshold");
+    let expected = naive_join(&a.updates, &b.updates);
+
+    for window in [1, 100] {
+        for fresh in [Fresh::Input0, Fresh::Input1] {
+            let mut tactic = ProxyJoinTactic::new(EdgeJoinBackend::new(window));
+            let work = tactic.prep(vec![a.clone()], vec![b.clone()], fresh, 0);
+            let mut got: Vec<((Edge, Edge), Time, Diff)> =
+                work.flatten().map(|(l, r, t, d)| ((l, r), t, d)).collect();
+            consolidate_updates(&mut got);
+            assert_eq!(got, expected, "window={window}");
+        }
+    }
+}
 
 #[test]
 fn join_matches_naive() {

From bff410b1b5bae4b3bda63614b4db249f4ec27acf Mon Sep 17 00:00:00 2001
From: Frank McSherry <fmcsherry@me.com>
Date: Thu, 23 Jul 2026 12:18:47 -0400
Subject: [PATCH 18/18] JoinUnit: give the fields their structure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review feedback: the unit had become a flat 13-field bag with no
visible organization — one field accreted per protocol change, none of
them prompting reorganization. The grouping that was missing is the
protocol itself, so the type now displays it:

* Task — the immutable work description (batches, fresh side,
  capability time), with the JoinInstance construction as its method.
* The shared backend and the two per-unit state halves it interprets:
  cursor (read resumption) and sink (output staging).
* Phase — the window machine, previously three fields in a trench coat
  (done + flushed + current: Option): Fetch, Merge(window, i, j),
  Drained, Spent. next() is now a match over it, and the
  can't-flush-twice property is the state graph rather than a boolean
  to reason about.
* spent + high — the harness's reuse stash and ascending-window
  watermark; h0/h1 merge scratch; ready the output queue.

WindowFor<B0, B1, Bk> names the bridge type that was previously
spelled out six-parameters-long at each use. No behavioral change;
the suite is the witness.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/operators/int_proxy/join.rs           | 244 ++++++++++--------
 1 file changed, 140 insertions(+), 104 deletions(-)

diff --git a/differential-dataflow/src/operators/int_proxy/join.rs b/differential-dataflow/src/operators/int_proxy/join.rs
index aa2bf3da5..b3e357414 100644
--- a/differential-dataflow/src/operators/int_proxy/join.rs
+++ b/differential-dataflow/src/operators/int_proxy/join.rs
@@ -136,17 +136,12 @@ where
 {
     fn prep(&mut self, input0: Vec<B0>, input1: Vec<B1>, fresh: Fresh, meet: B0::Time) -> Box<dyn Iterator<Item = Bk::Output>> {
         Box::new(JoinUnit {
+            task: Task { input0, input1, fresh, lower: Antichain::from_elem(meet) },
             backend: std::rc::Rc::clone(&self.backend),
-            input0,
-            input1,
-            fresh,
-            lower: Antichain::from_elem(meet),
             cursor: Bk::Cursor::default(),
             sink: Bk::Sink::default(),
+            phase: Phase::Fetch,
             high: None,
-            done: false,
-            flushed: false,
-            current: None,
             spent: None,
             h0: IdHistory::new(),
             h1: IdHistory::new(),
@@ -155,48 +150,87 @@ where
     }
 }
 
-/// One lazy join unit: owns its batches and streams outputs a key at a time.
-///
-/// Each `next` first drains `ready`; when empty it advances the unit by one step —
-/// fetching the next window if none is in progress, or merge-matching **one** key from
-/// the window in progress, feeding each match to the backend's `absorb` (which yields
-/// containers at its own granularity; the final remainder comes from `flush` when the
-/// unit exhausts). Matches are never staged in the harness: peak state is one window's
-/// presentations, plus one key's yielded containers in `ready` (a fanout-F key at
-/// container target t enqueues F/t containers in one step), plus the sink's partial.
-///
-/// Spent windows are handed back to the backend through `next_window`'s `reuse`
-/// argument, and the replay histories (`h0`/`h1`) live on the unit, so steady-state
-/// operation allocates only what the backend's own representations require.
-///
-/// `lower` is the capability's time, a lower bound on the fresh side's times, so the
-/// accumulated side loads compacted (see [`JoinInstance`]); every output is produced under
-/// that capability, so advancing loaded times by it leaves the output unchanged.
-struct JoinUnit<B0: BatchReader, B1: BatchReader<Time = B0::Time>, Bk: ProxyJoinBackend<B0, B1>> {
-    backend: std::rc::Rc<std::cell::RefCell<Bk>>,
+/// The bridge type a backend `Bk` presents for batches `B0`/`B1` — [`JoinWindow`] at
+/// the backend's tokens and the batches' time. Named to keep the unit's fields legible.
+type WindowFor<B0, B1, Bk> = JoinWindow<
+    <Bk as ProxyJoinBackend<B0, B1>>::Group,
+    <Bk as ProxyJoinBackend<B0, B1>>::Token0,
+    <Bk as ProxyJoinBackend<B0, B1>>::Token1,
+    <B0 as BatchReader>::Time,
+    <Bk as ProxyJoinBackend<B0, B1>>::R0,
+    <Bk as ProxyJoinBackend<B0, B1>>::R1,
+>;
+
+/// The immutable description of a unit's work: both batch lists, which side is fresh,
+/// and the capability's time (a lower bound on the fresh side's times, so the
+/// accumulated side loads compacted — see [`JoinInstance`]; every output ships under
+/// that capability, so advancing loaded times by it leaves the output unchanged).
+struct Task<B0: BatchReader, B1> {
     input0: Vec<B0>,
     input1: Vec<B1>,
     fresh: Fresh,
     lower: Antichain<B0::Time>,
-    /// Backend-interpreted resumption state; `Default` at the unit's start.
+}
+
+impl<B0: BatchReader, B1: BatchReader<Time = B0::Time>> Task<B0, B1> {
+    /// The borrowed view of the task that every backend call receives.
+    fn instance(&self) -> JoinInstance<'_, B0, B1> {
+        JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() }
+    }
+}
+
+/// Where a unit stands in its march through the backend's windows.
+enum Phase<W> {
+    /// No window in progress; ask the backend for the next one.
+    Fetch,
+    /// Merging through a window, one key per step; the `usize`s are the merge
+    /// positions into its two bridges.
+    Merge(W, usize, usize),
+    /// The backend returned `None`: windows are exhausted, final `flush` not yet taken.
+    Drained,
+    /// `flush` taken; the iterator is spent and yields only `None`.
+    Spent,
+}
+
+/// One lazy join unit: owns its batches and streams outputs a key at a time.
+///
+/// Each `next` first drains `ready`; when empty it advances `phase` by one step —
+/// fetching the next window, or merge-matching **one** key from the current one,
+/// feeding each match to the backend's `absorb` (which yields containers at its own
+/// granularity; the final remainder comes from `flush` at `Drained`). Matches are
+/// never staged in the harness: peak state is one window's presentations, plus one
+/// key's yielded containers in `ready` (a fanout-F key at container target t enqueues
+/// F/t containers in one step), plus the sink's partial.
+///
+/// The fields group by owner. The *task* is the immutable work description. The
+/// *backend* is shared by every live unit of the operator, so the two state halves it
+/// interprets — `cursor` (read resumption) and `sink` (output staging) — live here,
+/// per unit; a shared sink would ship one unit's matches in another's containers (see
+/// [`ProxyJoinBackend::Sink`]). The harness owns the window *machine*: `phase`,
+/// the `high` watermark enforcing ascending windows, and the `spent` window awaiting
+/// return to the backend for buffer reuse. `h0`/`h1` are merge *scratch*, reloaded
+/// per key (only the >=16/>=16 wave path touches them) so high-fanout keys pay no
+/// per-key allocation. `ready` is the *output* queue toward the driver.
+struct JoinUnit<B0, B1, Bk>
+where
+    B0: BatchReader,
+    B1: BatchReader<Time = B0::Time>,
+    Bk: ProxyJoinBackend<B0, B1>,
+{
+    // The work.
+    task: Task<B0, B1>,
+    // The shared backend, and the two per-unit state halves it interprets.
+    backend: std::rc::Rc<std::cell::RefCell<Bk>>,
     cursor: Bk::Cursor,
-    /// Backend-interpreted output staging; unit-owned so interleaved units cannot
-    /// contaminate each other's containers (see [`ProxyJoinBackend::Sink`]).
     sink: Bk::Sink,
-    /// Greatest group presented so far, to enforce ascending windows.
+    // The harness's window machine.
+    phase: Phase<WindowFor<B0, B1, Bk>>,
     high: Option<Bk::Group>,
-    done: bool,
-    /// Whether the end-of-unit `flush` has been taken.
-    flushed: bool,
-    /// The window in progress and the merge positions into its two bridges.
-    current: Option<(JoinWindow<Bk::Group, Bk::Token0, Bk::Token1, B0::Time, Bk::R0, Bk::R1>, usize, usize)>,
-    /// The previous, fully-processed window, awaiting return to the backend for reuse.
-    spent: Option<JoinWindow<Bk::Group, Bk::Token0, Bk::Token1, B0::Time, Bk::R0, Bk::R1>>,
-    /// Per-key replay histories, held across the unit and reloaded per key (only the >=16/>=16
-    /// replay-wave path touches them), so a high-fanout join pays no per-key `IdHistory` alloc.
+    spent: Option<WindowFor<B0, B1, Bk>>,
+    // Per-key merge scratch, reused across keys and windows.
     h0: IdHistory<Bk::Token0, B0::Time, Bk::R0>,
     h1: IdHistory<Bk::Token1, B0::Time, Bk::R1>,
-    /// Outputs produced but not yet handed to the driver: at most one key's containers.
+    // Outputs not yet handed to the driver: at most one key's containers.
     ready: std::collections::VecDeque<Bk::Output>,
 }
 
@@ -211,78 +245,80 @@ where
         while self.ready.is_empty() {
             let backend = self.backend.clone();
             let mut backend = backend.borrow_mut();
-            let instance = JoinInstance { batches0: &self.input0, batches1: &self.input1, lower: self.lower.borrow() };
+            let instance = self.task.instance();
+
+            match &mut self.phase {
+                Phase::Spent => return None,
 
-            // Exhausted: take this unit's final partial container, exactly once.
-            if self.done && self.current.is_none() {
-                if self.flushed {
-                    return None;
+                // Take this unit's final partial container, exactly once.
+                Phase::Drained => {
+                    self.phase = Phase::Spent;
+                    return backend.flush(&instance, &mut self.sink);
                 }
-                self.flushed = true;
-                return backend.flush(&instance, &mut self.sink);
-            }
 
-            // Fetch the next window if none is in progress, returning the spent one.
-            if self.current.is_none() {
-                match backend.next_window(&instance, self.fresh, &mut self.cursor, self.spent.take()) {
-                    None => {
-                        self.done = true;
-                    }
-                    Some(window) => {
-                        super::debug_assert_sorted_bridge(&window.input0, "next_window.input0");
-                        super::debug_assert_sorted_bridge(&window.input1, "next_window.input1");
-                        // Progress guard: an empty window cannot advance the watermark, so a
-                        // backend emitting them repeatedly would spin this loop forever. Skip
-                        // fully-cancelled ranges internally, or return `None`.
-                        assert!(
-                            !window.input0.is_empty() || !window.input1.is_empty(),
-                            "next_window: windows must present at least one record",
-                        );
-                        let first = window.input0.first().map(|r| r.0.0).into_iter().chain(window.input1.first().map(|r| r.0.0)).min();
-                        let last = window.input0.last().map(|r| r.0.0).into_iter().chain(window.input1.last().map(|r| r.0.0)).max();
-                        super::assert_ascending_window(&mut self.high, first, last, "join");
-                        self.current = Some((window, 0, 0));
+                // Ask for the next window, returning the spent one for buffer reuse.
+                Phase::Fetch => {
+                    match backend.next_window(&instance, self.task.fresh, &mut self.cursor, self.spent.take()) {
+                        None => self.phase = Phase::Drained,
+                        Some(window) => {
+                            super::debug_assert_sorted_bridge(&window.input0, "next_window.input0");
+                            super::debug_assert_sorted_bridge(&window.input1, "next_window.input1");
+                            // Progress guard: an empty window cannot advance the watermark, so a
+                            // backend emitting them repeatedly would spin this loop forever. Skip
+                            // fully-cancelled ranges internally, or return `None`.
+                            assert!(
+                                !window.input0.is_empty() || !window.input1.is_empty(),
+                                "next_window: windows must present at least one record",
+                            );
+                            let first = window.input0.first().map(|r| r.0.0).into_iter().chain(window.input1.first().map(|r| r.0.0)).min();
+                            let last = window.input0.last().map(|r| r.0.0).into_iter().chain(window.input1.last().map(|r| r.0.0)).max();
+                            super::assert_ascending_window(&mut self.high, first, last, "join");
+                            self.phase = Phase::Merge(window, 0, 0);
+                        }
                     }
                 }
-                continue;
-            }
 
-            // Merge-match at most ONE key from the window in progress, so `ready` holds at
-            // most one key's containers. Each match goes straight to the backend's `absorb`
-            // — no staging — which yields containers at its own granularity, including
-            // *within* a high-fanout key's wave.
-            let (window, i, j) = self.current.as_mut().unwrap();
-            let p0 = &window.input0;
-            let p1 = &window.input1;
-            let (h0, h1) = (&mut self.h0, &mut self.h1);
-            let ready = &mut self.ready;
-            let sink = &mut self.sink;
-            let mut emit = |l: (Bk::Group, Bk::Token0), r: (Bk::Group, Bk::Token1), t: B0::Time, d: Bk::ROut| {
-                if let Some(out) = backend.absorb(&instance, sink, l, r, t, d) {
-                    ready.push_back(out);
-                }
-            };
-            let mut matched = false;
-            while !matched && *i < p0.len() && *j < p1.len() {
-                let (ki, kj) = (p0[*i].0.0, p1[*j].0.0);
-                if ki < kj {
-                    *i += 1;
-                } else if kj < ki {
-                    *j += 1;
-                } else {
-                    let mut e0 = *i;
-                    while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
-                    let mut e1 = *j;
-                    while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
-                    join_key(ki, p0, *i..e0, p1, *j..e1, h0, h1, &mut emit);
-                    *i = e0;
-                    *j = e1;
-                    matched = true;
+                // Merge-match at most ONE key, so `ready` holds at most one key's
+                // containers. Each match goes straight to the backend's `absorb` — no
+                // staging — which yields containers at its own granularity, including
+                // *within* a high-fanout key's wave.
+                Phase::Merge(window, i, j) => {
+                    let p0 = &window.input0;
+                    let p1 = &window.input1;
+                    let (h0, h1) = (&mut self.h0, &mut self.h1);
+                    let ready = &mut self.ready;
+                    let sink = &mut self.sink;
+                    let mut emit = |l: (Bk::Group, Bk::Token0), r: (Bk::Group, Bk::Token1), t: B0::Time, d: Bk::ROut| {
+                        if let Some(out) = backend.absorb(&instance, sink, l, r, t, d) {
+                            ready.push_back(out);
+                        }
+                    };
+                    let mut matched = false;
+                    while !matched && *i < p0.len() && *j < p1.len() {
+                        let (ki, kj) = (p0[*i].0.0, p1[*j].0.0);
+                        if ki < kj {
+                            *i += 1;
+                        } else if kj < ki {
+                            *j += 1;
+                        } else {
+                            let mut e0 = *i;
+                            while e0 < p0.len() && p0[e0].0.0 == ki { e0 += 1; }
+                            let mut e1 = *j;
+                            while e1 < p1.len() && p1[e1].0.0 == ki { e1 += 1; }
+                            join_key(ki, p0, *i..e0, p1, *j..e1, h0, h1, &mut emit);
+                            *i = e0;
+                            *j = e1;
+                            matched = true;
+                        }
+                    }
+                    if *i >= p0.len() || *j >= p1.len() {
+                        match std::mem::replace(&mut self.phase, Phase::Fetch) {
+                            Phase::Merge(window, _, _) => self.spent = Some(window),
+                            _ => unreachable!("phase was Merge above"),
+                        }
+                    }
                 }
             }
-            if *i >= p0.len() || *j >= p1.len() {
-                self.spent = self.current.take().map(|(w, _, _)| w);
-            }
         }
         self.ready.pop_front()
     }