LazyAgent：需求驱动的智能体程序物化与物理优化

# Demand-Driven Materialization and PhysicalOptimization of Agentic Programs
Source: [https://arxiv.org/html/2609.23058](https://arxiv.org/html/2609.23058)
## LazyAgent: Demand\-Driven Materialization and Physical Optimization of Agentic Programs

###### Abstract

Current agent runtimes that plan before acting execute on one rule: once a step is ready, run it\. We present LazyAgent, to our knowledge the first unified execution framework for agent\-authored programs organized around a live, goal\-derived demanded set\. Prior work contains individual pieces — lazy evaluation, output\-rooted pruning, stopping, scheduling, projection, and caching — but no agent runtime makes one request\-relative set govern both permission to execute and the physical operations that follow\. LazyAgent differs by refreshing a backward closure from requested outputs as execution state changes and executing a ready node only when the active goal requires it\. This turns selection from repeated local judgments into one backward analysis, linear in graph size, followed by constant\-time membership tests — allowing plans to remain broad while execution stays goal\-specific\.

This shift makes broad predefined workflows cheap to describe and selective to execute\. On programs that describe more than the current request needs, LazyAgent consistently outperforms the strongest goal\-stopping eager baseline by refusing unrelated work before it starts\. Adding one unrelated product raises the eager bill by22\.5%22\.5\\%and LazyAgent’s by0\.0%0\.0\\%\. This saves 42\.0% of measured CPU on production scientific workflows and 51\.7% of container time on a live release gate spanning four repositories\. On that gate, LazyAgent avoids all work for unrequested issues whether or not the requested issue is eventually fixed; goal stopping avoids none while it remains open, because stopping requires success\. As a fairness check, we also prove and verify exact equivalence when the request reaches the whole graph under matched execution conditions, leaving no unrelated work for either semantics to avoid\.

Beyond permission, projection also saves measured cost: on two third\-party test suites LazyAgent can save up to approximately90%90\\%of a shared step while the identical eager control saves0\.0%0\.0\\%\(Section[8\.1](https://arxiv.org/html/2609.23058#S8.SS1)\)\. The advantage disappears when the omitted output has no other consumer or the request needs it\. Ordering, reuse, and pruning also save under favorable visit order, repeated requests, or an explicit prune rule, but do not replace permission\. These operations provide an initial controlled map, not an exhaustive account of what the semantics enables\.

Finally, we establish that today’s public benchmarks are eager\-shaped by design and therefore cannot exercise demand\-driven semantics\. A pre\-registered planning intervention did not broaden them, so we report this narrowness without claiming its cause\. Meanwhile industry is moving toward predefined and scheduled workflows, which makes evaluating non\-eager execution increasingly important\. Future benchmark researchers should examine how much of a predefined program each request actually needs\.

## 1Introduction

Two execution disciplines dominate current agent systems\. In the first, an agent invents its next action from a running scratchpad, as in ReAct\[[47](https://arxiv.org/html/2609.23058#bib.bib47)\]: reason over the trajectory, take one action, observe, and reason again\. The canonical loop has no predeclared graph to slice and selects one action at a time\. Our ReAct baseline makes one cost of that choice explicit: it re\-reads the complete accumulated trajectory at each step, so without context truncation or prefix reuse, trajectory tokens grow linearly per turn and sum quadratically over the run\. This is the accounting of our explicit baseline, not a theorem about every ReAct implementation\. In the second discipline, the agent writes a plan before all observations exist and a runtime executes it, as in ReWOO\[[46](https://arxiv.org/html/2609.23058#bib.bib46)\]and LLMCompiler\[[22](https://arxiv.org/html/2609.23058#bib.bib22)\], reprising the declare\-then\-execute discipline of dataflow systems\[[1](https://arxiv.org/html/2609.23058#bib.bib1)\]\. The planned family is inspectable before execution, exposes concurrency, and is auditable afterwards\.

Eager execution also carries a cost that is rarely stated\. A conventional dataflow scheduler implements

ready⁡\(n\)⟹execute⁡\(n\),\\mathrm\{ready\}\(n\)\\;\\Longrightarrow\\;\\mathrm\{execute\}\(n\),so every node the planner writes down becomes a bill\. For sub\-millisecond pure functions that is the right default\. When a node is a frontier\-LLM call, a simulation, a test suite, or a container build, the planner has been handed the authority to spend money by writing prose: the plan is a set of options, and the scheduler silently exercises all of them\.

LazyAgent instead makes that implication a policy decision\. We separate*readiness*, a property of the graph, from*materialization*, a decision relative to what is currently being asked for:

ready≠materialized\.\\textsc\{ready\}\\;\\neq\\;\\textsc\{materialized\}\.A node may be well\-typed, dependency\-satisfied, and free of failing guards, and still remain abstract because the active goal does not demand it\. That is the*permission*layer\. The ingredients have clear precedents: lazy evaluation and build systems use closure, Helium prunes a fixed workflow backward from designated outputs, dynamic schedulers stop from predicates, and the operation literature covers reordering, projection, pruning, reuse, fidelity, fusion, and speculation \(Section[4](https://arxiv.org/html/2609.23058#S4)\)\. These are component precedents, not a framework precedent\. To our knowledge, LazyAgent is the first agent\-execution framework in which a request\-derived closure is recomputed after observations, constitutes permission rather than mere readiness, and becomes the common reference set for every later physical operation and cost comparison, while the same state model carries independent safety constraints\. Once permission admits nodes, those operations decide which runs first, how much output becomes concrete, whether a still\-legal option is declined, whether an earlier artifact can satisfy it, and whether an irreversible effect is authorized\. One state and action model therefore covers pieces that prior systems expose separately\.

#### Why the decision cannot be made node by node\.

This invites an obvious objection: keep the eager loop, and simply ask at each ready node whether that node ought to run\. Three obstacles stand in the way:relevance is a global graph property; checking every node has its own cost; and useful work may still be unrequested\.Together they motivate the mechanism\.Membership is not local\.Whether a nodennmatters is whether some path leads fromnnto a node the goal named — a reachability property of the graph, not a property ofnnand its neighborhood\. A local test must therefore either guess, or first propagate the goal backward through the graph; and the second is the closure itself, so a correct local test is this algorithm wearing a different interface\.Checking every node consumes part of the saving\.Consider first a guard\-valid graphG=\(V,E\)G=\(V,E\), whereVVis the set of program nodes,EEits data, guard, and ordering edges, andD⊆VD\\subseteq Vthe demanded set for the current goal\. Letc⁡\(n\)c\(n\)be the cost of materializing nodennandq⁡\(n\)q\(n\)the cost of asking a perfect local oracle whethernnshould run\. LetSSdenote net cost saved relative to an eager executor that runs every node inVV\. Then

Sclosure=∑n∈V∖Dc⁡\(n\),Scheck=∑n∈V∖Dc⁡\(n\)−∑n∈Vq⁡\(n\)\.S\_\{\\mathrm\{closure\}\}=\\sum\_\{n\\in V\\setminus D\}c\(n\),\\qquad S\_\{\\mathrm\{check\}\}=\\sum\_\{n\\in V\\setminus D\}c\(n\)\-\\sum\_\{n\\in V\}q\(n\)\.The first quantity is LazyAgent’s saving: the execution cost of every node outside the goal’s closure\. The second is the best a per\-node checker could save, even if it never makes a mistake: it avoids the same nodes but paysq⁡\(n\)q\(n\)for every node, including those it keeps\. ThusScheck=Sclosure−∑n∈Vq⁡\(n\)S\_\{\\mathrm\{check\}\}=S\_\{\\mathrm\{closure\}\}\-\\sum\_\{n\\in V\}q\(n\); if checking is itself a model call andq⁡\(n\)∼c⁡\(n\)q\(n\)\\sim c\(n\), most or all of the saving disappears\.

ComputingDDinstead is one backward graph traversal\. With adjacency lists, each node and edge is visited at most once, so each recomputation costsO⁡\(\|V\|\+\|E\|\)O\(\|V\|\+\|E\|\)time andO⁡\(\|V\|\)O\(\|V\|\)space, with no model calls\. The traversal stores one demand bit per node; reading that bit when the node becomes ready is thereforeO⁡\(1\)O\(1\)— by construction, not by an empirical assumption\.Useful is not requested\.A local judge still sees ready work that is cheap and genuinely valuable: repairing an unrequested defect is useful, but not required for this goal\. Only backward reachability represents that distinction\.

The algorithm is therefore backward reachability, with the same direction as backward induction rather than greedy local choice\. Cheap global analysis followed by constant\-time decisions removes execution cost, tokens, and waiting time for unrequested nodes\. More importantly, it lets a planner describe a much wider graph without forcing the runtime to execute that width\.

#### Why this is not early stopping\.

A well\-engineered eager executor already checks whether the goal is met and halts\. This is a real mechanism, implemented in recent dynamic schedulers\[[45](https://arxiv.org/html/2609.23058#bib.bib45)\], and it is the baseline we hold ourselves to throughout:stop\_eager\. The difference is what the executor consults\. Early stopping evaluates a*predicate*—*are we done yet?*Demand\-driven materialization evaluates a*set*—*is this ready node on any path required by what was asked for?*A predicate can only stop the future; a set can also excuse the present\. When a graph contains ready work that no goal\-relevant path passes through, early stopping avoids it only if the scheduler happens to reach the goal before offering it, which is a property of node ordering rather than of the program\.

#### Why public benchmarks cannot exercise this mechanism\.

Separating readiness from permission also supplies a measuring instrument for the evidence base itself, and the first thing it measures is how little of a plan lies outside its request\. A node\-level census finds almost nothing outside the request: 137 of 139 planned nodes across the multi\-goal plans are demanded by some ticket \(98\.6%\),27 of 28plans contain no unrequested work, and the pool arenas equal their own backward closure \(Section[5](https://arxiv.org/html/2609.23058#S5)\)\.

That follows from the question these corpora were built to ask\. Each poses a single request and scores whether an agent can satisfy it, so the plan is written for that request and everything in it is needed by construction\. None was built to ask the complementary question — whether an agent can decline work nobody asked for — which is what demand\-driven execution exists to answer\. A review of 445 language\-model benchmarks documents the general concern: 42\.6% reuse existing benchmark data, and the authors warn that reuse can constrain construct validity\[[9](https://arxiv.org/html/2609.23058#bib.bib9)\]\. Here the specific missing variable is the share of a program outside the current request\. Existing corpora pin it near zero, so eager and demand\-driven execution must agree there; Proposition[2](https://arxiv.org/html/2609.23058#Thmproposition2)proves the tie, which we report as a prediction rather than a failure\. A further economic explanation — that readiness billing*additionally*suppresses breadth, so a planner told breadth is free would describe more of it — is testable, and did not survive the test \(Section[7\.5](https://arxiv.org/html/2609.23058#S7.SS5)\)\.

#### The regime is arriving in industry ahead of the benchmarks\.

Two product trends converge on the case current corpora omit\. Agent frameworks and enterprise platforms now use*authored graphs*with branches and parallel paths, where a model call is one step rather than the whole program\[[24](https://arxiv.org/html/2609.23058#bib.bib24),[28](https://arxiv.org/html/2609.23058#bib.bib28),[5](https://arxiv.org/html/2609.23058#bib.bib5)\]\. Separately, products trigger agent tasks from schedules and repository or messaging events\[[33](https://arxiv.org/html/2609.23058#bib.bib33),[6](https://arxiv.org/html/2609.23058#bib.bib6)\], and vendors now pursue goals “across days and weeks instead of completing only a task or interaction”\[[38](https://arxiv.org/html/2609.23058#bib.bib38)\]\. When an authored graph is reused across such narrower invocations, the two trends create the separation region: one graph broader than any request, invoked for different subsets\.

Workflow products that specify their execution semantics advertise deterministic, explicitly defined paths as a feature\[[28](https://arxiv.org/html/2609.23058#bib.bib28),[5](https://arxiv.org/html/2609.23058#bib.bib5)\]\. Determinism governs*what a step does when it runs*, not*whether this request needs it*; a scheduled workflow serving several purposes can therefore pay for all of them on every invocation\. We make no performance or prevalence claim about these products\. They establish the ingredients of the regime and explain why it is increasingly relevant; they do not establish that every platform combines them\.

#### Why the operations need the same discipline\.

Once permission decides which nodes may run, is any further optimization of*how*they run attributable to demand\-awareness, or a scheduling gain any eager executor could take? Fitting a policy that skips or reorders agent work does not settle it: LLM\-as\-Scheduler adapts workflow routing and EnumGRPO searches quality–cost query plans\[[45](https://arxiv.org/html/2609.23058#bib.bib45),[31](https://arxiv.org/html/2609.23058#bib.bib31)\], while Helium\[[41](https://arxiv.org/html/2609.23058#bib.bib41)\]schedules semantically equivalent operators for serving efficiency\. LazyAgent contributes a different attribution test\. We report each operation’s*demand\-specific remainder*— its worth tolazyminus the worth of the identical mechanism on a matched eager arm\. A lazy\-only column with no matched eager row shows that an operation works, not that demand made it work\.

#### What this paper contributes\.

We believe this work contributes six things to the study of agent execution:

1. 1\.The first unified execution framework for agent\-authored programs organized around a live demanded set \(Section[3](https://arxiv.org/html/2609.23058#S3)\): request\-derived permission distinct from readiness; closure recomputation after observations; one state and action model for physical operations and independent commit constraints; a policy factored into permission, order, and projection; four cross\-policy invariants; and three propositions predicting equivalence, separation, and order invariance\.
2. 2\.A vocabulary of eight operations over the demanded set — reorder, project, prune, reuse, fidelity, fusion, speculation, and commit — each stated with the matched control it requires \(Section[3\.7](https://arxiv.org/html/2609.23058#S3.SS7)\)\.
3. 3\.A diagnosis ofnear\-complete request coveragein the evidence base \(Sections[1](https://arxiv.org/html/2609.23058#S1)and[5](https://arxiv.org/html/2609.23058#S5)\): public agent benchmarks contain almost no off\-path work, because each scores whether one request can be satisfied rather than whether unrequested work can be declined\. They therefore pin the variable demand\-driven execution acts on near zero and cannot exercise the mechanism under study\. A paired planning\-only intervention additionally rules out the tempting economic explanation, finding no evidence that stating demand\-billed rather than readiness\-billed execution makes one planner describe broader graphs \(Section[7\.5](https://arxiv.org/html/2609.23058#S7.SS5)\)\.
4. 4\.Six public arenas and a family of composed programs \(Section[5](https://arxiv.org/html/2609.23058#S5)\), each labeled by which of three preconditions it meets\.
5. 5\.An empirical demarcation of where permission pays and where it provably cannot \(Section[7](https://arxiv.org/html/2609.23058#S7)\), against the strongest goal\-stopping baseline\. Where the request reaches the whole graph, both semantics are identical to the integer — predicted before measuring\. Where the program is wider than the request, the eager bill carries that width as a factor and the demand\-driven bill does not, so breadth stops being a budget decision\. Goal stopping recovers part of that difference under a kind visit order and none of it while the goal stays open\.
6. 6\.A discipline for attributing physical optimizations to demand\-awareness rather than to scheduling \(Sections[8](https://arxiv.org/html/2609.23058#S8)and[7\.10](https://arxiv.org/html/2609.23058#S7.SS10)\): each operation is scored by its*demand\-specific remainder*— worth tolazyminus the worth of the identical mechanism on a matched eager arm, signed and allowed to come out negative\. The remainders sort the operation space rather than tally wins: those narrowing how much of a demanded node becomes concrete add to permission, those removing which nodes run are partial substitutes for it, and speculation placeslazyandeagerat two ends of one dial\.

## 2Motivating example

Imagine a company entrusts routine release execution to an AI release maintainer\. Its engineering team has encoded the write–review–build–deploy process as a reusable dependency graph: rules for preparing the environment, generating and reviewing patches, running tests, and deploying approved changes\. The graph may be much broader than any one release request because it records the company’s full operating procedure\.

Today three issues are eligible for the next release\. Each has several candidate patches, any one of which may pass, and all depend on one expensive environment build — checkout, dependency installation, and test harness\. The eventual release needs all three issues closed, but a human operator gives the AI maintainer a narrower goal:*ship issue one now*\. The standing graph does not change; only its active goal does\.

Three execution policies carry the comparisons throughout the paper\. Two of them turn on*guards*\. A guard is a condition the program records on a step —*verify this patch only if it applied cleanly*— that reads a result from an upstream step\. It is*unresolved*while that result does not yet exist, and it*fails*once the result contradicts it, which makes the step it protects useless; declining a step whose guard has failed is the one refusal every runtime already makes\.guard\_eagerruns every dependency\-ready node whose guards have not failed\. Here no candidate’s guard fails, so once the environment is ready it runs every candidate branch for all three issues\.stop\_eagerfollows the same rule while the goal remains open, then refuses new work after issue one obtains a passing patch\.lazyuses the same guards and stopping test but adds permission: a ready node runs only if the backward closure of the active goal reaches it\. Here that closure contains the environment build, issue one’s candidates, and their verification, but not the other issue branches\.

The distinction matters while the AI agent executes the plan\.guard\_eagerpays for all three branches\.stop\_eageravoids an unrequested branch only when the scheduler happens to offer it after issue one succeeds; before then, the goal is open and the policy has no reason to refuse it\.lazyrefuses both unrequested branches from the start, under every visit order\. This permission decision requires no additional LLM call: once the graph and human\-defined goal are present, the runtime computes the closure by graph traversal and applies a membership test at each ready node\. A frontier model may still generate the candidate patches, but it is not repeatedly asked which branch should execute\.

When the full release is requested later, the same graph runs with a goal naming all three issues and the policies bill identically\. Deferral changed neither the program nor the acceptance criterion; it preserved the plan while avoiding model calls and container tests irrelevant to today’s goal\. Figure[1](https://arxiv.org/html/2609.23058#S2.F1)shows the two structures behind that result: a disjunctive candidate pool inside the goal’s closure, where nothing can be refused in advance, and ready branches outside it, where only goal\-relative permission refuses work reliably\. The same program also hosts the physical operations: candidate order, projected test output, explicit pruning, and reuse of an earlier environment\.

env buildpatch cand\. Apatch cand\. Bissue 1 fixedissue 2 patchissue 2 fixedissue 3 patchshaded = backward closure of the goal \(*demanded*\)dashed = ready but outside the active goal \(*refused by demand*\)

Figure 1:The two permission regions in one program\. Inside the closure the candidate patches form a disjunctive pool: either may be the one that satisfies the goal, so nothing there can be refused in advance, andlazyandstop\_eagermust tie\. Outside the closure the other issues’ branches are ready but outside today’s request; only demand refuses them reliably, whilestop\_eagerskips them when the visit order is kind and pays for them when it is not\.This shape recurs whenever a standing program has several independently useful products and a human or upstream service asks an agent for a subset: the release gate above; a data\-science plan whose cleaned table, trained model, and report are separately requestable; a scientific workflow with several outputs; or a build graph in which one target is requested from a package\. Section[7](https://arxiv.org/html/2609.23058#S7)measures all four on real recorded costs\.

## 3Execution model

### 3\.1Programs

A program is a graphGGof typed nodes\. Each node carries an identifier, a task specification, input bindings, ordering dependencies, guards, and a lifecycle state\. An input binding is either a literal value or a field reference\(u,p\)\(u,p\): the identifieruuof an upstream node and a dot\-separated field pathppinto that node’s output\. At runtime the reference resolves to fieldppofuu’s materialized value, so a data edge can demand one field rather than the whole output\. A guard likewise names an upstream node, field path, comparison operator, and value, and resolves to holds, fails, or unresolved\. Each task specification declares a resource vector over wall time, CPU seconds, dollars, and tokens, plus an effect class distinguishing reversible from irreversible work\.

Lifecycle states are

planned→ready→demanded→materializing→materialized,\\textsc\{planned\}\\to\\textsc\{ready\}\\to\\textsc\{demanded\}\\to\\textsc\{materializing\}\\to\\textsc\{materialized\},withskipped,cancelled,failed,pruned, andblockedas additional terminals\. The two middle states are*transient*: a node entersreadywhen the engine offers it anddemandedwhen the policy accepts it on demand, and a node the policy declines returns toplanned, to be offered again when progress occurs\. Readiness is thus a fact aboutGGalone, recomputed every wave; demand is relative to the current goal\. At the end of a run a node that was never demanded is thereforeplanned, and the metrics report it under the terminal*reason**never\-demanded*, so “we declined to run it,” “a guard proved it irrelevant,” and “we burned a still\-legal option on purpose” stay three different facts\. Terminal reasons partition the nodes that were never materialized — never\-demanded, skipped, cancelled, pruned, blocked — whilematerializedandfailedare the two paid outcomes, and a failed attempt is charged in full\.

### 3\.2State, actions, and demand

In plain terms, a materialization state is the complete runtime snapshot used to answer the next execution question: what exists, what is wanted, what has already happened, what each choice costs, and what is authorized\.

###### Definition 1\(Materialization state\)\.

A materialization state is

σ=⟨G,R,A,O,C,B⟩,\\sigma=\\langle\\,G,\\;R,\\;A,\\;O,\\;C,\\;B\\,\\rangle,whereGGis the program,RRthe root demand \(what the run is*for*\),AAthe artifacts produced so far,OOthe observations \(node states and resolved guard predicates\),CCthe declared resource vectors, andBBthe commit constraints over irreversible nodes\.

This tuple is our state abstraction, not a claimed standard, nor the only possible decomposition\. It is operationally sufficient for every decision studied here:GGsupplies the available work and dependencies;RRdistinguishes two requests against the same program;AAandOOdetermine readiness, goal satisfaction, and resolved branches;CCsupplies prices known before execution; andBBsupplies authorization that neither readiness nor demand implies\. Omitting any category would merge runtime situations that can require different legal decisions\. We do not claim the tuple is mathematically minimal\.GGmay grow when a host agent emits work;CCis*declared*, not measured, so a policy never sees a cost it could not have known; and unresolved guards in partialOOfail open, never licensing refusal\.

The following four actions are*our engine’s transition interface*, not a catalog of optimization operations\. They cover the possible outcomes when the engine considers work: execute the offered node, postpone it without closing the option, close it permanently, or rewrite the graph\. In the table,nnis the offered node,ϕ\\phithe set of output fields to materialize,mmthe selected materializer implementation \(and hence possibly its fidelity\), andτ\\taua typed, semantics\-preserving graph transformation\. The currently offerednnis implicit inDefer\\mathrm\{Defer\}\.

The action interface and the operation catalog answer different questions\. Reordering chooses whichnnis offered before an action is taken; projection and fidelity supplyϕ\\phiandmmtoMaterialize\\mathrm\{Materialize\}; prune is already a direct action; fusion and substitution can be represented byTransform⁡\(τ\)\\mathrm\{Transform\}\(\\tau\); reuse may satisfy a demand from an existing artifact instead of invoking a new materializer; speculation changes which work permission admits; and commit constrains whether an irreversibleMaterialize\\mathrm\{Materialize\}action is legal\. Thus the four actions describe state transitions, whereas Section[3\.7](https://arxiv.org/html/2609.23058#S3.SS7)describes policies and mechanisms that choose or parameterize them\.

A*goal form*supplies two things: root nodes and required fields \(an empty field set means the whole value\), and a satisfaction predicate over the resulting graph\. We implement three forms:AllOutputs, a conjunction satisfied when every named node is materialized;AnyAcceptable, a disjunction satisfied by the first payload passing an acceptance predicate and demanding every candidate because any might work; andEachOf, a conjunction of subgoals that may themselves be disjunctive — several products, each satisfiable by several candidates\. These are not claimed to exhaust possible goals\. They are the smallest basis required by this paper’s arenas: conjunction, disjunction, and a conjunction of disjunctions; a new goal may implement the same two interfaces without changing the engine\.

###### Definition 2\(Demanded set\)\.

Letσ=⟨G,R,A,O,C,B⟩\\sigma=\\langle G,R,A,O,C,B\\ranglebe a materialization state \(Definition[1](https://arxiv.org/html/2609.23058#Thmdefinition1)\), and writeN⁡\(G\)N\(G\)for the nodes ofGG\. The*demanded set*

dem⁡\(R,σ\)⊆N⁡\(G\)\\mathrm\{dem\}\(R,\\sigma\)\\subseteq N\(G\)is the smallest setSSsuch that

1. 1\.every root demand named byRRbelongs toSS;
2. 2\.ifn∈Sn\\in Sandeeis a data edge, guard edge, or ordering edge intonn, then the producer ofeebelongs toSS, provided that producer is present inGG, is not already terminal underOO, and does not have guards resolving to*fails*\.

Equivalently,dem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\)is the backward closure ofRRinGGalong those three edge kinds, truncated at settled or dead producers\.

#### What it costs to know the demanded set\.

Definition[2](https://arxiv.org/html/2609.23058#Thmdefinition2)is a reachability query, computed rather than estimated\. One reverse traversal from the roots ofRRvisits each node and edge at most once —O⁡\(\|N⁡\(G\)\|\+\|E\|\)O\(\|N\(G\)\|\+\|E\|\)pointer operations, no materializer invoked and no model consulted — leaving a set\-membership test at each node\. Two consequences carry\. Permission’s overhead is negligible againstc⁡\(n\)c\(n\)whenever the materializer is a model call, a container build, or a simulation, so the closure can be refreshed before each sequential permission question and between concurrent waves\. This keepsdem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\)a function of the current state rather than of the state at launch\. And membership is a property ofGGandRR, not of any node’s neighborhood, so no test local tonndecides it without reconstructing the same closure: a correct per\-node check computes this set, and an incorrect one is a heuristic whose errors run in the direction that costs money\.

Three properties carry weight later\. The closure is*field\-granular*, since a field reference contributes only its own path upstream, which is what makes projection expressible; it includes*guard producers*, since a node feeding only a guard is still needed to decide the branch; and it is refreshed before the next sequential decision or concurrent wave, since a resolved guard can remove an entire upstream cone\.

#### Demand is a set at a state, and the state moves\.

Definition[2](https://arxiv.org/html/2609.23058#Thmdefinition2)is stated over the whole stateσ\\sigmarather than overGGandRRalone, so it survives every way the state can change\. Three cases exhaust them\.

###### Lemma 1\(Monotonicity under fixed program and ask\)\.

FixGGandRRand consider a run segment with no graph transformation or growth, request change, or artifact invalidation\. Letσ0,σ1,…\\sigma\_\{0\},\\sigma\_\{1\},\\ldotsbe its states under any policy and selector\. Thendem⁡\(R,σt\+1\)⊆dem⁡\(R,σt\)\\mathrm\{dem\}\(R,\\sigma\_\{t\+1\}\)\\subseteq\\mathrm\{dem\}\(R,\\sigma\_\{t\}\)for everytt\. In particular, a node outside the demanded set at any state of the segment remains outside it later in that segment\.

###### Proof sketch\.

WithGGandRRfixed, the roots of the closure are fixed, and a step of the run can changeOOin only two ways: a producer becomes terminal, or a guard resolves\. Both are truncation conditions in Definition[2](https://arxiv.org/html/2609.23058#Thmdefinition2), so each can only remove members from the closure, never add them\. Readiness plays no part in the definition, so a node becoming ready changes nothing\. ∎

The second case is*growth ofGG*: a host emits new work, the closure is recomputed over the larger graph, and a node formerly outside it can enter only through an edge that did not previously exist — demanded work from the moment the edge is, billed to every arm alike, with the engine treating an emission as a plan resynchronization\. The third is a*change of ask*: a new ticket arrives against a standing program,RRchanges, and the closure is recomputed from new roots\. Demand is therefore a property of a*request against a program*rather than of a program: oneGGunder ticketsR1,R2,…R\_\{1\},R\_\{2\},\\ldotshas a sequence of demanded sets, with Lemma[1](https://arxiv.org/html/2609.23058#Thmproposition1)holding inside each\. Every measurement here is a special case — the pool and workflow arenas fixGGandRR, DataSciBench and the portfolios fixGGand varyRRacross runs, and the lifecycle gym variesRRwithin one standingGG\.

### 3\.3Policies

###### Definition 3\(Policy\)\.

A policy factors as

π=⟨πperm,πorder,πproj⟩,\\pi=\\langle\\,\\pi\_\{\\mathrm\{perm\}\},\\;\\pi\_\{\\mathrm\{order\}\},\\;\\pi\_\{\\mathrm\{proj\}\}\\,\\rangle,whereW⁡\(σ\)W\(\\sigma\)is the dependency\-ready set available to be offered,πorder:\(W,σ\)→seq⁡\(W\)\\pi\_\{\\mathrm\{order\}\}:\(W,\\sigma\)\\to\\operatorname\{seq\}\(W\)ranks that set through the selector,πperm:\(n,σ,D\)→\{0,1\}\\pi\_\{\\mathrm\{perm\}\}:\(n,\\sigma,D\)\\to\\\{0,1\\\}decides whether an offered node may materialize, withD=dem⁡\(R,σ\)D=\\mathrm\{dem\}\(R,\\sigma\)consulted only by demand\-aware permission, andπproj:\(n,σ\)→ϕ\\pi\_\{\\mathrm\{proj\}\}:\(n,\\sigma\)\\to\\phidecides how much of an admitted node must become concrete\.

This tuple isolates the three axes whose effects the paper must not confound:*whether*a ready node may run,*which*ready candidate is offered first, and*how much*output an admitted node produces\. Ordering precedes permission because permission is evaluated against the state current at each offer: an earlier materialization may satisfy the goal before a later candidate is considered\. This is neither a unique factorization nor an exhaustive catalog of policy choices\. In particular, choosing materializermmis the optional fidelity operation rather than a fourth core axis; prune, reuse, fusion, speculation, and commit likewise act through or around the transition interface defined above\. We keep the three\-axis tuple because every arm has a permission rule, an ordering rule, and an output projection, including when the last two use defaults\. Holding the functions fixed makes each intervention identifiable even though ordering can change the state at which later permission questions are asked\. We further requireπperm\\pi\_\{\\mathrm\{perm\}\}to be*cost\-blind*: it may read guards, satisfaction, and demand membership, but never declared cost\. We verify this by permuting declared costs and checking that permission does not change\.

The four reference permission policies are:

lazyis*stopping plus membership*: it applies the same satisfaction test asstop\_eagerand then additionally consults the demanded set\.

Algorithm[1](https://arxiv.org/html/2609.23058#alg1)assembles the pieces into the sequential reference loop used by the primary cost comparisons\. The engine orders dependency\-ready candidates before asking permission; each permission rule then applies its own guard, stopping, and demand tests\.BackwardClosureis the whole demand mechanism\. It invokes no materializer and consults no model, and each node and edge enters the frontier at most once, so refreshing demand before the next offer is affordable\.

Algorithm 1Sequential materialization under policyπ=⟨πperm,πorder,πproj⟩\\pi=\\langle\\pi\_\{\\mathrm\{perm\}\},\\pi\_\{\\mathrm\{order\}\},\\pi\_\{\\mathrm\{proj\}\}\\rangle\. Permission owns guards, stopping, and demand; the commit barrier is independent of it\. Underlazy,πperm\(n,σ,D\)=\[n∈D\]\\pi\_\{\\mathrm\{perm\}\}\(n,\\sigma,D\)=\[\\,n\\in D\\,\]after guard and satisfaction checks\.1:program

GG, root demand

RR, policy

π\\pi, commit barriers

BB
2:

A←∅A\\leftarrow\\emptyset⊳\\trianglerightnodes offered since the last progress event

3:whiletruedo

4:

W←\{n:n​is dependency\-ready in​σ\}∖AW\\leftarrow\\\{\\,n:n\\text\{ is dependency\-ready in \}\\sigma\\,\\\}\\setminus A
5:if

W=∅W=\\emptysetthen

6:break

7:endif

8:

n←First​\(πorder​\(W,σ\)\)n\\leftarrow\\textsc\{First\}\(\\pi\_\{\\mathrm\{order\}\}\(W,\\sigma\)\);

A←A∪\{n\}A\\leftarrow A\\cup\\\{n\\\}
9:

D←BackwardClosure​\(R,σ\)D\\leftarrow\\textsc\{BackwardClosure\}\(R,\\sigma\)if permission is demand\-aware;

∅\\emptysetotherwise

10:if

πperm​\(n,σ,D\)=0\\pi\_\{\\mathrm\{perm\}\}\(n,\\sigma,D\)=0then

11:

SettleRefusal​\(n\)\\textsc\{SettleRefusal\}\(n\)⊳\\trianglerightguard failure skips; otherwise defer

12:elseif

nnis irreversible and no released barrier in

BBcovers

nnthen

13:

Block​\(n\)\\textsc\{Block\}\(n\)⊳\\trianglerightinvariant I2; independent of permission

14:else

15:

Materialize​\(n,πproj​\(n,σ\),m\)\\textsc\{Materialize\}\(n,\\pi\_\{\\mathrm\{proj\}\}\(n,\\sigma\),m\)
16:

SyncPlan​\(G\)\\textsc\{SyncPlan\}\(G\)⊳\\trianglerightincorporate observations and newly emitted work

17:endif

18:ifstate or graph made progressthen

19:

A←∅A\\leftarrow\\emptyset
20:endif

21:endwhile

22:

23:procedureBackwardClosure\(

R,σR,\\sigma\)

24:

S←Roots​\(R\)S\\leftarrow\\textsc\{Roots\}\(R\); frontier

Q←SQ\\leftarrow S
25:while

Q≠∅Q\\neq\\emptysetdo

26:pop

nnfrom

QQ
27:for alldata, guard, and ordering edges

u→nu\\to nin

GGdo

28:if

u∉Su\\notin Sand

uuis present, nonterminal, and has no guard resolving*fails*then

29:

S←S∪\{u\}S\\leftarrow S\\cup\\\{u\\\}; push

uuonto

QQ
30:endif

31:endfor

32:endwhile

33:return

SS⊳\\trianglerightO⁡\(\|V\|\+\|E\|\)O\(\|V\|\+\|E\|\); each node and edge entered at most once

34:endprocedure

#### Parallel extension\.

Parallel execution first snapshots the dependency\-ready wave, then offers and launches its admitted members without forming another wave from an in\-flight result\. After the wave completes, the engine updates state and refreshes demand before scheduling the next wave\. Sequential execution instead incorporates each completion before selecting the next node\. This is why concurrency weakens goal stopping: siblings already in flight cannot be recalled when one closes the goal\. The primary cost comparisons use the sequential mode; the speculation study explicitly measures parallel rounds\.

### 3\.4Permission is constitutive

A policy is lazy iffπperm\\pi\_\{\\mathrm\{perm\}\}is demand membership — iff a ready node can be refused because the active goal does not reach it\. No other component has this property: ordering ranks candidates before permission evaluates them, projection narrows an admitted node,Prune\\mathrm\{Prune\}declines one, reuse serves one from a cache, and each is equally well defined whenπperm\\pi\_\{\\mathrm\{perm\}\}is eager\. Three consequences follow, all enforced by the engine\. Every arm labeledlazycarries demand permission\. An arm applying an operation on top of an eager rule — cheapest\-first ordering, projection, pruning, reuse, or another operation — is a matched*control*, never a LazyAgent configuration\. And since each operation is definable on both arms, its absolute saving is not evidence about LazyAgent — only the demand\-specific remainder is\.

### 3\.5Cross\-policy invariants

Here an*invariant*is a condition held fixed or enforced across every policy arm, so a cost difference cannot be purchased by changing correctness, safety, or accounting\. These are experimental contracts rather than quantities claimed constant during every state transition\. The engine enforces four\.I1, goal:a run is correct only if the goal is satisfied on the executed graph, judged identically for every policy; cost is never reported without matched quality\.I2, safety:an irreversible node materializes only under a released commit barrier, and a node with no covering barrier is refused; deferral is not a safety mechanism and is not credited as one\.I3, denominator:every policy is compared over the same program, and a node materialized under a projection is still charged its whole declared cost in the denominator; materialization ratio isMR=materialized cost/planned cost\\mathrm\{MR\}=\\text\{materialized cost\}/\\text\{planned cost\}, and*wasted*materialization ratio is the share of a policy’s own materialized cost that lay outside the goal’s closure and so fed no answer — zero forlazyby construction, and for an eager arm the price of the distinction this paper draws\.I4, separated reasons:never\-demanded, guard\-false skip, upstream\-failure cancellation, explicit prune, and barrier block are five distinct terminal reasons that partition the unmaterialized part of the denominator; the paid part ismaterializedorfailed, and the two parts together reconcile to the planned cost\.

### 3\.6Predictions

LetMπ​\(σ\)M\_\{\\pi\}\(\\sigma\)be the set of nodes on which policyπ\\piinvokesMaterialize\\mathrm\{Materialize\}fromσ\\sigmaonward, including attempts that fail and are charged\. The body gives proof sketches to keep the model readable; Appendix[C](https://arxiv.org/html/2609.23058#A3)gives full proofs under the stated assumptions\.

###### Proposition 2\(Equivalence on flat disjunctive pools\)\.

From a common initial state, let the goal beAnyAcceptableover candidatesc1,…,ckc\_\{1\},\\dots,c\_\{k\}, each named as a root demand and ending an independent chain\. Suppose every node that can be offered before satisfaction lies on one of those chains and therefore belongs todem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\)\. Under a shared selector and materializers,Mlazy=Mstop\_eagerM\_\{\\texttt\{lazy\}\}=M\_\{\\texttt\{stop\\\_eager\}\}\.

###### Proof sketch\.

Every node that can be offered belongs todem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\), solazy’s membership test is vacuously true\. Both policies refuse once the goal is satisfied, and their decisions coincide pointwise under the shared selector\. ∎

###### Proposition 3\(Structural separation\)\.

FixGGandRR, letσ\\sigmabe any state of a fixed\-program run segment, and letn∉dem⁡\(R,σ\)n\\notin\\mathrm\{dem\}\(R,\\sigma\)become ready\. Thenn∉Mlazy​\(σ\)n\\notin M\_\{\\texttt\{lazy\}\}\(\\sigma\)under every selector\. If a selector offersnnwhile the goal is open, its guards have not failed, and it is reversible or covered by a released barrier, thenn∈Mstop\_eager​\(σ\)n\\in M\_\{\\texttt\{stop\\\_eager\}\}\(\\sigma\)\.

###### Proof sketch\.

By Lemma[1](https://arxiv.org/html/2609.23058#Thmproposition1),nnstays outside the demanded set at every later state of the run, andlazyinvokes materialization only under membership, so it never invokesnn\.stop\_eagerconsults guards, satisfaction, and the independent commit barrier; under the stated conditions it invokesnn\. ∎

IfGGgrows, the proposition applies again on a subsequent interval with the enlargedGGand fixedRR\. A node entering demand through a new edge is then demanded work and cannot produce separation\.

###### Corollary 4\(Stopping is order\-contingent; reachability is not\)\.

On fixedGGandRR, let an executable off\-path node become ready and eventually be offered\. Whetherstop\_eagerinvokes it depends on whether the offer precedes goal closure;lazy’s reachability decision does not\. The materialized sets can coincide only if the selector postpones every such node until after the goal closes\. With fixed, strictly positive additive node costs, the same condition is necessary for bill equality\. If the goal never closes,stop\_eagerinvokes every such node it is offered\.

We therefore report ties in two kinds\. A*forced*tie occurs when the goal’s closure covers the whole graph, so no policy could have saved anything\. An*order\-contingent*tie occurs when off\-path work existed andstop\_eagerhappened not to be offered it\. The same number, two different facts\.

###### Proposition 5\(Order invariance for conjunctive goals\)\.

FixGG,RR, and a common initial state\. Suppose the goal cannot be closed by any single materialization before its whole closure has run —AllOutputs, or anEachOfin which every subgoal names exactly one candidate, so that no subgoal is a pool whose first passing member depends on visit order\. Suppose materializer payloads are deterministic, guards read payloads only, andGGremains fixed \(conditions C1–C3 of Section[8\.3](https://arxiv.org/html/2609.23058#S8.SS3)\); hold projection, materializer, and barrier choices fixed; and require each selector eventually to offer every ready permitted node\. If every demanded invocation succeeds, thenMlazyM\_\{\\texttt\{lazy\}\}is invariant across those selectors\.

###### Proof sketch\.

Such a goal cannot become true early, so the satisfaction test refuses no needed node\. Under C1–C3, every selector sees the same executable, nonterminal members of the closure; fairness eventually offers each one, andlazyrejects every node outside that set\. ∎

This does*not*extend to disjunctive goals: underAnyAcceptablethe first passing candidate terminates the run, so which is tried first moveslazy’s bill exactly as it movesstop\_eager’s\. AnEachOfover pools sits between: its*across\-product*part — which products run at all — is order\-invariant underlazy, since an unrequested product is refused in every order, while its*within\-pool*part varies for both arms alike\. Under the stated execution assumptions, order invariance depends on goal shape rather than on permission alone\.

#### Opportunity, capture, and remainder\.

Propositions[2](https://arxiv.org/html/2609.23058#Thmproposition2)and[3](https://arxiv.org/html/2609.23058#Thmproposition3)predict a shape, not just a sign\. OnNNequal\-cost products where the goal names one, the fraction outside the goal is\(N−1\)/N\(N\-1\)/N, so a raw saving must grow withNNeven if the policy has not improved\. Separating opportunity from achievement:

O=Cguard\_eager,offpath,Aπ=1−Cπ,offpathO,Δperm=Alazy−Astop\_eager\.O=C\_\{\\texttt\{guard\\\_eager\},\\mathrm\{offpath\}\},\\qquad A\_\{\\pi\}=1\-\\frac\{C\_\{\\pi,\\mathrm\{offpath\}\}\}\{O\},\\qquad\\Delta\_\{\\mathrm\{perm\}\}=A\_\{\\texttt\{lazy\}\}\-A\_\{\\texttt\{stop\\\_eager\}\}\.OOis the*executable opportunity*, what the full guard\-respecting eager row pays outside the requested product’s closure;AπA\_\{\\pi\}is the share policyπ\\piavoids; andΔperm\\Delta\_\{\\mathrm\{perm\}\}is permission’s additional capture beyond goal stopping\. Every paid event is classified as shared setup, demanded\-product work, or off\-path work, and the role totals reconcile to each policy’s cost\. Off\-path is goal\-relative rather than hindsight\-relative: a failed candidate inside the requested product remains demanded work\. For a physical operation, the same difference is

Δop=Alazyop−Astop\_eagerop,\\Delta\_\{\\mathrm\{op\}\}=A^\{\\mathrm\{op\}\}\_\{\\texttt\{lazy\}\}\-A^\{\\mathrm\{op\}\}\_\{\\texttt\{stop\\\_eager\}\},called its*demand\-specific remainder*\. The superscript “op” means the saving produced by adding that operation to each permission arm; it does not introduce a new capture metric\. Thus both quantities useΔ\\Delta: the subscript says whether the comparison isolates permission or one physical operation\.

#### What a planner can move, and what it cannot\.

Two results below have their*sign*fixed under the propositions’ coupled fixed\-program assumptions, whichever model writes the program\.lazyinvokes a subset of the nodesstop\_eagerinvokes, so with nonnegative additive costs its bill cannot be higher\. On conjunctive goals its invoked set is order\-invariant; under the fixed per\-node charges used in the comparison, a price heuristic therefore moves only the eager bill\. The remainder is that effect negated — negative where cheapest\-first helps the eager arm, positive where it backfires — and never a response oflazyto order\. A planner determines the amount of off\-path work and therefore the*size*of both effects, but cannot make refusing positive\-cost unasked work more expensive than performing it\.

Operations that rewrite a node’s ask carry no such guarantee\. Projection does not filter an answer already computed; it re\-runs the node under a narrower request, a different generation whose price is a fact about how one model responds to being asked for less — measurable, not derivable\. The division is therefore between results resting on a subset relation and results resting on a model’s response to a changed prompt, and only the second kind can reverse\. Section[8\.4](https://arxiv.org/html/2609.23058#S8.SS4)tests this against three planners and finds the division where this argument places it\.

### 3\.7The operation space

Permission is one operation\. Stating it alone would invite each later operation to arrive with its own scheduler and its own favorable baseline, so we name the full space and the control each requires\.

Section[7](https://arxiv.org/html/2609.23058#S7)credits the first row to permission; Section[8](https://arxiv.org/html/2609.23058#S8)measures the rest\. The individual algorithms have prior literatures; the novelty is making one live demanded set govern their legality and measuring each operation against the eager control that isolates its demand\-specific value \(Section[4](https://arxiv.org/html/2609.23058#S4)\)\.

## 4Related work

Table[1](https://arxiv.org/html/2609.23058#S4.T1)places the nearest systems on the axes defined in Section[3](https://arxiv.org/html/2609.23058#S3)\. Component precedents exist, but no prior agent runtime spans the row LazyAgent occupies: request\-derived closure over a standing program, recomputation after observations, ready\-queue and field\-level physical operations, and an independent commit barrier, all under one live demanded\-set semantics\.

Table 1:Positioning\.Goal\-relativity:S— execution is restricted to a backward closure rooted at requested or designated outputs;P— restricted by a predicate over the request, model features, or observations;—— no such restriction is established\. Other columns: ✓ present,∘\\circpartial, blank absent\. Checkmarks mark component precedents; novelty resides in the unified LazyAgent row\.†Implemented as actions and measured with matched controls \(Section[8](https://arxiv.org/html/2609.23058#S8)\), always with permission underneath thelazyarm\.

#### Demand\-driven and goal\-relative execution\.

Backward closure has established foundations in call\-by\-need\[[42](https://arxiv.org/html/2609.23058#bib.bib42)\], its natural semantics\[[25](https://arxiv.org/html/2609.23058#bib.bib25)\], demand\-driven evaluation\[[37](https://arxiv.org/html/2609.23058#bib.bib37)\], dependency\-directed rebuilding\[[14](https://arxiv.org/html/2609.23058#bib.bib14)\], program slicing\[[43](https://arxiv.org/html/2609.23058#bib.bib43)\], and goal\-relative build systems\[[30](https://arxiv.org/html/2609.23058#bib.bib30)\]\. However, those formulations do not combine the four conditions agentic programs add: planners extend the graph during execution, observations change closure membership, satisfaction is judged rather than timestamp\-compared, and nodes spend money or commit irreversible effects\. LazyAgent makes closure well defined, linear\-time to recompute, and enforceable as permission under all four, with equivalence and separation regions measurable in real workloads\.

#### Agentic execution and cost\.

Helium is the closest output\-rooted precedent in an agent workflow: it prunes a query plan backward from fixed outputs, then consolidates and schedules the remaining operators\[[41](https://arxiv.org/html/2609.23058#bib.bib41)\]\. However, LazyAgent derives closure from each active request against a standing program, recomputes it after observations, and makes it common runtime permission for physical operations and commit barriers — not one fixed logical\-plan rewrite\.

LLM\-as\-Scheduler conditions early exit, repair, and rerouting on observations\[[45](https://arxiv.org/html/2609.23058#bib.bib45)\]; tool\-call necessity estimates whether one call is warranted\[[44](https://arxiv.org/html/2609.23058#bib.bib44)\]; and LOTUS makes the semantic operator the unit of optimization\[[36](https://arxiv.org/html/2609.23058#bib.bib36)\]\. However, they ask whether to stop or route, make one call, or configure an operator; LazyAgent computes the complete request\-relative set authorized to run\. The answers coincide in pools \(Proposition[2](https://arxiv.org/html/2609.23058#Thmproposition2)\) and separate on ready off\-path work \(Proposition[3](https://arxiv.org/html/2609.23058#Thmproposition3)\)\.

EnumGRPO provides component precedents for our physical\-operation study by searching projection width, operator placement, and relation\-level selectivity under a joint quality\-cost objective\[[31](https://arxiv.org/html/2609.23058#bib.bib31)\]\. However, it asks which variant wins; ours asks what the live goal authorizes and subtracts the identical eager mechanism’s effect from every lever\. The signed remainder attributes value to demand rather than merely finding a cheaper setting\.

Other work reduces inference cost without graph\-demand semantics\. FrugalGPT adapts prompts, approximates models, or conditionally adds calls in a cheap\-to\-expensive cascade\[[12](https://arxiv.org/html/2609.23058#bib.bib12)\]; RouteLLM sends each query to one selected model before generation\[[32](https://arxiv.org/html/2609.23058#bib.bib32)\]\. These methods choose how many or which model calls answer a query; permission decides which nodes of an already described workflow the current goal reaches\. The levels compose, which is also why our comparisons hold the model fixed\.

#### Operations and their sources\.

Adaptive reordering under revised estimates is classical query processing\[[7](https://arxiv.org/html/2609.23058#bib.bib7),[17](https://arxiv.org/html/2609.23058#bib.bib17)\]\. Reuse and cache validity are the subject of incremental computation: dynamic dependence graphs, change propagation, and memoization identify stale and unaffected subcomputations\[[3](https://arxiv.org/html/2609.23058#bib.bib3),[4](https://arxiv.org/html/2609.23058#bib.bib4),[18](https://arxiv.org/html/2609.23058#bib.bib18)\]; differential dataflow extends this to partially ordered versions and nested iteration\[[27](https://arxiv.org/html/2609.23058#bib.bib27),[2](https://arxiv.org/html/2609.23058#bib.bib2)\]\. That literature asks what is*stale*after an input changes; permission asks what is*wanted*after the request changes\. A node can be current and still not owed\.

Serving\-layer reuse shares attention state through paged KV memory, declared prompt modules, or automatic prefix matching\[[23](https://arxiv.org/html/2609.23058#bib.bib23),[16](https://arxiv.org/html/2609.23058#bib.bib16),[49](https://arxiv.org/html/2609.23058#bib.bib49)\]\. It makes a repeated call cheaper; artifact reuse can eliminate the call, so the mechanisms compose\. Meta\-Dataflows shares exploratory work across jobs\[[11](https://arxiv.org/html/2609.23058#bib.bib11)\]; Helium applies pruning and common\-subexpression elimination to agent plans\[[41](https://arxiv.org/html/2609.23058#bib.bib41)\]; speculation exchanges redundant work for latency as speculative decoding does within a call\[[26](https://arxiv.org/html/2609.23058#bib.bib26)\]; and our static/dynamic dependency boundary follows selective applicative functors\[[29](https://arxiv.org/html/2609.23058#bib.bib29)\]\. These mechanisms are established individually; LazyAgent contributes their common request\-relative semantics and a matched\-control discipline that exposes each operation’s signed, possibly negative, demand\-specific remainder\.

## 5Arenas: public benchmarks and composed programs

Six public arenas are wired to one engine through adapters that preserve their native cost columns \(Table[2](https://arxiv.org/html/2609.23058#S5.T2)\)\. We classify an arena’s*shape*by the relationship between its active goal and the outputs its graph could produce, not by application domain\. A*pool*asks for one acceptable answer among alternatives: until one succeeds, every candidate may still be needed, so the demand closure contains the whole pool\. A*multi\-product graph*produces several independently useful outputs while the current request names only some of them; branches serving the other products can therefore fall outside the goal’s closure\. A*build graph*asks for one native target inside a larger package, and its dependencies form that target’s closure while unrelated package targets remain outside it\. Three arenas are pools, WfCommons and DataSciBench are multi\-product, and Bazel supplies the exploratory build\-graph domain; it is not an agentic workload, and every claim resting on it is labeled accordingly\.

These arenas are a controlled map of the mechanism’s boundary, not an exhaustive account of where demand\-driven execution may help\. Public corpora supply natural graphs, costs, outcomes, and the important cases where we predict no saving\. The composed portfolios and authored gyms deliberately vary the structure those corpora hold nearly constant; we label every such construction and retain native costs wherever they exist\. They demonstrate causal conditions, not how often those conditions occur in deployment\. Nor do we claim that LazyAgent beats every eager executor with every heuristic: the primary comparison is the strongest goal\-stopping eager baseline, and each physical operation receives a matched eager control\. An eager executor given the same correct goal closure would make the same permission decisions — it would, in effect, have implemented the mechanism studied here\.

Table 2:Arenas\. Cost columns are arena\-native and never rescaled; “live” means the materializer ran real code or a real model during our measurement\.#### Three preconditions, declared before the results\.

The semantics is sharp enough to state its own payoff conditions in advance, and we fix them here before any arena is scored\. The mechanism pays exactly where three conditions hold together: the program must contain work that is*ready but not demanded*, since permission refuses only what lies outsidedem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\); that work must be*physically separable*, so a step can do part and skip the rest; and the skipped part must be*expensive enough*that removing it survives the accounting\. Where all three hold we predict a positive remainder\. Where any one fails we predict exactly zero — not a small effect to be argued over, but an identity\. Because the list is fixed in advance, the zeros below are commitments the theory makes and then meets, rather than losses reported after the fact; Section[9](https://arxiv.org/html/2609.23058#S9)reads the two groups against each other\.

#### What current corpora hold constant\.

Permission’s opportunity has an exact measure — the share of the graph a request does not reach — so the evidence base itself becomes something we can quantify rather than assume\. Three features of current evaluation hold that share near zero\. First, pool tasks keep every candidate relevant until one succeeds; depth does not help, because every rung remains a possible witness\. Second, single\-request evaluation asks whether an agent solves one task rather than how one standing program serves a sequence of narrower requests\. Third, the planning prompt enumerates the current output files and asks for a plan of that task, so the object being authored is anchored to the request by construction\. The resulting near\-complete coverage is visible in the data: pool closures contain every candidate, while among 28 multi\-goal DataSciBench plans, 137 of 139 nodes \(98\.6%\) are demanded by some ticket and27 of 28contain no work outside those requests\. A controlled prompt intervention below changes the stated billing semantics without changing that coverage \(Section[7\.5](https://arxiv.org/html/2609.23058#S7.SS5)\), so we do not attribute this narrowness to billing\.

These corpora do exactly what they were built to do: establish whether an agent can produce and execute a correct plan\. What they hold nearly constant is the independent variable of this paper — the requested share of a standing program\. Proposition[2](https://arxiv.org/html/2609.23058#Thmproposition2)therefore predicts exact ties on their pool strata\. To test separation rather than rediscover that zero, we compose native tasks into multi\-product programs and build authored gyms that switch one precondition at a time; every result identifies which topology, request grouping, price, or outcome came from us\.

#### Portfolios from native costs\.

A SimulCost program bundles several design studies from one physics family; a Defects4J program bundles several repair targets from one project\. Each product is anAnyAcceptablepool and the program goal isEachOfover products, so one program contains a disjunctive equivalence region*inside*a conjunctive separation region\. The topology is authored; the costs are native and unmodified\. At widthN=3,4,5,6N=3,4,5,6this yields 893, 667, 535, and 443 programs\. Every product position is requested in turn, every zero row is retained, and an all\-products request is carried as a control that must tie exactly\.

#### A live release gate\.

Over SWE\-bench we build the program of Section[2](https://arxiv.org/html/2609.23058#S2): three issues in one repository, a real agent attempting candidate patches, each candidate run in a Docker container that installs the repository, applies the patch, and executes the test suite\. The cost is measured container time — a cloud bill, not a transcribed trace\. Repositories are drawn by a deterministic stratified sampler after an early run selected only Astropy by taking the head of an alphabetical list\.

#### Authored gyms\.

Two gyms isolate the physical operations\. Prices are declared*before*anything runs, so ordering claims are ex\-ante rather than transcribed from recorded runtime, and their magnitudes are reported as controlled factorial shapes, never as measurements of a real system\. The*engineering gym*contains:*screening*, three demanded alternatives ready after a cheap checkout — a static check \(2 CPU units\), an external review \(25\), and the full test suite \(200\) — underAnyAcceptable;*profile*, a shared node producing a cheap pass/fail summary and an expensive execution trace, with a second consumer \(a coverage report\) named in the program text; a prune family, a fidelity ladder, a fusion pair, a speculation family, and a family ofKKcontingent irreversible actions behind commit barriers\. The*lifecycle gym*supplies what a single\-ask benchmark cannot: a standing graph plus an ordered list of tickets, with*session coverage*\(the share of the program’s products the whole sequence ever demands\) and*invalidation*\(the share of tickets whose upstream input changed\) as explicit axes\. Every arm is reset identically between tickets, artifacts survive only when reuse is enabled, and invalidation voids the changed node and its whole downstream cone for every arm\.

## 6Implementation and methodology

#### Engine\.

One execution engine runs every condition\. It receives the graph, goal, materializers, cost models, guards, commit barriers, event log, and selector; onlyπ\\pichanges between arms\. In sequential mode the main loop ranks the dependency\-ready set, offers its first node to the policy, incorporates any resulting observation, and then forms the next offer\. Demand\-aware permission therefore refreshes the closure before each offer\. A node is offered at most once per progress epoch and re\-offered when progress occurs, which is how a deferred node can later become demanded as guards resolve\. The default order is alphabetical by node identifier\. This is deterministic and neutral, but it meansstop\_eager’s bill depends on node naming — Corollary[4](https://arxiv.org/html/2609.23058#Thmproposition4)made visible\. A controlled renaming demonstrates the effect: sorting the undemanded branch early costsstop\_eager415, sorting it late costs 15, andlazycosts 15 either way\. Parallel mode evaluates and launches a whole ready wave before any member completes, then refreshes state and demand between waves\. This weakens goal stopping, so we report the sequential comparison — the harder case for us\.

#### Thereactarm\.

Where areactrow appears \(Section[7\.8](https://arxiv.org/html/2609.23058#S7.SS8), Appendix[B\.3](https://arxiv.org/html/2609.23058#A2.SS3)\) it is not a policy over the shared program and is not run through the matched\-control harness, because not having a program is the definition of ReAct\. It is a separate ReAct\-style executor instrumented into the same event log: it holds no plan, reasons one step, takes one action, observes, and repeats, using the same materializers so that an action costs what the same action costs under every policy\. We make it deliberately strong — an oracle\-competent agent that notices at once when an observation makes a downstream node pointless, as a guard\-respecting DAG would — and we charge it what a planned executor never pays: a deliberation turn before every action that re\-reads the growing trajectory, priced as a declared token formula that grows with the step count and kept in the token resource so it never enters a CPU or wall\-clock comparison\. Because it plans only what it reaches, its materialization ratio has no shared denominator and is never reported; it is compared on absolute cost per resource\. On single\-ask verification work it lands besidestop\_eager, since stopping when the goal is met is what both do; what it cannot do is hold a plan and refuse part of it, so under an open goal it materializes everything it reaches and ties the eager arms\.

#### Pairing and statistics\.

Every comparison is paired at the task level: the same program under two policies\. We report the mean per\-task saving with a bootstrap 95% confidence interval, the median, win/loss/tie counts, a Wilcoxon signed\-rankpp, and rank\-biserial effect size\. Goal rows drawn from one task are clustered within it, and product requests from one portfolio are averaged within the program before resampling across programs\. When every paired delta is zero we report “identical on allnn” rather than app\-value\. A pooled ratio of totals weights expensive tasks and is usually larger than the paired mean \(62\.2% versus 42\.0% on the workflow arena\); we quote paired means and label pooled figures as such\.

#### Ex\-ante cost and quality\.

Replay arenas record what work actually cost\. That number is a legitimate outcome measure but never enters a selector, because ranking by measured duration is hindsight; the authored gyms write cost before execution for the same reason\. Permission is cost\-blind, so this does not touch the permission claim\. Quality is judged identically for every arm \(an LLM judge on the live agentic arena\), and a cost is never reported without matched quality\. Costs are vectors; every comparison reduces one to a scalar, and Appendix[B\.3](https://arxiv.org/html/2609.23058#A2.SS3)shows an operation whose verdict depends on which component survives\. Elapsed time is among the reported resources; adding it changed no archived number, because every arena except the lead\-time family declares CPU only\.

#### The ordering grid\.

An ordering number measured only againststop\_eageris ambiguous, because a stopping rule is already a weak permission proxy\. We therefore cross three termination rules — none \(guard\_eager\), a stopping rule \(stop\_eager\), and demand \(lazy\) — with three orderings \(fixed, cheapest node, cheapest branch\) on the five priced arenas — the two authored gyms plus SimulCost, WfCommons and DataSciBench, which is a different set from Table[2](https://arxiv.org/html/2609.23058#S5.T2)’s six, because an ordering grid needs a cost column a selector can rank and the pool replays do not supply one per node\. The identity check on the “none” row is per task, not pooled, because a sum can hide two tasks moving in opposite directions\.

## 7Results: permission

Table[3](https://arxiv.org/html/2609.23058#S7.T3)is the permission argument in one page; every row is reported againststop\_eager, the strongest baseline\. Two regions organize the results\. We lead with*separation*: when a program is wider than the current request, demand excludes off\-path work that an eager rule may bill\. We then give the*equivalence*boundary: when the request’s closure covers the whole graph, demand has nothing to exclude and the policies must tie exactly\. The remaining subsections move the request and program shape between those regions\.

Table 3:Evidence at a glance\. One row per study, reported againststop\_eager\. The last column is the control that had to pass for the row to mean anything; every one of them did\.### 7\.1The separation region

Production scientific workflows contain ready work a goal does not require: an instance often has several output products and a consumer wants some of them\. We replay 154 WfInstances traces, 86 with more than one output product, and issue 303 seeded product requests using measured CPU seconds as the cost\.

Paired againststop\_eager,lazysaves a mean of42\.0%\(95% CI \[37\.5%, 46\.7%\]\), median 37\.0%, with211 wins, 0 losses, 92 ties,p<0\.001p<0\.001, rank\-biserial\+1\.00\+1\.00\. The wasted materialization ratio is Proposition[3](https://arxiv.org/html/2609.23058#Thmproposition3)as a measurement:stop\_eagerspends 62\.2% of what it materializes on work that never fed the answer, andlazyspends none\. The negative control is the single\-product stratum: on the 68 requests whose instance has one output product, the saving is exactly 0\.0% \(cheaper on 0/68\), because there the requested product’s closure is the whole workflow; on the 235 multi\-product requests it is 54\.2% \(cheaper on 211/235\)\.

#### Aggregate bills for this study\.

The 92 ties partition exactly as Corollary[4](https://arxiv.org/html/2609.23058#Thmproposition4)predicts\. Againstguard\_eagerall 235 multi\-product requests are cheaper, so every one of them contains off\-path work\. Sixty\-eight ties are therefore*forced*— the single\-product stratum, where there was nothing to decline — and the remaining 24 are*order\-contingent*: off\-path work existed and the alphabetical visit order happened to close the goal beforestop\_eagerwas offered it\. None of the 92 is evidence that a stopping rule suffices\.

### 7\.2The equivalence region

Proposition[2](https://arxiv.org/html/2609.23058#Thmproposition2)predicts exact ties on flat disjunctive pools, and all three software and simulation arenas have that native shape\.

On SWE\-bench Verified the two policies materialize the identical integer cost, 574,739, on every task; quality is matched in all three arenas \(445 solved, matched, and 185 solved respectively\)\. Set equality predicts the identical integer; statistical similarity would not\. Had we reported a saving here it would have been a defect: the only way to skip a pool candidate before attempting it is to consult an outcome the policy is not entitled to know\. Theguard\_eagercolumn — 78\.8%, 73\.0%, 29\.9% — shows what a paper reporting only a naive\-eager comparison would be measuring: the absence of a cheap predicate rather than the presence of a new mechanism\.

The coincidence has classical precedent\. Pingali and Arvind showed that data\-driven evaluation of a suitably transformed program “performs exactly the same computation as a demand\-driven evaluation of the original program”\[[37](https://arxiv.org/html/2609.23058#bib.bib37)\], and Weiser’s slice is “a minimal form which still produces that behavior”\[[43](https://arxiv.org/html/2609.23058#bib.bib43)\]\. Those results explain our equivalence region; LazyAgent adds the agent\-runtime semantics and experimentally maps the boundary where equivalence ends\. A pool arena is a program equal to its own slice, and the zeros follow\.

### 7\.3The shape law

Setting the goal on the 86 multi\-product instances to one product, half the products, or all products — a controlled intervention — gives 235 observations:

The all\-products row is the falsification test and it passes to the bit\. Within one\-product scopes the Spearman correlation between off\-path CPU fraction and saving is\+0\.931\+0\.931: instances under 25% off\-path save 3\.3% \(n=28n\{=\}28\), instances above 75% save 85\.1% \(n=40n\{=\}40\)\. Sweeping eight seeded ready\-wave orders isolates Proposition[5](https://arxiv.org/html/2609.23058#Thmproposition5)and Corollary[4](https://arxiv.org/html/2609.23058#Thmproposition4)\. The sweep is over a fixed slice — the first 60 one\-product requests of the population above, every arm on the same seed — and its bills are counted in*materialized tasks*rather than CPU seconds, because the question is whether the executed*set*moves, and a count answers it without weighting by task duration\.lazy’s pooled count is bit\-identical across all eight seeds \(4,082 tasks\),guard\_eager’s is too \(10,394\), andstop\_eagermoves from 7,652 to 8,132 — a 6\.0% spread that is scheduling luck\.lazy’s margin overstop\_eagerclears that spread on every seed \(46\.7–49\.8%, median 48\.6%\), so the separation is not an ordering artifact\.

### 7\.4Agent\-authored graphs

DataSciBench carries the mechanism into live, agent\-authored graphs, and is unusually well suited to it: its Data Interpreter emits an explicit dependency\-structured plan, and the benchmark evaluates generated data\-science code under task\-specific criteria\[[48](https://arxiv.org/html/2609.23058#bib.bib48)\]\. That supplies what a replayed workflow cannot — an agent\-authored graph and executable work rather than a final answer alone\. In our adaptation, an LLM plans once, real code executes each step, and individual deliverables become separate goals; an LLM judges their quality\.

The measured population is reached in two steps: of 40 candidate tasks, 3 are skipped before any arm runs because their benchmark inputs are absent or unreadable, and of the 37 attempted, 9 yield no measurement because the planner’s own generated program fails at the task level\. That leaves28 tasks and 95 goals\.

The two statistics answer two questions\. Among the33 of 95 goals with nonzero observed savings, permission saves a mean of39\.4%of real tokens, and up to 86\.7% on one goal\. This is the positive\-difference subset, not every goal whose plan contains off\-path work\. Averaged over all goals, the task\-clustered mean is 12\.8%\. The first figure describes the magnitude of observed wins; the second describes the population average\. Both are reported, and Section[9](https://arxiv.org/html/2609.23058#S9)returns to why public corpora sit close to the fully\-demanded corner\. The tie structure explains the difference\. Of the 62 ties,13 are forced: the goal’s closure covered the whole plan\. The other49 are order\-contingent: 133 planned nodes were left unrun by both arms under the recorded visit order, sostop\_eagerwas never offered work it had no principled reason to refuse\. Those 62 are not evidence the mechanism is unnecessary; they are evidence that a predicate\-based executor is one renaming away from paying\.

### 7\.5Planning incentives and graph breadth

Here off\-request work being free means*free to describe*, not free to execute\. Under demand billing, a branch outside today’s closure stays in the program but remains abstract and incurs no current bill; every node inside the closure still runs and is paid\. This creates an economic reason to favor recall — include every plausibly useful branch — over precision — include only today’s branch\. Under eager execution the same surplus runs and becomes expensive\.

We tested whether stating that incentive was enough\. In a pre\-registered, planning\-only intervention on the same 28 tasks, both prompts askedgpt\-5\.6\-terrafor a reusable program; one billed every ready step and the other only the requested closure\. Three paired repeats produced168 of 168valid plans, but no broadening: readiness billing put 4 of 482 nodes off path \(0\.8%\) and demand billing 0 of 483 \(0\.0%\), with mean plan size unchanged at 5\.74 against 5\.75\. The paired difference in each plan’s own off\-path fraction is−0\.9\-0\.9percentage points \(95% CI \[−2\.4\-2\.4,0\.00\.0\],p=0\.501p=0\.501\)\.

The null concerns the planner’s response, not the execution economics: Section[7\.7](https://arxiv.org/html/2609.23058#S7.SS7)measures the price of one additional product as\+22\.5%\+22\.5\\%understop\_eagerand\+0\.0%\+0\.0\\%underlazy\. However, these single\-request tasks anchor every named deliverable, so extra breadth can appear only as unnamed internal work\. A decisive test needs benchmarks with broad standing programs and sequences of narrower asks, where optional branches are concrete future deliverables — the regime formed when authored agent graphs are reused across scheduled or event\-driven requests \(Sections[1](https://arxiv.org/html/2609.23058#S1)and[10](https://arxiv.org/html/2609.23058#S10)\)\.

### 7\.6Both regions on one program

The composed portfolios \(Section[5](https://arxiv.org/html/2609.23058#S5)\) put a disjunctive pool inside a conjunctive program, so both regions appear under one cost column\. AtN=3N=3there are 893 programs \(764 SimulCost, 129 Defects4J\) and 3,572 rows\. Controls first:893 of 893all\-products rows tie exactly, there are0quality mismatches, and0losses anywhere\. Products within a program are ordered, and we sweep which one the goal requests\. The table below is the*settleable*stratum only — products some candidate can close, which is the stratum wherestop\_eagerhas a stopping event available and the position effect is therefore visible at all\. The open stratum, where no candidate settles, is reported separately below and shows no position dependence, because a goal that never closes gives goal stopping nothing to do at any position\.

Program, policy, cost column, and graph are fixed; the*only*thing that changes down the table is which deliverable was asked for \(Figure[2](https://arxiv.org/html/2609.23058#S7.F2)\)\. Asking for the product that sorts first is the equivalence region — an exact tie on 65 of 65 Defects4J programs and 674 of 743 SimulCost programs, becausestop\_eagerusually closes the goal before it is offered anything else\. Asking for a later product gives 74–86%, becausestop\_eagerhas already paid for the earlier ones\. Over the order\-fair sweep the settleable stratum saves 52\.5% \(SimulCost,n=2,210n\{=\}2\{,\}210\) and 51\.5% \(Defects4J,n=182n\{=\}182\)\. The open stratum — products no candidate ever settles, declared in the freeze before the numbers were seen — saves 70\.1% \(SimulCost,n=82n\{=\}82\) and 65\.5% \(Defects4J,n=205n\{=\}205\), with no ties and no losses at any position, because a goal that never closes gives goal stopping nothing to stop on wherever the product sits\. The two strata are reported apart and never blended\. Restricting instead to the lexicographically first product — one row per program, the moststop\_eager\-favorable ask in the suite — gives 12\.8%, and we give both that and the sweep mean, since quoting either alone is the same error in opposite directions\. Varying the derived shared\-setup share across0×0\\times,1×1\\times, and2×2\\timesthe program median moves the SimulCost settleable mean only from 53\.2% to 51\.9%\.

firstmiddlelast002525505075751001000074\.374\.385\.585\.57\.57\.567\.367\.383\.583\.5which of the three products the goal requestedmean saving vsstop\_eager\(%\)Defects4JSimulCostFigure 2:Same program, same policies, same cost column — only the ask changes\. Requesting the product that sorts first is the equivalence region; requesting a later product is the separation region\. A Defects4J product is a repair target; a SimulCost product is a design study\. The zero\-valued first Defects4J bar is drawn as a 1\-point stub solely for visibility; its label and reported value remain 0\.0%\.
### 7\.7Program width: opportunity versus capture

Program width is the dial that separates what an experiment manufactures from what a policy achieves\. Asking for one product of three places roughly two thirds of the program outside the goal, and one of six places five sixths, so a raw percentage must rise withNNeven where the policy has not improved\. Rerunning the construction atN=3,4,5,6N=3,4,5,6\(2,679, 2,668, 2,675, 2,658 one\-product rows; all2,538all\-products controls tie exactly\) and applying the event\-level accounting of Section[3\.6](https://arxiv.org/html/2609.23058#S3.SS6)separates four facts \(Figure[3](https://arxiv.org/html/2609.23058#S7.F3)\):

1. 1\.Experiment\-created opportunityOOrises withNN, tracking\(N−1\)/N\(N\-1\)/Nalmost exactly — 65\.1% atN=3N=3to 82\.7% atN=6N=6in the open Defects4J stratum, against 66\.7% and 83\.3%\. This is arithmetic we chose\.
2. 2\.LazyAgent captures 100%of executable off\-path cost in every arena, stratum, and width\.
3. 3\.stop\_eagercaptures 0%under open goals and approximately50%under settleable goals\.
4. 4\.100%of every nonzero cost difference between the policies is off\-path work; shared setup and requested\-product costs do not move\.

334455666060707080809090products per programNNoff\-path % of guard\-eager bill\(a\) Opportunity: set by the experiment\(N−1\)/N\(N\{\-\}1\)/NreferenceDefects4J, openSimulCost, settleable

3344556600252550507575100100products per programNN% of opportunity avoided\(b\) Capture: set by the policylazy, every stratumstop\_eager, settleablestop\_eager, repairablestop\_eager, open

Figure 3:Separating what the experiment manufactures from what the policy achieves\. Panel \(a\), the share of the guard\-eager bill outside the demanded product, tracks\(N−1\)/N\(N\{\-\}1\)/N\. Panel \(b\), the fraction of that opportunity each policy avoids, is flat inNN:lazycaptures all of it everywhere; goal stopping captures none when the demanded product cannot settle and about half when it can\.The 100%/0% split under an open goal follows directly from the two rules: when no candidate can settle the demanded product the goal never closes, sostop\_eagerhas nothing to stop on\. The near\-50% split under settleable goals is a robust pattern under this exhaustive order\-fair construction, not a constant; a deployment whose requests name early products will favorstop\_eager, and one naming late products will favorlazy\. Program\-clustered inference gives no losses andp<0\.001p<0\.001in every stratum\.

#### The sweep in absolute units\.

Both panels are ratios\. Re\-reading the same frozen rows in the unit they were measured in answers the question a planner faces: if one more product is described, who pays? On Defects4J measured wall seconds, program\-clustered:

lazyvaries by a factor of 1\.0009 across four widths, because it pays shared setup plus the one requested product — a quantity with noNNin it\. Every eager rule carriesNNas a factor, andthe strongest eager baseline is linear too:stop\_eagergrows at\+22\.5%\+22\.5\\%per described product, essentiallyguard\_eager’s slope\. Goal stopping lowers the intercept, not the exponent, because a stopping predicate refers to what has been computed and never to what was requested\. SimulCost is concordant in direction \(eager\+21\.6%\+21\.6\\%,lazy\+0\.2%\+0\.2\\%per product\) and much noisier; we quote Defects4J as the witness\. Under demand\-driven semantics, program breadth stops being a budget decision\.

### 7\.8A live money witness across four repositories

The live release gate \(Section[5](https://arxiv.org/html/2609.23058#S5)\) puts real spending on the clock: each candidate patch runs in a container and we meter its execution seconds\. Two of the three issues are off\-path, so the question is concrete — does a policy pay for real containers running real test suites for issues nobody asked about?

Both strata appear here, on the same cost column\. A requested issue is*settleable*on a row if some candidate patch passes the project’s test suite during our measurement, and*open*if none does\. The distinction is not cosmetic: goal stopping can decline work only after the goal closes, so on an open rowstop\_eagercoincides withguard\_eagernode for node, while on a settleable row its predicate fires and it declines whatever the visit order had not yet reached\. Two runs are reported — four gates across four repositories, and four further gates on Django alone with a different patcher — and the strata are never pooled\.

Saving is againststop\_eager, the strongest eager arm, and the two runs give10 wins, 2 ties, 0 losseseach\. Every tie is a row where the requested issue settled early enough that goal stopping declined the same work permission did; none is a row where LazyAgent paid more\. Quality is matched on every row, all eight all\-products controls tie at exactly 0\.0000%, andreact\(Section[6](https://arxiv.org/html/2609.23058#S6)\) tiesstop\_eageron all twenty\-four rows, since it too avoids undemanded work only by reaching the goal first\.

The capture decomposition separates what the request made unnecessary from who actually avoided it, and it is where the two strata diverge\.

LazyAgent captures every unit of off\-path container time on all twenty\-four rows\. Goal stopping captures a little under half of it where the goal closes, nothing at all where it does not, and the open\-stratum zero is an identity rather than a small effect — the predicate cannot refer to what was requested, only to what has been computed, so with the goal still open the strongest eager arm and the naive one are literally the same arm\. This is the live counterpart of the replayed strata in Sections[7\.6](https://arxiv.org/html/2609.23058#S7.SS6)and[7\.7](https://arxiv.org/html/2609.23058#S7.SS7), and it reproduces their 40–50% on metered container seconds, at 46\.5% and 41\.5%\.

Three qualifications\. The settleable means are averages over a split distribution rather than typical rows: the six four\-repository rows read0,0,0,79\.2,100,1000,0,0,79\.2,100,100and the six Django rows read0,0,0,49\.2,100,1000,0,0,49\.2,100,100\. Goal stopping recovers everything when the settle precedes the off\-path work and nothing when it follows, so the mean describes the arena’s visit orders, not a rate any single gate should be expected to show\. This remains a case study rather than a population claim: four program clusters per run bound the smallest exact Wilcoxonppat 0\.125, and the raw percentages carry theN=3N=3width dependence of Section[7\.7](https://arxiv.org/html/2609.23058#S7.SS7)\. Finally the two runs draw on disjoint issue pools, so they are two measurements of the same structure rather than a repetition, and we report them apart and never pool them\. Both were materialized by the same patcher as every other live number in this paper\.

### 7\.9A second structural domain: native build targets

Bazel\[[8](https://arxiv.org/html/2609.23058#bib.bib8)\]is a build system that already computes the dependency closure of a requested target\. We use it as a second structural domain to check that the mechanism concerns graph shape rather than agents: what we replay is the union graph of a whole package, asking the engine for one native target at a time so the arena’s off\-path work is the rest of the package\. Two production packages,bazel\-skylib\(284 targets\) andbuildtools\(135 targets\), are profiled once under a full\-package build with measured action CPU seconds, and every one of their 419 native targets is requested in turn as anAllOutputsgoal\. The permission spine —guard\_eager,stop\_eager,lazy— is run on each; unprofiled administrative parent actions are admitted at zero cost rather than priced by us\.

#### Kind skew\.

The saving runs from 99\.1% for a test target to 28\.2% for a distribution package, and the absolute bills onbazel\-skylibsay why\. A test target bills 0\.18 CPU\-s underlazyagainst 29\.1 understop\_eagerand 45\.2 underguard\_eager: its closure is a few source files and one runner, so nearly the whole union is off\-path and stopping, which must build in visit order until the target lands, pays for most of it\. A docs target bills 0\.41 against 15\.8\. A distribution package bills 0\.78 against 1\.19, because its closure*is*most of the package, so there is little outside it to refuse, and the one tie in the table is a package whose closure covers the union\. This is Section[7\.3](https://arxiv.org/html/2609.23058#S7.SS3)’s law — saving tracks the share of the graph outside the requested closure — read off product kinds rather than off a controlled scope sweep, and it is what makes the arena informative: the same union graph yields four different answers depending on what kind of thing was asked for\.

#### Opportunity and capture\.

Capture is the quantity that transfers, and it carries over intact:lazytakes 100% of the executable opportunity in both packages,stop\_eager42\.3% and 38\.7% — the 40–50% pattern of the settleable stratum \(Section[7\.7](https://arxiv.org/html/2609.23058#S7.SS7)\) again, here because every build target does settle and stopping fires somewhere in the alphabetical order\. The 96\.0% headline is the larger number but the smaller claim: a one\-target ask against a whole\-package union manufactures a very large opportunity \(99\.5% of full eager cost onbazel\-skylib, 93\.8% onbuildtools\), so that percentage is mostly a fact about request shape and should not be read against WfCommons’s 42\.0%\. Two production packages are not the Bazel ecosystem, the targets within a package are clustered, and none of this is agentic; the row is labeled exploratory throughout\. What it establishes is that the two regions and the capture split appear unchanged in a domain whose graphs, costs, and request language were none of them authored by us\.

### 7\.10Contingent irreversible actions

The commit barrier required by invariant I2 \(Section[3\.5](https://arxiv.org/html/2609.23058#S3.SS5)\) is independent of permission: it blocks an unauthorized irreversible act under every policy, but does not avoid the cost of preparing that act\. On an authored family ofK=1​…​4K=1\\ldots 4contingent commit paths, every irreversible node has its own barrier, released only by evidence the run itself produces\. Each path is an investigation costing 20 feeding an irreversible order costing 5; the goal names the one response the incident invoked, and we sweep which one that is\.

Exactly one irreversible action occurs on every arm at everyKK: safety belongs to the barrier and is never credited to laziness\. The preparation cost is the claim\. Describing one more contingency costs 20 on every eager arm —stop\_eagerdoes not even lower the intercept, billing 86 atK=4K=4like the naive rule, because every investigation is offered before any order can close the goal — and nothing under permission\. Two controls hold: with authorization refused after the investigations are paid, no arm acts and the eager arms have bought all four cones for nothing \(81 versus 21\); with the barrier removed, every arm is refused identically\. Prices are authored, so only the two slopes transfer\.

## 8Results: physical operations

Section[7](https://arxiv.org/html/2609.23058#S7)evaluated permission — the constitutive component of the policy tuple in Definition[3](https://arxiv.org/html/2609.23058#Thmdefinition3)— which decides whether a ready node may run\. This section holds permission fixed and evaluates order and projection, the tuple’s other two components, alongside prune, reuse, fidelity, fusion, and speculation; Table[4](https://arxiv.org/html/2609.23058#S8.T4)summarizes their matched\-control results, while commit was measured with permission in Section[7\.10](https://arxiv.org/html/2609.23058#S7.SS10)\.

Projection and fidelity lead because their positive remainders add to permission by narrowing how much of a demanded node becomes concrete\. Reordering follows as the strongest substitute for permission and as an exact boundary on when scheduling can change a bill\. Prune, reuse, fusion and speculation are developed in Appendix[B](https://arxiv.org/html/2609.23058#A2): pruning is a demand\-independent terminal action, reuse and fusion mostly substitute for work permission already removed, and speculation moves in the opposite direction by buying unasked work to reduce latency\. Section[8\.5](https://arxiv.org/html/2609.23058#S8.SS5)reads all seven together\.

Table 4:Physical operations at a glance\. Remainder is demand\-specific: lever worth tolazyminus lever worth to the matched eager arm\. A negative remainder means the eager control captured more of the lever’s absolute effect thanlazydid, not that the lever failed\. The final block is not a remainder: speculation’s rows report a cost/latency pair against the no\-speculation lazy arm, where positive latency is faster and negative cost is more expensive\. Speculation’s latency is measured in*rounds containing real work*, never in seconds; Appendix[B\.6](https://arxiv.org/html/2609.23058#A2.SS6)says why a clock cannot be used here\.### 8\.1Projection

#### Live LLM steps\.

Across126 of the 590 measured DataSciBench nodes— every one whose consumers wanted less than it produced — whole asks consumed 290,471 tokens and narrow asks248,968, a14\.3%saving\. The two figures answer two questions, as with permission in Section[7\.4](https://arxiv.org/html/2609.23058#S7.SS4): 14\.3% is what projection is worth where the precondition holds, and the\+3\.2%\+3\.2\\%remainder is that saving diluted across a corpus where it holds on roughly a fifth of nodes\. Projection is worth 2\.2% tostop\_eagerand 5\.5% tolazy, and the reason the remainder is positive is structural: what a node may omit depends on who is asking, so the narrowing an eager runtime can justify from the program text alone is strictly smaller than the narrowing a goal licenses\.

That saving is admissible only if the narrowed field is as good as the same field asked alongside its siblings, which no token count can check\. Judged blind over all151field pairs — provenance hidden, and which answer appears first assigned by a hash of the pair rather than by which one is cheap — the verdicts are 94 equivalent, 33 favoring the*narrow*answer and 24 the whole one; an exact two\-sided sign test on the 57 decisive pairs givesp=0\.29p=0\.29\. The blind judge therefore detects no significant preference between the arms; this is not an equivalence or non\-inferiority claim\. We report the 14\.3% token reduction alongside that result\. The unblinded figure is not measuring the answers: an earlier instrument labeled the candidates and always showed the projected one first, and re\-scored blind, identical content is judged at least as good 89\.5% of the time in the first slot against 78\.7% in the second — an eleven\-point slot effect inside a single model\. Any LLM\-judged quality column that fixes the order or names the arm is reporting some of that\.

#### The precondition is one edge\.

The profile program’s shared node emits a cheap pass/fail summary and an expensive execution trace, and the program text names a coverage report reading the trace\. The static eager projection control reads the program without today’s goal and must keep the trace because a real consumer edge names it;lazy’s goal\-scoped demand need not, since the coverage report is outside today’s closure\. Authored programs isolate this to the single edge \(Appendix[B](https://arxiv.org/html/2609.23058#A2), Table[9](https://arxiv.org/html/2609.23058#A2.T9)\): programs differing only in whether the undemanded half has a downstream consumer give\+84\.3%\+84\.3\\%when it does and exactly\+0\.0%\+0\.0\\%when it does not, and the remainder grows from\+35\.4%\+35\.4\\%to\+72\.9%\+72\.9\\%as a standing session’s coverage falls from 100% to 25%\.

*A narrower ask pays only when the undemanded field has another consumer in the program text\.*Then no static pass may drop it, an eager arm keeps paying for it every ticket, and only a live goal\-scoped demanded set declines it\. With no consumer it is dead output, an ordinary dead\-field pass removes it, and the eager arm takes the identical saving\. Both conditions must hold — the materializer must physically do less, and the dropped field must be named for somebody else\. DataSciBench supplies a smaller, planner\-bound witness: narrow asks used 14\.3% fewer tokens and produced a\+3\.2%\+3\.2\\%remainder on one planner\. The controlled Jinja/Flask pair isolates both conditions directly\. The structure is common wherever one expensive step serves two audiences on different schedules: a test run emitting a pass/fail a gate turns on and a coverage report a weekly dashboard reads; a workflow stage emitting a summary for one product and a full intermediate dataset for another\.

#### Measured prices\.

The magnitudes above are arithmetic on constants we chose, so we built the same shape over code we did not write and let a clock set the prices\. We instantiate a continuous\-integration verify job in two pinned third\-party repositories: Jinja, Pallets’ Python template engine, and Flask, its web application framework\[[35](https://arxiv.org/html/2609.23058#bib.bib35),[34](https://arxiv.org/html/2609.23058#bib.bib34)\]\. They form a controlled pair: the same organization, language, and pytest toolchain, but distinct codebases and suite sizes \(911 and 494 passing tests\)\. Both have modular tests, so the same job can target one affected module or the full suite — the physical decomposition projection requires\.

The job emits three deliverables: a*verdict*for the module under change, a*coverage*report, and a*regression*result for the whole suite\. Its rule is mechanical: whole suite if regression was asked for and one module otherwise, instrumentation on only if coverage was asked for\. Nothing is computed and then discarded\. The four distinct command lines were each run seven times and the median kept, before any policy object existed, and the seven non\-empty field subsets collapse onto those four, so every ask is billed from its own measurement rather than interpolated\. The fields interact — coverage over the whole suite costs more than over one module — so the node publishes no per\-field decomposition, which would overstate what dropping two of them saves\.

Three cells rather than two, because each of the claim’s two preconditions must be switchable on its own: the no\-consumer control removes the second consumer, while the all\-demanded control keeps that consumer and puts it inside today’s request\. Both remainders are exactly zero, and the no\-consumer control reaches zero while projection still saves\+89\.1%\+89\.1\\%for*both*arms\. That zero means the static pass took the whole saving, not that narrowing did nothing\.

Two qualifications belong with the number\. The zeros are structural rather than empirical: in the no\-consumer control both arms resolve to the same demanded field set and bill the same measured entry, so the remainder is zero by construction, and the control’s force is that it excludes an accounting leak rather than that it surveyed a population\. And the magnitude is a property of the repository, the ratio of one test module to a whole suite plus coverage overhead, moving between76%76\\%and89%89\\%across the two repositories and across repetition counts — so the sign and the control pattern are the result, and the magnitude is not a constant\.

Finally, the boundary this control draws\. The static eager projection control reads the program text without today’s goal, and a stronger static pass specialized to a known root would trace backward from the gate check, find the coverage and regression deliverables unreachable, and take the same saving — against*that*baseline the remainder collapses to zero, and we do not claim otherwise\. The separation is between a program compiled once and run under a sequence of asks and one recompiled per ask, which is the distinction permission itself draws: the demanded set is a function of the goal, and a static pass matches it only by being handed the goal and re\-run\. Where recompiling per ticket is free, projection’s remainder belongs to whoever ships the compiler\. Where the program is fixed and the ask varies — a standing CI pipeline, a release gate, a service — it does not\.

### 8\.2Fidelity

Fidelity is projection at precision granularity: both compare a static reading as the eager control with a live, goal\-relative reading as the lazy treatment\. We test it in an authored controlled scenario, not a SimulCost replay\. A standing workflow serves two consumers: today’s gate needs a coarse yes/no answer, while a later published metric needs the precise result\. Its materializer ladder is a cached estimate \(cost 2, accuracy 0\.25\), a sampled run \(30, 0\.80\), and a full run \(200, 0\.98\), plus shared checkout and output costs of 1 and 5\. The static eager control sees the precise consumer in the program and pays 206; goal\-relative fidelity sees only today’s gate and pays 8\. Thus the predicted remainder is96\.1%=\(206−8\)/206=\(200−2\)/20696\.1\\%=\(206\-8\)/206=\(200\-2\)/206\. The table switches off each precondition in turn\.

The magnitude is arithmetic on constants we chose; the claim is the sign pattern, which reproduces projection’s consumer\-present and no\-consumer controls\. Only when the precise consumer exists and the goal does not reach it do the arms separate, and permission alone moves nothing there\. We cannot supply a corpus row, and the reason is a finding: SimulCost, the one public multi\-fidelity benchmark, records error as a residual against an*executed*refined run, so learning that the cheap answer sufficed requires computing the expensive one — verification is 66\.0% of spend over the 31,092 attempts that bill it separately, and the benchmark excludes it from the cost its agents are scored on\.

Appendix[B](https://arxiv.org/html/2609.23058#A2)completes the factorial for the four operations held back from this section, including the two whose worth is real but arrives outside the resource a remainder is computed in: pruning under a deadline, where the deciding resource is calendar time rather than spend, and speculation’s dial, whose corners are verified as identities againstlazyandeager\.

### 8\.3Reordering

Reordering has an exact structural boundary, not merely a negative average\. Under three conditions and with no rule able to terminate the run early, every ready, guard\-valid node eventually runs; a selector changes*when*work runs, never*whether*, so the executed set is invariant; with fixed additive node charges, the bill is too\. The conditions are*\(C1\) deterministic materializer payloads*,*\(C2\) payload\-only guards*that do not read the clock or execution history, and*\(C3\) a fixed graph during the comparison*\. Under C1–C3 the executed set is an order\-independent fixpoint\. Five priced arenas verify the bill identity at0\.0% on every task, under cheapest\-node, cheapest\-branch, and eight random orders; every replay arena satisfies C1–C3 exactly because its payloads and graph are fixed\.

However, outside that boundary reordering can be valuable whenever visit order changes the termination event: which candidate first satisfies a disjunctive goal, or whether a stopping rule reaches the goal before off\-path work\. In the disjunctive screening family it saves 57% for both permission arms; with predicate stopping it recovers part of permission’s gap\. For conjunctive goals underlazy, its value remains exactly zero for the opposite reason: permission removes off\-path work under every order, leaving no executed\-set difference for ordering to create\.

#### How much a price heuristic recovers\.

Define overlap as*recovered*/*gap*: of the difference between the stopping rule and demand, the share a scheduler picks up with no notion of what was asked for\. Across the four priced populations that have a gap to recover — SimulCost’s is zero, so no ratio is defined there — it runs from 21\.4% on DataSciBench in real tokens to 70\.7% on an authored lifecycle program \(Appendix[B](https://arxiv.org/html/2609.23058#A2), Table[10](https://arxiv.org/html/2609.23058#A2.T10)\), authored programs flattering ordering because their prices correlate with off\-path\-ness by construction\. On the live population cheapest\-node ordering was worth 4\.2% ofstop\_eager’s pooled bill and 0\.0% oflazy’s, cheapest\-branch 5\.6% and 0\.0%, so permission does roughly five times what a price heuristic reaches; Section[8\.4](https://arxiv.org/html/2609.23058#S8.SS4)reports what that ratio does under a change of planner\.

That fifth is concentrated rather than typical: cheapest\-node ordering changes nothing on 63 of the 95 goals, helps on 17, backfires on 15, and three goals supply 93% of every token it saves\. It is not a rate a scheduler earns broadly but a few large wins net of comparable small losses, divided by a gap permission closes on every goal at once\.

#### Price is not relevance\.

Hand both arms the same reasonable heuristic, cheapest ready node first\. On authored lifecycle programs the eager arm pays roughly three times what arbitrary order cost it \(−180\.7%\-180\.7\\%and−231\.9%\-231\.9\\%\) while the cheapest\-first lazy arm is bit\-identical tolazy: an eager arm’s only brake is goal satisfaction, which arrives from the on\-path node, and cheapest\-first walks it through every cheap off\-path branch while deferring the expensive on\-path node that would have closed the goal\. Permission asks whether the node is required for what was asked, and is structurally immune\.

The inversion is not an authored artifact\. It appears on 7 of 60 WfCommons tasks in recorded CPU \(worst−47\.6%\-47\.6\\%\) and 16 of 95 DataSciBench goals in real tokens \(worst−72\.2%\-72\.2\\%,5,048→8,6915\{,\}048\\to 8\{,\}691\), against 12 of 23 authored lifecycle tasks \(Appendix[B](https://arxiv.org/html/2609.23058#A2), Table[11](https://arxiv.org/html/2609.23058#A2.T11)\)\. Across 178 conjunctive tasks in three arenas and two real cost units, the lazy bill movedzero times; any such inversion would violate the order\-invariance prediction\.

#### The live first pass\.

With each arm making its own model calls and a repeat of each ordering as control, no selector changed the executed set on 8/8 tasks — but no task produced competing schedules, because a freshly planned live graph carries no prices: a cost\-ranked selector sees one price everywhere, ties, and breaks ties by identifier, which is what arbitrary order already does\. Permission needs only the goal, known before anything runs\. On a priced authored shape materialized by real model calls the selectors did diverge, and the bill moved less across orderings \(0\.6%0\.6\\%\) than between two runs of the same ordering \(2\.0%2\.0\\%\) — the identity exact for the work performed and, for tokens, inside the noise floor of asking one model the same question twice\.

### 8\.4Which rows survive a change of planner

Every live number above was produced by a language model writing the program being measured\. That raises a question the rest of the paper cannot answer from inside a single run: which results are properties of the mechanism, and which are properties of the model\. We ran the live agentic arena under three planners —gemini\-3\.1\-pro\-preview,gpt\-5\.6\-terraandclaude\-sonnet\-5— with the benchmark, the harness, the arms and the temperature held fixed\.

Each planner completes tasks the others cannot, so the three runs measure overlapping rather than identical populations\. A DataSciBench task yields a measurement only if the planner’s own generated code runs, and the three fail on*disjoint*sets: the only tasks failing under all three are one missing a library from the image and one no planner handled\. We therefore compare on the 77 goals all three measured, since comparing each run against its own survivors would confound a change in the result with a change in what was measured\. How much of that disjointness is the planner is settled below by repeating one of them\.

The split falls exactly where Section[3\.7](https://arxiv.org/html/2609.23058#S3.SS7)said it must\. Above the rule, permission saves under every planner, never approaching zero and never changing sign, and LazyAgent is order\-invariant*exactly*— its materialized cost is bit\-identical under fixed, cheapest\-node and cheapest\-branch order in all three runs\. On each planner’s own population the task\-clustered permission mean is\+9\.8%\+9\.8\\%,\+12\.8%\+12\.8\\%and\+10\.1%\+10\.1\\%, all withp<0\.001p<0\.001and, in every run,not one task where LazyAgent lost\. Across all three runs, blind comparisons detect no significant preference between projected and whole asks\. Establishing that required re\-judging: the frozen experiment image predates the blind judge of Section[8\.1](https://arxiv.org/html/2609.23058#S8.SS1), so the third run’s own quality line reads “17 of 20, not matched” off the biased instrument, and blind re\-scoring of its 56 field pairs returns 85\.7% \[74\.3%, 92\.6%\] with 8 discordant pairs against 7 and a sign test atp=1\.000p=1\.000\. The archive marks the in\-run line not\-to\-be\-quoted\.

Below the rule the numbers move, exactly where Section[3\.6](https://arxiv.org/html/2609.23058#S3.SS6)said they could\. Ordering’s worth ranges from slightly negative to\+2\.4%\+2\.4\\%; the overlap ratio is not interpretable at all under Gemini, whose cheapest\-first made the eager arm marginally*worse*; and projection’s remainder is negative under Gemini against positive under both others\. These are the operations that re\-run a node under a changed ask rather than refusing it, and their sign is a fact about how a given model answers a narrower request\.

The overlap ratio deserves a note, because read the other way it looks like the most stable number in the paper and is not\. On each planner’s*own*population it reads 20\.5%, 21\.4% and 19\.9% — within a point and a half, while its numerator and denominator each move by roughly half \(2\.8% and 13\.6% under the first planner against 4\.2% and 19\.8% under the second\)\. That steadiness does not survive restriction to the shared goals, where the same ratio spans−0\.7%\-0\.7\\%to 13\.3%\. A per\-planner population is complete for itself, which flatters the comparison; “same goal” across planners does not mean the same program was written to reach it\. We therefore treat the ratio as arena\-bound, and quote the matched figures\.

#### Between models against between rounds\.

A spread across planners means nothing without a noise floor, so we repeatedgpt\-5\.6\-terraonce under conditions identical to its first run — same command, same frozen image, same pins, temperature zero in both\. Two effects separate cleanly\.*The pooled magnitude is reproducible*: on the goals both rounds measured the permission saving moves 20\.5% to 18\.2%, and on the goals all planners share, 18\.8% to 18\.9%, so run\-to\-run movement is bounded by about2\.32\.3points and the difference does not keep a consistent sign across subsets\. Against 4\.6 points between the two planners on those same goals, and 7–8 points across all three, the between\-model spread is the larger effect and the per\-planner column above survives\.*Membership does not reproduce*: both rounds measured 28 tasks, but not the same 28\. Six of 31 tasks flip, three in each direction, for a Jaccard of 81%\. Two of the three tasks that had looked like a capability difference between planners are simply tasks the same planner fails and then passes on being asked again, so the disjointness above is substantially this churn rather than the model\.

The stability lives in the aggregate rather than in the row: 58% of shared goals reproduce to within0\.010\.01points, while 31% move by more than 5 and 10% by more than 20, the largest by 47\.5 — and these cancel to a 1\.3% difference in total tokens\. The reading rule is therefore that an aggregate over a benchmark is reproducible while any single row of it is not, which is the opposite of how per\-task tables are normally read\. Both invariants held exactly in both rounds, and the blind quality rate, the one instrument we can apply identically everywhere, agrees more tightly than any cost figure here: 84\.1%, 83\.0% and 85\.7% across two planners and a repeat, with sign tests atp=0\.289p=0\.289,1\.0001\.000and1\.0001\.000\.

The conclusion is narrow and firm\. Three planners and one repeat show that the paper’s central claim and the identity it rests on are not artifacts of one vendor, that the physical operations are more model\-bound than the permission result they are measured against, and that the set of tasks a live agentic benchmark yields is itself a run\-level variable that single\-run tables silently condition on\. They do not establish a variance, and we do not report one\. A reader carrying our numbers to a different model should carry the signs above the rule, re\-measure everything below it, and treat any one task’s figure as unreproducible\.

### 8\.5Reading the rows together

Six of the seven operations yield a demand\-specific remainder, and they split along the factorization of Definition[3](https://arxiv.org/html/2609.23058#Thmdefinition3)\. The levers that act onπproj\\pi\_\{\\mathrm\{proj\}\}— projection, and fidelity as projection one granularity down — are the ones with positive remainders: they narrow*how much*of a demanded node must become concrete, and demand is what tells them which part is wanted, so their worth is largest exactly where a shared program names a second consumer for the part the current ask does not need\. The levers that act on which nodes run or in what order — ordering, prune, reuse, fusion — remove off\-path work, and off\-path work is exactly what permission removes structurally\. Those are therefore not gains stacked on permission; they are, mostly, cheaper and less reliable ways of reaching the same target — one mechanism with several faces, falsifiable in a way a tally of wins would not be, since a single positive remainder from a lever that does not touch demand would break it\.

- •Projection: a positive remainder \(\+84\.3%\+84\.3\\%on the isolation pair,\+78\.1%\+78\.1\\%on the gate\-only profile, growing to\+72\.9%\+72\.9\\%as session coverage falls;\+89\.1%\+89\.1\\%and\+80\.1%\+80\.1\\%on two third\-party test suites where the prices are measured rather than authored\), iff the step is physically decomposable and the dropped field is named for another consumer\.
- •Fidelity: a positive remainder \(\+96\.1%\+96\.1\\%\) under the same controls — projection one granularity down, choosing*which*materializer once permission has said yes\.
- •Ordering: an exact zero at fixed additive prices under C1–C3 without termination; outside that boundary it recovers 21–36% of permission’s gap on real costs and 62–71% on authored programs, but can invert badly where permission is untouched and is undefined on an unpriced first pass\.
- •Prune: a distinct action matched at zero with a real cost when the pruned option would have settled the goal — and, under a deadline, the difference between 2 days and 21 while its remainder stays at exactly zero\.
- •Reuse: negative in every cell, live and authored; arms bit\-identical at low coverage\. Permission’s irreducible share is the first ticket and the unrepeated work\.
- •Fusion: worth the same to both arms when all sharers are demanded, and nothing to the lazy arm when they are not\.
- •Speculation: no matched control; a dial withlazyandeagerat its ends; a free\-latency corner, counted in rounds rather than seconds, that closes as soon as coverage falls or the world moves\.

Projection now has two kinds of measured support: a smaller live\-token remainder on DataSciBench whose sign varies by planner, and the controlled Jinja/Flask pair whose prices come from execution rather than from us\. The latter keeps the predicted sign at\+89\.1%\+89\.1\\%and\+80\.1%\+80\.1\\%and both controls at exactly zero\. Authoring the program is therefore not the same as assuming the answer: the construction states a precondition, and the clock, not the author, decides whether it pays\. Fidelity retains only the authored version of that pattern\. The census explains the gap in a way that is about the corpus: public single\-ask benchmarks sit at session coverage≈1\.0\\approx 1\.0, the corner where every substitute for permission looks best and permission has least to do, and under a single ask speculation’s hit rate is zero by construction\. The region in which the operations differ from permission — a standing program, a ticket sequence that never asks for all of it, a step that can physically do less, a chain deep enough for prepayment to save a wave, a resource the decision is actually about — has to be built into a program\.

## 9Discussion

#### What the results say\.

Permission determines whether a ready node may run; projection and fidelity determine how much of an admitted node becomes concrete\. Ordering, prune, reuse, and fusion mostly substitute for work permission already removes, while speculation deliberately buys undemanded work\. In the separation region, permission saves 42\.0% on measured workflow CPU, tracks excluded work at Spearman\+0\.931\+0\.931, and falls to zero when everything is demanded\. In the equivalence region, all 3,199 flat\-pool asks tie exactly\. Reordering adds a second boundary: under C1–C3 without termination it cannot change the executed set, or the bill at fixed additive prices; outside that boundary, termination can make it valuable or harmful\.

The width and contingency sweeps give this an engineering consequence: each additional product or contingency raises the eager bill while LazyAgent remains flat\. A stopping predicate refers to what has been computed rather than to what was requested, so it lowers the intercept, not the slope\. These measurements establish the execution price of breadth; they do not show that planners will choose broader programs\.

#### Near\-complete coverage, revisited with the intervention in hand\.

The DataSciBench pair — 39\.4% among the 33 goals with nonzero observed savings against 12\.8% averaged over all 95 goals — separates the magnitude of observed wins from the population average\. The 39\.4% is descriptive of the positive\-difference subset, not an estimate over every goal with off\-path opportunity\. Both figures belong in the report, with that distinction explicit\.

Benchmark design supplies a structural account of near\-complete coverage: a plan elicited and validated for one request is anchored to that request\. The paired intervention of Section[7\.5](https://arxiv.org/html/2609.23058#S7.SS5)tested an additional billing account\. Its demand\-billed prompt made off\-request branches free to describe by leaving them abstract until demanded — not free to execute once demanded — but produced 0\.0% off\-path work against 0\.8% under readiness billing \(p=0\.501p=0\.501\)\. We therefore do not attribute the observed narrowness to billing\. This prompt intervention neither supports that explanation in this setting nor identifies the historical cause of benchmark design\.

#### The zeros are the load\-bearing half\.

For controlled permission, projection, and fidelity cells, the declared preconditions predict separation or exact equivalence \(Table[5](https://arxiv.org/html/2609.23058#S9.T5)\)\. Permission and projection now have measured\-price witnesses; fidelity reproduces the sign and controls on authored prices, so its96\.1%96\.1\\%magnitude is arithmetic rather than an empirical estimate\. Where a required condition fails, the result is exactly zero: a fully demanded graph leaves permission nothing to remove, and a field with no second consumer leaves projection no demand\-specific gap\. The other operations require their own controls and may produce zero or negative remainders\. A theory that predicted gains everywhere would be unfalsifiable; the zeros show where the mechanism ends\.

Table 5:Selected controlled separation and equivalence cells\.*Ready\-but\-undemanded*means the program contains off\-path work;*separable*means that work can be skipped physically; and*material*means its cost survives the accounting\. Projection and fidelity additionally require a demand\-specific gap relative to the static control\.CellCost unitPreconditionsResult*All three hold — separation predicted*Live release gate, SWE\-benchcontainer secondsall three51\.7%51\.7\\%,52\.1%52\.1\\%Live projection, Jinja and Flaskmeasured CPU sall three\+89\.1%\+89\.1\\%,\+80\.1%\+80\.1\\%Composed portfolios, Defects4J and SimulCostnative arena costsall threeseparation regionDataSciBench projectionreal tokensall three\+3\.2%\+3\.2\\%pooled;14\.3%14\.3\\%on the 126 narrowable nodes \(gpt\-5\.6\-terra; sign is planner\-bound, §[8\.4](https://arxiv.org/html/2609.23058#S8.SS4)\)Fidelity ladderauthoredall three\+96\.1%=\(206−8\)/206\+96\.1\\%=\(206\-8\)/206; magnitude authored*One fails — exact zero predicted*Projection, Jinja/Flask no\-consumer controlmeasured CPU sno demand\-specific gap00Projection, Jinja/Flask all\-demanded controlmeasured CPU sno undemanded part00Fidelity controlsauthoredno precise consumer / precise result demanded00Pool arenas, equivalence regionnative arena costsno off\-path workexact tie
#### A design criterion for the next benchmark\.

Public task\-solving benchmarks generally optimize for answer correctness rather than independently varying avoidable work\. WfCommons and Bazel become informative here only after the requested closure is varied against a broader graph\. A benchmark designed for execution policy should vary three quantities directly: ready work outside each request’s closure, whether that work is physically separable, and whether its cost is large enough to survive accounting\. Projection and fidelity should additionally toggle whether an omitted field or precision level has another consumer, preserving ordinary dead\-output elimination as a matched control\. Section[10](https://arxiv.org/html/2609.23058#S10)turns these requirements into a buildable ask\.

#### What the semantics makes possible, as distinct from cheaper\.

Two capabilities follow from the width invariance just stated — a bill that carries no factor of how much program was described\.*Open\-ended programs*: a planner may describe a ladder whose length is unknown when written — next candidate patch, next configuration, refine until the tolerance is met\. Eager execution cannot exhaust an unbounded generator without an external bound or stopping rule; demand\-driven graph expansion could instead materialize only the consumed prefix\. This transposes Hughes’s separation of candidate generation from selection\[[19](https://arxiv.org/html/2609.23058#bib.bib19)\]to agentic programs\. The current implementation uses finite graphs and does not yet expand a generator on demand, so this remains a design implication\.*Contingent irreversible actions*are the measured version \(Section[7\.10](https://arxiv.org/html/2609.23058#S7.SS10)\): the barrier makes the act safe under every policy, while permission makes the preparation for unrequested contingencies free\.

#### Threats to validity\.

Appendix[A](https://arxiv.org/html/2609.23058#A1)registers 21 limitations, each with the claim it constrains and how we handle it\. Four bound the reading of this paper more than the rest\. The largest permission\-separation result is*replayed*scientific workflows rather than LLM programs, and its product requests are seeded rather than observed; the agentic witness is smaller and sits at coverage≈1\.0\\approx 1\.0\. Each live gate run is twelve rows from four clusters — a case study, not a population — and its settleable capture is bimodal rather than centered, so that mean describes those runs’ visit orders and not a rate to expect from one gate\. The positive measured operation evidence is currently projection: real DataSciBench tokens and Jinja/Flask CPU\. Fidelity’s96\.1%96\.1\\%is authored ladder arithmetic, not a SimulCost result; only its sign and two zero controls transfer\. Reordering uses live and replayed prices, but its central set identity under C1–C3 without termination is structural; the exact bill identity follows for fixed additive prices\. Finally, the noise floor is measured for one planner only: repeatinggpt\-5\.6\-terramoves the pooled saving by about2\.32\.3points against 4\.6–8 between planners, while 6 of 31 tasks flip in or out, so aggregates here are citable where single rows are not\.

#### Evidence boundary\.

The live release gate supplies measured container prices for permission, and the controlled Jinja/Flask pair supplies measured CPU prices and independent zero controls for projection\. Fidelity remains authored; a measured fidelity ladder would test whether its external magnitude is material\. Reordering is set\-invariant only under C1–C3 without termination, and bill\-invariant there only at fixed additive prices; it can be valuable or harmful outside that boundary\. A real\-clock speculation study could change, not merely rescale, the rounds\-based frontier\. Learned selection remains future work\.

## 10Future directions

The demanded set is goal\-derived, linear\-time to compute, and cost\-blind\. Under a fixed graph and ask it can only contract \(Lemma[1](https://arxiv.org/html/2609.23058#Thmproposition1)\); graph growth or a changed ask can enlarge it\. Relative to the declared graph and goal, the set is sound but not hindsight\-tight: it contains every node the goal may still need, including candidates later outcomes reveal were unnecessary\. Closure itself is therefore not a learning target\. The learnable surfaces lie inside it, below it, and above it, with different contracts\.

#### The residual decision problem\.

For scheduling inside the closure, the legal node actions at stateσ\\sigmaare the ready members ofdem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\), not the whole closure\. Ordering, fidelity, and reuse choose among or parameterize that work without changing demand membership, although fidelity still owes matched quality and reuse owes provenance and validity\. Learned pruning acts below closure by permanently declining a still\-demanded option; it can fail the task and therefore needs an explicit failure constraint\. Learned speculation acts above closure by admitting undemanded work; a budget can cap its excess spend, but is not a safety guarantee, and commit barriers remain independent\.

The closure hands a learner an unusually well\-formed decision problem, and which formalism fits depends on assumptions a deployment must establish\. The problem is an MDP only if the observable state is Markov\-sufficient, or if a sufficient belief state is used; latent candidate quality makes it partially observed\. A flat independent pool with immediate feedback can reduce to a costly bandit, but graph dependencies, cache state, fidelity, and cross\-request speculation retain sequential structure\. The replay arenas provide a cheap finite simulator for alternative schedules over recorded candidates and outcomes; they cannot generate counterfactual candidates or evaluate actions that change the recorded environment\.

Existing results calibrate baselines rather than bound every chooser\. Cheapest\-first recovered 21\.4% of permission’s gap on its live population,−0\.7%\-0\.7\\%to 13\.3% on goals shared across planners, and 36\.0% on replayed WfCommons\. A genuine ceiling needs a hindsight optimum or regret bound under stated assumptions, with hindsight excluded from policy features\. A large ordering gain would show that cheapest\-first was weak; a large matched\-quality pruning gain would quantify how much hindsight slack can be predicted ex ante\.

#### Planning for recall rather than for precision\.

Demand\-driven execution changes the price of valid surplus breadth, not intrinsic plan quality\. In the authored width family, one additional product raisesstop\_eager’s bill by\+22\.5%\+22\.5\\%and LazyAgent’s by\+0\.0%\+0\.0\\%\(Section[7\.7](https://arxiv.org/html/2609.23058#S7.SS7)\); this is the execution price of a correctly represented branch outside today’s closure\. It does not show that planning, validation, or storage is free, or that a planner will produce broader graphs\.

That motivates a testable hypothesis: a smaller planner habituated to demand billing may preserve recall while describing more valid optional work, trading precision for breadth without charging today’s request\. The prompt\-level test found no such response: 0\.0% off\-path work under demand billing against 0\.8% under readiness billing \(p=0\.501p=0\.501\)\. Its single\-request tasks and deliverable\-anchoring validator do not test the stronger hypothesis\. Doing so first requires standing programs under sequences of narrower asks, with ground truth for required deliverables, dependencies, graph validity, and task quality\. The observed Spearman correlation of\+0\.931\+0\.931between off\-path fraction and saving motivates measuring the relationship again; it does not imply that changing planner breadth moves proportionally along the same curve\. Recall, structural validity, and delivered quality must be held fixed before cost is compared\.

#### Describing what is not authorized\.

The commit barrier is independent of permission: it blocks an unauthorized irreversible act under every policy, while permission decides whether preparation for an unrequested contingency materializes\. The experiment therefore does not show that eager execution is unsafe or that demand permission makes an act safe\. It shows a narrower affordance: contingencies can remain represented in an inspectable standing graph while preparation outside the current request remains abstract\.

In the authored family, each additional contingency costs both eager arms 20 units and LazyAgent zero; when authorization is withheld after investigation, the corresponding totals are 81 and 21\. Only those slopes and controls transfer from the authored prices\. The barrier supplies authorization; permission reduces the cost of retaining uninvoked contingencies\. Whether the artifact is actually audited belongs to the surrounding process, not the execution semantics\.

#### A corpus that could falsify this\.

A benchmark should vary the three conditions current corpora largely hold fixed: how much ready work lies outside each request’s closure, whether that work is physically separable, and whether its cost is large enough to survive accounting\. Projection and fidelity should additionally toggle whether an omitted field or precision level has another consumer, so ordinary dead\-output elimination remains a matched control\. For the recall\-over\-precision hypothesis, the same corpus needs standing programs, sequences of narrower asks, and optional named deliverables whose validity and contribution can be scored\. Benchmark construction is therefore a prerequisite for that test, not a parallel activity\. The prompt\-level null does not explain current near\-complete coverage; it only rules out the tested intervention as evidence for a billing response\.

#### Closure overlap when one graph serves many asks\.

A natural next deployment combines authored workflows and long\-horizon agents, capabilities now appearing in products\[[24](https://arxiv.org/html/2609.23058#bib.bib24),[28](https://arxiv.org/html/2609.23058#bib.bib28),[38](https://arxiv.org/html/2609.23058#bib.bib38)\], by reusing one graph across many requests\. If a platform does so, the demanded set becomes a per\-request mask over that graph and its overlap becomes a scheduling resource\. Given a set of pending asks whose closures partially coincide, what materialization order is optimal, and can shared setup be amortized across requests without breaking either isolation or the denominator discipline of invariant I3? Whether the width scaling law holds per\-request or only in aggregate is an open question with direct capacity consequences for such a platform\. Sharing exploratory work across related jobs\[[11](https://arxiv.org/html/2609.23058#bib.bib11)\]and sharing state across requests at the serving layer\[[23](https://arxiv.org/html/2609.23058#bib.bib23)\]are the closest neighbors, and neither reasons about a mask derived from a goal\.

#### One implication we state without claiming\.

If branches outside the current closure incur no materialization cost, static program breadth need not be the usage unit\. One alternative is to charge for work actually materialized on behalf of a request, with closure supplying attribution rather than automatically supplying the bill\. The measurements do not show that planning, validation, storage, or every candidate inside a disjunctive closure is free, and we have no deployment evidence for any pricing design\.

## 11Conclusion

LazyAgent establishes a measured separation between readiness and materialization\. In the separation region, permission saves 42\.0% on measured workflow CPU and tracks excluded work at Spearman\+0\.931\+0\.931; each additional product raises the eager bill by22\.5%22\.5\\%while LazyAgent remains flat, each contingency adds 20 units against zero, and permission captures 100% of executable off\-path cost at every tested width\. At the boundary where every candidate is demanded, LazyAgent and goal\-stopping eager execution tie exactly on all 3,199 pool asks, confirming the predicted equivalence region\.

The framework contribution is a live demanded\-set semantics that recomputes each request’s backward closure after observations and gives that set, rather than the ready set, to physical operations in one graph and engine\. Projection adds a distinct measured benefit:\+3\.2%\+3\.2\\%on live DataSciBench tokens and\+89\.1%\+89\.1\\%and\+80\.1%\+80\.1\\%on measured Jinja/Flask CPU, with both controls exactly zero\. Fidelity reproduces the sign and controls, although its96\.1%96\.1\\%magnitude is authored arithmetic; reordering is set\-invariant under C1–C3 without termination and bill\-invariant there at fixed additive prices, but may help or harm outside that boundary\. Safety belongs independently to the commit barrier\. Authored graphs, scheduled triggers, and long\-horizon goals are already shipping capabilities; their combination motivates this regime without claiming its deployment frequency\.

These results turn a limitation of current agentic benchmarks into a concrete research program\. Existing plans have 98\.6% request coverage, and 27 of 28 contain no off\-request work; a paired prompt intervention produced no broader graphs under demand billing, so we neither attribute this narrowness to billing nor claim that planners already respond to cheaper surplus breadth\. The next benchmark should instead provide standing programs, sequences of narrower asks, and optional named deliverables whose validity and contribution can be scored\. By making valid surplus breadth economically executable at materialization time and its value directly falsifiable, LazyAgent supplies both the runtime foundation and the benchmark question needed to test the next generation of agentic programs\.

## References

- \[1\]Martín Abadi et al\.TensorFlow: A system for large\-scale machine learning\.In12th USENIX Symposium on Operating Systems Design and Implementation, pages 265–283, 2016\.URL:[https://www\.usenix\.org/conference/osdi16/technical\-sessions/presentation/abadi](https://www.usenix.org/conference/osdi16/technical-sessions/presentation/abadi)\.
- \[2\]Martín Abadi, Frank McSherry, and Gordon D\. Plotkin\.Foundations of differential dataflow\.InFoundations of Software Science and Computation Structures \(FoSSaCS\), volume 9034 ofLecture Notes in Computer Science, pages 71–83, 2015\.[doi:10\.1007/978\-3\-662\-46678\-0\_5](https://doi.org/10.1007/978-3-662-46678-0_5)\.
- \[3\]Umut A\. Acar\.Self\-Adjusting Computation\.PhD thesis, Carnegie Mellon University, 2005\.Technical Report CMU\-CS\-05\-129\.
- \[4\]Umut A\. Acar, Guy E\. Blelloch, Matthias Blume, Robert Harper, and Kanat Tangwongsan\.An experimental analysis of self\-adjusting computation\.ACM Transactions on Programming Languages and Systems, 32\(1\):1–53, 2009\.[doi:10\.1145/1596527\.1596530](https://doi.org/10.1145/1596527.1596530)\.
- \[5\]Amazon Web Services\.Orchestration models: From rule\-based to AI\-native, 2026\.Accessed September 16, 2026\.URL:[https://docs\.aws\.amazon\.com/prescriptive\-guidance/latest/agentic\-ai\-serverless/orchestration\-models\.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/agentic-ai-serverless/orchestration-models.html)\.
- \[6\]Anthropic\.Automate work with routines, 2026\.Accessed September 16, 2026\.URL:[https://code\.claude\.com/docs/en/routines](https://code.claude.com/docs/en/routines)\.
- \[7\]Ron Avnur and Joseph M\. Hellerstein\.Eddies: Continuously adaptive query processing\.InProceedings of the 2000 ACM SIGMOD International Conference on Management of Data, pages 261–272, 2000\.[doi:10\.1145/335191\.335420](https://doi.org/10.1145/335191.335420)\.
- \[8\]Bazel Project\.The Bazel query reference, 2026\.Accessed September 16, 2026\.URL:[https://bazel\.build/query/language](https://bazel.build/query/language)\.
- \[9\]Andrew M\. Bean et al\.Measuring what matters: Construct validity in large language model benchmarks\.InAdvances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track, 2025\.URL:[https://papers\.neurips\.cc/paper\_files/paper/2025/hash/1967e0fc3aa6cbbace562f5cb8e3954e\-Abstract\-Datasets\_and\_Benchmarks\_Track\.html](https://papers.neurips.cc/paper_files/paper/2025/hash/1967e0fc3aa6cbbace562f5cb8e3954e-Abstract-Datasets_and_Benchmarks_Track.html)\.
- \[10\]Yadi Cao, Sicheng Lai, Jiahe Huang, Yang Zhang, Zach Lawrence, Rohan Bhakta, Izzy F\. Thomas, Mingyun Cao, Chung\-Hao Tsai, Zihao Zhou, Yidong Zhao, Hao Liu, Alessandro Marinoni, Alexey Arefiev, and Rose Yu\.SimulCost: A cost\-aware benchmark and toolkit for automating physics simulations with LLMs, 2026\.Version 3, arXiv:2603\.20253\.URL:[https://arxiv\.org/abs/2603\.20253v3](https://arxiv.org/abs/2603.20253v3)\.
- \[11\]Raul Castro Fernandez, William Culhane, Pijika Watcharapichat, Matthias Weidlich, Victoria Lopez Morales, and Peter Pietzuch\.Meta\-dataflows: Efficient exploratory dataflow jobs\.InProceedings of the 2018 International Conference on Management of Data, pages 1157–1172, 2018\.[doi:10\.1145/3183713\.3183760](https://doi.org/10.1145/3183713.3183760)\.
- \[12\]Lingjiao Chen, Matei Zaharia, and James Zou\.FrugalGPT: How to use large language models while reducing cost and improving performance\.Transactions on Machine Learning Research, 2024\.URL:[https://openreview\.net/forum?id=cSimKw5p6R](https://openreview.net/forum?id=cSimKw5p6R)\.
- \[13\]Tainã Coleman, Henri Casanova, Loïc Pottier, Manav Kaushik, Ewa Deelman, and Rafael Ferreira da Silva\.WfCommons: A framework for enabling scientific workflow research and development\.Future Generation Computer Systems, 128:16–27, 2022\.[doi:10\.1016/j\.future\.2021\.09\.043](https://doi.org/10.1016/j.future.2021.09.043)\.
- \[14\]Stuart I\. Feldman\.MAKE—a program for maintaining computer programs\.Software: Practice and Experience, 9\(4\):255–265, 1979\.[doi:10\.1002/spe\.4380090402](https://doi.org/10.1002/spe.4380090402)\.
- \[15\]Rafael Ferreira da Silva\.WfInstances: v1\.5, 2024\.Version 1\.5; experiment pinned at Git commit 467f5c6\.[doi:10\.5281/zenodo\.12510982](https://doi.org/10.5281/zenodo.12510982)\.
- \[16\]In Gim, Guojun Chen, Seung\-seob Lee, Nikhil Sarda, Anurag Khandelwal, and Lin Zhong\.Prompt cache: Modular attention reuse for low\-latency inference\.InProceedings of Machine Learning and Systems \(MLSys\), volume 6, pages 325–338, 2024\.URL:[https://proceedings\.mlsys\.org/paper\_files/paper/2024/hash/a66caa1703fe34705a4368c3014c1966\-Abstract\-Conference\.html](https://proceedings.mlsys.org/paper_files/paper/2024/hash/a66caa1703fe34705a4368c3014c1966-Abstract-Conference.html)\.
- \[17\]Goetz Graefe\.Volcano—an extensible and parallel query evaluation system\.IEEE Transactions on Knowledge and Data Engineering, 6\(1\):120–135, 1994\.[doi:10\.1109/69\.273032](https://doi.org/10.1109/69.273032)\.
- \[18\]Matthew A\. Hammer, Yit Phang Khoo, Michael Hicks, and Jeffrey S\. Foster\.Adapton: Composable, demand\-driven incremental computation\.InProceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 156–166, 2014\.[doi:10\.1145/2594291\.2594324](https://doi.org/10.1145/2594291.2594324)\.
- \[19\]John Hughes\.Why functional programming matters\.The Computer Journal, 32\(2\):98–107, 1989\.[doi:10\.1093/comjnl/32\.2\.98](https://doi.org/10.1093/comjnl/32.2.98)\.
- \[20\]Carlos E\. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan\.SWE\-bench: Can language models resolve real\-world GitHub issues?InInternational Conference on Learning Representations \(ICLR\), 2024\.URL:[https://openreview\.net/forum?id=VTF8yNQM66](https://openreview.net/forum?id=VTF8yNQM66)\.
- \[21\]René Just, Darioush Jalali, and Michael D\. Ernst\.Defects4J: A database of existing faults to enable controlled testing studies for Java programs\.InProceedings of the 2014 International Symposium on Software Testing and Analysis \(ISSTA\), pages 437–440, 2014\.[doi:10\.1145/2610384\.2628055](https://doi.org/10.1145/2610384.2628055)\.
- \[22\]Sehoon Kim, Suhong Moon, Ryan Tabrizi, Nicholas Lee, Michael W\. Mahoney, Kurt Keutzer, and Amir Gholami\.An LLM compiler for parallel function calling\.InProceedings of the 41st International Conference on Machine Learning, volume 235 ofProceedings of Machine Learning Research, pages 24370–24391\. PMLR, 2024\.URL:[https://proceedings\.mlr\.press/v235/kim24y\.html](https://proceedings.mlr.press/v235/kim24y.html)\.
- \[23\]Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E\. Gonzalez, Hao Zhang, and Ion Stoica\.Efficient memory management for large language model serving with PagedAttention\.InProceedings of the 29th ACM Symposium on Operating Systems Principles, pages 611–626\. ACM, 2023\.[doi:10\.1145/3600006\.3613165](https://doi.org/10.1145/3600006.3613165)\.
- \[24\]LangChain\.Workflows and agents, 2026\.Accessed September 16, 2026\.URL:[https://docs\.langchain\.com/oss/python/langgraph/workflows\-agents](https://docs.langchain.com/oss/python/langgraph/workflows-agents)\.
- \[25\]John Launchbury\.A natural semantics for lazy evaluation\.InProceedings of the 20th ACM SIGPLAN\-SIGACT Symposium on Principles of Programming Languages, pages 144–154, 1993\.[doi:10\.1145/158511\.158618](https://doi.org/10.1145/158511.158618)\.
- \[26\]Yaniv Leviathan, Matan Kalman, and Yossi Matias\.Fast inference from transformers via speculative decoding\.InProceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machine Learning Research, pages 19274–19286\. PMLR, 2023\.
- \[27\]Frank McSherry, Derek G\. Murray, Rebecca Isaacs, and Michael Isard\.Differential dataflow\.InConference on Innovative Data Systems Research \(CIDR\), 2013\.
- \[28\]Microsoft\.Workflows overview, 2026\.Accessed September 16, 2026\.URL:[https://learn\.microsoft\.com/en\-us/microsoft\-copilot\-studio/workflows\-experience/flows\-overview](https://learn.microsoft.com/en-us/microsoft-copilot-studio/workflows-experience/flows-overview)\.
- \[29\]Andrey Mokhov, Georgy Lukyanov, Simon Marlow, and Jeremie Dimino\.Selective applicative functors\.Proceedings of the ACM on Programming Languages, 3\(ICFP\):90:1–90:29, 2019\.[doi:10\.1145/3341694](https://doi.org/10.1145/3341694)\.
- \[30\]Andrey Mokhov, Neil Mitchell, and Simon Peyton Jones\.Build systems à la carte\.Proceedings of the ACM on Programming Languages, 2\(ICFP\):79:1–79:29, 2018\.[doi:10\.1145/3236774](https://doi.org/10.1145/3236774)\.
- \[31\]Lunyiu Nie, Yilin Xia, Yiren Liu, Christopher Jermaine, and Swarat Chaudhuri\.Cost\-aware optimization for agentic query execution\.arXiv preprint arXiv:2606\.03152, 2026\.URL:[https://arxiv\.org/abs/2606\.03152](https://arxiv.org/abs/2606.03152)\.
- \[32\]Isaac Ong, Amjad Almahairi, Vincent Wu, Wei\-Lin Chiang, Tianhao Wu, Joseph E\. Gonzalez, M\. Waleed Kadous, and Ion Stoica\.RouteLLM: Learning to route LLMs from preference data\.InInternational Conference on Learning Representations \(ICLR\), 2025\.URL:[https://proceedings\.iclr\.cc/paper\_files/paper/2025/hash/5503a7c69d48a2f86fc00b3dc09de686\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2025/hash/5503a7c69d48a2f86fc00b3dc09de686-Abstract-Conference.html)\.
- \[33\]OpenAI\.Scheduled tasks in ChatGPT, 2026\.Accessed September 16, 2026\.URL:[https://help\.openai\.com/en/articles/10291617\-scheduled\-tasks\-in\-chatgpt](https://help.openai.com/en/articles/10291617-scheduled-tasks-in-chatgpt)\.
- \[34\]Pallets Projects\.Flask: A lightweight web application framework\.GitHub repository, 2026\.Pinned revision: Git commit d73fa1cdcbd8b1465c151db8924ba58b1dd14e35\.URL:[https://github\.com/pallets/flask](https://github.com/pallets/flask)\.
- \[35\]Pallets Projects\.Jinja: A template engine for python\.GitHub repository, 2026\.Pinned revision: Git commit 5ef70112a1ff19c05324ff889dd30405b1002044\.URL:[https://github\.com/pallets/jinja](https://github.com/pallets/jinja)\.
- \[36\]Liana Patel, Siddharth Jha, Melissa Pan, Harshit Gupta, Parth Asawa, Carlos Guestrin, and Matei Zaharia\.Semantic operators and their optimization: Enabling LLM\-based data processing with accuracy guarantees in LOTUS\.Proceedings of the VLDB Endowment, 18\(11\):4171–4184, 2025\.URL:[https://www\.vldb\.org/pvldb/vol18/p4171\-patel\.pdf](https://www.vldb.org/pvldb/vol18/p4171-patel.pdf),[doi:10\.14778/3749646\.3749685](https://doi.org/10.14778/3749646.3749685)\.
- \[37\]Keshav Pingali and Arvind\.Efficient demand\-driven evaluation\. part 1\.ACM Transactions on Programming Languages and Systems, 7\(2\):311–333, 1985\.[doi:10\.1145/3318\.3480](https://doi.org/10.1145/3318.3480)\.
- \[38\]Salesforce\.Salesforce expands Agentforce with a new portfolio of AI agents built for high\-value work, September 2026\.URL:[https://www\.salesforce\.com/news/stories/agentforce\-job\-ready\-ai\-agents/](https://www.salesforce.com/news/stories/agentforce-job-ready-ai-agents/)\.
- \[39\]Victor Sobreira, Thomas Durieux, Fernanda Madeiral, Martin Monperrus, and Marcelo A\. Maia\.Dissection of a bug dataset: Anatomy of 395 patches from Defects4J\.InProceedings of the 25th IEEE International Conference on Software Analysis, Evolution and Reengineering, pages 130–140, 2018\.[doi:10\.1109/SANER\.2018\.8330203](https://doi.org/10.1109/SANER.2018.8330203)\.
- \[40\]SWE\-bench Project\.SWE\-bench Verified, 2024\.Accessed September 16, 2026\.URL:[https://www\.swebench\.com/verified](https://www.swebench.com/verified)\.
- \[41\]Noppanat Wadlom, Junyi Shen, and Yao Lu\.Efficient LLM serving for agentic workflows: A data systems perspective\.Proceedings of the ACM on Management of Data, 4\(3\):169:1–169:29, 2026\.Article 169\.[doi:10\.1145/3802046](https://doi.org/10.1145/3802046)\.
- \[42\]Christopher P\. Wadsworth\.Semantics and Pragmatics of the Lambda\-Calculus\.PhD thesis, University of Oxford, 1971\.
- \[43\]Mark Weiser\.Program slicing\.IEEE Transactions on Software Engineering, SE\-10\(4\):352–357, 1984\.[doi:10\.1109/TSE\.1984\.5010248](https://doi.org/10.1109/TSE.1984.5010248)\.
- \[44\]Qinyuan Wu, Soumi Das, Mahsa Amani, Arijit Nag, Seungeon Lee, Krishna P\. Gummadi, Abhilasha Ravichander, and Muhammad Bilal Zafar\.To call or not to call: A framework to assess and optimize LLM tool calling\.arXiv preprint arXiv:2605\.00737, 2026\.URL:[https://arxiv\.org/abs/2605\.00737](https://arxiv.org/abs/2605.00737)\.
- \[45\]Dawei Xiang, Kexin Chu, Wenyan Xu, Wenhui Zhang, and Wei Zhang\.LLM\-as\-scheduler: Agentic workflow dynamic scheduling\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), pages 12752–12763, 2026\.[doi:10\.18653/v1/2026\.acl\-long\.581](https://doi.org/10.18653/v1/2026.acl-long.581)\.
- \[46\]Binfeng Xu, Zhiyuan Peng, Bowen Lei, Subhabrata Mukherjee, Yuchen Liu, and Dongkuan Xu\.ReWOO: Decoupling reasoning from observations for efficient augmented language models\.arXiv preprint arXiv:2305\.18323, 2023\.URL:[https://arxiv\.org/abs/2305\.18323](https://arxiv.org/abs/2305.18323)\.
- \[47\]Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao\.ReAct: Synergizing reasoning and acting in language models\.InThe Eleventh International Conference on Learning Representations, 2023\.URL:[https://openreview\.net/forum?id=WE\_vluYUL\-X](https://openreview.net/forum?id=WE_vluYUL-X)\.
- \[48\]Dan Zhang, Sining Zhoubian, Min Cai, Fengzu Li, Lekang Yang, Wei Wang, Tianjiao Dong, Ziniu Hu, Jie Tang, and Yisong Yue\.DataSciBench: An LLM agent benchmark for data science\.InFindings of the Association for Computational Linguistics: ACL 2026, pages 3685–3728, 2026\.URL:[https://aclanthology\.org/2026\.findings\-acl\.181/](https://aclanthology.org/2026.findings-acl.181/),[doi:10\.18653/v1/2026\.findings\-acl\.181](https://doi.org/10.18653/v1/2026.findings-acl.181)\.
- \[49\]Lianmin Zheng, Liangsheng Yin, Zhiqiang Xie, Chuyue Sun, Jeff Huang, Cody Hao Yu, Shiyi Cao, Christos Kozyrakis, Ion Stoica, Joseph E\. Gonzalez, Clark Barrett, and Ying Sheng\.SGLang: Efficient execution of structured language model programs\.InAdvances in Neural Information Processing Systems, volume 37, pages 62557–62583, 2024\.URL:[https://proceedings\.neurips\.cc/paper\_files/paper/2024/file/724be4472168f31ba1c9ac630f15dec8\-Paper\-Conference\.pdf](https://proceedings.neurips.cc/paper_files/paper/2024/file/724be4472168f31ba1c9ac630f15dec8-Paper-Conference.pdf),[doi:10\.52202/079017\-2000](https://doi.org/10.52202/079017-2000)\.

## Appendix ALimitations register

This register makes 21 identified evidence limits explicit and names the claim each constrains\. The four that most bound the paper appear in Section[9](https://arxiv.org/html/2609.23058#S9); Tables[6](https://arxiv.org/html/2609.23058#A1.T6)and[7](https://arxiv.org/html/2609.23058#A1.T7)separate limits on evidence coverage from limits on the instruments that produced it\.

Table 6:Limits on what the evidence covers\.Table 7:Limits on the instruments\.
## Appendix BOperations measured in full

This appendix gives the authored projection controls and detailed reordering populations supporting Section[8](https://arxiv.org/html/2609.23058#S8), followed by the four operations summarized but not developed there\. Together they complete the operation map: prune isolates demand\-independent refusal, reuse and fusion quantify mechanisms that substitute for permission, and speculation traces the cost/latency frontier beyond demand\. Table[8](https://arxiv.org/html/2609.23058#A2.T8)defines the controlled scenario terms\.

Table 8:Reader\-facing vocabulary for the controlled scenarios in this appendix\. These terms describe structural conditions, not software identifiers\.### B\.1Projection: the authored magnitudes

Table 9:Projection on authored programs, where we set the prices\. The named\-consumer/no\-consumer pair is the one\-edge isolation: the programs differ only in whether the expensive undemanded output has a downstream consumer\. The gate\-output/all\-demanded pair separately varies whether today’s goal requests that output\. The session rows carry the same shape into a standing program under a ticket sequence\. Magnitudes are authored; the sign and control pattern are the claim, and the measured version is in Section[8\.1](https://arxiv.org/html/2609.23058#S8.SS1)\.Before projection,stop\_eagerandlazyhave identical costs in both isolation programs\. Adding the one consumer edge leaves projection worth 0\.0% tostop\_eagerbut raises its worth tolazyfrom 0\.0% to 84\.3%\.

### B\.2Reordering details

Table 10:Overlap by arena — of the cost difference between the stopping rule and demand, the share a price heuristic recovers with no notion of what was asked for\. All four rows come from the one ordering grid, so the columns are commensurable\.Table 11:Cheapest\-first handed to both arms\. Top: the authored pair, where the eager arm pays about three times what arbitrary order cost it\. Bottom: how often the inversion appears per arena, and the lazy column that is zero everywhere\.

### B\.3Explicit prune

Pruning permanently declines a node that is demanded, ready, and passes every guard — a live, legal option — for a reason the graph does not encode \(a deadline, a policy on what may be touched, or a budget\)\. It is not early stopping, which fires once the goal is met, and not a guard, which encodes a condition in the program text\. This experiment uses the same three methods as the earlier screening control but visits the static check first, so fixed order reaches external review before the suite and an unpruned run settles at cost 28 rather than 201\. The two families are therefore not compared bill\-for\-bill\. The prune rule removes external review whenever the static check is inconclusive, identically on both permission arms:

Remainder\+0\.0%\+0\.0\\%on every matched program: the rule reads the calendar and the budget, not the demanded set, so nothing demand\-driven is left to measure\. Burning the review when it would have settled the goal for 28 costs 203 instead, and when the suite does not settle either, the pruned arms fail the goal outright\. That negative control is what distinguishes prune from a disguised early stop\. Prune is a capability the semantics must name, so that a risky refusal cannot later be smuggled in as a guard — not a saving to apply by default\.

#### The resource decides the verdict\.

In authored CPU seconds, prune is a7\.25×7\.25\\timesregression\. But a pruner exists to decline an option for a reason the CPU column does not contain, while calendar lead time was absent from the printed resource table\. A lead\-time variant keeps the structure and prices both resources: static check 2 CPU / same day, review 25 CPU / 21 days, suite 200 CPU / 2 days, release in 5 days\. Fixed order reaches review before the suite, so an unpruned run settles on review — cheaply, and three weeks late\.

CPU accounting reports prune as−625\.0%\-625\.0\\%on both arms with remainder\+0\.0%\+0\.0\\%; calendar lead time reports 2 days versus 21, and only the pruned arms deliver on time\. Two controls: with the ship date at 30 days the rule does not fire and every arm is on time at CPU cost 28; when the static check settles, prune never fires and every arm bills 3\.stop\_eagerobtains the same 21 days aslazy, so no lead\-time remainder exists\. A remainder measures demand\-awareness, not absolute worth, and the resource can decide the verdict while every arm is measured identically\.

### B\.4Reuse

Reuse asks whether an artifact on hand can satisfy a later ask\. On the 28 multi\-goal DataSciBench follow\-up tasks, one graph is shared across a task’s deliverables; a cache hit is priced at zero against the first\-seen whole\-request token cost, and artifact retention is toggled identically on both arms\.

The remainder is negative for the same asymmetry as ordering’s: the eager arm did the extra work that populated the cache, so the cache has more to give it\. Both arms land at the same pooled bill, and the lazy arm with reuse is not more expensive anywhere\. The standing\-session experiment sweeps session coverage and invalidation rate, and the remainder is negative in every cell:

At 25% coverage the two reuse arms arebit\-identical\(191 vs\. 191 CPU\-s\)\. In the no\-invalidation column, the remainder rises as coverage falls \(−73\.8%→−15\.3%\-73\.8\\%\\to\-15\.3\\%\); the invalidated columns are not monotone\. Swept to its floor — one touched product of eight, three widths, three session lengths — it reaches exactly\+0\.0%\+0\.0\\%and never passes it\. The cells agree by*touched count*, not coverage: 8 of 32 products bills what 8 of 8 bills\. A cache is a partial substitute for permission, whose irreducible value is the first ticket and work a session never repeats\. Lengthening the same eight\-task cohort from two through five tickets yields remainders of−1\.7%\-1\.7\\%,−1\.4%\-1\.4\\%,−3\.0%\-3\.0\\%, and−3\.0%\-3\.0\\%, with no movement toward a crossover\.

### B\.5Fusion

Fusion pays shared physical work once\. It is equally available under eager permission, so we expected no demand\-specific gain and measured that prediction\. A single static rewrite is not a valid matched intervention here: fusing a demanded node with an undemanded one would re\-bill the undemanded work tolazyand change the common planned denominator\. Fusion is therefore represented by an execution\-time ledger — both nodes stay planned at full cost, and the second member of an equivalence class is not charged for work the first already did\. A hand\-merged control bills 17, exactly what the two\-node graph bills with the ledger\.

The zero confirms fusion is not secretly a demand mechanism\. The negative row is the sharpest confirmation in the section: fusion is worth 32\.0% to a baseline that ran the addendum and has two solver setups to merge, and nothing to an arm that never ran it, because work permission declined is duplicate work fusion cannot merge\. A positive number here would have meant permission had left duplicated unrequested work on the table\. In the archived DataSciBench plans, 21 of 32 contain a product read by two or more steps, so the structure occurs\. This is a separate pre\-Terra census, not the final 28\-task Terra population; what those corpora cannot price is the shared half\.

### B\.6Speculation

Speculation materializes an eligible node outside the current demanded set, betting that a later ticket will demand it\. It does not enlarge the demanded set; it admits work outside that set\. Its matched eager control is degenerate because an eager arm already materializes every ready node\.

#### Eager is a setting of this operation, not a baseline for it\.

The speculator takes a budget \(spend permitted outside demand\) and a floor on the authored odds it will accept, and the two interpolate between the permission rules this paper has spent its length separating:

Both corners are verified as*identities*: at budget00the speculative arm is indistinguishable fromlazyon cost*and on the set of paid node identifiers*; opened fully it reacheseager’s materialized set over the nodes that declare odds\. “Eager versus lazy” becomes a comparison of two settings of one operation\.

#### Speculation cannot reduce cost, so its case is latency\.

Reuse already stops a session paying twice, so a bet can only move work earlier, and a wrong bet adds work\. IfCspecC\_\{\\mathrm\{spec\}\}andC0C\_\{0\}are session costs with and without speculation, thenCspec≥C0C\_\{\\mathrm\{spec\}\}\\geq C\_\{0\}; equivalently, every signed cost saving in the table is at most zero\. Latency is measured as*rounds containing real work*under concurrent execution, and every latency figure in this subsection is a percentage of those rounds rather than of elapsed time\. The reason is not convenience: replayed materializers return instantly, so a wall clock here would time our harness rather than the work, and a seconds figure would be an artifact of the replay\. A round is the unit a scheduler actually saves when a bet lands — one concurrent wave that no longer has to wait — so the proxy is the right shape, but it is a proxy, and the conversion to seconds depends on a real materializer’s service time, which this instrument does not supply\. The frontier compares parallel lazy execution with reuse, with and without speculation, over standing programs driven by a ticket sequence:

Three regimes, and the boundary is whether the bet is vindicated rather than invalidation alone\.Free latency: at coverage≥50%\\geq 50\\%with nothing invalidated, cost ties*exactly*and latency improves 11–22%; every bet is vindicated, so the session pays the same total sooner\.A priced trade: once coverage falls below 50%*or*anything is invalidated, 8–25% more cost buys 8–20% less waiting; whoever prepaid the widest set loses most when the world moves, which is the sentence this paper already wrote about the eager arm\. The 25%\-coverage row enters this regime despite zero invalidation: a bet can go unredeemed simply because the session never returns for it\.Strictly dominated: at coverage 12\.5%, 30% more cost buys nothing, because the session never revisits enough for a bet to land\. Speculation only has somewhere to spend because permission left the nodeplanned; an eager runtime bought the same work at full price on ticket one with no way to decline it\.

In this fixed\-graph, single\-ask family, the demanded set may contract after observations but cannot grow\. A node speculated while outside that set therefore cannot become demanded later in the run, giving a 0% hit rate by construction\. The speculative case pays 5 units above the lazy arm’s checkout, profile, and gate work, so every fixed\-graph, single\-ask benchmark of this form reports speculation as strictly dominated\. Three refusals bound the claim: effectful nodes are never bet on at any odds; a node with no declared prior is declined even at unbounded budget; and skill is refused — every bettable node declares the same prior \(0\.50\.5\), so the frontier is what askill\-freespeculator achieves and the floor a learned one must clear\.

## Appendix CFull proofs

The proofs use the execution model of Section[3](https://arxiv.org/html/2609.23058#S3)\. At each decision,GGis finite and its demand roots belong toN⁡\(G\)N\(G\); unresolved guards fail open; and compared policies receive the same graph, goal, projection, materializers, barriers, selector, and execution mode unless one is the variable under study\. “Offered” means selected from the dependency\-ready set for policy evaluation; “executable” means its guards have not failed and it is reversible or covered by a released barrier\. Set comparisons couple realized outputs only for nodes invoked in both runs\. Where a result fixesGGandRR, transformation, graph growth, request change, and artifact invalidation are outside that run segment and trigger a fresh application of the result\.

#### Lemma[1](https://arxiv.org/html/2609.23058#Thmproposition1)\(monotonicity\)\.

###### Full proof\.

FixGGandRRfor the run segment stated in the lemma\. LetPtP\_\{t\}be the predecessor relation available to the backward traversal at stateσt\\sigma\_\{t\}: a data, guard, or ordering edge belongs toPtP\_\{t\}exactly when its producer is present, nonterminal, and not guarded false underOtO\_\{t\}\. The root set named byRRis fixed\. A transition can make a producer terminal or resolve a guard\. A terminal producer and a guard resolving false remove predecessor edges; a guard resolving true removes none, because an unresolved guard already failed open\. ThusPt\+1⊆PtP\_\{t\+1\}\\subseteq P\_\{t\}\. The demanded set is the set reachable backward from the fixed roots under this relation, and reachability under a subrelation cannot add nodes\. Thereforedem⁡\(R,σt\+1\)⊆dem⁡\(R,σt\)\\mathrm\{dem\}\(R,\\sigma\_\{t\+1\}\)\\subseteq\\mathrm\{dem\}\(R,\\sigma\_\{t\}\)\. By induction, a node outside the demanded set at timettremains outside it at every later state of that segment\. ∎

#### Proposition[2](https://arxiv.org/html/2609.23058#Thmproposition2)\(flat\-pool equivalence\)\.

###### Full proof\.

Before theAnyAcceptablegoal is satisfied, every candidate endpoint is a root demand\. By the proposition’s execution\-domain assumption, every node that can be offered lies on a candidate chain and belongs todem⁡\(R,σ\)\\mathrm\{dem\}\(R,\\sigma\)\. Consider the next node selected from a shared ready wave\. If the goal is already satisfied, both policies stop\. Otherwise membership is true, so both invoke materialization on the same node\. Coupling its realized output gives both runs the same new observation and next ready wave\. Induction over selected nodes gives identical invocations until the same candidate first satisfies the goal; both then refuse all remaining work\. HenceMlazy=Mstop\_eagerM\_\{\\texttt\{lazy\}\}=M\_\{\\texttt\{stop\\\_eager\}\}\. ∎

#### Proposition[3](https://arxiv.org/html/2609.23058#Thmproposition3)\(structural separation\)\.

###### Full proof\.

FixGGandRRand letn∉dem⁡\(R,σ\)n\\notin\\mathrm\{dem\}\(R,\\sigma\)\. By Lemma[1](https://arxiv.org/html/2609.23058#Thmproposition1),nnremains outside the demanded set throughout the fixed\-program segment\. Demand membership is necessary forlazyto invoke materialization, son∉Mlazy​\(σ\)n\\notin M\_\{\\texttt\{lazy\}\}\(\\sigma\)under every selector\. The rule forstop\_eagercontains no membership test\. Ifnnis offered while the goal is open, its guards have not failed, and it is legal under the shared barrier, sostop\_eagerinvokes it andn∈Mstop\_eager​\(σ\)n\\in M\_\{\\texttt\{stop\\\_eager\}\}\(\\sigma\)\. Graph growth or a new request begins a new segment with a recomputed demanded set\. ∎

#### Corollary[4](https://arxiv.org/html/2609.23058#Thmproposition4)\(order contingency\)\.

###### Full proof\.

Letnnbe executable off\-path work that becomes ready and is eventually offered\. Proposition[3](https://arxiv.org/html/2609.23058#Thmproposition3)excludesnnfrom the lazy invocation set\. If the offer occurs while the goal is open,stop\_eagerinvokesnn; if it occurs after closure,stop\_eagerrefuses it\. Thus inclusion in the stopping executor’s set is contingent on position relative to the closing event, while the lazy decision is not\. The sets can coincide only if every such node is postponed past that event\. Under fixed, strictly positive additive node costs, any extra invocation increases the bill, so the same condition is necessary for bill equality\. If no closing event occurs,stop\_eagerinvokes every such node it is offered\. ∎

#### Proposition[5](https://arxiv.org/html/2609.23058#Thmproposition5)\(order invariance\)\.

###### Full proof\.

Under C1, a materialized node produces the same payload in every visit order\. Under C2, each guard therefore resolves identically in every order\. Under C3, the graph is fixed\. Consequently every fair selector sees the same guard\-valid dependency relation and backward closure from the conjunctive roots\. By assumption every demanded invocation succeeds, and the goal cannot close before its executable closure has run, so stopping removes no member early\. Demand permission admits the same executable, nonterminal closure members and rejects every node outside them\. A selector may choose a different topological order among simultaneously ready members, but fairness eventually offers every member\. Hence every selector invokes materialization on the same set andMlazyM\_\{\\texttt\{lazy\}\}is invariant\.

ForEachOfover disjunctive pools, the statement applies only to the across\-product choice: an unrequested product is outside the roots in every order\. Within a requested pool, the first passing candidate may change with order, so the stronger whole\-set invariance does not apply, as stated after the proposition in Section[3\.6](https://arxiv.org/html/2609.23058#S3.SS6)\. ∎