From 7c7bfc96228dc0475f337a33dfcd079e4e9855ee Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 15:33:38 -0400
Subject: [PATCH 01/31] timely-util: bound serialized column chunks and merge
 allocations

---
 src/timely-util/src/columnar/batcher.rs |  94 ++++++---------
 src/timely-util/src/columnar/chunk.rs   | 152 ++++++++++++++++++++++--
 2 files changed, 177 insertions(+), 69 deletions(-)

diff --git a/src/timely-util/src/columnar/batcher.rs b/src/timely-util/src/columnar/batcher.rs
index d459ea2efebdc..116e911fb4f43 100644
--- a/src/timely-util/src/columnar/batcher.rs
+++ b/src/timely-util/src/columnar/batcher.rs
@@ -21,7 +21,7 @@ use std::marker::PhantomData;
 use crate::columnation::ColumnationStack;
 use columnar::Container as _;
 use columnar::Push as _;
-use columnar::{Clear, Columnar, Index, Len};
+use columnar::{Borrow, Clear, Columnar, Index, Len};
 use columnation::Columnation;
 use differential_dataflow::difference::Semigroup;
 use differential_dataflow::trace::implementations::merge_batcher::Merger;
@@ -29,6 +29,7 @@ use timely::Accountable;
 use timely::Container;
 use timely::PartialOrder;
 use timely::container::{ContainerBuilder, PushInto, SizableContainer};
+use timely::dataflow::channels::ContainerBytes;
 use timely::progress::frontier::{Antichain, AntichainRef};
 
 use crate::columnar::Column;
@@ -382,22 +383,13 @@ where
                 // every record path pushes exactly one element to each.
                 let (sd, st, sr) = self_c;
 
-                // Pre-size each output leaf for the worst-case merge
-                // (no consolidation): `len(left) + len(right)` records.
-                // `reserve_for` walks each input's `as_bytes`, which is
-                // accurate for variable-length leaves (where reserving a
-                // record count wouldn't size the byte buffer correctly).
-                //
-                // Gated by record count: above a few hundred thousand
-                // records the input bound over-reserves any time
-                // consolidation is heavy, and the framework's outer
-                // ship-threshold check yields us before we'd use the
-                // headroom. For inputs past that point, geometric grow
-                // is bounded by 2× the actual output and avoids
-                // committing pages we'd never touch.
-                const RESERVE_RECORD_THRESHOLD: usize = 1_000_000;
-                if upper_l + upper_r <= RESERVE_RECORD_THRESHOLD {
-                    use columnar::Container as _;
+                // Reserving by record count can allocate an entire wide input
+                // for every small output chunk. Reserve only when both inputs
+                // fit within two ship-sized chunks.
+                let input_bytes = left[0]
+                    .length_in_bytes()
+                    .saturating_add(right[0].length_in_bytes());
+                if input_bytes <= 2 * crate::columnar::SHIP_WORDS * 8 {
                     let inputs = [left_borrow, right_borrow];
                     sd.reserve_for(inputs.iter().map(|b| b.0));
                     st.reserve_for(inputs.iter().map(|b| b.1));
@@ -406,33 +398,14 @@ where
 
                 let mut stash = R::default();
 
-                // Mid-merge ship-threshold check, matching the heuristic
-                // used by `Column::at_capacity` and `ColumnBuilder`. The
-                // tuple `(sd.borrow(), st.borrow(), sr.borrow())` chains
-                // its leaves' `as_bytes` iterators, so passing it to
-                // `at_serialized_capacity` reuses the canonical
-                // `indexed::length_in_words` formula without needing the
-                // parent borrow we destructured.
-                //
-                // The check walks every leaf slice once per call, which
-                // is non-trivial on variable-length leaves; the caller
-                // runs it every `THRESHOLD_PERIOD_MASK + 1` iterations
-                // rather than per-iter. The ship threshold is ~65 K
-                // records, so overshooting by ~1 K records before the
-                // check fires has no practical impact — the framework's
-                // outer `at_capacity` check sees the oversize chunk and
-                // ships it regardless.
-                let at_ship_threshold =
-                    |sd: &D::Container, st: &T::Container, sr: &R::Container| {
-                        use columnar::Borrow as _;
-                        crate::columnar::at_serialized_capacity(&(
-                            sd.borrow(),
-                            st.borrow(),
-                            sr.borrow(),
-                        ))
-                    };
-                const THRESHOLD_PERIOD_MASK: u32 = 1023;
-                let mut iter: u32 = 0;
+                // Spend at most the ship threshold's headroom between size
+                // checks at the input's average width. This is a cadence hint,
+                // not a hard bound for heterogeneous rows. Chunk settlement
+                // splits any oversized result at record boundaries.
+                let average_bytes = input_bytes / (upper_l + upper_r).max(1);
+                let check_records =
+                    (crate::columnar::SHIP_WORDS * 8 / 10 / average_bytes.max(1)).clamp(1, 1024);
+                let mut next_check = sd.len() + check_records;
                 let mut yielded = false;
 
                 while left_pos[0] < upper_l && right_pos[0] < upper_r {
@@ -461,9 +434,11 @@ where
                                 && (l_d.get(left_pos[0]), l_t.get(left_pos[0])) < (d2, t2)
                             {
                                 let start = left_pos[0];
-                                gallop(upper_l, &mut left_pos[0], |i| {
-                                    (l_d.get(i), l_t.get(i)) < (d2, t2)
-                                });
+                                gallop(
+                                    upper_l.min(left_pos[0] + next_check.saturating_sub(sd.len())),
+                                    &mut left_pos[0],
+                                    |i| (l_d.get(i), l_t.get(i)) < (d2, t2),
+                                );
                                 // Per-leaf bulk copy of the run: each call
                                 // resolves to an `extend_from_slice` on its
                                 // leaf (recursively for nested leaves).
@@ -482,9 +457,11 @@ where
                                 && (r_d.get(right_pos[0]), r_t.get(right_pos[0])) < (d1, t1)
                             {
                                 let start = right_pos[0];
-                                gallop(upper_r, &mut right_pos[0], |i| {
-                                    (r_d.get(i), r_t.get(i)) < (d1, t1)
-                                });
+                                gallop(
+                                    upper_r.min(right_pos[0] + next_check.saturating_sub(sd.len())),
+                                    &mut right_pos[0],
+                                    |i| (r_d.get(i), r_t.get(i)) < (d1, t1),
+                                );
                                 sd.extend_from_self(r_d, start..right_pos[0]);
                                 st.extend_from_self(r_t, start..right_pos[0]);
                                 sr.extend_from_self(r_r, start..right_pos[0]);
@@ -505,12 +482,16 @@ where
                         }
                     }
 
-                    // Amortized ship-threshold check; see comment above
-                    // `at_ship_threshold` for rationale.
-                    iter = iter.wrapping_add(1);
-                    if iter & THRESHOLD_PERIOD_MASK == 0 && at_ship_threshold(sd, st, sr) {
-                        yielded = true;
-                        break;
+                    if sd.len() >= next_check {
+                        if crate::columnar::at_serialized_capacity(&(
+                            sd.borrow(),
+                            st.borrow(),
+                            sr.borrow(),
+                        )) {
+                            yielded = true;
+                            break;
+                        }
+                        next_check = sd.len() + check_records;
                     }
                 }
                 yielded
@@ -742,7 +723,6 @@ where
     }
 
     fn allocation(chunk: &Self::Chunk) -> (usize, usize, usize) {
-        use timely::dataflow::channels::ContainerBytes;
         // Serialized footprint stands in for both `size` and `capacity`: the
         // chunk owns one logical allocation worth of leaf storage, and we
         // ship/recycle the whole thing rather than tracking per-leaf
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 28cbd51a11a5f..e2078f2421385 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -336,6 +336,24 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
         ColumnChunk::Resident(Rc::new(column), 0)
     }
 
+    /// Append byte-bounded pieces, preserving order and generational depth.
+    /// A single update may exceed the bound because it cannot be split.
+    fn push_bounded(column: Column<(D, T, R)>, depth: u8, out: &mut VecDeque<Self>) {
+        let len = column.borrow().len();
+        if len <= 1 || column.length_in_bytes() <= COMMIT_BYTES {
+            if len > 0 {
+                out.push_back(Self::Resident(Rc::new(column), depth));
+            }
+            return;
+        }
+        let view = column.borrow();
+        for range in [0..len / 2, len / 2..len] {
+            let mut part = <(D, T, R) as Columnar>::Container::default();
+            part.extend_from_self(view, range);
+            Self::push_bounded(Column::Typed(part), depth, out);
+        }
+    }
+
     /// The body as an owned column. A spilled body is copied out of the pool
     /// within this call. A shared resident body is copied.
     pub fn into_column(self) -> Column<(D, T, R)> {
@@ -919,10 +937,25 @@ where
                 }
                 ColumnChunk::Resident(rc, depth) => (rc, depth),
             };
+            if rc.length_in_bytes() > COMMIT_BYTES && rc.borrow().len() > 1 {
+                let col = Rc::try_unwrap(rc).unwrap_or_else(|rc| copy_column(&rc));
+                let mut pieces = VecDeque::new();
+                Self::push_bounded(col, depth, &mut pieces);
+                for piece in pieces.into_iter().rev() {
+                    input.push_front(piece);
+                }
+                continue;
+            }
             let full = at_commit_size(&rc);
             // A sub-threshold chunk coalesces into the open carry by borrow,
             // never unwrapping a shared body.
-            if !full && let Some((mut acc, acc_depth)) = carry.take() {
+            let fits = carry.as_ref().is_some_and(|(acc, _)| {
+                acc.length_in_bytes().saturating_add(rc.length_in_bytes()) <= COMMIT_BYTES
+            });
+            if !full
+                && fits
+                && let Some((mut acc, acc_depth)) = carry.take()
+            {
                 let Column::Typed(acc_c) = &mut acc else {
                     unreachable!("carry is always Typed");
                 };
@@ -1139,6 +1172,7 @@ where
 /// raw input columns through a [`ColumnChunker`] and wraps its output chunks.
 pub struct ChunkChunker<D: Columnar, T: Columnar, R: Columnar> {
     inner: ColumnChunker<(D, T, R)>,
+    ready: VecDeque<ColumnChunk<D, T, R>>,
     staged: ColumnChunk<D, T, R>,
 }
 
@@ -1152,6 +1186,7 @@ where
     fn default() -> Self {
         Self {
             inner: Default::default(),
+            ready: VecDeque::new(),
             staged: Default::default(),
         }
     }
@@ -1179,14 +1214,20 @@ where
     type Container = ColumnChunk<D, T, R>;
 
     fn extract(&mut self) -> Option<&mut Self::Container> {
-        let col = self.inner.extract()?;
-        self.staged = ColumnChunk::from_column(std::mem::take(col));
+        if self.ready.is_empty() {
+            let col = self.inner.extract()?;
+            ColumnChunk::push_bounded(std::mem::take(col), 0, &mut self.ready);
+        }
+        self.staged = self.ready.pop_front()?;
         Some(&mut self.staged)
     }
 
     fn finish(&mut self) -> Option<&mut Self::Container> {
-        let col = self.inner.finish()?;
-        self.staged = ColumnChunk::from_column(std::mem::take(col));
+        if self.ready.is_empty() {
+            let col = self.inner.finish()?;
+            ColumnChunk::push_bounded(std::mem::take(col), 0, &mut self.ready);
+        }
+        self.staged = self.ready.pop_front()?;
         Some(&mut self.staged)
     }
 }
@@ -1585,6 +1626,95 @@ mod tests {
         collected
     }
 
+    type WideUpdate = ((u64, String), u64, i64);
+    type WideChunk = ColumnChunk<(u64, String), u64, i64>;
+
+    fn wide_column(keys: impl Iterator<Item = u64>, bytes: usize) -> Column<WideUpdate> {
+        let mut column = Column::default();
+        for key in keys {
+            column.push_into(&((key, "x".repeat(bytes)), 0, 1));
+        }
+        column
+    }
+
+    fn assert_wide_byte_bound(chunks: VecDeque<WideChunk>, expected: usize, payload_bytes: usize) {
+        let mut keys = Vec::new();
+        for chunk in chunks {
+            let column = chunk.into_column();
+            assert!(
+                column.length_in_bytes() <= COMMIT_BYTES || column.borrow().len() == 1,
+                "{} bytes in a {}-record chunk",
+                column.length_in_bytes(),
+                column.borrow().len(),
+            );
+            let view = column.borrow();
+            for index in 0..view.len() {
+                let ((key, payload), time, diff) = view.get(index);
+                assert_eq!(payload.len(), payload_bytes);
+                assert!(payload.iter().all(|byte| *byte == b'x'));
+                assert_eq!((*time, *diff), (0, 1));
+                keys.push(*key);
+            }
+        }
+        assert_eq!(keys, (0..u64::cast_from(expected)).collect::<Vec<_>>());
+    }
+
+    #[mz_ore::test]
+    fn chunker_enforces_byte_bound() {
+        let mut chunker = ChunkChunker::default();
+        let mut input = wide_column((0..4000).rev(), 3000);
+        chunker.push_into(&mut input);
+        let mut chunks = VecDeque::new();
+        if let Some(chunk) = chunker.extract() {
+            chunks.push_back(std::mem::take(chunk));
+        }
+        while let Some(chunk) = chunker.finish() {
+            chunks.push_back(std::mem::take(chunk));
+        }
+        assert_wide_byte_bound(chunks, 4000, 3000);
+    }
+
+    #[mz_ore::test]
+    fn merge_settle_enforces_byte_bound() {
+        let mut left = VecDeque::from([WideChunk::from_column(wide_column(
+            (0..2000).step_by(2),
+            2100,
+        ))]);
+        let mut right = VecDeque::from([WideChunk::from_column(wide_column(
+            (1..2000).step_by(2),
+            2100,
+        ))]);
+        let mut merged = VecDeque::new();
+        while !left.is_empty() && !right.is_empty() {
+            WideChunk::merge(&mut left, &mut right, &mut merged);
+        }
+        merged.append(&mut left);
+        merged.append(&mut right);
+        let mut settled = VecDeque::new();
+        WideChunk::settle(&mut merged, true, &mut settled);
+        assert_wide_byte_bound(settled, 2000, 2100);
+    }
+
+    #[mz_ore::test]
+    fn settle_enforces_byte_bound_after_coalescing() {
+        let mut input = VecDeque::from([
+            WideChunk::from_column(wide_column(0..400, 3000)),
+            WideChunk::from_column(wide_column(400..800, 3000)),
+        ]);
+        let mut settled = VecDeque::new();
+        WideChunk::settle(&mut input, true, &mut settled);
+        assert_wide_byte_bound(settled, 800, 3000);
+    }
+
+    #[mz_ore::test]
+    fn settle_byte_bound_allows_indivisible_update() {
+        let mut input =
+            VecDeque::from([WideChunk::from_column(wide_column(0..1, 2 * COMMIT_BYTES))]);
+        let mut settled = VecDeque::new();
+        WideChunk::settle(&mut input, true, &mut settled);
+        assert_wide_byte_bound(settled, 1, 2 * COMMIT_BYTES);
+    }
+
     /// Advancing a large input cuts the output into several chunks near the
     /// ship threshold, and their concatenation is the reference result.
     #[mz_ore::test]
@@ -1880,7 +2010,7 @@ mod tests {
     #[cfg_attr(miri, ignore)] // too slow
     fn settle_commits_at_accumulated_depth() {
         set_spill_override(Some(test_pool()));
-        let big: Vec<Tuple> = (0..100_000u64).map(|i| ((i, 0), 0, 1i64)).collect();
+        let big: Vec<Tuple> = (0..60_000u64).map(|i| ((i, 0), 0, 1i64)).collect();
         let mut input = VecDeque::from([
             ColumnChunk::Resident(Rc::new(build_column(&big)), 1),
             ColumnChunk::Resident(Rc::new(build_column(&[((0, 0), 0, 1)])), 0),
@@ -1903,10 +2033,8 @@ mod tests {
     #[mz_ore::test]
     #[cfg_attr(miri, ignore)] // too slow
     fn settle_carry_commits_at_target() {
-        // ~1.5 MiB per chunk (a row serializes to 32 bytes): under
-        // `at_commit_size`, so the carry has to coalesce, and a coalesced
-        // pair lands in the dead zone of the periodic window check.
-        let chunk_rows = u64::cast_from(1_500_000usize / 32);
+        // Two inputs fit in one slot. A third must start another chunk.
+        let chunk_rows = u64::cast_from(800_000usize / 32);
         let mut input: VecDeque<TestChunk> = (0..4u64)
             .map(|c| {
                 let data: Vec<Tuple> = (0..chunk_rows)
@@ -1923,8 +2051,8 @@ mod tests {
         for chunk in &out {
             let col = chunk.clone().into_column();
             assert!(
-                col.length_in_bytes() < 2 * COMMIT_BYTES,
-                "settled chunk of {} bytes exceeds twice the commit target",
+                col.length_in_bytes() <= COMMIT_BYTES,
+                "settled chunk of {} bytes exceeds the commit target",
                 col.length_in_bytes(),
             );
         }

From bb1979aec9c5bcabdce29ef9d2ee99660a19dea6 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 15:33:38 -0400
Subject: [PATCH 02/31] pool: bound insertion debt during concurrent
 enforcement

Reserve resident bytes before filling pool slots. If enforcement cannot make room within the bounded allowance, write the insertion directly to an extent and expose that fallback in pool metrics. This prevents an occupied single-flight enforcer from allowing an unbounded queue of resident insertions.

Add deterministic tests for a stalled enforcer and concurrent fills, including payload round trips and accounting after drops.
---
 doc/user/data/metrics.yml                  |   4 +
 src/ore/src/pool.rs                        | 148 +++++++++++++++++++--
 src/timely-util/src/pool_config/metrics.rs |   1 +
 3 files changed, 144 insertions(+), 9 deletions(-)

diff --git a/doc/user/data/metrics.yml b/doc/user/data/metrics.yml
index d42be02e4edd0..8b32bc164e62e 100644
--- a/doc/user/data/metrics.yml
+++ b/doc/user/data/metrics.yml
@@ -556,6 +556,10 @@ metrics:
   help: Evicted chunks re-admitted by an admitting read stealing the slot of a clean backed victim of the same size class.
   source: src/timely-util/src/pool_config/metrics.rs
   visibility: internal
+- name: mz_column_pool_direct_extent_inserts_total
+  help: Inserts written directly to an extent because resident admission was full.
+  source: src/timely-util/src/pool_config/metrics.rs
+  visibility: internal
 - name: mz_column_pool_eager_backs_total
   help: Chunks eagerly compressed to compressed-but-resident by idle spill threads; their later eviction is a pure page release.
   source: src/timely-util/src/pool_config/metrics.rs
diff --git a/src/ore/src/pool.rs b/src/ore/src/pool.rs
index e985f57b52029..0eadc89e241cc 100644
--- a/src/ore/src/pool.rs
+++ b/src/ore/src/pool.rs
@@ -194,6 +194,8 @@ enum Residency {
 pub struct PoolStats {
     /// Chunks inserted.
     pub inserts: u64,
+    /// Inserts written directly to an extent because resident admission was full.
+    pub direct_extent_inserts: u64,
     /// Chunks freed (handle dropped).
     pub frees: u64,
     /// Backing writes elided: chunks dead before their compression
@@ -279,6 +281,7 @@ pub struct PoolStats {
 
 #[derive(Debug, Default)]
 struct Counters {
+    direct_extent_inserts: AtomicU64,
     inserts: AtomicU64,
     spill_scheduled: AtomicU64,
     spill_cancelled: AtomicU64,
@@ -570,10 +573,13 @@ impl Pool {
     }
 
     /// Allocates a chunk of `len` words and fills it in place: `fill`
-    /// receives the chunk's slot memory directly and must overwrite all of
-    /// it (the slot's prior contents are unspecified), so serialization
-    /// writes its single copy straight into pool memory. The returned handle
-    /// starts `UnbackedResident`. A zero `len` returns a length-0 handle
+    /// receives `len` contiguous words and must overwrite all of them.
+    /// With resident admission, these are the slot's unspecified prior
+    /// contents, so serialization writes directly into pool memory.
+    /// Otherwise, `fill` writes into staging for a synchronous extent write.
+    /// The returned handle
+    /// starts `UnbackedResident` when admission has room, otherwise `Evicted`
+    /// with a directly written extent. A zero `len` returns a length-0 handle
     /// holding no slot; payloads beyond the largest size class fall back to
     /// a plain heap allocation, always resident, a prototype limitation.
     /// `hints` steer eviction and write-behind policy; callers without
@@ -620,14 +626,22 @@ impl Pool {
                 .oversize_payloads
                 .fetch_add(1, Ordering::Relaxed);
         }
+        if class.is_some() {
+            if !inner.reserve_insert(len_bytes) {
+                inner.enforce_budget();
+                if !inner.reserve_insert(len_bytes) {
+                    return self.insert_extent(len, hints, codec, fill);
+                }
+            }
+        } else {
+            inner
+                .counters
+                .resident_bytes
+                .fetch_add(u64::cast_from(len_bytes), Ordering::Relaxed);
+        }
         // A class with no free slot degrades to the heap path below: an
         // unpageable chunk beats a dead replica.
         let slot = class.and_then(|class| inner.alloc_slot(class, len_bytes));
-        // Whichever home the payload found, it is resident.
-        inner
-            .counters
-            .resident_bytes
-            .fetch_add(u64::cast_from(len_bytes), Ordering::Relaxed);
         let meta = match (class, slot) {
             (Some(class), Some(slot)) => {
                 let region = &inner.regions[class];
@@ -689,11 +703,49 @@ impl Pool {
         ChunkHandle { meta }
     }
 
+    fn insert_extent(
+        &self,
+        len: usize,
+        hints: ChunkHints,
+        codec: &'static dyn ExtentCodec,
+        fill: impl FnOnce(&mut [u64]),
+    ) -> ChunkHandle {
+        // Compress synchronously to keep denied insertions from queuing
+        // uncompressed payloads behind an occupied enforcer.
+        let mut words = vec![0; len];
+        fill(&mut words);
+        let inner = &self.0;
+        let extent = SwapExtent::write(&inner.extent_arena, &words, codec, Scratch::Shrink);
+        drop(words);
+        let meta = Arc::new(ChunkMeta::new(
+            inner,
+            len,
+            region::size_class_for(len * 8),
+            hints.depth,
+            codec,
+            Residency::Evicted,
+            None,
+            None,
+        ));
+        inner.live_chunks.fetch_add(1, Ordering::Relaxed);
+        inner
+            .counters
+            .direct_extent_inserts
+            .fetch_add(1, Ordering::Relaxed);
+        {
+            let mut state = meta.state();
+            inner.commit_extent(&meta, &mut state, extent);
+        }
+        inner.enforce_or_defer_compressed_cap();
+        ChunkHandle { meta }
+    }
+
     /// Snapshot of the pool's counters.
     pub fn stats(&self) -> PoolStats {
         let c = &self.0.counters;
         PoolStats {
             inserts: c.inserts.load(Ordering::Relaxed),
+            direct_extent_inserts: c.direct_extent_inserts.load(Ordering::Relaxed),
             frees: c.frees.load(Ordering::Relaxed),
             writes_elided: c.writes_elided.load(Ordering::Relaxed),
             evictions_compress: c.evictions_compress.load(Ordering::Relaxed),
@@ -986,6 +1038,23 @@ impl PoolInner {
         }
     }
 
+    /// Reserve insertion bytes before populating a slot. Enforcement can
+    /// lag by one eighth of the budget, or one payload for small budgets.
+    /// Read admissions use the budget itself and cannot consume this slack.
+    fn reserve_insert(&self, len_bytes: usize) -> bool {
+        let len = u64::cast_from(len_bytes);
+        self.counters
+            .resident_bytes
+            .try_update(Ordering::Relaxed, Ordering::Relaxed, |cur| {
+                let budget = self.budget_bytes.load(Ordering::Relaxed);
+                let ceiling = budget.saturating_add((budget / 8).max(len));
+                let next = cur.checked_add(len)?;
+                let oversize = self.counters.oversize_bytes.load(Ordering::Relaxed);
+                (next.saturating_sub(oversize) <= ceiling).then_some(next)
+            })
+            .is_ok()
+    }
+
     fn enforce_budget(&self) {
         // Single-flight: enforcement runs synchronously on whichever thread
         // trips it (every insert), and concurrent passes would
@@ -3172,6 +3241,67 @@ mod tests {
         );
     }
 
+    #[mz_ore::test]
+    fn insertion_debt_is_bounded_during_enforcement() {
+        let budget = 2 * SMALL * 8;
+        let pool = test_pool(budget);
+        let guard = pool.0.enforcing.lock().expect("enforcement lock");
+        let mut handles = Vec::new();
+        for seed in 0..16 {
+            handles.push(insert(&pool, &mut payload(SMALL, seed)));
+            assert!(
+                pool.stats().resident_bytes <= u64::cast_from(budget + SMALL * 8),
+                "an occupied enforcer must not allow unlimited insertion debt",
+            );
+        }
+        drop(guard);
+        for (seed, handle) in handles.iter().enumerate() {
+            assert_eq!(read(handle), payload(SMALL, u64::cast_from(seed)));
+        }
+        drop(handles);
+        assert_eq!(pool.stats().resident_bytes, 0);
+        assert_eq!(pool.stats().live_chunks, 0);
+        assert_eq!(pool.stats().extent_resident_bytes, 0);
+    }
+
+    #[mz_ore::test]
+    fn admission_reserves_before_concurrent_fills() {
+        let budget = 2 * SMALL * 8;
+        let pool = test_pool(budget);
+        let guard = pool.0.enforcing.lock().expect("enforcement lock");
+        let gate = Arc::new(std::sync::Barrier::new(9));
+        let threads: Vec<_> = (0..8u64)
+            .map(|seed| {
+                let pool = pool.clone();
+                let gate = Arc::clone(&gate);
+                std::thread::spawn(move || {
+                    pool.insert_with(SMALL, ChunkHints::default(), &TEST_CODEC, |dst| {
+                        gate.wait();
+                        gate.wait();
+                        dst.copy_from_slice(&payload(SMALL, seed));
+                    })
+                })
+            })
+            .collect();
+        gate.wait();
+        let reserved = pool.stats().resident_bytes;
+        // Release every producer even if the assertion fails.
+        gate.wait();
+        let handles: Vec<_> = threads
+            .into_iter()
+            .map(|t| t.join().expect("producer panicked"))
+            .collect();
+        drop(guard);
+        assert!(reserved <= u64::cast_from(budget + SMALL * 8));
+        assert!(pool.stats().direct_extent_inserts > 0);
+        for (seed, handle) in handles.iter().enumerate() {
+            assert_eq!(read(handle), payload(SMALL, u64::cast_from(seed)));
+        }
+        drop(handles);
+        assert_eq!(pool.stats().resident_bytes, 0);
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+
     #[mz_ore::test]
     fn set_budget_retunes_in_place() {
         let pool = test_pool(usize::MAX);
diff --git a/src/timely-util/src/pool_config/metrics.rs b/src/timely-util/src/pool_config/metrics.rs
index 1146a721d8252..7221f38a79b03 100644
--- a/src/timely-util/src/pool_config/metrics.rs
+++ b/src/timely-util/src/pool_config/metrics.rs
@@ -39,6 +39,7 @@ pub fn register(registry: &MetricsRegistry) {
         // instantaneous levels are mixed under the one gauge type, so the
         // `_total` name suffix, not the metric type, marks a field as
         // monotonic.
+        gauge(registry, metric!(name: "mz_column_pool_direct_extent_inserts_total", help: "Inserts written directly to an extent because resident admission was full."), |s| s.direct_extent_inserts);
         gauge(registry, metric!(name: "mz_column_pool_resident_bytes", help: "Uncompressed bytes resident in the buffer pool."), |s| s.resident_bytes);
         gauge(registry, metric!(name: "mz_column_pool_oversize_bytes", help: "Bytes held by oversize chunks that bypass pool paging."), |s| s.oversize_bytes);
         gauge(registry, metric!(name: "mz_column_pool_inserts_total", help: "Chunks inserted into the buffer pool."), |s| s.inserts);

From 761ac84fc4855c61943c0c4ec826fbdb3f19e445 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 15:51:56 -0400
Subject: [PATCH 03/31] storage: offload upsert drain reads to the blocking
 executor

Add enable_upsert_async_reads for chunked stash drains and feedback probes. Read pooled bodies on Tokio's blocking executor with at most eight queued or running reads per pool. Submitted jobs retain their handles and permits through cancellation. Resident columns stay on the timely worker, and merge/seal reads remain synchronous.

Default the flag off in production and on in mzcompose defaults, register it for stress-test flag flips, and expose submitted/in-flight read metrics. This is an offload experiment: it adds scheduling and read-buffer allocation overhead, and does not pipeline reads within one drain.

Validate cancellation and admission bounds, copy-out without residency admission, straddled probe keys, and skipped chunks. Compare paged, synchronous chunked, and asynchronous chunked output in the upsert operator scenarios, including forced pool eviction.

Validation: 302 pool/timely utility tests passed; 14 focused async and upsert operator tests passed after the final harness changes. bin/fmt, flag-registration lint, storage cargo check, and clippy for all targets in mz-ore, mz-timely-util, and mz-storage passed. Full bin/lint remains blocked by macOS Bash 3 in check-protobuf and environment stripping in check-mzcompose-files under the jj workspace. No performance results yet.
---
 doc/user/data/metrics.yml                     |   8 +
 misc/python/materialize/mzcompose/__init__.py |   5 +
 .../materialize/parallel_workload/action.py   |   1 +
 src/ore/src/pool.rs                           | 170 ++++++++++++++++++
 src/storage-types/src/dyncfgs.rs              |  11 ++
 .../src/upsert_continual_feedback_v2.rs       |  62 +++++--
 src/timely-util/src/columnar/chunk.rs         |  72 +++++++-
 src/timely-util/src/columnar/unload.rs        | 105 +++++++----
 src/timely-util/src/pool_config/metrics.rs    |   2 +
 9 files changed, 380 insertions(+), 56 deletions(-)

diff --git a/doc/user/data/metrics.yml b/doc/user/data/metrics.yml
index 8b32bc164e62e..04d8a2228dff1 100644
--- a/doc/user/data/metrics.yml
+++ b/doc/user/data/metrics.yml
@@ -556,6 +556,14 @@ metrics:
   help: Evicted chunks re-admitted by an admitting read stealing the slot of a clean backed victim of the same size class.
   source: src/timely-util/src/pool_config/metrics.rs
   visibility: internal
+- name: mz_column_pool_async_reads_in_flight
+  help: Submitted pool reads that have not released their concurrency permit.
+  source: src/timely-util/src/pool_config/metrics.rs
+  visibility: internal
+- name: mz_column_pool_async_reads_total
+  help: Pool reads submitted to the blocking executor.
+  source: src/timely-util/src/pool_config/metrics.rs
+  visibility: internal
 - name: mz_column_pool_direct_extent_inserts_total
   help: Inserts written directly to an extent because resident admission was full.
   source: src/timely-util/src/pool_config/metrics.rs
diff --git a/misc/python/materialize/mzcompose/__init__.py b/misc/python/materialize/mzcompose/__init__.py
index a2e156a9e627b..6775050092307 100644
--- a/misc/python/materialize/mzcompose/__init__.py
+++ b/misc/python/materialize/mzcompose/__init__.py
@@ -364,6 +364,11 @@ def get_variable_system_parameters(
             "true",
             ["true", "false"],
         ),
+        VariableSystemParameter(
+            "enable_upsert_async_reads",
+            "true",
+            ["true", "false"],
+        ),
         VariableSystemParameter(
             "enable_upsert_v2",
             "false",
diff --git a/misc/python/materialize/parallel_workload/action.py b/misc/python/materialize/parallel_workload/action.py
index 6a008fc235834..5e77cdc17e42f 100644
--- a/misc/python/materialize/parallel_workload/action.py
+++ b/misc/python/materialize/parallel_workload/action.py
@@ -3179,6 +3179,7 @@ def __init__(
         ]
         self.flags_with_values["enable_upsert_paged_spill"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_chunked_stash"] = BOOLEAN_FLAG_VALUES
+        self.flags_with_values["enable_upsert_async_reads"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["column_chunk_compress_min_depth"] = [
             "0",  # compress every spilled body
             "1",  # the default: fresh chunks store uncompressed
diff --git a/src/ore/src/pool.rs b/src/ore/src/pool.rs
index 0eadc89e241cc..b8ac6d167af41 100644
--- a/src/ore/src/pool.rs
+++ b/src/ore/src/pool.rs
@@ -80,6 +80,11 @@ use crate::pool::region::{Region, SIZE_CLASSES};
 /// NOTE: Seen OoMs with Miri since it actually allocates the capacity.
 const CLASS_CAPACITY_BYTES: usize = if cfg!(miri) { 16 << 20 } else { 1 << 40 };
 
+// At most eight queued or running reads per pool. Completed buffers belong
+// to callers, whose staging limits must bound their retained memory.
+#[cfg(feature = "async")]
+const ASYNC_READ_CONCURRENCY: usize = 8;
+
 /// A chunk-provided transform between a chunk's body bytes and the stored
 /// bytes its extent holds. The pool owns scheduling: spill threads, the
 /// residency state machine, cancellation, and the ledger. It invokes the
@@ -196,6 +201,10 @@ pub struct PoolStats {
     pub inserts: u64,
     /// Inserts written directly to an extent because resident admission was full.
     pub direct_extent_inserts: u64,
+    /// Reads submitted to the blocking executor.
+    pub async_reads: u64,
+    /// Submitted reads that have not released their concurrency permit.
+    pub async_reads_in_flight: u64,
     /// Chunks freed (handle dropped).
     pub frees: u64,
     /// Backing writes elided: chunks dead before their compression
@@ -282,6 +291,7 @@ pub struct PoolStats {
 #[derive(Debug, Default)]
 struct Counters {
     direct_extent_inserts: AtomicU64,
+    async_reads: AtomicU64,
     inserts: AtomicU64,
     spill_scheduled: AtomicU64,
     spill_cancelled: AtomicU64,
@@ -381,6 +391,8 @@ struct PoolInner {
     /// counter read still has its bytes enforced rather than dropped.
     enforce_pending: std::sync::atomic::AtomicBool,
     counters: Counters,
+    #[cfg(feature = "async")]
+    read_slots: Arc<tokio::sync::Semaphore>,
     spill: Spill,
 }
 
@@ -568,6 +580,8 @@ impl Pool {
             enforcing: Mutex::new(()),
             enforce_pending: std::sync::atomic::AtomicBool::new(false),
             counters: Counters::default(),
+            #[cfg(feature = "async")]
+            read_slots: Arc::new(tokio::sync::Semaphore::new(ASYNC_READ_CONCURRENCY)),
             spill: Spill::default(),
         })))
     }
@@ -746,6 +760,17 @@ impl Pool {
         PoolStats {
             inserts: c.inserts.load(Ordering::Relaxed),
             direct_extent_inserts: c.direct_extent_inserts.load(Ordering::Relaxed),
+            async_reads: c.async_reads.load(Ordering::Relaxed),
+            async_reads_in_flight: {
+                #[cfg(feature = "async")]
+                {
+                    u64::cast_from(ASYNC_READ_CONCURRENCY - self.0.read_slots.available_permits())
+                }
+                #[cfg(not(feature = "async"))]
+                {
+                    0
+                }
+            },
             frees: c.frees.load(Ordering::Relaxed),
             writes_elided: c.writes_elided.load(Ordering::Relaxed),
             evictions_compress: c.evictions_compress.load(Ordering::Relaxed),
@@ -1958,6 +1983,37 @@ impl ChunkHandle {
         self.read_impl(0..self.meta.len, dst, false);
     }
 
+    /// Copy this chunk on the blocking executor without admitting it to the pool.
+    ///
+    /// Requires a Tokio runtime. A submitted read retains its handle and
+    /// concurrency permit until it finishes, even if the caller cancels.
+    /// The returned buffer belongs to the caller.
+    #[cfg(feature = "async")]
+    pub async fn read_async(self: &Arc<Self>) -> Vec<u64> {
+        let permit = Arc::clone(&self.meta.pool.read_slots)
+            .acquire_owned()
+            .await
+            .expect("pool read semaphore remains open");
+        let handle = Arc::clone(self);
+        self.meta
+            .pool
+            .counters
+            .async_reads
+            .fetch_add(1, Ordering::Relaxed);
+        crate::task::spawn_blocking(
+            || "pool_read",
+            move || {
+                // A cancelled JoinHandle must not release admission while its
+                // blocking read still owns a slot or extent reference.
+                let _permit = permit;
+                let mut words = Vec::new();
+                handle.read_into(&mut words);
+                words
+            },
+        )
+        .await
+    }
+
     /// As [`ChunkHandle::read_into`], restricted to the word range `range`
     /// of the chunk's contents, which must lie within them. `dst` receives
     /// exactly the range.
@@ -2216,6 +2272,9 @@ impl Drop for ChunkHandle {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(feature = "async")]
+    use std::sync::atomic::{AtomicBool, AtomicUsize};
+
     use super::*;
     use crate::pool::extent::TEST_CODEC;
 
@@ -2231,6 +2290,117 @@ mod tests {
         pool
     }
 
+    #[cfg(feature = "async")]
+    #[derive(Debug, Default)]
+    struct DelayedReadCodec {
+        entered: AtomicUsize,
+        released: AtomicBool,
+    }
+
+    #[cfg(feature = "async")]
+    impl ExtentCodec for DelayedReadCodec {
+        fn encode(&self, body: &[u8], out: &mut Vec<u8>) {
+            TEST_CODEC.encode(body, out);
+        }
+
+        fn decode(&self, stored: &[u8], body: &mut [u8]) {
+            // NOTE: Test-only delay models a page fault while the state lock is held.
+            self.entered.fetch_add(1, Ordering::SeqCst);
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+            while !self.released.load(Ordering::SeqCst) {
+                assert!(
+                    std::time::Instant::now() < deadline,
+                    "test read was released"
+                );
+                std::thread::sleep(std::time::Duration::from_millis(1));
+            }
+            TEST_CODEC.decode(stored, body);
+        }
+    }
+
+    #[cfg(feature = "async")]
+    struct ReleaseReadsOnDrop(&'static DelayedReadCodec);
+
+    #[cfg(feature = "async")]
+    impl Drop for ReleaseReadsOnDrop {
+        fn drop(&mut self) {
+            self.0.released.store(true, Ordering::SeqCst);
+        }
+    }
+
+    #[cfg(feature = "async")]
+    async fn wait_for_read_state(mut ready: impl FnMut() -> bool) {
+        tokio::time::timeout(std::time::Duration::from_secs(10), async {
+            while !ready() {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("read workers made progress");
+    }
+
+    #[cfg(feature = "async")]
+    #[mz_ore::test(tokio::test)]
+    #[cfg_attr(miri, ignore)]
+    async fn async_read_round_trip_without_admission() {
+        for budget in [0, usize::MAX] {
+            let pool = test_pool(budget);
+            let expected = payload(8192, 42);
+            let handle = Arc::new(insert(&pool, &mut expected.clone()));
+            let resident = pool.stats().resident_bytes;
+            assert_eq!(handle.read_async().await, expected);
+            assert_eq!(pool.stats().resident_bytes, resident);
+            assert_eq!(pool.stats().async_reads, 1);
+            assert_eq!(pool.stats().async_reads_in_flight, 0);
+        }
+    }
+
+    #[cfg(feature = "async")]
+    #[mz_ore::test(tokio::test)]
+    #[cfg_attr(miri, ignore)]
+    async fn async_reads_remain_bounded_after_cancellation() {
+        let pool = test_pool(0);
+        let codec = Box::leak(Box::new(DelayedReadCodec::default()));
+        let release = ReleaseReadsOnDrop(codec);
+        let expected = payload(8192, 7);
+        let handles: Vec<_> = (0..=ASYNC_READ_CONCURRENCY)
+            .map(|_| {
+                Arc::new(
+                    pool.insert_with(expected.len(), ChunkHints::default(), codec, |dst| {
+                        dst.copy_from_slice(&expected);
+                    }),
+                )
+            })
+            .collect();
+        let mut reads: Vec<_> = handles.iter().map(|h| Box::pin(h.read_async())).collect();
+        for read in &mut reads {
+            assert!(futures::poll!(read.as_mut()).is_pending());
+        }
+        wait_for_read_state(|| codec.entered.load(Ordering::SeqCst) == ASYNC_READ_CONCURRENCY)
+            .await;
+        assert_eq!(
+            pool.stats().async_reads,
+            u64::cast_from(ASYNC_READ_CONCURRENCY)
+        );
+        assert_eq!(
+            pool.stats().async_reads_in_flight,
+            u64::cast_from(ASYNC_READ_CONCURRENCY)
+        );
+        drop(reads);
+        drop(handles);
+        // The unsubmitted ninth read frees immediately. Detached blocking
+        // jobs must retain both their handles and their admission permits.
+        assert_eq!(pool.stats().frees, 1);
+        assert_eq!(
+            pool.stats().async_reads_in_flight,
+            u64::cast_from(ASYNC_READ_CONCURRENCY)
+        );
+        drop(release);
+        wait_for_read_state(|| pool.stats().frees == u64::cast_from(ASYNC_READ_CONCURRENCY + 1))
+            .await;
+        assert_eq!(pool.stats().async_reads_in_flight, 0);
+    }
+
     /// Scales an iteration count down under Miri, where one interpreted
     /// compression costs what thousands do natively.
     fn rounds(native: u64, miri: u64) -> u64 {
diff --git a/src/storage-types/src/dyncfgs.rs b/src/storage-types/src/dyncfgs.rs
index a98278efa5621..e27dff344b92e 100644
--- a/src/storage-types/src/dyncfgs.rs
+++ b/src/storage-types/src/dyncfgs.rs
@@ -442,6 +442,16 @@ pub const ENABLE_UPSERT_CHUNKED_STASH: Config<bool> = Config::new(
     ParameterScope::Replica,
 );
 
+/// Offload chunked upsert stash drains and feedback lookups to the blocking
+/// executor. Merge reads remain synchronous. Read at operator construction.
+pub const ENABLE_UPSERT_ASYNC_READS: Config<bool> = Config::new(
+    "enable_upsert_async_reads",
+    false,
+    "Read sealed stash and feedback chunks asynchronously when enable_upsert_v2 and \
+     enable_upsert_chunked_stash are true. Takes effect on new dataflows.",
+    ParameterScope::Replica,
+);
+
 // RocksDB
 
 /// How many times to try to cleanup old RocksDB DB's on disk before giving up.
@@ -566,6 +576,7 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&SUSPENDABLE_SOURCES)
         .add(&ENABLE_UPSERT_PAGED_SPILL)
         .add(&ENABLE_UPSERT_CHUNKED_STASH)
+        .add(&ENABLE_UPSERT_ASYNC_READS)
         .add(&WALLCLOCK_GLOBAL_LAG_HISTOGRAM_RETENTION_INTERVAL)
         .add(&WALLCLOCK_LAG_HISTORY_RETENTION_INTERVAL)
         .add(&crate::sources::sql_server::CDC_CLEANUP_CHANGE_TABLE)
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index 5b4b699ac2048..d00b818cc9379 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -105,7 +105,7 @@ use mz_repr::{Datum, Diff, GlobalId, Row};
 #[cfg(feature = "fuzzing")]
 use mz_row_spine::DatumSeq;
 use mz_row_spine::{ValRowColPagedBuilder, ValRowSpine};
-use mz_storage_types::dyncfgs::ENABLE_UPSERT_CHUNKED_STASH;
+use mz_storage_types::dyncfgs::{ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH};
 use mz_storage_types::errors::{DataflowError, EnvelopeError, UpsertError};
 use mz_timely_util::builder_async::{
     AsyncOutputHandle, Event as AsyncEvent, OperatorBuilder as AsyncOperatorBuilder,
@@ -148,7 +148,7 @@ pub enum UpsertStashFlavor {
     Paged,
     /// Chunk merge batcher stash, chunk-spine feedback arrangement,
     /// bulk-probe drain. Spills through the process buffer pool.
-    Chunked,
+    Chunked { async_reads: bool },
 }
 
 impl UpsertStashFlavor {
@@ -157,7 +157,9 @@ impl UpsertStashFlavor {
     /// for its whole life even if the flag flips underneath it.
     pub fn from_config(config: &ConfigSet) -> Self {
         if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
-            Self::Chunked
+            Self::Chunked {
+                async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
+            }
         } else {
             Self::Paged
         }
@@ -442,7 +444,7 @@ where
         source_config.source_statistics.clone(),
     );
     match flavor {
-        UpsertStashFlavor::Chunked => {
+        UpsertStashFlavor::Chunked { async_reads } => {
             // Chains and sealed batches alike are `FeedbackChunk`s whose
             // bodies spill to the buffer pool, behind the same process spill
             // gate as the source stash.
@@ -461,6 +463,7 @@ where
                 persist_token,
                 upsert_metrics,
                 source_config,
+                async_reads,
             )
         }
         UpsertStashFlavor::Paged => {
@@ -484,6 +487,7 @@ where
                 persist_token,
                 upsert_metrics,
                 source_config,
+                false,
             )
         }
     }
@@ -568,6 +572,7 @@ fn build_upsert_operator<'scope, A, T, FromTime>(
     persist_token: Option<Vec<PressOnDropButton>>,
     upsert_metrics: UpsertMetrics,
     source_config: crate::source::SourceExportCreationConfig,
+    async_reads: bool,
 ) -> (
     VecCollection<'scope, T, Result<Row, DataflowError>, Diff>,
     StreamVec<'scope, T, (Option<GlobalId>, HealthStatusUpdate)>,
@@ -806,6 +811,7 @@ where
                     &mut persist_trace,
                     source_config.worker_id,
                     source_config.id,
+                    async_reads,
                 )
                 .await;
 
@@ -926,6 +932,7 @@ where
         trace: &mut TraceAgent<Self::Spine>,
         worker_id: usize,
         source_id: GlobalId,
+        async_reads: bool,
     ) -> DrainStats;
 }
 
@@ -970,9 +977,10 @@ where
         trace: &mut TraceAgent<Self::Spine>,
         worker_id: usize,
         source_id: GlobalId,
+        async_reads: bool,
     ) -> DrainStats {
         drain_sealed_input_chunked(
-            sealed.into_iter().map(ColumnChunk::into_column),
+            sealed.into_iter(),
             ineligible,
             output_handle,
             output_cap,
@@ -980,6 +988,7 @@ where
             trace,
             worker_id,
             source_id,
+            async_reads,
         )
         .await
     }
@@ -1020,6 +1029,7 @@ where
         trace: &mut TraceAgent<Self::Spine>,
         worker_id: usize,
         source_id: GlobalId,
+        _async_reads: bool,
     ) -> DrainStats {
         drain_sealed_input_paged(
             sealed,
@@ -1104,7 +1114,7 @@ struct DrainStats {
 /// probe hits for its keys) is resident regardless of drain size. Only the
 /// re-stashed ineligible set is materialized.
 async fn drain_sealed_input_chunked<T, O>(
-    sealed: impl Iterator<Item = Column<UpsertUpdate<T, O>>>,
+    sealed: impl Iterator<Item = UpsertChunk<T, O>>,
     ineligible: &mut Vec<UpsertUpdate<T, O>>,
     output_handle: &UpsertOutputHandle<T>,
     output_cap: &Capability<T>,
@@ -1112,6 +1122,7 @@ async fn drain_sealed_input_chunked<T, O>(
     trace: &mut TraceAgent<FeedbackSpine<T>>,
     worker_id: usize,
     source_id: GlobalId,
+    async_reads: bool,
 ) -> DrainStats
 where
     T: Timestamp + TotalOrder + Lattice + Sync,
@@ -1141,6 +1152,11 @@ where
 
     for chunk in sealed {
         use columnar::{Index, Len};
+        let chunk = if async_reads {
+            chunk.into_column_async().await
+        } else {
+            chunk.into_column()
+        };
         let view = chunk.borrow();
         let total = view.len();
         let mut start = 0;
@@ -1184,7 +1200,13 @@ where
                 use columnar::Borrow;
                 let mut staging = <FeedbackUpdate<T> as columnar::Columnar>::Container::default();
                 for batch in &batches {
-                    batch.extract_into(probe_col.borrow(), &mut staging);
+                    if async_reads {
+                        batch
+                            .extract_into_async(probe_col.borrow(), &mut staging)
+                            .await;
+                    } else {
+                        batch.extract_into(probe_col.borrow(), &mut staging);
+                    }
                 }
                 let staged = staging.borrow();
                 let mut hits: Vec<_> = (0..staged.len())
@@ -1499,10 +1521,8 @@ mod test {
         Row::pack_slice(&[Datum::Int64(k), Datum::Int64(v)])
     }
 
-    // Runs the test body once per stash flavor and asserts the two flavors
-    // produce identical (consolidated) output, so every scenario covers both
-    // operator arms. Returns one flavor's output for the caller's own
-    // expected-value assertion.
+    // Compare paged, synchronous chunked, and asynchronous chunked output
+    // before checking each scenario's expected result.
     macro_rules! upsert_test {
         (|$input:ident, $persist:ident, $worker:ident| $body:block) => {{
             let run = |flavor: UpsertStashFlavor| {
@@ -1571,8 +1591,10 @@ mod test {
             };
 
             let paged = run(UpsertStashFlavor::Paged);
-            let chunked = run(UpsertStashFlavor::Chunked);
+            let chunked = run(UpsertStashFlavor::Chunked { async_reads: false });
             assert_eq!(paged, chunked, "stash flavors must produce equal output");
+            let asynchronous = run(UpsertStashFlavor::Chunked { async_reads: true });
+            assert_eq!(chunked, asynchronous, "async reads must preserve output");
             chunked
         }};
     }
@@ -1751,13 +1773,14 @@ mod test {
     /// paged flavor (which the harness also runs) routes through the column
     /// pager rather than the chunk override, so it stays resident and serves
     /// as the reference.
-    #[mz_ore::test]
+    #[mz_ore::test(tokio::test)]
     #[cfg_attr(miri, ignore)]
-    fn drain_reads_spilled_chunks() {
+    async fn drain_reads_spilled_chunks() {
         use mz_ore::pool::Pool;
         use mz_timely_util::columnar::chunk::set_spill_override;
 
         let pool = Pool::new().expect("pool creation");
+        pool.set_budget(0);
         set_spill_override(Some(pool.clone()));
 
         const KEYS: i64 = 1500;
@@ -1783,6 +1806,11 @@ mod test {
             "chunks should have spilled through the pool"
         );
 
+        assert!(
+            pool.stats().async_reads > 0,
+            "the async drain must read spilled chunks"
+        );
+
         let mut expected: Vec<(Result<Row, DataflowError>, _, _)> = Vec::new();
         for k in 0..KEYS {
             expected.push((Ok(row(k, k)), new_ts(1), Diff::MINUS_ONE));
@@ -1961,7 +1989,11 @@ mod test {
     #[mz_ore::test]
     #[cfg_attr(miri, ignore)]
     fn lagging_replacement_below_upper_strands_data() {
-        for flavor in [UpsertStashFlavor::Paged, UpsertStashFlavor::Chunked] {
+        for flavor in [
+            UpsertStashFlavor::Paged,
+            UpsertStashFlavor::Chunked { async_reads: false },
+            UpsertStashFlavor::Chunked { async_reads: true },
+        ] {
             let (frontier, emitted) = run_below_upper_scenario_v2(flavor);
 
             // The below-upper data is discarded (no output) and the output
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index e2078f2421385..4c39d35712f66 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -44,6 +44,7 @@ use std::cell::Cell;
 use std::cell::RefCell;
 use std::collections::VecDeque;
 use std::rc::Rc;
+use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
 
 use columnar::bytes::indexed;
@@ -281,7 +282,7 @@ pub struct SpilledBody<D: Columnar, T> {
     /// and miss every path that skips it.
     compressed: bool,
     /// The pool chunk holding the serialized column.
-    handle: ChunkHandle,
+    handle: Arc<ChunkHandle>,
 }
 
 /// A sorted, consolidated run of `(D, T, R)` updates, resident or spilled.
@@ -369,6 +370,14 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
         }
     }
 
+    /// Load a spilled body asynchronously, keeping resident columns on this worker.
+    pub async fn into_column_async(self) -> Column<(D, T, R)> {
+        match self {
+            Self::Spilled(body, _) => Column::Align(body.handle.read_async().await),
+            resident @ Self::Resident(..) => resident.into_column(),
+        }
+    }
+
     /// True when the body lives in the pool.
     pub fn is_spilled(&self) -> bool {
         matches!(self, ColumnChunk::Spilled(_, _))
@@ -446,7 +455,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
                 time_lower,
                 time_upper: time_upper.into(),
                 compressed,
-                handle,
+                handle: Arc::new(handle),
             }),
             depth,
         )
@@ -1094,6 +1103,22 @@ where
         }
     }
 
+    async fn extract_into_async(
+        &self,
+        probes: Self::Probes<'_>,
+        probe_index: &mut usize,
+        staging: &mut Self::Staging,
+    ) {
+        match self {
+            Self::Resident(_, _) => self.extract_into(probes, probe_index, staging),
+            Self::Spilled(body, _) => {
+                let words = body.handle.read_async().await;
+                let view = borrow_words::<((K, V), T, R)>(&words);
+                extract_view_into::<K, V, T, R>(view, probes, probe_index, staging);
+            }
+        }
+    }
+
     fn fetch_into(&self, staging: &mut Self::Staging) {
         match self {
             ColumnChunk::Resident(col, _) => {
@@ -1592,6 +1617,49 @@ mod tests {
         }
     }
 
+    #[mz_ore::test(tokio::test)]
+    #[cfg_attr(miri, ignore)]
+    async fn async_reads_preserve_straddles_and_skip_unprobed_chunks() {
+        let input = vec![
+            ((1, 0), 0, 1),
+            ((2, 0), 0, 1),
+            ((2, 1), 0, -1),
+            ((3, 0), 0, 1),
+            ((8, 0), 0, 1),
+        ];
+        for spill in [false, true] {
+            let pool = Pool::new().expect("pool creation");
+            pool.set_budget(0);
+            let chunks: Vec<TestChunk> = if spill {
+                chunked_spilled(&input, &[1, 1], &pool).into()
+            } else {
+                chunked(&input, &[1, 1]).into()
+            };
+            let description = Description::new(
+                Antichain::from_elem(0u64),
+                Antichain::new(),
+                Antichain::from_elem(0u64),
+            );
+            let batch = ChunkBatch::new(chunks.clone(), description);
+            let mut probes = <u64 as Columnar>::Container::default();
+            for key in [0u64, 2, 4, 9] {
+                probes.push(key);
+            }
+            let mut staging = <Tuple as Columnar>::Container::default();
+            batch
+                .extract_into_async(probes.borrow(), &mut staging)
+                .await;
+            assert_eq!(collect_staging(&staging), input[1..3]);
+            assert_eq!(pool.stats().async_reads, if spill { 2 } else { 0 });
+            let mut actual = Vec::new();
+            for chunk in chunks {
+                actual.append(&mut collect_column(&chunk.into_column_async().await));
+            }
+            assert_eq!(actual, input);
+            assert_eq!(pool.stats().resident_bytes, 0);
+        }
+    }
+
     /// `locate` answers the three-way span comparison for every probe
     /// placement: below, within, and past the chunk's keys.
     #[mz_ore::test]
diff --git a/src/timely-util/src/columnar/unload.rs b/src/timely-util/src/columnar/unload.rs
index 58911a62bb5e9..e257eb4b8861c 100644
--- a/src/timely-util/src/columnar/unload.rs
+++ b/src/timely-util/src/columnar/unload.rs
@@ -92,6 +92,16 @@ pub trait UnloadChunk: Chunk {
         staging: &mut Self::Staging,
     );
 
+    /// As `extract_into`, allowing a spilled body to be read asynchronously.
+    fn extract_into_async(
+        &self,
+        probes: Self::Probes<'_>,
+        probe_index: &mut usize,
+        staging: &mut Self::Staging,
+    ) -> impl std::future::Future<Output = ()> {
+        async move { self.extract_into(probes, probe_index, staging) }
+    }
+
     /// Append the whole chunk into `staging` (the scan path).
     fn fetch_into(&self, staging: &mut Self::Staging);
 }
@@ -110,51 +120,32 @@ pub trait UnloadBatch<C: UnloadChunk> {
     /// whose continuation follows in staging.
     fn extract_into(&self, probes: C::Probes<'_>, staging: &mut C::Staging);
 
+    /// Extract probe hits in order, awaiting each selected chunk's read.
+    fn extract_into_async(
+        &self,
+        probes: C::Probes<'_>,
+        staging: &mut C::Staging,
+    ) -> impl std::future::Future<Output = ()>;
+
     /// Materialize the batch's full contents into `staging` (the scan path).
     fn fetch_into(&self, staging: &mut C::Staging);
 }
 
 impl<C: UnloadChunk> UnloadBatch<C> for ChunkBatch<C> {
     fn extract_into(&self, probes: C::Probes<'_>, staging: &mut C::Staging) {
-        let count = C::probe_count(probes);
-        let chunks = &self.chunks[..];
-        let (mut probe_index, mut chunk) = (0usize, 0usize);
-        while probe_index < count && chunk < chunks.len() {
-            // Whether chunk `c` lies entirely below `probes[probe_index]`
-            // (its last key is smaller), read from resident metadata.
-            let below = |c: usize| chunks[c].locate(probes, probe_index) == Ordering::Greater;
-            // Gallop to the first chunk not below the probe: exponential
-            // search from the current chunk, then binary within the bracket.
-            if below(chunk) {
-                let (mut prev, mut step) = (chunk, 1usize);
-                while prev + step < chunks.len() && below(prev + step) {
-                    prev += step;
-                    step <<= 1;
-                }
-                let (mut a, mut b) = (prev + 1, (prev + step).min(chunks.len()));
-                while a < b {
-                    let m = a + (b - a) / 2;
-                    if below(m) { a = m + 1 } else { b = m }
-                }
-                chunk = a;
-            }
-            if chunk >= chunks.len() {
-                return;
-            }
-            // Consume probes in the gap below this chunk's first key: they
-            // match nothing in the batch, and deciding so from resident
-            // metadata is what keeps an untouched body unopened.
-            while probe_index < count && chunks[chunk].locate(probes, probe_index) == Ordering::Less
-            {
-                probe_index += 1;
-            }
-            if probe_index < count && chunks[chunk].locate(probes, probe_index) == Ordering::Equal {
-                chunks[chunk].extract_into(probes, &mut probe_index, staging);
-            }
-            // Everything strictly below this chunk's last key is consumed; a
-            // probe equal to it was extracted but left for the next chunk
-            // (the straddle re-offer).
-            chunk += 1;
+        let (mut probe_index, mut chunk) = (0, 0);
+        while let Some(next) = next_probe_chunk(&self.chunks, probes, &mut probe_index, &mut chunk)
+        {
+            next.extract_into(probes, &mut probe_index, staging);
+        }
+    }
+
+    async fn extract_into_async(&self, probes: C::Probes<'_>, staging: &mut C::Staging) {
+        let (mut probe_index, mut chunk) = (0, 0);
+        while let Some(next) = next_probe_chunk(&self.chunks, probes, &mut probe_index, &mut chunk)
+        {
+            next.extract_into_async(probes, &mut probe_index, staging)
+                .await;
         }
     }
 
@@ -165,6 +156,42 @@ impl<C: UnloadChunk> UnloadBatch<C> for ChunkBatch<C> {
     }
 }
 
+// Select from resident fences only. The caller advances the probe index
+// through the returned chunk, leaving its last-key probe for the next one.
+fn next_probe_chunk<'a, C: UnloadChunk>(
+    chunks: &'a [C],
+    probes: C::Probes<'_>,
+    probe_index: &mut usize,
+    chunk: &mut usize,
+) -> Option<&'a C> {
+    let count = C::probe_count(probes);
+    while *probe_index < count && *chunk < chunks.len() {
+        let below = |c: usize| chunks[c].locate(probes, *probe_index) == Ordering::Greater;
+        if below(*chunk) {
+            let (mut prev, mut step) = (*chunk, 1usize);
+            while prev + step < chunks.len() && below(prev + step) {
+                prev += step;
+                step <<= 1;
+            }
+            let (mut a, mut b) = (prev + 1, (prev + step).min(chunks.len()));
+            while a < b {
+                let m = a + (b - a) / 2;
+                if below(m) { a = m + 1 } else { b = m }
+            }
+            *chunk = a;
+        }
+        let next = chunks.get(*chunk)?;
+        *chunk += 1;
+        while *probe_index < count && next.locate(probes, *probe_index) == Ordering::Less {
+            *probe_index += 1;
+        }
+        if *probe_index < count && next.locate(probes, *probe_index) == Ordering::Equal {
+            return Some(next);
+        }
+    }
+    None
+}
+
 #[cfg(test)]
 mod tests {
     //! Contract tests for the batch driver over a miniature row family:
diff --git a/src/timely-util/src/pool_config/metrics.rs b/src/timely-util/src/pool_config/metrics.rs
index 7221f38a79b03..9d7d32b4f5049 100644
--- a/src/timely-util/src/pool_config/metrics.rs
+++ b/src/timely-util/src/pool_config/metrics.rs
@@ -39,6 +39,8 @@ pub fn register(registry: &MetricsRegistry) {
         // instantaneous levels are mixed under the one gauge type, so the
         // `_total` name suffix, not the metric type, marks a field as
         // monotonic.
+        gauge(registry, metric!(name: "mz_column_pool_async_reads_total", help: "Pool reads submitted to the blocking executor."), |s| s.async_reads);
+        gauge(registry, metric!(name: "mz_column_pool_async_reads_in_flight", help: "Submitted pool reads that have not released their concurrency permit."), |s| s.async_reads_in_flight);
         gauge(registry, metric!(name: "mz_column_pool_direct_extent_inserts_total", help: "Inserts written directly to an extent because resident admission was full."), |s| s.direct_extent_inserts);
         gauge(registry, metric!(name: "mz_column_pool_resident_bytes", help: "Uncompressed bytes resident in the buffer pool."), |s| s.resident_bytes);
         gauge(registry, metric!(name: "mz_column_pool_oversize_bytes", help: "Bytes held by oversize chunks that bypass pool paging."), |s| s.oversize_bytes);

From d8989ee40c926a86e28ffc0c273cc89a1b88c2c3 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 16:05:46 -0400
Subject: [PATCH 04/31] timely-util: compress chunk output directly into
 extents

Add enable_column_chunk_direct_compressed_output, off in production and on in mzcompose test defaults. Eligible spilled chunks encode directly into an actual-size extent without entering the resident slot pool. Preserve the compression depth floor and existing empty/oversize fallbacks. Typed columns use bounded retained serialization scratch; aligned columns encode from their existing words.

Expose Pool::insert_cold and a separate cold-insertion metric. Share extent registration and reclamation accounting with admission-denied insertions. Encoding remains synchronous and bypassing resident slots gives up write elision for short-lived chunks.

Test cold insertion, read admission, extent reuse, cleanup, empty/oversize handling, byte-identical typed/aligned serialization, and the compression floor. Exercise the upsert drain with direct output disabled/enabled and synchronous/asynchronous reads against the paged reference.

Validation: 331 selected utility and upsert tests passed. Clippy passed for all targets in mz-ore, mz-timely-util, mz-storage, and mz-compute. Formatting and flag-registration checks passed. Full lint has local tooling failures in check-protobuf (macOS Bash 3) and check-mzcompose-files (Git environment stripped under jj). Performance remains to be measured.
---
 doc/user/data/metrics.yml                     |   4 +
 misc/python/materialize/mzcompose/__init__.py |   5 +
 .../materialize/parallel_workload/action.py   |   3 +
 src/compute-types/src/dyncfgs.rs              |  10 ++
 src/compute/src/compute_state.rs              |   3 +
 src/ore/src/pool.rs                           |  99 +++++++++++++++-
 .../src/upsert_continual_feedback_v2.rs       |  17 ++-
 src/timely-util/src/columnar/chunk.rs         | 108 +++++++++++++++---
 src/timely-util/src/pool_config/metrics.rs    |   1 +
 9 files changed, 229 insertions(+), 21 deletions(-)

diff --git a/doc/user/data/metrics.yml b/doc/user/data/metrics.yml
index 04d8a2228dff1..c105e251d2e38 100644
--- a/doc/user/data/metrics.yml
+++ b/doc/user/data/metrics.yml
@@ -564,6 +564,10 @@ metrics:
   help: Pool reads submitted to the blocking executor.
   source: src/timely-util/src/pool_config/metrics.rs
   visibility: internal
+- name: mz_column_pool_cold_inserts_total
+  help: Chunks inserted directly into an extent by caller request.
+  source: src/timely-util/src/pool_config/metrics.rs
+  visibility: internal
 - name: mz_column_pool_direct_extent_inserts_total
   help: Inserts written directly to an extent because resident admission was full.
   source: src/timely-util/src/pool_config/metrics.rs
diff --git a/misc/python/materialize/mzcompose/__init__.py b/misc/python/materialize/mzcompose/__init__.py
index 6775050092307..f57c5ea6d1789 100644
--- a/misc/python/materialize/mzcompose/__init__.py
+++ b/misc/python/materialize/mzcompose/__init__.py
@@ -364,6 +364,11 @@ def get_variable_system_parameters(
             "true",
             ["true", "false"],
         ),
+        VariableSystemParameter(
+            "enable_column_chunk_direct_compressed_output",
+            "true",
+            ["true", "false"],
+        ),
         VariableSystemParameter(
             "enable_upsert_async_reads",
             "true",
diff --git a/misc/python/materialize/parallel_workload/action.py b/misc/python/materialize/parallel_workload/action.py
index 5e77cdc17e42f..4d5217f5d63f5 100644
--- a/misc/python/materialize/parallel_workload/action.py
+++ b/misc/python/materialize/parallel_workload/action.py
@@ -3180,6 +3180,9 @@ def __init__(
         self.flags_with_values["enable_upsert_paged_spill"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_chunked_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_async_reads"] = BOOLEAN_FLAG_VALUES
+        self.flags_with_values["enable_column_chunk_direct_compressed_output"] = (
+            BOOLEAN_FLAG_VALUES
+        )
         self.flags_with_values["column_chunk_compress_min_depth"] = [
             "0",  # compress every spilled body
             "1",  # the default: fresh chunks store uncompressed
diff --git a/src/compute-types/src/dyncfgs.rs b/src/compute-types/src/dyncfgs.rs
index 01cf2f5292d9c..9ef2757cf3654 100644
--- a/src/compute-types/src/dyncfgs.rs
+++ b/src/compute-types/src/dyncfgs.rs
@@ -134,6 +134,15 @@ pub const COLUMN_CHUNK_COMPRESS_MIN_DEPTH: Config<u32> = Config::new(
     ParameterScope::Replica,
 );
 
+/// Bypass resident pool slots when committing compression-eligible chunk bodies.
+pub const ENABLE_COLUMN_CHUNK_DIRECT_COMPRESSED_OUTPUT: Config<bool> = Config::new(
+    "enable_column_chunk_direct_compressed_output",
+    false,
+    "Compress spilled chunk output directly into extents without resident slot admission. \
+     Applies at the compression depth floor and above, at each spill.",
+    ParameterScope::Replica,
+);
+
 /// Resident-bytes budget fraction for chunk spilling. Two consumers read
 /// it: the column pager's tiered policy multiplies it against the
 /// announced memory limit, and the buffer pool (`mz_ore::pool`)
@@ -852,4 +861,5 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&COLUMN_PAGED_BATCHER_EAGER_BACKING)
         .add(&COLUMN_PAGED_BATCHER_POOL_RSS_TARGET_FRACTION)
         .add(&COLUMN_CHUNK_COMPRESS_MIN_DEPTH)
+        .add(&ENABLE_COLUMN_CHUNK_DIRECT_COMPRESSED_OUTPUT)
 }
diff --git a/src/compute/src/compute_state.rs b/src/compute/src/compute_state.rs
index b19c8d8044c65..600458a8b74ab 100644
--- a/src/compute/src/compute_state.rs
+++ b/src/compute/src/compute_state.rs
@@ -581,6 +581,9 @@ impl ComputeState {
             let compress_min_depth =
                 u8::try_from(COLUMN_CHUNK_COMPRESS_MIN_DEPTH.get(config)).unwrap_or(u8::MAX);
             mz_timely_util::columnar::chunk::set_compress_min_depth(compress_min_depth);
+            mz_timely_util::columnar::chunk::set_direct_compressed_output(
+                ENABLE_COLUMN_CHUNK_DIRECT_COMPRESSED_OUTPUT.get(config),
+            );
         }
 
         // Remember the maintenance interval locally to avoid reading it from the config set on
diff --git a/src/ore/src/pool.rs b/src/ore/src/pool.rs
index b8ac6d167af41..f0ab4ca01339d 100644
--- a/src/ore/src/pool.rs
+++ b/src/ore/src/pool.rs
@@ -201,6 +201,8 @@ pub struct PoolStats {
     pub inserts: u64,
     /// Inserts written directly to an extent because resident admission was full.
     pub direct_extent_inserts: u64,
+    /// Chunks inserted directly into an extent by caller request.
+    pub cold_inserts: u64,
     /// Reads submitted to the blocking executor.
     pub async_reads: u64,
     /// Submitted reads that have not released their concurrency permit.
@@ -291,6 +293,7 @@ pub struct PoolStats {
 #[derive(Debug, Default)]
 struct Counters {
     direct_extent_inserts: AtomicU64,
+    cold_inserts: AtomicU64,
     async_reads: AtomicU64,
     inserts: AtomicU64,
     spill_scheduled: AtomicU64,
@@ -717,6 +720,27 @@ impl Pool {
         ChunkHandle { meta }
     }
 
+    /// Encode `data` directly into an extent without allocating a resident slot.
+    ///
+    /// Compression is synchronous. The extent participates in the pool's
+    /// compressed-residency accounting and reclamation. Empty and oversize
+    /// payloads use the same fallback as [`Pool::insert_with`].
+    pub fn insert_cold(
+        &self,
+        data: &[u64],
+        hints: ChunkHints,
+        codec: &'static dyn ExtentCodec,
+    ) -> ChunkHandle {
+        if data.is_empty() || region::size_class_for(std::mem::size_of_val(data)).is_none() {
+            return self.insert_with(data.len(), hints, codec, |dst| dst.copy_from_slice(data));
+        }
+        let inner = &self.0;
+        let extent = SwapExtent::write(&inner.extent_arena, data, codec, Scratch::Shrink);
+        inner.counters.inserts.fetch_add(1, Ordering::Relaxed);
+        inner.counters.cold_inserts.fetch_add(1, Ordering::Relaxed);
+        self.finish_extent(data.len(), hints, codec, extent)
+    }
+
     fn insert_extent(
         &self,
         len: usize,
@@ -731,6 +755,21 @@ impl Pool {
         let inner = &self.0;
         let extent = SwapExtent::write(&inner.extent_arena, &words, codec, Scratch::Shrink);
         drop(words);
+        inner
+            .counters
+            .direct_extent_inserts
+            .fetch_add(1, Ordering::Relaxed);
+        self.finish_extent(len, hints, codec, extent)
+    }
+
+    fn finish_extent(
+        &self,
+        len: usize,
+        hints: ChunkHints,
+        codec: &'static dyn ExtentCodec,
+        extent: SwapExtent,
+    ) -> ChunkHandle {
+        let inner = &self.0;
         let meta = Arc::new(ChunkMeta::new(
             inner,
             len,
@@ -742,10 +781,6 @@ impl Pool {
             None,
         ));
         inner.live_chunks.fetch_add(1, Ordering::Relaxed);
-        inner
-            .counters
-            .direct_extent_inserts
-            .fetch_add(1, Ordering::Relaxed);
         {
             let mut state = meta.state();
             inner.commit_extent(&meta, &mut state, extent);
@@ -760,6 +795,7 @@ impl Pool {
         PoolStats {
             inserts: c.inserts.load(Ordering::Relaxed),
             direct_extent_inserts: c.direct_extent_inserts.load(Ordering::Relaxed),
+            cold_inserts: c.cold_inserts.load(Ordering::Relaxed),
             async_reads: c.async_reads.load(Ordering::Relaxed),
             async_reads_in_flight: {
                 #[cfg(feature = "async")]
@@ -3940,6 +3976,61 @@ mod tests {
         assert_eq!(range, want[8..24], "range reads copy the range directly");
     }
 
+    #[mz_ore::test]
+    fn cold_insert_skips_resident_admission() {
+        let codecs: [&'static dyn ExtentCodec; 2] = [&TEST_CODEC, &IDENTITY_CODEC];
+        for codec in codecs {
+            let pool = test_pool(256 << 20);
+            pool.set_rss_target(1 << 30);
+            let want = payload(SMALL, 703);
+            let handle = pool.insert_cold(&want, ChunkHints { depth: 3 }, codec);
+            assert_eq!(handle.residency(), Residency::Evicted);
+            assert_eq!(handle.meta.depth, 3);
+            let stats = pool.stats();
+            assert_eq!(stats.inserts, 1);
+            assert_eq!(stats.cold_inserts, 1);
+            assert_eq!(stats.direct_extent_inserts, 0);
+            assert_eq!(stats.resident_bytes, 0);
+            assert_eq!(stats.live_chunks, 1);
+            assert!(stats.extent_resident_bytes > 0);
+            assert_eq!(read(&handle), want);
+            assert_eq!(pool.stats().resident_bytes, 0);
+            let mut range = Vec::new();
+            handle.read_range_into(3..11, &mut range);
+            assert_eq!(range, want[3..11]);
+            assert_eq!(read_admit(&handle), want);
+            assert!(pool.stats().resident_bytes > 0);
+            pool.evict(&handle);
+            assert_eq!(
+                pool.stats().extent_bytes_written,
+                stats.extent_bytes_written
+            );
+            assert_eq!(read(&handle), want);
+            drop(handle);
+            let stats = pool.stats();
+            assert_eq!(stats.resident_bytes, 0);
+            assert_eq!(stats.live_chunks, 0);
+            assert_eq!(stats.extent_resident_bytes, 0);
+            assert_eq!(stats.frees, 1);
+        }
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)]
+    fn cold_insert_empty_and_oversize_fallbacks() {
+        let pool = test_pool(usize::MAX);
+        let empty = pool.insert_cold(&[], ChunkHints::default(), &TEST_CODEC);
+        assert_eq!(read(&empty), Vec::<u64>::new());
+        let want = payload(SIZE_CLASSES[SIZE_CLASSES.len() - 1] / 8 + 1, 704);
+        let big = pool.insert_cold(&want, ChunkHints::default(), &TEST_CODEC);
+        assert_eq!(big.residency(), Residency::Oversize);
+        assert_eq!(read(&big), want);
+        assert_eq!(pool.stats().inserts, 2);
+        assert_eq!(pool.stats().cold_inserts, 0);
+        drop(big);
+        assert_eq!(pool.stats().resident_bytes, 0);
+    }
+
     #[mz_ore::test]
     fn insert_with_fills_in_place() {
         let pool = test_pool(usize::MAX);
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index d00b818cc9379..f47c89f947112 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -1776,12 +1776,21 @@ mod test {
     #[mz_ore::test(tokio::test)]
     #[cfg_attr(miri, ignore)]
     async fn drain_reads_spilled_chunks() {
+        for direct in [false, true] {
+            assert_spilled_drain(direct);
+        }
+    }
+
+    fn assert_spilled_drain(direct: bool) {
         use mz_ore::pool::Pool;
-        use mz_timely_util::columnar::chunk::set_spill_override;
+        use mz_timely_util::columnar::chunk::{
+            set_direct_compressed_output_override, set_spill_override,
+        };
 
         let pool = Pool::new().expect("pool creation");
         pool.set_budget(0);
         set_spill_override(Some(pool.clone()));
+        set_direct_compressed_output_override(Some(direct));
 
         const KEYS: i64 = 1500;
         let actual = upsert_test!(|input, persist, worker| {
@@ -1793,6 +1802,10 @@ mod test {
 
             for k in 0..KEYS {
                 input.send(((key(k), Some(Ok(row(k, k + 1))), 1), new_ts(1), Diff::ONE));
+                if k % 500 == 499 {
+                    input.flush();
+                    worker.step();
+                }
             }
             input.advance_to(new_ts(2));
             worker.step();
@@ -1801,6 +1814,8 @@ mod test {
         });
 
         set_spill_override(None);
+        set_direct_compressed_output_override(None);
+        assert_eq!(pool.stats().cold_inserts > 0, direct);
         assert!(
             pool.stats().inserts > 0,
             "chunks should have spilled through the pool"
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 4c39d35712f66..b5a031b08f740 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -39,9 +39,7 @@
 //! actually touches.
 
 use std::borrow::Cow;
-#[cfg(test)]
-use std::cell::Cell;
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::collections::VecDeque;
 use std::rc::Rc;
 use std::sync::Arc;
@@ -84,7 +82,9 @@ thread_local! {
     #[cfg(test)]
     static COMPRESS_MIN_DEPTH_OVERRIDE: Cell<Option<u8>> = const { Cell::new(None) };
 
-    /// Reusable staging for call-scoped reads of spilled bodies.
+    static DIRECT_COMPRESSED_OUTPUT_OVERRIDE: Cell<Option<bool>> = const { Cell::new(None) };
+
+    /// Reusable staging for call-scoped reads and serialization of spilled bodies.
     static READ_SCRATCH: RefCell<Vec<u64>> = const { RefCell::new(Vec::new()) };
 }
 
@@ -119,6 +119,28 @@ pub fn set_spill_override(pool: Option<Pool>) {
     SPILL_OVERRIDE.with(|cell| *cell.borrow_mut() = pool);
 }
 
+static DIRECT_COMPRESSED_OUTPUT: AtomicBool = AtomicBool::new(false);
+
+/// Compress eligible spilled bodies directly into extents, bypassing resident slots.
+///
+/// Consulted at each spill. Bodies below the compression floor retain normal
+/// admission. Encoding is synchronous, and short-lived bodies lose write elision.
+pub fn set_direct_compressed_output(enabled: bool) {
+    DIRECT_COMPRESSED_OUTPUT.store(enabled, Ordering::Relaxed);
+}
+
+/// Override direct compressed output on this thread for tests and benchmarks.
+/// `None` restores the process setting.
+pub fn set_direct_compressed_output_override(enabled: Option<bool>) {
+    DIRECT_COMPRESSED_OUTPUT_OVERRIDE.with(|cell| cell.set(enabled));
+}
+
+fn direct_compressed_output() -> bool {
+    DIRECT_COMPRESSED_OUTPUT_OVERRIDE
+        .with(|cell| cell.get())
+        .unwrap_or_else(|| DIRECT_COMPRESSED_OUTPUT.load(Ordering::Relaxed))
+}
+
 /// The youngest generational depth whose spilled bodies are compressed. See
 /// [`set_compress_min_depth`].
 static COMPRESS_MIN_DEPTH: AtomicU8 = AtomicU8::new(DEFAULT_COMPRESS_MIN_DEPTH);
@@ -188,12 +210,12 @@ fn spill_pool() -> Option<Pool> {
     }
 }
 
-/// Scratch capacity retained across reads, in words. A read larger than this
+/// Scratch capacity retained across calls, in words. A read larger than this
 /// releases the buffer afterward, so a thread's scratch does not ratchet to
 /// the largest body it ever carried (heap no pool gauge can see).
 const SCRATCH_RETAIN_WORDS: usize = 1 << 18;
 
-/// Run `f` with this thread's read scratch, cleared of any previous use.
+/// Run `f` with this thread's scratch, cleared of any previous use.
 fn with_scratch<Out>(f: impl FnOnce(&mut Vec<u64>) -> Out) -> Out {
     READ_SCRATCH.with(|cell| {
         let mut scratch = cell.take();
@@ -447,7 +469,14 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
         let mut fences = D::Container::default();
         fences.push(view.0.get(0));
         fences.push(view.0.get(records - 1));
-        let handle = spill_column(column, pool, len_bytes, ChunkHints { depth }, codec);
+        let handle = spill_column(
+            column,
+            pool,
+            len_bytes,
+            ChunkHints { depth },
+            codec,
+            compressed && direct_compressed_output(),
+        );
         ColumnChunk::Spilled(
             Rc::new(SpilledBody {
                 records,
@@ -590,23 +619,36 @@ impl ExtentCodec for Lz4Codec {
     }
 }
 
-/// Serialize a column into a pool slot. The `Align` variant is already the
-/// serialized form and copies in directly. Other variants write their
-/// [`ContainerBytes`] encoding through a cursor over the slot memory. Sizing
-/// is exact, so a short or overlong write is a contract violation and panics.
+/// Serialize a column into the pool, optionally bypassing resident admission.
 fn spill_column<C: Columnar>(
     column: Column<C>,
     pool: &Pool,
     len_bytes: usize,
     hints: ChunkHints,
     codec: &'static dyn ExtentCodec,
+    direct: bool,
 ) -> ChunkHandle {
     mz_ore::soft_assert_eq_no_log!(len_bytes % 8, 0);
+    if direct {
+        return match column {
+            Column::Align(words) => pool.insert_cold(&words, hints, codec),
+            other => with_scratch(|words| {
+                words.resize(len_bytes / 8, 0);
+                serialize_column(other, words);
+                pool.insert_cold(words, hints, codec)
+            }),
+        };
+    }
+    pool.insert_with(len_bytes / 8, hints, codec, |dst| {
+        serialize_column(column, dst)
+    })
+}
+
+fn serialize_column<C: Columnar>(column: Column<C>, dst: &mut [u64]) {
     match column {
-        Column::Align(words) => {
-            pool.insert_with(words.len(), hints, codec, |dst| dst.copy_from_slice(&words))
-        }
-        other => pool.insert_with(len_bytes / 8, hints, codec, |dst| {
+        Column::Align(words) => dst.copy_from_slice(&words),
+        other => {
+            let len_bytes = std::mem::size_of_val(dst);
             let bytes: &mut [u8] = bytemuck::cast_slice_mut(dst);
             let mut cursor = std::io::Cursor::new(bytes);
             other.into_bytes(&mut cursor);
@@ -615,7 +657,7 @@ fn spill_column<C: Columnar>(
                 len_bytes,
                 "serialized body must fill the chunk exactly",
             );
-        }),
+        }
     }
 }
 
@@ -2420,6 +2462,40 @@ mod tests {
         set_compress_min_depth_override(None);
     }
 
+    #[mz_ore::test]
+    fn direct_output_respects_floor_and_preserves_serialization() {
+        let data: Vec<Tuple> = (0..2048u64).map(|k| ((k, k + 1), k % 3, 1)).collect();
+        set_compress_min_depth_override(Some(1));
+        for enabled in [false, true] {
+            set_direct_compressed_output_override(Some(enabled));
+            for depth in [0, 1] {
+                for aligned in [false, true] {
+                    let pool = Pool::new().expect("pool creation");
+                    pool.set_budget(usize::MAX);
+                    let column = build_column(&data);
+                    let mut expected = vec![0; column.length_in_bytes() / 8];
+                    serialize_column(column.clone(), &mut expected);
+                    let column = if aligned {
+                        Column::Align(expected.clone())
+                    } else {
+                        column
+                    };
+                    let chunk = TestChunk::spill_body(column, &pool, depth);
+                    assert_eq!(pool.stats().cold_inserts, u64::from(enabled && depth >= 1));
+                    assert_eq!(pool.stats().resident_bytes == 0, enabled && depth >= 1);
+                    let Column::Align(actual) = chunk.into_column() else {
+                        panic!("a spilled body must read back serialized");
+                    };
+                    assert_eq!(actual, expected);
+                    assert_eq!(pool.stats().resident_bytes, 0);
+                }
+            }
+        }
+        set_direct_compressed_output_override(None);
+        set_compress_min_depth_override(None);
+        READ_SCRATCH.with(|scratch| assert!(scratch.borrow().capacity() <= SCRATCH_RETAIN_WORDS));
+    }
+
     /// Re-spilling an already-serialized body exercises the `Column::Align`
     /// branch of `spill_column` and round-trips byte-identically.
     #[mz_ore::test]
diff --git a/src/timely-util/src/pool_config/metrics.rs b/src/timely-util/src/pool_config/metrics.rs
index 9d7d32b4f5049..4f2d6c291f196 100644
--- a/src/timely-util/src/pool_config/metrics.rs
+++ b/src/timely-util/src/pool_config/metrics.rs
@@ -41,6 +41,7 @@ pub fn register(registry: &MetricsRegistry) {
         // monotonic.
         gauge(registry, metric!(name: "mz_column_pool_async_reads_total", help: "Pool reads submitted to the blocking executor."), |s| s.async_reads);
         gauge(registry, metric!(name: "mz_column_pool_async_reads_in_flight", help: "Submitted pool reads that have not released their concurrency permit."), |s| s.async_reads_in_flight);
+        gauge(registry, metric!(name: "mz_column_pool_cold_inserts_total", help: "Chunks inserted directly into an extent by caller request."), |s| s.cold_inserts);
         gauge(registry, metric!(name: "mz_column_pool_direct_extent_inserts_total", help: "Inserts written directly to an extent because resident admission was full."), |s| s.direct_extent_inserts);
         gauge(registry, metric!(name: "mz_column_pool_resident_bytes", help: "Uncompressed bytes resident in the buffer pool."), |s| s.resident_bytes);
         gauge(registry, metric!(name: "mz_column_pool_oversize_bytes", help: "Bytes held by oversize chunks that bypass pool paging."), |s| s.oversize_bytes);

From 4b2082723270c418e77e7615ccd70f6367fbdaff Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 21:58:41 -0400
Subject: [PATCH 05/31] storage: prototype payload-separated upsert for
 hydration benchmarks

---
 .../design/20260908_out_of_core_operators.md  | 572 ++++++++++++++++++
 misc/python/materialize/mzcompose/__init__.py |   5 +
 .../materialize/parallel_workload/action.py   |   1 +
 src/storage-types/src/dyncfgs.rs              |  10 +
 .../src/upsert_continual_feedback_v2.rs       | 322 +++++++++-
 .../upsert_continual_feedback_v2/payload.rs   | 448 ++++++++++++++
 src/timely-util/src/columnar.rs               |   1 +
 src/timely-util/src/columnar/chunk.rs         |  10 +-
 src/timely-util/src/columnar/payload.rs       | 392 ++++++++++++
 src/timely-util/src/lib.rs                    |   1 +
 src/timely-util/src/out_of_core.rs            |  34 ++
 src/timely-util/src/out_of_core/batch.rs      |  66 ++
 src/timely-util/src/out_of_core/operators.rs  | 181 ++++++
 src/timely-util/src/out_of_core/payload.rs    | 568 +++++++++++++++++
 src/timely-util/src/out_of_core/tests.rs      | 515 ++++++++++++++++
 .../mzcompose.py                              |   1 +
 16 files changed, 3095 insertions(+), 32 deletions(-)
 create mode 100644 doc/developer/design/20260908_out_of_core_operators.md
 create mode 100644 src/storage/src/upsert_continual_feedback_v2/payload.rs
 create mode 100644 src/timely-util/src/columnar/payload.rs
 create mode 100644 src/timely-util/src/out_of_core.rs
 create mode 100644 src/timely-util/src/out_of_core/batch.rs
 create mode 100644 src/timely-util/src/out_of_core/operators.rs
 create mode 100644 src/timely-util/src/out_of_core/payload.rs
 create mode 100644 src/timely-util/src/out_of_core/tests.rs

diff --git a/doc/developer/design/20260908_out_of_core_operators.md b/doc/developer/design/20260908_out_of_core_operators.md
new file mode 100644
index 0000000000000..3c91c8c658852
--- /dev/null
+++ b/doc/developer/design/20260908_out_of_core_operators.md
@@ -0,0 +1,572 @@
+# A shared model for out-of-core operators
+
+- Status: discussion draft, September 8, 2026. Interfaces and rollout gates below are proposals.
+- Related: [Buffer-managed dataflow state](20260610_buffer_managed_state.md).
+- Related experiment: [upsert hydration optimizations, PR #38719](https://github.com/MaterializeInc/materialize/pull/38719).
+
+## Proposal in brief
+
+Separate operator state into immutable payload storage and a spillable index of
+keys, handles, timestamps, and differences. Execute operators through resumable,
+budgeted work units that request payloads only when their semantics require them.
+Reuse Differential's time and difference machinery where possible, including the
+boundary demonstrated by `int_proxy`.
+
+Upsert is the first consumer. Equijoin is the second design and implementation
+check. Neither storage nor scheduling should know about source offsets,
+latest-value selection, join predicates, or a particular reduction function.
+
+The central hypothesis is that moving compact metadata through repeated merges,
+while keeping payload blocks independently owned, reduces byte amplification.
+Whether this improves elapsed time depends on the additional lookup, equality,
+fragmentation, and payload-read costs. We will measure those costs separately.
+
+## The problem
+
+Our chunked state paths can repeatedly serialize, copy, compress, and decompress
+wide rows while sorting or merging updates. Much of that work is needed to move
+state through the representation, even when the operation only needs a key,
+timestamp, or source ordering field to make its decision.
+
+The existing pool controls chunk residency. It does not by itself separate payload
+lifetime from merge lifetime. Smaller chunks, tighter admission, direct compressed
+output, and offloaded reads improve the current representation. A shared operator
+model should also let a merge keep a payload reference instead of rebuilding the
+payload at every generation.
+
+This is broader than upsert hydration. Joins need to find matching groups and
+materialize selected pairs. Reductions need to replay histories and reconcile
+outputs. All need progress tracking, bounded staging, storage ownership, and an
+execution path that can wait for unavailable data without blocking a worker.
+
+## Success criteria
+
+- Upsert and equijoin share payload storage, ownership, memory accounting, and
+  read scheduling. Their semantic rules remain in their operator implementations.
+- A metadata merge can retain live payloads without decoding or rewriting them.
+  Repacking payload blocks is separately scheduled and measured.
+- Payloads, indexes, handle translation, ownership metadata, staging, and queued
+  work have explicit memory charges. Increasing state beyond the budget does not
+  introduce an unbounded resident table of row handles or block descriptors.
+- Supported operators make progress under a small budget, including with skew,
+  slow reads, output backpressure, cancellation, and concurrent consumers.
+- Results and progress agree with existing operators under arbitrary valid
+  batching, retractions, timestamp order, compaction, and restarts.
+- Deep-state workloads improve without an unacceptable resident-state penalty.
+  Proposed acceptance thresholds appear under measurement, rather than assuming
+  that fewer copied bytes guarantee faster queries.
+
+## Scope
+
+This proposal covers recreatable local operator state. Persist remains the durable
+source of recovery. Local handles do not become part of persisted records or the
+wire protocol. Crossing a process boundary materializes or explicitly transfers
+owned data rather than sending a process-local handle.
+
+We will preserve existing in-memory implementations during evaluation. Converting
+all operators, implementing a new durable store, and selecting a particular kernel
+async I/O API are outside the first delivery. General reduction remains a design
+requirement, but arbitrary reduction callbacks do not automatically acquire a
+bounded-memory implementation through this interface.
+
+## What int-proxy contributes
+
+Differential's `int_proxy` tactics exchange consolidated presentations of:
+
+```text
+((key_hash: u64, value_id: u64), time, diff)
+```
+
+The tactic performs the time and difference computation. The backend interprets
+values and constructs outputs. A join returns matched IDs with joined times and
+multiplied differences. A reduce asks the backend for corrections at the times
+that require reconciliation.
+
+The two integers have different contracts. `key_hash` partitions independent
+work, but collisions are allowed. `value_id` identifies data within the backend's
+presentation. Distinct logical data in the same hash group must remain distinct,
+and equal data must be presented consistently wherever cancellation is required.
+Input and output presentations can have separate ID namespaces.
+
+The local reference reduce backend assigns IDs per window and resolves them
+through row vectors. It still clones rows and emits ordinary row batches. The
+proxy interface therefore demonstrates a separation of responsibilities, not a
+ready-made payload store or an out-of-core guarantee.
+
+Two constraints matter for this design:
+
+1. The callbacks are synchronous. A cold read cannot simply become an `await`
+   inside the existing tactic protocol.
+2. The reduce window contract requires a complete key-hash group in the window
+   that first reports it. A window target does not bound a single enormous group.
+   Its novel time support must also survive consolidation: even an update that
+   cancels against history can introduce a time requiring reconciliation.
+
+Reference code is in the sibling Differential repository under
+`differential-dataflow/src/operators/int_proxy/{mod,reduce,join,vec_backend}.rs`.
+This draft describes that local implementation. Materialize currently locks
+Differential 0.25.1, whose proxy API must be reconciled with the local work before
+integration. Names and signatures here are illustrative, not a compatibility claim.
+
+## Architecture and ownership boundaries
+
+```mermaid
+flowchart TD
+    A[Operator semantics: upsert, join, reduce] --> B[Resumable execution and time/diff logic]
+    B --> C[Spillable indexes and immutable batches]
+    B --> D[Budgeted payload reads]
+    C --> E[Payload store and ownership manifests]
+    D --> E
+    E --> F[Pool and extent storage]
+    G[Shared memory and I/O admission] -.-> B
+    G -.-> C
+    G -.-> D
+    G -.-> E
+```
+
+### Payload storage
+
+Store immutable row blocks independently of index batches. A block includes its
+record boundaries and encoding information. The store supports batched resolution
+of row handles, allowing requests to be grouped by block and decoded together.
+The first implementation should reuse the pool's codecs and extent machinery.
+
+Reads initially return owned, budgeted decoded buffers. References into a decoded
+buffer are scoped to a read lease. This follows the pool's current copy-out model
+and avoids requiring a redesign around borrowed pointers into evictable slots.
+A lease retains both the bytes' memory charge and ownership of the source needed
+by an unfinished read. Callers cannot retain a naked row reference after the
+lease expires.
+
+Block size is a policy choice, separate from index chunk size. Smaller blocks
+reduce sparse-read amplification but add metadata and can weaken compression.
+Benchmark several sizes rather than baking the upsert workload's preferred size
+into the interface. Oversized individual rows require a charged exceptional path
+or streaming support, never an unaccounted allocation.
+
+### Identity: handles need not be integers
+
+Use distinct types for storage identity and presentation identity:
+
+| Identity | Meaning | Lifetime |
+| --- | --- | --- |
+| `RowHandle` | Locates a stored row within a store namespace | While owning batches or read operations retain it |
+| `ProxyId` | Identifies semantic data in an operator presentation | Until that presentation's work and output translation finish |
+| Group key | Defines independent semantic work | Defined by the operator and its index |
+
+A candidate `RowHandle` representation is `(block_id, row_slot, generation)`.
+Moving a block between resident memory and an extent changes its location, not
+its identity. Generation checks prevent stale handles from resolving to reused
+storage. The store namespace is supplied by the owning batch or execution context.
+
+The current proxy bridge requires `u64`, but the design does not require every
+identity to be a `u64`. A backend can translate storage handles to dense integer
+IDs for a bounded window. We should keep that adapter before generalizing the
+upstream tactic's types unless two consumers demonstrate a need for the latter.
+A handle's numeric order does not imply row order.
+
+Physical identity is also not semantic equality. Two independently ingested equal
+rows can have different handles. Exact consolidation needs an equality mechanism:
+for example, a fingerprint to find candidates followed by byte comparison, with
+consistent proxy IDs assigned to equal data during presentation. Fingerprints
+alone are insufficient. Such lookup state must be budgeted and spillable too.
+
+Do not require global interning of all live rows. Window-local canonicalization
+and merge-time equality resolution are the starting point. Operators can exploit
+stronger local knowledge, such as an already-owned output being reused, without
+making that knowledge a storage requirement.
+
+### Indexes and batches
+
+An index entry carries the fields required for navigation and operator decisions,
+plus references to payloads. Field projection belongs to an index layout or
+operator backend. The storage layer does not assume a fixed tuple containing
+upsert-specific ordering information.
+
+Keys can themselves be wide. A hash or compact prefix may identify candidate
+groups, but exact key comparison can require payload reads. The execution protocol
+must permit these reads during navigation and consolidation, not just at final
+output. Likewise, a reducer that requires value ordering cannot sort opaque
+handles and assume the order matches values.
+
+Index chunks, fences, equality indexes, and manifests must support external
+storage. Resident roots and caches have byte budgets. Existing merge machinery
+can be reused where it operates on the chosen compact representation. Comparator
+or equality paths requiring cold data need an explicit suspend/resume boundary.
+
+### Ownership and reclamation
+
+A `RowHandle` is a locator, not an owning reference. An immutable batch manifest
+owns the payload blocks its entries reference. Active reads and unpublished output
+builders acquire ownership too. Prefer ownership per block or segment over an
+atomic reference count for every row copy.
+
+Publishing an output batch must establish its manifest's ownership before input
+ownership is released. Cancellation discards unpublished output and releases its
+ownership. Dropping a batch releases references incrementally, with pending
+release work charged and able to yield. A block is reclaimable only when no
+published batch, builder, or active read owns it. A timestamp frontier alone is
+not a reclamation proof.
+
+Coarse ownership can retain mostly dead blocks. Repacking live rows is a separate,
+budgeted maintenance operation that creates new blocks and rewrites affected index
+references. Old batches and active readers continue to own old blocks until they
+retire. Do not introduce an unbounded per-row forwarding map to hide relocation.
+Measure the temporary double ownership and charge the rewrite's scratch space.
+
+The ownership manifest and block directory are substantial parts of the work.
+Retaining one always-resident `Arc<ChunkHandle>` per live block merely moves the
+scaling limit. A production design needs paged directory/ownership metadata,
+bounded resident roots, and a way to retire metadata without loading an entire
+batch manifest. The current pool API may need extensions at this boundary.
+
+## Execution, progress, and budgets
+
+The execution unit is a continuation with explicit input ownership, progress
+holds, and a bounded working set. Its conceptual protocol is:
+
+```text
+advance(work_budget)
+    -> need_reads(read_set, continuation)
+     | produced(output_batch, continuation)
+     | yield(continuation)
+     | complete
+     | error
+```
+
+These are protocol outcomes, not proposed Rust signatures. Metadata and payload
+reads use the same admission rules. A ready-data step is synchronous and bounded
+by bytes or work, with a separate fairness limit so a long CPU-only step yields.
+Output backpressure suspends execution without accumulating unlimited ready output.
+
+The driver reserves decode/output memory and I/O capacity before issuing a read.
+Completed buffers remain charged until consumed, including while the worker is
+busy elsewhere. A limit on running reads alone is insufficient. Several operators
+share process-level admission, with per-consumer fairness and an allowance for
+work that releases memory. An operator must not hold the whole budget while
+waiting for an additional allocation needed to make progress. The prototype must
+exercise this deadlock case and establish a reservation/release discipline.
+
+No pool locks, borrowed cursors into mutable state, or uncharged buffers may cross
+a suspension. Cancellation retains a running job's lease and permit until that
+job actually finishes, then releases them even if its consumer disappeared.
+Storage errors invalidate the work and are surfaced through the operator's error
+or restart path. Partially built output is not published as a completed batch.
+
+Suspension must preserve Differential's time semantics. Work retains capabilities
+or equivalent holds for every timestamp at which it can still emit. A yield or
+pending read must not advance the output frontier. Publication and continuation
+updates must avoid duplicate output when work resumes. Partial-order timestamps,
+compaction, and novel time support remain the responsibility of the time/diff
+machinery and its adapter, rather than the payload store.
+
+Time/diff bookkeeping is part of the budget too. Replay histories, pending-time
+schedules, and retained presentations must be spillable or have an explicit
+admission bound. The tactic's existing resident pending-time map cannot be treated
+as free metadata. Any bound must preserve required times and holds, using
+backpressure or external state rather than dropping work. This is a dependency of
+the resumable tactic design, not something the payload store can solve alone.
+
+There are two integration options: prepare a bounded, fully resident presentation
+before invoking a synchronous tactic, or make tactic execution resumable. The
+first is useful for a prototype, but cannot provide the complete contract for
+large groups or payload-dependent comparisons. The target design requires a
+resumable path. We should upstream the smallest suitable execution boundary
+rather than duplicate Differential's time logic in each backend.
+
+The initial I/O implementation can offload swap faults and decoding to a bounded
+blocking executor. It does not guarantee fault-free worker execution, and it is
+not native asynchronous file I/O. The same request/continuation contract should
+permit a later file-extent implementation without changing operator semantics.
+
+## Large groups and operator contracts
+
+A hot key can exceed any window budget. Different operators need different
+strategies, and declaring an arbitrary split into independent windows is incorrect.
+
+| Consumer | Small representation | Payload access | Large-group strategy |
+| --- | --- | --- | --- |
+| Upsert | Key, time, source order, optional row handle | Equality and old/new rows needed for output | Stream latest-update selection while preserving the existing feedback and frontier rules |
+| Equijoin | Key projection/hash, row handles, time, diff | Exact key checks, predicates, output construction | Block both sides, retain resumable history, and stream matches under output backpressure |
+| Threshold or aggregatable reduce | Group identity, value identity or sufficient aggregate, time, diff | Depends on equality and aggregate semantics | Use valid partial state or spillable histories |
+| General reduce | Group and value references with histories | Potentially all values in semantic order | Require a streaming callback or external intermediate state; an arbitrary slice callback has no bounded-memory guarantee |
+
+Upsert's source stash can select by source order without reading every row.
+Its feedback state still requires exact row identity for retractions and
+consolidation. Equality reconciliation after persist readback must not assume
+that a deserialized row preserves its former local handle.
+
+Equijoin must enumerate all valid matches even when output greatly exceeds input.
+That cost cannot be removed by proxies. Blocking may require rereading one side,
+so we must measure actual read amplification and scheduler fairness.
+
+These two consumers should use the same lower layers. If implementing equijoin
+requires a second payload store or ownership mechanism, the proposed abstraction
+has not met its purpose.
+
+## Minimal viable prototype and delivery
+
+This document precedes a prototype so we can agree on the ownership and execution
+boundaries before implementing them. No performance gains from this representation
+have been measured yet.
+
+1. Build a small shared store/index experiment with a deliberately tiny budget,
+   duplicate logical rows at different handles, asynchronous reads, and cancellation.
+   Exercise both an upsert-like selector and an equijoin over it. Keep the interfaces
+   provisional until both work. A fully resident metadata directory can be used to
+   establish mechanics, but cannot satisfy the out-of-core acceptance gate.
+2. Implement spillable metadata and manifests, exact equality reconciliation,
+   reclamation, large-group continuations, and publication/progress invariants.
+   Demonstrate budget and liveness properties independently of hydration speed.
+3. Integrate upsert while preserving its existing time and feedback semantics.
+   Compare against v1 and the measured optimization stack. Keep persisted and wire
+   representations unchanged so a fresh replica can select either implementation.
+4. Integrate equijoin using the same store, admission, and ownership APIs. Validate
+   skew and output backpressure. Use a reduction consumer to settle remaining
+   value-order and large-group interface questions before claiming broad support.
+5. Roll out per consumer behind flags. Production defaults off, test/CI defaults
+   on for supported paths. Check small-state overhead and deep-state behavior before
+   increasing exposure. Rollback recreates local state from persist rather than
+   converting live handles between formats.
+
+## Correctness and measurement
+
+Correctness testing compares output updates and progress with existing operators,
+including product timestamps with incomparable elements. Vary input batch order,
+negative differences, frontier advancement, compaction, empty inputs, deletion,
+and duplicate rows. Force hash collisions and separate physical copies of equal
+data. Preserve the case where novel input cancels against history but still
+introduces a time requiring reconciliation.
+
+Storage and scheduler tests cover eviction during reads, cancellation before and
+after submission, delayed completion, stale handle generations, output publication
+before input release, repacking while old batches remain live, scratch exhaustion,
+and injected read failures. Run with budgets smaller than a group and with two
+competing consumers. Verify both progress and eventual release of charges.
+Restart tests reconstruct state from persist and verify that no local handles leak
+into durable or exchanged data.
+
+Use the spec-sheet persisted-seed workflow for upsert hydration: load once, stop
+the writer, and recreate a replica for each variant. Record the exact image,
+configuration, seed shape, worker count, CPU, memory, and usable scratch/swap.
+Compare the current optimized representation with the proposed one on the same
+build where possible. Keep a v1 control, but do not make v1 parity the only success
+criterion for a shared framework.
+
+Measure equijoin separately with fixed input/output cardinalities, selective and
+dense matches, skew, and wide join keys. Add steady-state update/retraction runs
+and concurrent consumers. The first upsert screening replica has one worker and
+half a CPU; it cannot establish production concurrency or scheduling behavior.
+
+Sweep payload width, actual compressibility, state-to-budget ratio, update density,
+key skew, worker/core ratio, and payload block size in stages rather than running
+an undirected Cartesian product. Include resident-state controls and poorly
+compressible data. Randomize or counterbalance variant order, retain failed runs,
+and repeat enough trials to report variation rather than one timing.
+
+Collect elapsed time, CPU, worker scheduling delay, time waiting for reads, decode
+time, peak RSS, swap, and all memory-ledger components. Count metadata merge bytes,
+payload bytes copied/decoded/rewritten, equality lookups and verification reads,
+block cache hits, dead-byte retention, reclamation work, and output bytes. Separate
+extent creation from physical device traffic. Account for sampling gaps and missing
+metrics explicitly. Treat restarts as failed trials, not successful slow runs.
+
+Proposed gates for discussion:
+
+- Correctness and bounded-memory/liveness checks pass for both initial consumers.
+- Supported deep-state workloads finish under a fixed budget without growing an
+  unaccounted directory, pending-read queue, or output queue.
+- On wide-row, deep-state cases with comparable output, reduce payload bytes
+  processed by state maintenance by at least 2x versus the optimized chunk path,
+  and demonstrate an elapsed-time improvement outside run-to-run variation.
+- Target no more than 5% resident-state slowdown for each consumer. If overhead
+  exceeds that threshold, investigate layout/admission costs or keep an explicit
+  small-state path. These thresholds are proposed acceptance criteria, not forecasts.
+
+## Local mechanics prototype
+
+The prototype lives in [`mz_timely_util::out_of_core`](../../../src/timely-util/src/out_of_core.rs).
+It provides a shared payload store, immutable block manifests, resident metadata
+batches, and whole-step read admission. A read request owns its blocks before it
+can suspend. A blocking read job owns its byte and job permits through
+cancellation, and the returned lease retains the byte reservation until its
+borrowed output is consumed.
+
+Two consumers share these interfaces: maximum-order selection and equijoin.
+Selection rebuilds metadata while reusing existing payload blocks. The resumable
+join cursor emits one pair per step and uses the same store to acquire both
+payloads atomically. String and composite keys work without integer encoding.
+
+The standalone proxy adapters and live Differential harness are retained in the
+local prototype workspace. The benchmark image includes the shared storage and
+native columnar upsert integration below, using Materialize's existing Timely
+and Differential dependencies. It has no sibling-checkout dependency.
+
+## Live dataflow setup
+
+`out_of_core::live` in the standalone prototype workspace installs
+operators into a running Timely dataflow using the local Differential checkout:
+
+1. `store_payloads` exchanges serialized input rows by key, then packs their
+   bytes into the worker's payload store. It emits `Stored<V>` values whose
+   ordering and equality use a caller-defined logical identity. Each value owns
+   its payload block. Handles never cross workers.
+2. `arrange_payloads` builds a Differential chunk spine over key hashes, exact
+   keys, and stored values. Trace consolidation and merging clone metadata and
+   ownership references, without copying payload bytes.
+3. `latest` runs `ProxyReduceTactic` through `reduce_with_tactic`. `join` runs
+   `ProxyJoinTactic` through `join_with_tactic`. These drivers maintain input and
+   output history, compaction frontiers, and capabilities across successive
+   input batches. The backends resolve exact identities and hash collisions.
+4. `fetch` requests the complete read set for an output record, polls its future
+   on the Timely worker, and uses a synchronous activator to resume when I/O
+   completes. Blocking pool reads run through the Tokio executor. Each future
+   holds an output capability and its stored values until publication. Incoming
+   antichain stamps are retained as capability sets before deriving a capability
+   at each record's time.
+
+The integration harness runs selection and join together on two workers and
+compares both outputs against standard Differential operators. Inputs advance
+through multiple epochs and are probed before sending subsequent epochs. It also
+covers product timestamps, two-element message stamps, error propagation, a
+blocked read that leaves another dataflow schedulable, and dropping a dataflow
+while its blocking read still owns admission.
+
+```sh
+MZ_DEV_BUILD_SHA=f0e632d1 cargo +1.97.1 nextest run \
+  -p mz-timely-util --features out-of-core-prototype --test out_of_core_live
+
+MZ_OOC_EPOCHS=1000 MZ_DEV_BUILD_SHA=f0e632d1 cargo +1.97.1 nextest run \
+  -p mz-timely-util --features out-of-core-prototype --test out_of_core_live \
+  -E 'test(live_proxy_pipeline_matches_reference_on_two_workers)' --no-capture
+```
+
+A local 1,000-epoch run matched both reference outputs. With a 1,024-byte decoded
+budget per worker, observed peaks were 1,024 and 992 bytes. Live payload blocks
+sampled after each completed epoch peaked at 10 and 5, and both workers released
+all blocks on closure. This is a functional small-state run over compressed
+extents, not a hydration or disk-throughput benchmark.
+
+The generic live harness remains separate from Materialize's source and compute
+renderers. The native upsert integration below uses the same storage and ownership
+model with Materialize's current Differential dependency and existing feedback
+protocol.
+
+The remaining shared runtime work includes spillable metadata and ownership
+indexes, exact row equality where the caller has no logical identity, resumable
+window presentation and history loading, decoded-block reuse, and admission covering
+queued metadata and output. Production wiring also needs one compatible Timely
+and Differential dependency set, row/error codecs, operator shutdown integration,
+metrics, configuration defaults, and restart/rehydration validation.
+
+### Resumable join matching
+
+The local proxy join retains direct-cross positions or bilinear replay histories
+across calls. Each prepared work unit clones its configured backend, giving it a
+private ID interpretation table. A window can produce multiple `cross` calls,
+so that table remains valid until the next window or work-unit drop.
+
+`JoinWork::step` returns output, yield, or done. The live driver retains its
+capabilities on yield and reactivates the operator, including when exact-key
+filtering discards every candidate. Matching defaults to 4,096 candidate matches
+and 4,096 replay transitions per quantum. The compatibility iterator consumes
+yields internally and provides no scheduling guarantee.
+
+Window presentation, history loading, and consolidation remain synchronous and
+can exceed a quantum. The limits bound staged matches and matching transitions,
+not the whole activation, input memory, or arbitrary backend output expansion.
+A live test checks a 10,000-pair hot key through pool-backed payload fetches.
+
+
+### Native columnar upsert integration
+
+`enable_upsert_payload_stash` selects a third upsert-v2 state representation. It
+is off in production and on in the mzcompose test parameter defaults. It takes
+precedence over `enable_upsert_chunked_stash` when upsert-v2 is enabled.
+
+`columnar::payload::PayloadChunk` wraps a normal columnar metadata chunk and a
+manifest. The existing Differential chunk batcher and spine handle merging,
+advancement, sealing, and compaction. Metadata can spill through the existing
+columnar path. Each rewrite retains exactly the referenced payload blocks,
+without decoding payloads. The generic bulk-probe interface returns metadata
+with the ownership needed to resolve its locators.
+
+The source stash stores keys, times, source offsets, tombstones, and row handles.
+Offset selection is the existing `UpsertDiff` semigroup. Payloads are published
+after the initial chunker selects its winners, in metadata order. Ineligible updates retain
+their handles when re-stashed. The feedback arrangement stores keys and exact
+payload identities with ordinary additive diffs. An operator-local weak equality
+index uses fingerprints to find candidates, then checks their bytes before
+reusing a live handle. It owns no blocks and sweeps dead entries incrementally.
+This identity policy is specific to this consumer, rather than required by the
+chunk abstraction. Its resident index cost needs measurement.
+
+Source and feedback share one payload store: 2 MiB blocks, a 16 MiB decoded-read
+budget, and two blocking read jobs. The drain retains at most two decoded blocks
+for reuse across windows. Each 1,024-record window groups emitted updates by
+payload locator before decoding, avoiding old/new block alternation. Feedback
+canonicalization retains one decoded block. Payloads larger
+than a block remain inline, preserving supported row sizes at the cost of the
+original row-copying behavior for those rows. Encoded error rows follow the same
+path as successful values. The persist format is unchanged.
+
+The upsert driver still owns resume filtering, persist eligibility, frontiers,
+metrics, and shutdown. This does not replace that protocol with a generic latest
+reduction, and does not install the local proxy join driver into compute. It
+requires no Timely or Differential dependency migration.
+
+Limits to measure include the resident equality index and manifests, metadata
+reads while pruning ownership, synchronous metadata merges, batching scratch,
+and payload block retention when only a few rows remain live. Decoded admission
+is shared by the source and feedback operators of one upsert dataflow, not yet
+across every operator in the process. The process pool still governs residency.
+
+The hydration comparison adds `v2_payload` alongside `v1` and `v2_all`, using
+identical persisted state and fresh replicas. The candidate image must contain
+the new flag. The existing overnight image predates this integration.
+
+
+## Alternatives
+
+**Continue improving combined row chunks.** This has the smallest implementation
+cost and preserves write elision for short-lived chunks. It remains the baseline.
+It is sufficient if measurements show that byte amplification is no longer the
+limiting cost, and avoids the proposed equality and ownership overhead.
+
+**Adopt the existing int-proxy reference backend directly.** This validates tactic
+integration, but does not eliminate row copying or provide bounded cold reads,
+metadata, or large-group execution. It is a useful reference, not the target store.
+
+**Globally intern every row to an integer.** Equality becomes cheap after lookup,
+but the interning index and ownership can dominate memory and I/O. Requiring it
+also couples every consumer to a global identity policy. Prefer bounded exact
+canonicalization, with stronger interning optional when measurements justify it.
+
+**Use one key/value store for all operator state.** This can supply storage and
+lookup, but still needs integration with immutable batch sharing, time histories,
+progress, and output backpressure. It may be a backend option rather than the
+operator interface itself.
+
+**Make native async I/O the first project.** It can improve read scheduling, but
+preserves unnecessary bytes read, written, and decoded. Separate the operator's
+resumable contract from the extent implementation so both improvements can be
+measured independently.
+
+## Questions for discussion
+
+1. **Execution boundary:** should Differential expose resumable tactics, or a
+   smaller replay primitive that a Materialize async driver composes? Preparing
+   resident windows is a useful first experiment, not a complete large-group answer.
+2. **Ownership granularity:** can block/segment manifests and paged ownership
+   metadata provide acceptable dead-byte retention, or do we need finer liveness
+   information? What is the minimum pool API extension required?
+3. **Equality:** which consumers can canonicalize within a merge or work window,
+   and which need a longer-lived spillable equality index? How much cold comparison
+   traffic does each approach introduce?
+4. **Large groups:** which reduction contracts are worth supporting initially,
+   and how should operators declare their streaming or external-state requirements?
+5. **Delivery gate:** do we agree that equijoin must exercise the shared runtime
+   before these APIs are considered stable, even though upsert ships first?
+6. **Performance gate:** are the proposed 2x byte-reduction and 5% resident-overhead
+   targets appropriate, and which workloads should decide whether the additional
+   storage machinery is justified?
diff --git a/misc/python/materialize/mzcompose/__init__.py b/misc/python/materialize/mzcompose/__init__.py
index f57c5ea6d1789..de91f84b6a89e 100644
--- a/misc/python/materialize/mzcompose/__init__.py
+++ b/misc/python/materialize/mzcompose/__init__.py
@@ -369,6 +369,11 @@ def get_variable_system_parameters(
             "true",
             ["true", "false"],
         ),
+        VariableSystemParameter(
+            "enable_upsert_payload_stash",
+            "true",
+            ["true", "false"],
+        ),
         VariableSystemParameter(
             "enable_upsert_async_reads",
             "true",
diff --git a/misc/python/materialize/parallel_workload/action.py b/misc/python/materialize/parallel_workload/action.py
index 4d5217f5d63f5..7dfdac8e99ccd 100644
--- a/misc/python/materialize/parallel_workload/action.py
+++ b/misc/python/materialize/parallel_workload/action.py
@@ -3180,6 +3180,7 @@ def __init__(
         self.flags_with_values["enable_upsert_paged_spill"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_chunked_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_async_reads"] = BOOLEAN_FLAG_VALUES
+        self.flags_with_values["enable_upsert_payload_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_column_chunk_direct_compressed_output"] = (
             BOOLEAN_FLAG_VALUES
         )
diff --git a/src/storage-types/src/dyncfgs.rs b/src/storage-types/src/dyncfgs.rs
index e27dff344b92e..066e8f53b1bf9 100644
--- a/src/storage-types/src/dyncfgs.rs
+++ b/src/storage-types/src/dyncfgs.rs
@@ -452,6 +452,15 @@ pub const ENABLE_UPSERT_ASYNC_READS: Config<bool> = Config::new(
     ParameterScope::Replica,
 );
 
+/// Separate upsert-v2 payload blocks from columnar merge metadata.
+/// Read once per dataflow. Uses the process pool and asynchronous payload reads.
+pub const ENABLE_UPSERT_PAYLOAD_STASH: Config<bool> = Config::new(
+    "enable_upsert_payload_stash",
+    false,
+    "Use payload-separated columnar state for upsert-v2. Takes effect on new dataflows.",
+    ParameterScope::Replica,
+);
+
 // RocksDB
 
 /// How many times to try to cleanup old RocksDB DB's on disk before giving up.
@@ -577,6 +586,7 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&ENABLE_UPSERT_PAGED_SPILL)
         .add(&ENABLE_UPSERT_CHUNKED_STASH)
         .add(&ENABLE_UPSERT_ASYNC_READS)
+        .add(&ENABLE_UPSERT_PAYLOAD_STASH)
         .add(&WALLCLOCK_GLOBAL_LAG_HISTOGRAM_RETENTION_INTERVAL)
         .add(&WALLCLOCK_LAG_HISTORY_RETENTION_INTERVAL)
         .add(&crate::sources::sql_server::CDC_CLEANUP_CHANGE_TABLE)
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index f47c89f947112..7551cae9482b3 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -64,9 +64,12 @@
 //! ## Stash flavors
 //!
 //! [`UpsertStashFlavor`], resolved from `enable_upsert_chunked_stash` at
-//! operator construction, selects between two instantiations of the same
+//! operator construction, selects between three instantiations of the same
 //! loop:
 //!
+//! * **Payload**: columnar chunks contain metadata and payload locators.
+//!   Separate manifests own pool-backed rows, and feedback uses exact,
+//!   operator-local payload identities for consolidation.
 //! * **Chunked**: the stash is differential's chunk merge batcher over
 //!   `ColumnChunk`s and the feedback arrangement is a spine of chunk batches.
 //!   Committed chunk bodies spill to the process buffer pool, the drain
@@ -77,7 +80,9 @@
 //!   through the storage-owned column pager, and prior state comes back
 //!   through a trace cursor.
 //!
-//! Both flavors' spill paths are gated by `enable_upsert_paged_spill`.
+//! Paged and chunked spill paths are gated by `enable_upsert_paged_spill`.
+//! The experimental payload flavor is selected by `enable_upsert_payload_stash`
+//! and always allocates its external payloads through the process pool.
 //!
 //! ## Eligibility condition (total order)
 //!
@@ -88,6 +93,8 @@
 //! with `p < ts` is ineligible (persist hasn't caught up), and one with
 //! `ts < p` is already persisted and dropped.
 
+mod payload;
+
 use std::fmt::Debug;
 
 use differential_dataflow::difference::{IsZero, Semigroup};
@@ -105,7 +112,9 @@ use mz_repr::{Datum, Diff, GlobalId, Row};
 #[cfg(feature = "fuzzing")]
 use mz_row_spine::DatumSeq;
 use mz_row_spine::{ValRowColPagedBuilder, ValRowSpine};
-use mz_storage_types::dyncfgs::{ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH};
+use mz_storage_types::dyncfgs::{
+    ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH, ENABLE_UPSERT_PAYLOAD_STASH,
+};
 use mz_storage_types::errors::{DataflowError, EnvelopeError, UpsertError};
 use mz_timely_util::builder_async::{
     AsyncOutputHandle, Event as AsyncEvent, OperatorBuilder as AsyncOperatorBuilder,
@@ -137,7 +146,7 @@ use crate::upsert::UpsertSourceTime;
 use crate::upsert::UpsertValue;
 
 /// Which stash and feedback-arrangement representation the upsert-v2
-/// operator instantiates. The two flavors run the same operator loop; they
+/// operator instantiates. All flavors run the same operator loop. They
 /// differ in the batcher, the feedback trace, and how the drain reads prior
 /// state. See the module docs for the comparison.
 #[derive(Clone, Copy, Debug)]
@@ -146,6 +155,8 @@ pub enum UpsertStashFlavor {
     /// arrangement, cursor-based drain. Spills through the storage-owned
     /// column pager.
     Paged,
+    /// Columnar metadata with independently owned payload blocks.
+    Payload,
     /// Chunk merge batcher stash, chunk-spine feedback arrangement,
     /// bulk-probe drain. Spills through the process buffer pool.
     Chunked { async_reads: bool },
@@ -156,7 +167,9 @@ impl UpsertStashFlavor {
     /// source at operator construction time, so a dataflow keeps one flavor
     /// for its whole life even if the flag flips underneath it.
     pub fn from_config(config: &ConfigSet) -> Self {
-        if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
+        if ENABLE_UPSERT_PAYLOAD_STASH.get(config) {
+            Self::Payload
+        } else if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
             Self::Chunked {
                 async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
             }
@@ -247,18 +260,18 @@ type FeedbackSpine<T> = ChunkSpine<FeedbackChunk<T>>;
 // `(key, time)` runs.
 #[derive(Clone, Debug, Default, columnar::Columnar)]
 #[columnar(derive(PartialEq, Eq, PartialOrd, Ord))]
-struct UpsertDiff<O> {
+struct UpsertDiff<O, V> {
     from_time: O,
-    value: Option<Row>,
+    value: Option<V>,
 }
 
-impl<O> IsZero for UpsertDiff<O> {
+impl<O, V> IsZero for UpsertDiff<O, V> {
     fn is_zero(&self) -> bool {
         false
     }
 }
 
-impl<O: Ord + Clone> Semigroup for UpsertDiff<O> {
+impl<O: Ord + Clone, V: Clone> Semigroup for UpsertDiff<O, V> {
     fn plus_equals(&mut self, rhs: &Self) {
         if rhs.from_time > self.from_time {
             *self = rhs.clone();
@@ -272,15 +285,16 @@ impl<O: Ord + Clone> Semigroup for UpsertDiff<O> {
 // wins" comparison — copying the value `Row` out of the column solely when `rhs`
 // wins. Losing folds (the common case for a repeatedly-updated key) then pay no
 // `Row` copy at all.
-impl<'a, O> Semigroup<columnar::Ref<'a, UpsertDiff<O>>> for UpsertDiff<O>
+impl<'a, O, V> Semigroup<columnar::Ref<'a, UpsertDiff<O, V>>> for UpsertDiff<O, V>
 where
     O: columnar::Columnar + Ord + Clone,
+    V: columnar::Columnar + Clone,
 {
-    fn plus_equals(&mut self, rhs: &columnar::Ref<'a, UpsertDiff<O>>) {
+    fn plus_equals(&mut self, rhs: &columnar::Ref<'a, UpsertDiff<O, V>>) {
         let rhs_from_time = <O as columnar::Columnar>::into_owned(rhs.from_time);
         if rhs_from_time > self.from_time {
             self.from_time = rhs_from_time;
-            self.value = <Option<Row> as columnar::Columnar>::into_owned(rhs.value);
+            self.value = <Option<V> as columnar::Columnar>::into_owned(rhs.value);
         }
     }
 }
@@ -288,11 +302,11 @@ where
 /// One source-stash update: a key, its dataflow time, and the payload diff.
 /// `O` is the columnar order key projected from the source `FromTime` (see
 /// [`UpsertSourceTime`]).
-type UpsertUpdate<T, O> = (UpsertKey, T, UpsertDiff<O>);
+type UpsertUpdate<T, O, V = Row> = (UpsertKey, T, UpsertDiff<O, V>);
 
 /// One stash chunk: a sorted, consolidated run of updates, resident or
 /// spilled to the buffer pool.
-type UpsertChunk<T, O> = ColumnChunk<UpsertKey, T, UpsertDiff<O>>;
+type UpsertChunk<T, O> = ColumnChunk<UpsertKey, T, UpsertDiff<O, Row>>;
 
 /// The chunked flavor's stash: differential's chunk merge batcher over
 /// `ColumnChunk`s. Data is pushed in unsorted. The batcher maintains
@@ -307,11 +321,11 @@ type UpsertChunkBatcher<T, O> = ChunkBatcher<UpsertChunk<T, O>>;
 /// like [`UpsertChunkBatcher`] but storing each chain entry as a `Column`
 /// routed through the storage-owned pager, which pages cold chains out of
 /// RSS.
-type UpsertPagedBatcher<T, O> = ColumnMergeBatcher<UpsertKey, T, UpsertDiff<O>>;
+type UpsertPagedBatcher<T, O> = ColumnMergeBatcher<UpsertKey, T, UpsertDiff<O, Row>>;
 
 /// The chunker that sorts and consolidates raw input into the `Column` chunks
 /// both stash batchers consume.
-type UpsertChunker<T, O> = ColumnChunker<UpsertUpdate<T, O>>;
+type UpsertChunker<T, O, V = Row> = ColumnChunker<UpsertUpdate<T, O, V>>;
 
 /// The operator's data-output handle. A fueled `Vec` builder so the drain can
 /// `give_fueled` each emitted update and yield to timely under large snapshot
@@ -444,6 +458,35 @@ where
         source_config.source_statistics.clone(),
     );
     match flavor {
+        UpsertStashFlavor::Payload => {
+            let store = payload::store();
+            let (encoded, token) = payload::encode_feedback(encoded, store.clone());
+            let persist_arranged = arrange_core::<
+                _,
+                _,
+                payload::FeedbackChunker<T>,
+                ChunkBatcher<
+                    mz_timely_util::columnar::payload::PayloadChunk<payload::FeedbackLayout, T>,
+                >,
+                ChunkBuilder<
+                    mz_timely_util::columnar::payload::PayloadChunk<payload::FeedbackLayout, T>,
+                >,
+                payload::FeedbackSpine<T>,
+            >(encoded, Pipeline, "Persist payload feedback");
+            let mut persist_token = persist_token.unwrap_or_default();
+            persist_token.push(token);
+            build_upsert_operator::<payload::PayloadArm, _, _>(
+                input,
+                resume_upper,
+                persist_arranged,
+                Some(persist_token),
+                upsert_metrics,
+                source_config,
+                true,
+                Some(store),
+            )
+        }
+
         UpsertStashFlavor::Chunked { async_reads } => {
             // Chains and sealed batches alike are `FeedbackChunk`s whose
             // bodies spill to the buffer pool, behind the same process spill
@@ -464,6 +507,7 @@ where
                 upsert_metrics,
                 source_config,
                 async_reads,
+                None,
             )
         }
         UpsertStashFlavor::Paged => {
@@ -488,6 +532,7 @@ where
                 upsert_metrics,
                 source_config,
                 false,
+                None,
             )
         }
     }
@@ -573,6 +618,7 @@ fn build_upsert_operator<'scope, A, T, FromTime>(
     upsert_metrics: UpsertMetrics,
     source_config: crate::source::SourceExportCreationConfig,
     async_reads: bool,
+    payload_store: Option<mz_timely_util::out_of_core::Store>,
 ) -> (
     VecCollection<'scope, T, Result<Row, DataflowError>, Diff>,
     StreamVec<'scope, T, (Option<GlobalId>, HealthStatusUpdate)>,
@@ -581,6 +627,7 @@ fn build_upsert_operator<'scope, A, T, FromTime>(
 )
 where
     A: UpsertStashArm<T, FromTime::Order>,
+    for<'a> columnar::Ref<'a, A::Value>: Copy + Ord,
     T: Timestamp + TotalOrder + Sync,
     T: Refines<mz_repr::Timestamp> + differential_dataflow::lattice::Lattice,
     T: columnation::Columnation,
@@ -634,13 +681,13 @@ where
         // pushed in, bounding memory to O(unique key-time pairs) even during
         // large initial snapshots. How cold stash state leaves RSS is
         // flavor-specific; see the arm impls.
-        let mut batcher = A::new_batcher();
+        let mut batcher = A::new_batcher(payload_store);
         // The chunker sorts and consolidates raw input into the `Column` chunks
         // the batcher consumes.
-        let mut chunker: UpsertChunker<T, FromTime::Order> = Default::default();
+        let mut chunker: UpsertChunker<T, FromTime::Order, A::Value> = Default::default();
         // Scratch buffer for accumulating source events before flushing to
         // the batcher. Drained on each iteration via the chunker.
-        let mut push_buffer: Vec<UpsertUpdate<T, FromTime::Order>> = Vec::new();
+        let mut push_buffer: Vec<UpsertUpdate<T, FromTime::Order, A::Value>> = Vec::new();
 
         // Capability held at the minimum time of any buffered data. When
         // Some, the operator may still produce output; when None, the
@@ -684,7 +731,8 @@ where
                             {
                                 continue;
                             }
-                            let value = value.as_ref().map(upsert_value_to_row);
+                            let value =
+                                A::encode(value.as_ref().map(upsert_value_to_row), &mut batcher);
                             let from_time = from_time.upsert_order();
                             push_buffer.push((key, ts, UpsertDiff { from_time, value }));
                             pushed_any = true;
@@ -812,6 +860,7 @@ where
                     source_config.worker_id,
                     source_config.id,
                     async_reads,
+                    &mut batcher,
                 )
                 .await;
 
@@ -884,6 +933,11 @@ where
     O: columnar::Columnar + Default + Ord + Clone + Send + Sync + 'static,
     for<'a> columnar::Ref<'a, O>: Ord + Copy,
 {
+    type Value: columnar::Columnar + Default + Clone;
+
+    fn encode(value: Option<Row>, batcher: &mut Self::Batcher) -> Option<Self::Value>;
+    fn end_flush(_batcher: &mut Self::Batcher) {}
+
     /// The feedback arrangement's spine. `'static` because the operator
     /// future owns a trace agent for it.
     type Spine: TraceReader<Time = T> + 'static;
@@ -892,26 +946,28 @@ where
     type Batcher: Batcher<Time = T> + 'static;
 
     /// A new stash batcher for one source dataflow.
-    fn new_batcher() -> Self::Batcher;
+    fn new_batcher(store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher;
 
     /// Push one sorted, consolidated `Column` chunk into the batcher, in the
     /// batcher's chunk representation.
-    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>);
+    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Self::Value>>);
 
     /// Consolidate `updates` through `chunker` into `Column` chunks and push
     /// them into `batcher`, emptying `updates` (keeping its capacity). The
     /// chunker readies a fully-consolidated chunk per `push_into`, so the
     /// `extract` loop drains everything it produced.
     fn flush(
-        updates: &mut Vec<UpsertUpdate<T, O>>,
-        chunker: &mut UpsertChunker<T, O>,
+        updates: &mut Vec<UpsertUpdate<T, O, Self::Value>>,
+        chunker: &mut UpsertChunker<T, O, Self::Value>,
         batcher: &mut Self::Batcher,
-    ) {
+    ) where
+        for<'a> columnar::Ref<'a, Self::Value>: Copy + Ord,
+    {
         use timely::container::{ContainerBuilder as _, PushInto as _};
         if updates.is_empty() {
             return;
         }
-        let mut raw: Column<UpsertUpdate<T, O>> = Default::default();
+        let mut raw: Column<UpsertUpdate<T, O, Self::Value>> = Default::default();
         for update in updates.drain(..) {
             raw.push_into(&update);
         }
@@ -919,13 +975,14 @@ where
         while let Some(chunk) = chunker.extract() {
             Self::push_chunk(batcher, std::mem::take(chunk));
         }
+        Self::end_flush(batcher);
     }
 
     /// Classify one sealed stash against `persist_upper` and emit eligible
     /// output; see [`DrainStats`].
     async fn drain(
         sealed: Vec<<Self::Batcher as Batcher>::Output>,
-        ineligible: &mut Vec<UpsertUpdate<T, O>>,
+        ineligible: &mut Vec<UpsertUpdate<T, O, Self::Value>>,
         output_handle: &UpsertOutputHandle<T>,
         output_cap: &Capability<T>,
         persist_upper: &Antichain<T>,
@@ -933,6 +990,7 @@ where
         worker_id: usize,
         source_id: GlobalId,
         async_reads: bool,
+        batcher: &mut Self::Batcher,
     ) -> DrainStats;
 }
 
@@ -957,10 +1015,16 @@ where
     O: columnar::Columnar + Default + Ord + Clone + Send + Sync + 'static,
     for<'a> columnar::Ref<'a, O>: Ord + Copy,
 {
+    type Value = Row;
+
+    fn encode(value: Option<Row>, _batcher: &mut Self::Batcher) -> Option<Row> {
+        value
+    }
+
     type Spine = FeedbackSpine<T>;
     type Batcher = UpsertChunkBatcher<T, O>;
 
-    fn new_batcher() -> Self::Batcher {
+    fn new_batcher(_store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher {
         Batcher::new(None, 0)
     }
 
@@ -978,6 +1042,7 @@ where
         worker_id: usize,
         source_id: GlobalId,
         async_reads: bool,
+        _batcher: &mut Self::Batcher,
     ) -> DrainStats {
         drain_sealed_input_chunked(
             sealed.into_iter(),
@@ -1007,10 +1072,16 @@ where
     O: columnar::Columnar + Default + Ord + Clone + Send + Sync + 'static,
     for<'a> columnar::Ref<'a, O>: Ord + Copy,
 {
+    type Value = Row;
+
+    fn encode(value: Option<Row>, _batcher: &mut Self::Batcher) -> Option<Row> {
+        value
+    }
+
     type Spine = ValRowSpine<UpsertKey, T, Diff>;
     type Batcher = UpsertPagedBatcher<T, O>;
 
-    fn new_batcher() -> Self::Batcher {
+    fn new_batcher(_store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher {
         let mut batcher: UpsertPagedBatcher<T, O> = Batcher::new(None, 0);
         batcher.set_pager(crate::upsert::upsert_stash_pager::pager());
         batcher
@@ -1030,6 +1101,7 @@ where
         worker_id: usize,
         source_id: GlobalId,
         _async_reads: bool,
+        _batcher: &mut Self::Batcher,
     ) -> DrainStats {
         drain_sealed_input_paged(
             sealed,
@@ -1251,7 +1323,7 @@ where
                         ineligible.push((
                             *key,
                             ts,
-                            <UpsertDiff<O> as columnar::Columnar>::into_owned(diff),
+                            <UpsertDiff<O, Row> as columnar::Columnar>::into_owned(diff),
                         ));
                         continue;
                     }
@@ -1385,7 +1457,7 @@ where
                     ineligible.push((
                         *key,
                         ts,
-                        <UpsertDiff<O> as columnar::Columnar>::into_owned(diff),
+                        <UpsertDiff<O, Row> as columnar::Columnar>::into_owned(diff),
                     ));
                     continue;
                 }
@@ -2120,4 +2192,192 @@ mod test {
         differential_dataflow::consolidation::consolidate_updates(&mut emitted);
         (frontier, emitted)
     }
+    #[mz_ore::test]
+    fn payload_state_matches_columnar_feedback_across_resume_and_restash() {
+        let pool = mz_ore::pool::Pool::new().unwrap();
+        pool.set_budget(0);
+        pool.set_rss_target(1 << 20);
+        let _pool = payload::test_pool(pool.clone());
+        let runtime = tokio::runtime::Runtime::new().unwrap();
+        let _enter = runtime.enter();
+        let baseline = run_payload_feedback_scenario(UpsertStashFlavor::Paged, 32);
+        assert_eq!(
+            baseline,
+            run_payload_feedback_scenario(UpsertStashFlavor::Chunked { async_reads: true }, 32)
+        );
+        assert_eq!(
+            baseline,
+            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 32)
+        );
+        assert_eq!(
+            run_payload_feedback_scenario(UpsertStashFlavor::Chunked { async_reads: true }, 1900),
+            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 1900)
+        );
+        assert_eq!(
+            run_payload_feedback_scenario(UpsertStashFlavor::Paged, 3 << 20),
+            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 3 << 20)
+        );
+        assert_eq!(
+            pool.stats().live_chunks,
+            0,
+            "shutdown must release metadata and payload blocks"
+        );
+    }
+
+    fn run_payload_feedback_scenario(
+        flavor: UpsertStashFlavor,
+        width: usize,
+    ) -> Vec<(Result<Row, DataflowError>, Ts, Diff)> {
+        use timely::dataflow::operators::Probe;
+        timely::execute_directly(move |worker| {
+            let (mut input, mut persist, probe, capture, button) = worker
+                .dataflow::<MzTimestamp, _, _>(|scope| {
+                    scope.scoped::<Ts, _, _>("upsert", |scope| {
+                        let (input_handle, input) = scope.new_input();
+                        let (persist_handle, persist_input) = scope.new_input();
+                        let source_id = GlobalId::User(0);
+
+                        let reg = MetricsRegistry::new();
+                        let upsert_defs = UpsertMetricDefs::register_with(&reg);
+                        let upsert_metrics = UpsertMetrics::new(&upsert_defs, source_id, 0, None);
+
+                        let reg2 = MetricsRegistry::new();
+                        let storage_metrics = StorageMetrics::register_with(&reg2);
+
+                        let reg3 = MetricsRegistry::new();
+                        let stats_defs = SourceStatisticsMetricDefs::register_with(&reg3);
+                        let envelope = SourceEnvelope::Upsert(UpsertEnvelope {
+                            source_arity: 2,
+                            style: UpsertStyle::Default(KeyEnvelope::Flattened),
+                            key_indices: vec![0],
+                        });
+                        let source_statistics = SourceStatistics::new(
+                            source_id,
+                            0,
+                            &stats_defs,
+                            source_id,
+                            &ShardId::new(),
+                            envelope,
+                            Antichain::from_elem(Timestamp::minimum()),
+                        );
+                        let source_config = SourceExportCreationConfig {
+                            id: source_id,
+                            worker_id: 0,
+                            metrics: storage_metrics,
+                            source_statistics,
+                        };
+
+                        let (output, _, _, button) = upsert_inner(
+                            flavor,
+                            input.as_collection(),
+                            vec![0],
+                            Antichain::from_elem(new_ts(1)),
+                            persist_input.as_collection(),
+                            None,
+                            upsert_metrics,
+                            source_config,
+                        );
+                        let captured = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+                        let records = std::rc::Rc::clone(&captured);
+                        let output =
+                            output.inspect(move |update| records.borrow_mut().push(update.clone()));
+                        let (probe, _) = output.inner.probe();
+                        (input_handle, persist_handle, probe, captured, button)
+                    })
+                });
+
+            let drive = |worker: &mut timely::worker::Worker, upper: u64| {
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+                while probe.less_than(&new_ts(upper)) {
+                    assert!(
+                        std::time::Instant::now() < deadline,
+                        "upsert frontier stalled: {flavor:?}"
+                    );
+                    worker.step_or_park(Some(std::time::Duration::from_millis(1)));
+                }
+            };
+            let extra = if width < 1 << 20 { 2050 } else { 0 };
+            let extra_row = |key, version| {
+                let value = format!("{version}:{}", "x".repeat(width));
+                Row::pack_slice(&[Datum::Int64(key), Datum::String(&value)])
+            };
+            let error = UpsertError::NullKey(mz_storage_types::errors::UpsertNullKeyError);
+            let error_key = UpsertKey::from_key(Err(&error));
+            let wide = Row::pack_slice(&[Datum::Int64(3), Datum::String(&"x".repeat(width))]);
+            persist.send((Ok(row(1, 10)), new_ts(0), Diff::ONE));
+            persist.send((Ok(row(2, 20)), new_ts(0), Diff::ONE));
+            persist.advance_to(new_ts(1));
+            input.send(((key(1), Some(Ok(row(1, 999))), 100), new_ts(0), Diff::ONE));
+            input.send(((key(1), Some(Ok(row(1, 11))), 3), new_ts(1), Diff::ONE));
+            input.send(((key(1), Some(Ok(row(1, 12))), 2), new_ts(1), Diff::ONE));
+            input.send(((key(2), None, 4), new_ts(1), Diff::ONE));
+            input.send(((key(3), Some(Ok(wide.clone())), 5), new_ts(1), Diff::ONE));
+            for k in 100..100 + extra {
+                input.send((
+                    (key(k), Some(Ok(extra_row(k, 10))), 1),
+                    new_ts(1),
+                    Diff::ONE,
+                ));
+            }
+            input.send((
+                (error_key, Some(Err(Box::new(error))), 1),
+                new_ts(1),
+                Diff::ONE,
+            ));
+            input.advance_to(new_ts(2));
+            drive(worker, 2);
+            let first = capture.borrow().clone();
+            assert_eq!(
+                first.len(),
+                5 + usize::try_from(extra).unwrap(),
+                "initial insert, replacement, and delete"
+            );
+            for update in first {
+                persist.send(update);
+            }
+            persist.advance_to(new_ts(2));
+            input.send(((key(1), Some(Ok(row(1, 13))), 6), new_ts(2), Diff::ONE));
+            input.send(((key(1), Some(Ok(row(1, 14))), 7), new_ts(3), Diff::ONE));
+            input.send(((key(3), None, 8), new_ts(3), Diff::ONE));
+            for k in 100..100 + extra {
+                input.send((
+                    (key(k), Some(Ok(extra_row(k, 20))), 2),
+                    new_ts(2),
+                    Diff::ONE,
+                ));
+                input.send(((key(k), None, 3), new_ts(3), Diff::ONE));
+            }
+            input.send(((error_key, None, 2), new_ts(3), Diff::ONE));
+            input.advance_to(new_ts(4));
+            drive(worker, 3);
+            let second: Vec<_> = capture
+                .borrow()
+                .iter()
+                .filter(|(_, time, _)| *time == new_ts(2))
+                .cloned()
+                .collect();
+            assert_eq!(second.len(), 2 + 2 * usize::try_from(extra).unwrap());
+            for update in second {
+                persist.send(update);
+            }
+            persist.advance_to(new_ts(3));
+            drive(worker, 4);
+            let mut result = capture.borrow().clone();
+            assert_eq!(
+                result
+                    .iter()
+                    .filter(|(_, time, _)| *time == new_ts(3))
+                    .count(),
+                4 + usize::try_from(extra).unwrap()
+            );
+            drop(input);
+            drop(persist);
+            drop(button);
+            while worker.has_dataflows() {
+                worker.step();
+            }
+            differential_dataflow::consolidation::consolidate_updates(&mut result);
+            result
+        })
+    }
 }
diff --git a/src/storage/src/upsert_continual_feedback_v2/payload.rs b/src/storage/src/upsert_continual_feedback_v2/payload.rs
new file mode 100644
index 0000000000000..18837852abf5d
--- /dev/null
+++ b/src/storage/src/upsert_continual_feedback_v2/payload.rs
@@ -0,0 +1,448 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+use std::collections::BTreeMap;
+use std::marker::PhantomData;
+use std::rc::Rc;
+
+use columnar::{Columnar, Index, Len};
+use futures::StreamExt;
+use mz_timely_util::columnar::payload::{PayloadChunk, PayloadChunker, PayloadLayout};
+use mz_timely_util::out_of_core::{Manifest, PayloadInterner, ReadLease, RowHandle, Store};
+use timely::container::ContainerBuilder;
+
+use super::*;
+
+const BLOCK_BYTES: usize = 2 << 20;
+
+#[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd, columnar::Columnar)]
+#[columnar(derive(PartialEq, Eq, PartialOrd, Ord))]
+pub(super) enum Value {
+    External(RowHandle),
+    // Oversized rows retain the existing inline path instead of imposing a row limit.
+    Inline(Row),
+}
+
+impl Default for Value {
+    fn default() -> Self {
+        Self::Inline(Row::default())
+    }
+}
+
+fn visit(value: columnar::Ref<'_, Value>, rows: &mut Vec<RowHandle>) {
+    if let ValueReference::External(row) = value {
+        rows.push(RowHandle::into_owned(row));
+    }
+}
+
+pub(super) struct FeedbackLayout;
+impl PayloadLayout for FeedbackLayout {
+    type Data = (UpsertKey, Value);
+    type Diff = Diff;
+    fn visit(
+        (_, value): columnar::Ref<'_, Self::Data>,
+        _: columnar::Ref<'_, Diff>,
+        rows: &mut Vec<RowHandle>,
+    ) {
+        visit(value, rows);
+    }
+}
+
+pub(super) struct SourceLayout<O>(PhantomData<O>);
+impl<O: Columnar> PayloadLayout for SourceLayout<O> {
+    type Data = UpsertKey;
+    type Diff = UpsertDiff<O, Value>;
+    fn visit(
+        _: columnar::Ref<'_, UpsertKey>,
+        diff: columnar::Ref<'_, Self::Diff>,
+        rows: &mut Vec<RowHandle>,
+    ) {
+        if let Some(value) = diff.value {
+            visit(value, rows);
+        }
+    }
+}
+
+type SourceChunk<T, O> = PayloadChunk<SourceLayout<O>, T>;
+pub(super) type FeedbackSpine<T> = ChunkSpine<PayloadChunk<FeedbackLayout, T>>;
+
+#[cfg(test)]
+thread_local! {
+    static TEST_POOL: std::cell::RefCell<Option<mz_ore::pool::Pool>> =
+        const { std::cell::RefCell::new(None) };
+}
+
+#[cfg(test)]
+pub(super) struct TestPool;
+#[cfg(test)]
+impl Drop for TestPool {
+    fn drop(&mut self) {
+        TEST_POOL.with(|pool| *pool.borrow_mut() = None);
+        mz_timely_util::columnar::chunk::set_spill_override(None);
+    }
+}
+#[cfg(test)]
+pub(super) fn test_pool(pool: mz_ore::pool::Pool) -> TestPool {
+    mz_timely_util::columnar::chunk::set_spill_override(Some(pool.clone()));
+    TEST_POOL.with(|cell| *cell.borrow_mut() = Some(pool));
+    TestPool
+}
+
+pub(super) fn store() -> Store {
+    #[cfg(test)]
+    let pool = TEST_POOL.with(|pool| pool.borrow().clone());
+    #[cfg(not(test))]
+    let pool: Option<mz_ore::pool::Pool> = None;
+    let pool = pool
+        .or_else(mz_timely_util::pool_config::active_pool)
+        .or_else(mz_timely_util::pool_config::global_pool)
+        .expect("payload upsert requires a buffer pool");
+    Store::new(
+        pool,
+        BLOCK_BYTES,
+        8 * BLOCK_BYTES,
+        2,
+        &mz_timely_util::columnar::chunk::LZ4_CODEC,
+    )
+    .expect("valid payload store configuration")
+}
+
+pub(super) struct SourceBatcher<T, O>
+where
+    T: Timestamp + Lattice + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    O: Columnar + Default + Ord + Clone,
+    for<'a> columnar::Ref<'a, O>: Copy + Ord,
+{
+    inner: ChunkBatcher<SourceChunk<T, O>>,
+    store: Store,
+    owners: Vec<Manifest>,
+}
+
+impl<T, O> Batcher for SourceBatcher<T, O>
+where
+    T: Timestamp + Lattice + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    O: Columnar + Default + Ord + Clone,
+    for<'a> columnar::Ref<'a, O>: Copy + Ord,
+{
+    type Output = SourceChunk<T, O>;
+    type Time = T;
+    fn new(_: Option<Logger>, _: usize) -> Self {
+        panic!("construct with the shared payload store")
+    }
+    fn seal(&mut self, upper: Antichain<T>) -> (Vec<Self::Output>, Description<T>) {
+        self.inner.seal(upper)
+    }
+    fn frontier(&mut self) -> AntichainRef<'_, T> {
+        self.inner.frontier()
+    }
+}
+
+impl<T, O> PushInto<SourceChunk<T, O>> for SourceBatcher<T, O>
+where
+    T: Timestamp + Lattice + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    O: Columnar + Default + Ord + Clone,
+    for<'a> columnar::Ref<'a, O>: Copy + Ord,
+{
+    fn push_into(&mut self, chunk: SourceChunk<T, O>) {
+        self.inner.push_into(chunk);
+    }
+}
+
+pub(super) struct PayloadArm;
+impl<T, O> UpsertStashArm<T, O> for PayloadArm
+where
+    T: Timestamp + TotalOrder + Lattice + Sync + columnation::Columnation + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    O: Columnar + Default + Ord + Clone + Send + Sync + 'static,
+    for<'a> columnar::Ref<'a, O>: Copy + Ord,
+{
+    type Value = Value;
+    type Spine = FeedbackSpine<T>;
+    type Batcher = SourceBatcher<T, O>;
+
+    fn new_batcher(store: Option<Store>) -> Self::Batcher {
+        let store = store.expect("payload arm shares its store with feedback");
+        Self::Batcher {
+            inner: Batcher::new(None, 0),
+            store,
+            owners: Vec::new(),
+        }
+    }
+
+    fn encode(value: Option<Row>, _batcher: &mut Self::Batcher) -> Option<Value> {
+        value.map(Value::Inline)
+    }
+
+    fn end_flush(batcher: &mut Self::Batcher) {
+        batcher.owners.clear();
+    }
+
+    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Value>>) {
+        // Publish only the initial chunker's winners, packed in metadata order.
+        let mut builder = batcher.store.builder();
+        let mut metadata = Column::default();
+        let view = chunk.borrow();
+        for index in 0..view.len() {
+            let (key, time, diff) = view.get(index);
+            let value = diff.value.map(|value| match value {
+                ValueReference::Inline(row) if row.byte_len() + 8 <= BLOCK_BYTES => {
+                    Value::External(builder.push(row.data()).expect("row fits payload block"))
+                }
+                value => Value::into_owned(value),
+            });
+            metadata.push_into(&(
+                *key,
+                T::into_owned(time),
+                UpsertDiff {
+                    from_time: O::into_owned(diff.from_time),
+                    value,
+                },
+            ));
+        }
+        let owner = builder.finish();
+        let mut owners: Vec<_> = batcher.owners.iter().collect();
+        owners.push(&owner);
+        batcher
+            .inner
+            .push_into(PayloadChunk::new(metadata, &owners));
+    }
+
+    async fn drain(
+        sealed: Vec<SourceChunk<T, O>>,
+        ineligible: &mut Vec<UpsertUpdate<T, O, Value>>,
+        output_handle: &UpsertOutputHandle<T>,
+        output_cap: &Capability<T>,
+        persist_upper: &Antichain<T>,
+        trace: &mut TraceAgent<Self::Spine>,
+        _worker_id: usize,
+        _source_id: GlobalId,
+        _async_reads: bool,
+        batcher: &mut Self::Batcher,
+    ) -> DrainStats {
+        let batches = trace
+            .batches_through(Antichain::new().borrow())
+            .expect("complete feedback batches");
+        let mut stats = DrainStats {
+            eligible: 0,
+            result_count: 0,
+            inserts: 0,
+            updates: 0,
+            deletes: 0,
+            output_count: 0,
+        };
+        let mut cache = std::collections::VecDeque::new();
+        for chunk in sealed {
+            let metadata = chunk.metadata_async().await;
+            let view = metadata.borrow();
+            let mut retained = false;
+            let source_owner = Rc::new(chunk.manifest().clone());
+            for start in (0..view.len()).step_by(1024) {
+                let end = (start + 1024).min(view.len());
+                let keys: Vec<_> = (start..end)
+                    .filter_map(|i| {
+                        let (key, time, _) = view.get(i);
+                        matches!(
+                            classify_time(persist_upper, &T::into_owned(time)),
+                            TimeClass::Eligible
+                        )
+                        .then_some(*key)
+                    })
+                    .collect();
+                let mut hits: BTreeMap<(UpsertKey, Value), Diff> = BTreeMap::new();
+                let mut staging = mz_timely_util::columnar::payload::PayloadStaging::<(
+                    (UpsertKey, Value),
+                    T,
+                    Diff,
+                )>::default();
+                if !keys.is_empty() {
+                    use columnar::Borrow;
+                    let probes = UpsertKey::as_columns(&keys);
+                    for batch in &batches {
+                        batch
+                            .extract_into_async(probes.borrow(), &mut staging)
+                            .await;
+                    }
+                    let rows = staging.updates.borrow();
+                    for index in 0..rows.len() {
+                        let ((key, value), _, diff) = rows.get(index);
+                        *hits
+                            .entry((*key, Value::into_owned(value)))
+                            .or_insert(Diff::ZERO) += Diff::into_owned(diff);
+                    }
+                }
+                let owners = Manifest::retain(
+                    hits.keys().filter_map(|(_, value)| match value {
+                        Value::External(row) => Some(*row),
+                        Value::Inline(_) => None,
+                    }),
+                    staging.owners.iter().map(|owner| &**owner),
+                )
+                .expect("probe results retain payload ownership");
+                let owners = Rc::new(owners);
+                let mut old = BTreeMap::new();
+                for ((key, value), diff) in hits {
+                    if diff.is_positive() {
+                        assert_eq!(diff, Diff::ONE, "feedback value multiplicity");
+                        let previous = old.insert(key, (value, Rc::clone(&owners)));
+                        assert!(previous.is_none(), "multiple feedback values for one key");
+                    }
+                }
+                let mut pending = Vec::with_capacity(2 * (end - start));
+                for index in start..end {
+                    let (key, time, diff) = view.get(index);
+                    let time = T::into_owned(time);
+                    match classify_time(persist_upper, &time) {
+                        TimeClass::AlreadyPersisted => continue,
+                        TimeClass::Ineligible => {
+                            ineligible.push((*key, time, UpsertDiff::<O, Value>::into_owned(diff)));
+                            retained = true;
+                            continue;
+                        }
+                        TimeClass::Eligible => {}
+                    }
+                    stats.eligible += 1;
+                    let previous = old.remove(key);
+                    let value = diff.value.map(Value::into_owned);
+                    if let Some((previous, owner)) = previous {
+                        stats.result_count += 1;
+                        if value.is_some() {
+                            stats.updates += 1;
+                        } else {
+                            stats.deletes += 1;
+                        }
+                        pending.push((previous, owner, time.clone(), Diff::MINUS_ONE));
+                    } else if value.is_some() {
+                        stats.inserts += 1;
+                    }
+                    if let Some(value) = value {
+                        pending.push((value, Rc::clone(&source_owner), time, Diff::ONE));
+                    }
+                }
+                // Differential updates at a completed time can be emitted in any
+                // order. Group reads by physical block within this metadata window.
+                pending.sort_by_key(|(value, _, _, _)| match value {
+                    Value::External(row) => Some(*row),
+                    Value::Inline(_) => None,
+                });
+                for (value, owner, time, diff) in pending {
+                    let row = decode(&value, &owner, &batcher.store, &mut cache).await;
+                    let size = upsert_value_byte_len(&row);
+                    output_handle
+                        .give_fueled(output_cap, (row, time, diff), size)
+                        .await;
+                    stats.output_count += 1;
+                }
+            }
+            if retained {
+                batcher.owners.push(chunk.manifest().clone());
+            }
+        }
+        stats
+    }
+}
+
+async fn decode(
+    value: &Value,
+    owner: &Manifest,
+    store: &Store,
+    cache: &mut std::collections::VecDeque<ReadLease>,
+) -> UpsertValue {
+    match value {
+        Value::Inline(row) => decode_upsert_value(row.iter()),
+        Value::External(row) => {
+            let hit = cache.iter().position(|lease| lease.get(*row).is_ok());
+            if let Some(index) = hit {
+                let lease = cache.remove(index).expect("observed cached block");
+                cache.push_back(lease);
+            } else {
+                // Two blocks preserve old/new locality. Together with the feedback
+                // interner's one-block cache they fit below the eight-block budget.
+                if cache.len() == 2 {
+                    cache.pop_front();
+                }
+                cache.push_back(
+                    store
+                        .prepare_read([(owner, *row)])
+                        .expect("owned payload fits admission")
+                        .read()
+                        .await,
+                );
+            }
+            let bytes = cache
+                .back()
+                .expect("loaded payload")
+                .get(*row)
+                .expect("requested row");
+            // SAFETY: bytes came from Row::data and the pool preserves their contents.
+            let row = unsafe { Row::from_bytes_unchecked(bytes) };
+            decode_upsert_value(row.iter())
+        }
+    }
+}
+
+pub(super) fn encode_feedback<'scope, T>(
+    input: Stream<'scope, T, Column<((UpsertKey, Row), T, Diff)>>,
+    store: Store,
+) -> (
+    StreamVec<'scope, T, PayloadChunk<FeedbackLayout, T>>,
+    PressOnDropButton,
+)
+where
+    T: Timestamp + Lattice + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+{
+    let mut builder =
+        AsyncOperatorBuilder::new("Upsert feedback payloads".to_owned(), input.scope());
+    let (output, stream) =
+        builder.new_output::<CapacityContainerBuilder<Vec<PayloadChunk<FeedbackLayout, T>>>>();
+    let mut input = builder.new_input_for(input, Pipeline, &output);
+    let button = builder.build(move |caps| async move {
+        drop(caps);
+        let mut interner = PayloadInterner::new(store);
+        let mut chunker: ColumnChunker<((UpsertKey, Value), T, Diff)> = Default::default();
+        while let Some(event) = input.next().await {
+            if let AsyncEvent::Data(cap, column) = event {
+                let view = column.borrow();
+                let rows: Vec<_> = (0..view.len())
+                    .map(|i| <((UpsertKey, Row), T, Diff)>::into_owned(view.get(i)))
+                    .collect();
+                let bytes: Vec<_> = rows
+                    .iter()
+                    .filter(|((_, row), _, _)| row.byte_len() + 8 <= BLOCK_BYTES)
+                    .map(|((_, row), _, _)| row.data().to_vec())
+                    .collect();
+                let (handles, owner) = interner
+                    .intern(&bytes)
+                    .await
+                    .expect("feedback payloads fit store");
+                let mut handles = handles.into_iter();
+                let mut metadata: Column<((UpsertKey, Value), T, Diff)> = Default::default();
+                for ((key, row), time, diff) in rows {
+                    let value = if row.byte_len() + 8 > BLOCK_BYTES {
+                        Value::Inline(row)
+                    } else {
+                        Value::External(handles.next().expect("one handle per external row"))
+                    };
+                    metadata.push_into(&((key, value), time, diff));
+                }
+                chunker.push_into(&mut metadata);
+                while let Some(column) = chunker.extract() {
+                    output.give(&cap, PayloadChunk::new(std::mem::take(column), &[&owner]));
+                }
+                tokio::task::yield_now().await;
+            }
+        }
+    });
+    (stream, button.press_on_drop())
+}
+
+pub(super) type FeedbackChunker<T> = PayloadChunker<FeedbackLayout, T>;
diff --git a/src/timely-util/src/columnar.rs b/src/timely-util/src/columnar.rs
index d10fd370c899f..f9df11b1d30fc 100644
--- a/src/timely-util/src/columnar.rs
+++ b/src/timely-util/src/columnar.rs
@@ -23,6 +23,7 @@ pub mod builder_input;
 pub mod chunk;
 pub mod consolidate;
 pub mod merge_batcher;
+pub mod payload;
 pub mod unload;
 
 use std::hash::Hash;
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index b5a031b08f740..92949db84000e 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -400,6 +400,14 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
         }
     }
 
+    /// Borrow resident metadata, or scope a copy-out read to this callback.
+    pub(crate) fn with_column<Out>(&self, logic: impl FnOnce(&Column<(D, T, R)>) -> Out) -> Out {
+        match self {
+            Self::Resident(column, _) => logic(column),
+            Self::Spilled(..) => logic(&self.clone().into_column()),
+        }
+    }
+
     /// True when the body lives in the pool.
     pub fn is_spilled(&self) -> bool {
         matches!(self, ColumnChunk::Spilled(_, _))
@@ -421,7 +429,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
     }
 
     /// The first and last data items, from resident state only.
-    fn data_span(&self) -> (columnar::Ref<'_, D>, columnar::Ref<'_, D>) {
+    pub(crate) fn data_span(&self) -> (columnar::Ref<'_, D>, columnar::Ref<'_, D>) {
         match self {
             ColumnChunk::Resident(col, _) => {
                 let data = col.borrow().0;
diff --git a/src/timely-util/src/columnar/payload.rs b/src/timely-util/src/columnar/payload.rs
new file mode 100644
index 0000000000000..fa240df576cd4
--- /dev/null
+++ b/src/timely-util/src/columnar/payload.rs
@@ -0,0 +1,392 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Columnar metadata chunks with independently owned pool-backed payloads.
+
+use std::collections::VecDeque;
+use std::marker::PhantomData;
+use std::rc::Rc;
+
+use columnar::{Columnar, Index, Len};
+use differential_dataflow::difference::Semigroup;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::trace::chunk::Chunk;
+use timely::progress::Timestamp;
+use timely::progress::frontier::{Antichain, AntichainRef};
+
+use crate::columnar::Column;
+use crate::columnar::chunk::ColumnChunk;
+use crate::out_of_core::{Manifest, RowHandle};
+
+/// Identifies every external payload referenced by a metadata update.
+pub trait PayloadLayout: 'static {
+    /// Columnar data used for ordering and consolidation.
+    type Data: Columnar;
+    /// Columnar difference used for consolidation.
+    type Diff: Columnar;
+    /// Append all payload locators referenced by this update.
+    fn visit(
+        data: columnar::Ref<'_, Self::Data>,
+        diff: columnar::Ref<'_, Self::Diff>,
+        rows: &mut Vec<RowHandle>,
+    );
+}
+
+/// A metadata chunk whose manifest keeps every referenced payload block alive.
+///
+/// Metadata follows `ColumnChunk` spilling and compaction. Rewrites retain only
+/// referenced blocks, and never decode payloads. Identity and equality belong to
+/// the caller's metadata layout, independently of physical payload placement.
+pub struct PayloadChunk<P: PayloadLayout, T: Columnar> {
+    metadata: ColumnChunk<P::Data, T, P::Diff>,
+    manifest: Rc<Manifest>,
+    marker: PhantomData<P>,
+}
+
+impl<P: PayloadLayout, T: Columnar> Clone for PayloadChunk<P, T> {
+    fn clone(&self) -> Self {
+        Self {
+            metadata: self.metadata.clone(),
+            manifest: Rc::clone(&self.manifest),
+            marker: PhantomData,
+        }
+    }
+}
+
+impl<P: PayloadLayout, T: Columnar> PayloadChunk<P, T> {
+    /// The ownership needed to resolve this chunk's locators.
+    pub fn manifest(&self) -> &Manifest {
+        &self.manifest
+    }
+
+    /// Resident ordering bounds, without reading metadata or payload bodies.
+    pub fn data_span(&self) -> (columnar::Ref<'_, P::Data>, columnar::Ref<'_, P::Data>) {
+        self.metadata.data_span()
+    }
+
+    /// Read metadata without decoding payloads.
+    pub fn metadata(&self) -> Column<(P::Data, T, P::Diff)> {
+        self.metadata.clone().into_column()
+    }
+
+    /// Read metadata asynchronously without decoding payloads.
+    pub async fn metadata_async(&self) -> Column<(P::Data, T, P::Diff)> {
+        self.metadata.clone().into_column_async().await
+    }
+}
+
+impl<P, T> PayloadChunk<P, T>
+where
+    P: PayloadLayout,
+    for<'a> columnar::Ref<'a, P::Data>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
+{
+    /// Attach ownership to sorted, consolidated metadata.
+    pub fn new(metadata: Column<(P::Data, T, P::Diff)>, owners: &[&Manifest]) -> Self {
+        Self::attach(ColumnChunk::from_column(metadata), owners)
+    }
+
+    fn attach(metadata: ColumnChunk<P::Data, T, P::Diff>, owners: &[&Manifest]) -> Self {
+        let mut rows = Vec::new();
+        metadata.with_column(|column| {
+            let view = column.borrow();
+            for index in 0..view.len() {
+                let (data, _, diff) = view.get(index);
+                P::visit(data, diff, &mut rows);
+            }
+        });
+        let manifest = Manifest::retain(rows, owners.iter().copied())
+            .expect("metadata must retain payload ownership");
+        Self {
+            metadata,
+            manifest: Rc::new(manifest),
+            marker: PhantomData,
+        }
+    }
+
+    fn unwrap(
+        input: &mut VecDeque<Self>,
+        owners: &mut Vec<Rc<Manifest>>,
+    ) -> VecDeque<ColumnChunk<P::Data, T, P::Diff>> {
+        input
+            .drain(..)
+            .map(|chunk| {
+                owners.push(chunk.manifest);
+                chunk.metadata
+            })
+            .collect()
+    }
+
+    fn wrap(
+        input: VecDeque<ColumnChunk<P::Data, T, P::Diff>>,
+        owners: &[Rc<Manifest>],
+        output: &mut VecDeque<Self>,
+    ) {
+        let owners: Vec<_> = owners.iter().map(|owner| &**owner).collect();
+        output.extend(input.into_iter().map(|chunk| Self::attach(chunk, &owners)));
+    }
+}
+
+impl<P, T> Chunk for PayloadChunk<P, T>
+where
+    P: PayloadLayout,
+    for<'a> columnar::Ref<'a, P::Data>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
+{
+    type Time = T;
+    const TARGET: usize = ColumnChunk::<P::Data, T, P::Diff>::TARGET;
+    fn len(&self) -> usize {
+        self.metadata.len()
+    }
+
+    fn merge(left: &mut VecDeque<Self>, right: &mut VecDeque<Self>, output: &mut VecDeque<Self>) {
+        let a = left.pop_front().expect("nonempty merge input");
+        let b = right.pop_front().expect("nonempty merge input");
+        let owners = vec![a.manifest, b.manifest];
+        let mut a = VecDeque::from([a.metadata]);
+        let mut b = VecDeque::from([b.metadata]);
+        let mut out = VecDeque::new();
+        ColumnChunk::merge(&mut a, &mut b, &mut out);
+        let mut remaining = VecDeque::new();
+        Self::wrap(a, &owners, &mut remaining);
+        for chunk in remaining.into_iter().rev() {
+            left.push_front(chunk);
+        }
+        let mut remaining = VecDeque::new();
+        Self::wrap(b, &owners, &mut remaining);
+        for chunk in remaining.into_iter().rev() {
+            right.push_front(chunk);
+        }
+        Self::wrap(out, &owners, output);
+    }
+
+    fn extract(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<T>,
+        residual: &mut Antichain<T>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) {
+        let Some(chunk) = input.pop_front() else {
+            return;
+        };
+        let owners = vec![chunk.manifest];
+        let mut columns = VecDeque::from([chunk.metadata]);
+        let (mut kept, mut shipped) = (VecDeque::new(), VecDeque::new());
+        ColumnChunk::extract(&mut columns, frontier, residual, &mut kept, &mut shipped);
+        assert!(columns.is_empty());
+        Self::wrap(kept, &owners, keep);
+        Self::wrap(shipped, &owners, ship);
+    }
+
+    fn advance(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<T>,
+        done: bool,
+        output: &mut VecDeque<Self>,
+    ) {
+        let mut owners = Vec::new();
+        let mut columns = Self::unwrap(input, &mut owners);
+        let mut out = VecDeque::new();
+        ColumnChunk::advance(&mut columns, frontier, done, &mut out);
+        Self::wrap(columns, &owners, input);
+        Self::wrap(out, &owners, output);
+    }
+
+    fn settle(input: &mut VecDeque<Self>, done: bool, output: &mut VecDeque<Self>) {
+        let mut owners = Vec::new();
+        let mut columns = Self::unwrap(input, &mut owners);
+        let mut out = VecDeque::new();
+        ColumnChunk::settle(&mut columns, done, &mut out);
+        Self::wrap(columns, &owners, input);
+        Self::wrap(out, &owners, output);
+    }
+}
+
+impl<P: PayloadLayout, T: Columnar> Default for PayloadChunk<P, T> {
+    fn default() -> Self {
+        Self {
+            metadata: Default::default(),
+            manifest: Rc::new(Manifest::default()),
+            marker: PhantomData,
+        }
+    }
+}
+
+impl<P: PayloadLayout, T: Columnar> timely::Accountable for PayloadChunk<P, T> {
+    fn record_count(&self) -> i64 {
+        self.metadata.record_count()
+    }
+}
+
+/// Pass already sorted payload chunks to an arrangement without losing owners.
+pub struct PayloadChunker<P: PayloadLayout, T: Columnar> {
+    ready: VecDeque<PayloadChunk<P, T>>,
+    staged: PayloadChunk<P, T>,
+}
+impl<P: PayloadLayout, T: Columnar> Default for PayloadChunker<P, T> {
+    fn default() -> Self {
+        Self {
+            ready: VecDeque::new(),
+            staged: Default::default(),
+        }
+    }
+}
+impl<P: PayloadLayout, T: Columnar> timely::container::PushInto<&mut Vec<PayloadChunk<P, T>>>
+    for PayloadChunker<P, T>
+{
+    fn push_into(&mut self, input: &mut Vec<PayloadChunk<P, T>>) {
+        self.ready.extend(input.drain(..));
+    }
+}
+impl<P: PayloadLayout, T: Columnar> timely::container::ContainerBuilder for PayloadChunker<P, T> {
+    type Container = PayloadChunk<P, T>;
+    fn extract(&mut self) -> Option<&mut Self::Container> {
+        self.staged = self.ready.pop_front()?;
+        Some(&mut self.staged)
+    }
+    fn finish(&mut self) -> Option<&mut Self::Container> {
+        self.extract()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::out_of_core::{PayloadInterner, Store};
+    use timely::container::PushInto;
+
+    struct Layout;
+    impl PayloadLayout for Layout {
+        type Data = (u64, RowHandle);
+        type Diff = i64;
+        fn visit((_, row): columnar::Ref<'_, Self::Data>, _: &i64, rows: &mut Vec<RowHandle>) {
+            rows.push(RowHandle::into_owned(row));
+        }
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn metadata_compaction_cancels_rows_and_releases_payloads_without_reads() {
+        let pool = mz_ore::pool::Pool::new().unwrap();
+        pool.set_budget(0);
+        let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
+        let mut interner = PayloadInterner::new(store.clone());
+        let (ids, owner) = interner.intern(&[vec![1; 96], vec![2; 96]]).await.unwrap();
+        let make = |updates: &[((u64, RowHandle), u64, i64)]| {
+            let mut column = Column::default();
+            for update in updates {
+                column.push_into(update);
+            }
+            PayloadChunk::<Layout, u64>::new(column, &[&owner])
+        };
+        let mut a = VecDeque::from([make(&[((0, ids[0]), 0, 1), ((1, ids[1]), 0, 1)])]);
+        let mut b = VecDeque::from([make(&[((0, ids[0]), 0, -1)])]);
+        drop(owner);
+        let reads = store.stats().read_jobs;
+        let mut output = VecDeque::new();
+        PayloadChunk::merge(&mut a, &mut b, &mut output);
+        output.extend(a);
+        output.extend(b);
+        let mut advanced = VecDeque::new();
+        PayloadChunk::advance(
+            &mut output,
+            Antichain::from_elem(2).borrow(),
+            true,
+            &mut advanced,
+        );
+        assert_eq!(advanced.iter().map(Chunk::len).sum::<usize>(), 1);
+        assert_eq!(
+            pool.stats().live_chunks,
+            1,
+            "canceled row's block must retire"
+        );
+        assert_eq!(
+            store.stats().read_jobs,
+            reads,
+            "metadata rewrites must not fetch payloads"
+        );
+        let chunk = advanced.pop_front().unwrap();
+        let lease = store
+            .prepare_read([(chunk.manifest(), ids[1])])
+            .unwrap()
+            .read()
+            .await;
+        assert_eq!(lease.get(ids[1]).unwrap(), &[2; 96]);
+        drop(lease);
+        drop(chunk);
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+}
+
+/// Copied metadata and the owners needed to keep its external payloads valid.
+pub struct PayloadStaging<U: Columnar> {
+    /// Matching updates, retaining their stored times and differences.
+    pub updates: U::Container,
+    /// Chunk manifests that own the locators in `updates`.
+    pub owners: Vec<Rc<Manifest>>,
+}
+impl<U: Columnar> Default for PayloadStaging<U> {
+    fn default() -> Self {
+        Self {
+            updates: Default::default(),
+            owners: Vec::new(),
+        }
+    }
+}
+
+impl<P, K, V, T> crate::columnar::unload::UnloadChunk for PayloadChunk<P, T>
+where
+    P: PayloadLayout<Data = (K, V)>,
+    K: Columnar,
+    V: Columnar,
+    for<'a> columnar::Ref<'a, K>: Copy + Ord,
+    for<'a> columnar::Ref<'a, V>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
+{
+    type Staging = PayloadStaging<((K, V), T, P::Diff)>;
+    type Probes<'a> =
+        <ColumnChunk<(K, V), T, P::Diff> as crate::columnar::unload::UnloadChunk>::Probes<'a>;
+    fn probe_count(probes: Self::Probes<'_>) -> usize {
+        ColumnChunk::<(K, V), T, P::Diff>::probe_count(probes)
+    }
+    fn locate(&self, probes: Self::Probes<'_>, index: usize) -> std::cmp::Ordering {
+        self.metadata.locate(probes, index)
+    }
+    fn extract_into(
+        &self,
+        probes: Self::Probes<'_>,
+        index: &mut usize,
+        staging: &mut Self::Staging,
+    ) {
+        self.metadata
+            .extract_into(probes, index, &mut staging.updates);
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+    async fn extract_into_async(
+        &self,
+        probes: Self::Probes<'_>,
+        index: &mut usize,
+        staging: &mut Self::Staging,
+    ) {
+        self.metadata
+            .extract_into_async(probes, index, &mut staging.updates)
+            .await;
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+    fn fetch_into(&self, staging: &mut Self::Staging) {
+        self.metadata.fetch_into(&mut staging.updates);
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+}
diff --git a/src/timely-util/src/lib.rs b/src/timely-util/src/lib.rs
index 3e305994360de..aa2b8b4051ca8 100644
--- a/src/timely-util/src/lib.rs
+++ b/src/timely-util/src/lib.rs
@@ -26,6 +26,7 @@ pub mod containers;
 pub mod hash;
 pub mod operator;
 pub mod order;
+pub mod out_of_core;
 pub mod pact;
 pub mod panic;
 pub mod pool_config;
diff --git a/src/timely-util/src/out_of_core.rs b/src/timely-util/src/out_of_core.rs
new file mode 100644
index 0000000000000..703158550e074
--- /dev/null
+++ b/src/timely-util/src/out_of_core.rs
@@ -0,0 +1,34 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Experimental batch primitives separating payload storage from operator metadata.
+//!
+//! Payloads use the pool, while immutable manifests own the blocks referenced by
+//! an index. Reads reserve their whole decoded working set before submission and
+//! retain that reservation through cancellation and consumption. Selection and
+//! equijoin exercise the same ownership and read interfaces with bounded steps.
+//!
+//! Indexes and manifests are resident in this prototype. Builder scratch is
+//! bounded per builder, but is not included in read admission. This is not yet a
+//! globally budgeted operator runtime or a replacement for Differential's trace,
+//! frontier, and compaction machinery. See the out-of-core operator design.
+
+mod batch;
+mod operators;
+mod payload;
+
+pub use batch::{Batch, Record};
+pub use operators::{JoinCursor, JoinMatch, JoinStep, LatestCursor, SelectionStep};
+pub use payload::{
+    Manifest, PayloadBuilder, PayloadInterner, ReadLease, ReadRequest, RowHandle, Store,
+    StoreError, StoreStats,
+};
+
+#[cfg(test)]
+mod tests;
diff --git a/src/timely-util/src/out_of_core/batch.rs b/src/timely-util/src/out_of_core/batch.rs
new file mode 100644
index 0000000000000..fdac553d1d9d1
--- /dev/null
+++ b/src/timely-util/src/out_of_core/batch.rs
@@ -0,0 +1,66 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+use super::{Manifest, RowHandle, StoreError};
+
+/// Operator-defined index fields with an optional payload locator.
+#[derive(Clone, Debug)]
+pub struct Record<K, M> {
+    /// The exact grouping key. Hashes alone require collision resolution upstream.
+    pub key: K,
+    /// Operator-defined metadata, such as source order or `(time, diff)`.
+    pub metadata: M,
+    /// `None` can represent an operator-defined deletion or payload-free record.
+    pub row: Option<RowHandle>,
+}
+
+/// A resident sorted index owning its independently stored payload blocks.
+pub struct Batch<K, M> {
+    records: Vec<Record<K, M>>,
+    payloads: Manifest,
+}
+
+impl<K: Ord, M> Batch<K, M> {
+    /// Sort records by exact key and retain their payloads before releasing `owners`.
+    pub fn new(records: Vec<Record<K, M>>, owners: &[&Manifest]) -> Result<Self, StoreError> {
+        let payloads = Manifest::retain(
+            records.iter().filter_map(|record| record.row),
+            owners.iter().copied(),
+        )?;
+        let mut records = records;
+        records.sort_by(|left, right| left.key.cmp(&right.key));
+        Ok(Self { records, payloads })
+    }
+
+    /// Access the index without fetching payload bytes.
+    pub fn records(&self) -> &[Record<K, M>] {
+        &self.records
+    }
+
+    /// Payload ownership used to prepare reads or construct another batch.
+    pub fn payloads(&self) -> &Manifest {
+        &self.payloads
+    }
+}
+
+impl<K: Ord + Clone, M: Clone> Batch<K, M> {
+    /// Publish a selection with independent ownership and no payload copying.
+    pub fn select(&self, indices: impl IntoIterator<Item = usize>) -> Result<Self, StoreError> {
+        let records = indices
+            .into_iter()
+            .map(|index| {
+                self.records
+                    .get(index)
+                    .cloned()
+                    .ok_or(StoreError::InvalidIndex)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        Self::new(records, &[&self.payloads])
+    }
+}
diff --git a/src/timely-util/src/out_of_core/operators.rs b/src/timely-util/src/out_of_core/operators.rs
new file mode 100644
index 0000000000000..ff0ab8302631a
--- /dev/null
+++ b/src/timely-util/src/out_of_core/operators.rs
@@ -0,0 +1,181 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+use std::cmp::Ordering;
+use std::ops::Range;
+
+use differential_dataflow::difference::Multiply;
+use differential_dataflow::lattice::Lattice;
+
+use super::{Batch, RowHandle};
+
+/// One bounded step of maximum-metadata selection.
+#[derive(Debug, Eq, PartialEq)]
+pub enum SelectionStep {
+    /// Index of the winning record in the source batch.
+    Selected(usize),
+    /// The step exhausted its comparison budget.
+    Yield,
+    /// All keys were processed.
+    Done,
+}
+
+/// Select maximum metadata per exact key without accessing payloads.
+///
+/// Equal metadata keeps the first record. Consumers must ensure ties are
+/// interchangeable or provide an ordering that includes their tie-break rule.
+/// A consumer can group by `(key, time)` to select source order at each time.
+pub struct LatestCursor<'a, K, M> {
+    batch: &'a Batch<K, M>,
+    next: usize,
+    best: Option<usize>,
+}
+
+impl<'a, K: Ord, M: Ord> LatestCursor<'a, K, M> {
+    /// Begin selection over a sorted batch.
+    pub fn new(batch: &'a Batch<K, M>) -> Self {
+        Self {
+            batch,
+            next: 0,
+            best: None,
+        }
+    }
+
+    /// Inspect at most `fuel` records and return at most one winner.
+    pub fn step(&mut self, fuel: usize) -> SelectionStep {
+        let records = self.batch.records();
+        for _ in 0..fuel {
+            let Some(record) = records.get(self.next) else {
+                return self
+                    .best
+                    .take()
+                    .map(SelectionStep::Selected)
+                    .unwrap_or(SelectionStep::Done);
+            };
+            let index = self.next;
+            self.next += 1;
+            match self.best {
+                None => self.best = Some(index),
+                Some(best) if records[best].key != record.key => {
+                    self.best = Some(index);
+                    return SelectionStep::Selected(best);
+                }
+                Some(best) if record.metadata > records[best].metadata => self.best = Some(index),
+                Some(_) => {}
+            }
+        }
+        SelectionStep::Yield
+    }
+}
+
+/// A pair of payload locators with joined time and multiplied difference.
+#[derive(Debug, Eq, PartialEq)]
+pub struct JoinMatch<T, R> {
+    /// Position in the left index, for accessing its exact key and metadata.
+    pub left_index: usize,
+    /// Position in the right index, for accessing its exact key and metadata.
+    pub right_index: usize,
+    /// Left payload, or an operator-defined payload-free value.
+    pub left: Option<RowHandle>,
+    /// Right payload, or an operator-defined payload-free value.
+    pub right: Option<RowHandle>,
+    /// Lattice join of the input timestamps.
+    pub time: T,
+    /// Product of the input differences.
+    pub diff: R,
+}
+
+/// One bounded equijoin step, allowing output backpressure between matches.
+#[derive(Debug, Eq, PartialEq)]
+pub enum JoinStep<T, R> {
+    /// A match whose payloads can be requested together.
+    Match(JoinMatch<T, R>),
+    /// The step exhausted its key-comparison budget.
+    Yield,
+    /// Both inputs have no further matching keys.
+    Done,
+}
+
+/// Equijoin two immutable batches, retaining constant cursor state for large groups.
+///
+/// This is a batch cross product, not an incremental trace-join driver. The
+/// caller is responsible for scheduling each batch pair once and holding time
+/// capabilities until its matches are published. Input differences need not be
+/// positive, and output is not consolidated.
+pub struct JoinCursor<'a, K, T, R0, R1> {
+    left: &'a Batch<K, (T, R0)>,
+    right: &'a Batch<K, (T, R1)>,
+    left_next: usize,
+    right_next: usize,
+    group: Option<(Range<usize>, Range<usize>)>,
+    pair: (usize, usize),
+}
+
+impl<'a, K: Ord, T: Lattice + Clone, R0: Multiply<R1> + Clone, R1> JoinCursor<'a, K, T, R0, R1> {
+    /// Start matching exact keys in two sorted batches.
+    pub fn new(left: &'a Batch<K, (T, R0)>, right: &'a Batch<K, (T, R1)>) -> Self {
+        Self {
+            left,
+            right,
+            left_next: 0,
+            right_next: 0,
+            group: None,
+            pair: (0, 0),
+        }
+    }
+
+    /// Compare at most `fuel` key pairs or emit one match from the active group.
+    ///
+    /// Locating a group's end uses a binary search over resident index keys.
+    pub fn step(&mut self, fuel: usize) -> JoinStep<T, R0::Output> {
+        let left = self.left.records();
+        let right = self.right.records();
+        for _ in 0..fuel {
+            if let Some((left_group, right_group)) = &self.group {
+                let l = &left[self.pair.0];
+                let r = &right[self.pair.1];
+                let matched = JoinMatch {
+                    left_index: self.pair.0,
+                    right_index: self.pair.1,
+                    left: l.row,
+                    right: r.row,
+                    time: l.metadata.0.join(&r.metadata.0),
+                    diff: l.metadata.1.clone().multiply(&r.metadata.1),
+                };
+                self.pair.1 += 1;
+                if self.pair.1 == right_group.end {
+                    self.pair.1 = right_group.start;
+                    self.pair.0 += 1;
+                    if self.pair.0 == left_group.end {
+                        self.group = None;
+                    }
+                }
+                return JoinStep::Match(matched);
+            }
+            let (Some(l), Some(r)) = (left.get(self.left_next), right.get(self.right_next)) else {
+                return JoinStep::Done;
+            };
+            match l.key.cmp(&r.key) {
+                Ordering::Less => self.left_next += 1,
+                Ordering::Greater => self.right_next += 1,
+                Ordering::Equal => {
+                    let left_end = self.left_next
+                        + left[self.left_next..].partition_point(|record| record.key == l.key);
+                    let right_end = self.right_next
+                        + right[self.right_next..].partition_point(|record| record.key == r.key);
+                    self.pair = (self.left_next, self.right_next);
+                    self.group = Some((self.left_next..left_end, self.right_next..right_end));
+                    self.left_next = left_end;
+                    self.right_next = right_end;
+                }
+            }
+        }
+        JoinStep::Yield
+    }
+}
diff --git a/src/timely-util/src/out_of_core/payload.rs b/src/timely-util/src/out_of_core/payload.rs
new file mode 100644
index 0000000000000..51490a08e09cd
--- /dev/null
+++ b/src/timely-util/src/out_of_core/payload.rs
@@ -0,0 +1,568 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+use std::collections::BTreeMap;
+use std::fmt;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use mz_ore::cast::CastFrom;
+use mz_ore::pool::{ChunkHandle, ChunkHints, ExtentCodec, Pool};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+// Block identities are process-local and never reused, including across stores.
+static NEXT_BLOCK: AtomicU64 = AtomicU64::new(0);
+
+/// A non-owning row locator, valid only through a manifest or read lease.
+#[derive(
+    Clone,
+    Copy,
+    Debug,
+    Default,
+    Eq,
+    PartialEq,
+    Ord,
+    PartialOrd,
+    Hash,
+    columnar::Columnar
+)]
+#[columnar(derive(PartialEq, Eq, PartialOrd, Ord))]
+pub struct RowHandle {
+    block: u64,
+    offset: u32,
+}
+
+/// Invalid configuration, unresolved ownership, or an oversized working set.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum StoreError {
+    /// Block sizes must be word-aligned and between 16 bytes and 8 MiB.
+    BlockSize,
+    /// Admission must accommodate a full block and at least one read job.
+    ReadBudget,
+    /// One row, including its length prefix, exceeds the block size.
+    RowTooLarge,
+    /// The complete read set exceeds decoded-byte admission.
+    ReadTooLarge,
+    /// None of the supplied owners resolves this row.
+    UnownedRow,
+    /// A selected index is outside its batch.
+    InvalidIndex,
+}
+
+impl fmt::Display for StoreError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "payload store: {self:?}")
+    }
+}
+
+impl std::error::Error for StoreError {}
+
+struct Block {
+    handle: ChunkHandle,
+    words: usize,
+}
+
+/// An immutable collection of payload block owners.
+#[derive(Clone, Default)]
+pub struct Manifest {
+    blocks: BTreeMap<u64, Arc<Block>>,
+}
+
+impl Manifest {
+    /// Retain exactly the blocks needed by `rows`, before their previous owners retire.
+    pub fn retain<'a>(
+        rows: impl IntoIterator<Item = RowHandle>,
+        owners: impl IntoIterator<Item = &'a Manifest>,
+    ) -> Result<Self, StoreError> {
+        let owners: BTreeMap<_, _> = owners
+            .into_iter()
+            .flat_map(|owner| owner.blocks.iter().map(|(id, block)| (*id, block)))
+            .collect();
+        let mut result = Self::default();
+        for row in rows {
+            let block = owners.get(&row.block).ok_or(StoreError::UnownedRow)?;
+            result
+                .blocks
+                .entry(row.block)
+                .or_insert_with(|| Arc::clone(block));
+        }
+        Ok(result)
+    }
+
+    /// Number of owned blocks, including blocks retained by only one live row.
+    pub fn block_count(&self) -> usize {
+        self.blocks.len()
+    }
+}
+
+struct Admission {
+    bytes: Arc<Semaphore>,
+    jobs: Arc<Semaphore>,
+    limit: u32,
+    peak: AtomicU64,
+    decoded: AtomicU64,
+    reads: AtomicU64,
+}
+
+/// Shared payload allocation and read admission for several consumers.
+#[derive(Clone)]
+pub struct Store {
+    pool: Pool,
+    block_words: usize,
+    codec: &'static dyn ExtentCodec,
+    admission: Arc<Admission>,
+}
+
+/// Read counters, including reservations retained by completed or canceled work.
+#[derive(Debug)]
+pub struct StoreStats {
+    /// Bytes reserved by pending jobs and live leases.
+    pub charged_bytes: usize,
+    /// Largest observed decoded-byte reservation total.
+    pub peak_charged_bytes: u64,
+    /// Bytes copied out of the pool, counting repeated reads.
+    pub decoded_bytes: u64,
+    /// Submitted blocking jobs.
+    pub read_jobs: u64,
+}
+
+impl Store {
+    /// Create a store over an independently configured pool.
+    ///
+    /// Read admission charges decoded buffer lengths. Metadata and builder
+    /// scratch remain outside this prototype's shared byte budget.
+    pub fn new(
+        pool: Pool,
+        block_bytes: usize,
+        read_bytes: usize,
+        read_jobs: usize,
+        codec: &'static dyn ExtentCodec,
+    ) -> Result<Self, StoreError> {
+        if !(16..=8 << 20).contains(&block_bytes) || block_bytes % 8 != 0 {
+            return Err(StoreError::BlockSize);
+        }
+        if read_bytes < block_bytes
+            || read_bytes > usize::cast_from(u32::MAX)
+            || read_bytes > Semaphore::MAX_PERMITS
+            || read_jobs == 0
+            || read_jobs > Semaphore::MAX_PERMITS
+        {
+            return Err(StoreError::ReadBudget);
+        }
+        Ok(Self {
+            pool,
+            block_words: block_bytes / 8,
+            codec,
+            admission: Arc::new(Admission {
+                bytes: Arc::new(Semaphore::new(read_bytes)),
+                jobs: Arc::new(Semaphore::new(read_jobs)),
+                limit: u32::try_from(read_bytes).expect("validated read budget"),
+                peak: AtomicU64::new(0),
+                decoded: AtomicU64::new(0),
+                reads: AtomicU64::new(0),
+            }),
+        })
+    }
+
+    /// Start a builder with at most one block of word staging.
+    pub fn builder(&self) -> PayloadBuilder {
+        PayloadBuilder {
+            store: self.clone(),
+            manifest: Manifest::default(),
+            block: None,
+            words: Vec::with_capacity(self.block_words),
+        }
+    }
+
+    /// Resolve and own all blocks for one execution step before it can suspend.
+    ///
+    /// Repeated references to a block are coalesced. Callers must release prior
+    /// leases before requesting another complete step, or reserve the combined
+    /// working set here. Splitting a step's acquisition can deadlock on admission.
+    pub fn prepare_read<'a>(
+        &self,
+        rows: impl IntoIterator<Item = (&'a Manifest, RowHandle)>,
+    ) -> Result<ReadRequest, StoreError> {
+        let mut blocks = BTreeMap::new();
+        let mut bytes = 0usize;
+        for (manifest, row) in rows {
+            let block = manifest
+                .blocks
+                .get(&row.block)
+                .ok_or(StoreError::UnownedRow)?;
+            if let std::collections::btree_map::Entry::Vacant(entry) = blocks.entry(row.block) {
+                bytes = bytes
+                    .checked_add(block.words * 8)
+                    .ok_or(StoreError::ReadTooLarge)?;
+                if bytes > usize::cast_from(self.admission.limit) {
+                    return Err(StoreError::ReadTooLarge);
+                }
+                entry.insert(Arc::clone(block));
+            }
+        }
+        Ok(ReadRequest {
+            blocks,
+            bytes: u32::try_from(bytes).expect("checked read size"),
+            admission: Arc::clone(&self.admission),
+        })
+    }
+
+    /// Snapshot the shared read ledger.
+    pub fn stats(&self) -> StoreStats {
+        StoreStats {
+            charged_bytes: usize::cast_from(self.admission.limit)
+                - self.admission.bytes.available_permits(),
+            peak_charged_bytes: self.admission.peak.load(Ordering::Relaxed),
+            decoded_bytes: self.admission.decoded.load(Ordering::Relaxed),
+            read_jobs: self.admission.reads.load(Ordering::Relaxed),
+        }
+    }
+}
+
+/// Bounded word staging plus ownership of its completed payload blocks.
+pub struct PayloadBuilder {
+    store: Store,
+    manifest: Manifest,
+    block: Option<u64>,
+    words: Vec<u64>,
+}
+
+impl PayloadBuilder {
+    /// Append a row, returning a locator owned by this builder until `finish`.
+    ///
+    /// An oversized row is rejected without modifying the builder.
+    pub fn push(&mut self, row: &[u8]) -> Result<RowHandle, StoreError> {
+        let words = 1 + row.len().div_ceil(8);
+        if words > self.store.block_words {
+            return Err(StoreError::RowTooLarge);
+        }
+        if self.words.len() + words > self.store.block_words {
+            self.flush();
+        }
+        let block = *self.block.get_or_insert_with(|| {
+            NEXT_BLOCK
+                .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |id| id.checked_add(1))
+                .expect("block identity space exhausted")
+        });
+        let offset = self.words.len();
+        self.words
+            .push(u64::try_from(row.len()).expect("row fits block"));
+        self.words.resize(offset + words, 0);
+        bytemuck::cast_slice_mut::<u64, u8>(&mut self.words[offset + 1..])[..row.len()]
+            .copy_from_slice(row);
+        Ok(RowHandle {
+            block,
+            offset: u32::try_from(offset).expect("offset fits block"),
+        })
+    }
+
+    fn flush(&mut self) {
+        if let Some(id) = self.block.take() {
+            let handle = self.store.pool.insert_with(
+                self.words.len(),
+                ChunkHints::default(),
+                self.store.codec,
+                |destination| destination.copy_from_slice(&self.words),
+            );
+            self.manifest.blocks.insert(
+                id,
+                Arc::new(Block {
+                    handle,
+                    words: self.words.len(),
+                }),
+            );
+            self.words.clear();
+        }
+    }
+
+    /// Publish ownership of all appended rows.
+    pub fn finish(mut self) -> Manifest {
+        self.flush();
+        self.manifest
+    }
+}
+
+/// An owned read set that is safe to retain after input batches are dropped.
+pub struct ReadRequest {
+    blocks: BTreeMap<u64, Arc<Block>>,
+    bytes: u32,
+    admission: Arc<Admission>,
+}
+
+impl ReadRequest {
+    /// Reserve the full working set and read it on a blocking executor.
+    ///
+    /// Requires a Tokio runtime. Cancellation after submission retains both
+    /// byte and job admission until the blocking work actually finishes.
+    pub async fn read(self) -> ReadLease {
+        let bytes = Arc::clone(&self.admission.bytes)
+            .acquire_many_owned(self.bytes)
+            .await
+            .expect("read admission remains open");
+        let charged =
+            usize::cast_from(self.admission.limit) - self.admission.bytes.available_permits();
+        self.admission.peak.fetch_max(
+            u64::try_from(charged).expect("budget fits u64"),
+            Ordering::Relaxed,
+        );
+        let job = Arc::clone(&self.admission.jobs)
+            .acquire_owned()
+            .await
+            .expect("job admission remains open");
+        self.admission.reads.fetch_add(1, Ordering::Relaxed);
+        mz_ore::task::spawn_blocking(
+            || "payload_read",
+            move || {
+                // Both permits travel with the work, not the cancelable waiter.
+                let _job = job;
+                let mut decoded = BTreeMap::new();
+                for (id, owner) in self.blocks {
+                    let mut words = vec![0; owner.words];
+                    owner.handle.read_into(&mut words);
+                    self.admission.decoded.fetch_add(
+                        u64::try_from(words.len() * 8).expect("block size fits u64"),
+                        Ordering::Relaxed,
+                    );
+                    decoded.insert(
+                        id,
+                        DecodedBlock {
+                            _owner: owner,
+                            words,
+                        },
+                    );
+                }
+                ReadLease {
+                    blocks: decoded,
+                    _bytes: bytes,
+                }
+            },
+        )
+        .await
+    }
+}
+
+struct DecodedBlock {
+    _owner: Arc<Block>,
+    words: Vec<u64>,
+}
+
+/// Owned decoded blocks and the byte reservation backing their borrowed rows.
+pub struct ReadLease {
+    blocks: BTreeMap<u64, DecodedBlock>,
+    _bytes: OwnedSemaphorePermit,
+}
+
+impl ReadLease {
+    /// Borrow a row from a block covered by this lease.
+    pub fn get(&self, row: RowHandle) -> Result<&[u8], StoreError> {
+        let block = self.blocks.get(&row.block).ok_or(StoreError::UnownedRow)?;
+        let offset = usize::cast_from(row.offset);
+        let len = usize::try_from(*block.words.get(offset).ok_or(StoreError::UnownedRow)?)
+            .map_err(|_| StoreError::UnownedRow)?;
+        bytemuck::cast_slice::<u64, u8>(&block.words[offset + 1..])
+            .get(..len)
+            .ok_or(StoreError::UnownedRow)
+    }
+}
+
+/// Operator-local exact payload identities, with weak ownership of stored blocks.
+///
+/// Fingerprints select candidates only. Reuse requires byte equality. Dead entries
+/// are swept incrementally, and the index itself remains resident.
+pub struct PayloadInterner {
+    store: Store,
+    entries: BTreeMap<(u64, RowHandle), std::sync::Weak<Block>>,
+    sweep_after: Option<(u64, RowHandle)>,
+}
+
+impl PayloadInterner {
+    /// Create an independent identity domain over a shared payload store.
+    pub fn new(store: Store) -> Self {
+        Self {
+            store,
+            entries: BTreeMap::new(),
+            sweep_after: None,
+        }
+    }
+
+    /// Store a batch, reusing the identity of any live, byte-identical payload.
+    pub async fn intern(
+        &mut self,
+        rows: &[Vec<u8>],
+    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
+        use std::hash::{Hash, Hasher};
+        self.intern_hashed(rows, |row| {
+            let mut hasher = std::collections::hash_map::DefaultHasher::new();
+            row.hash(&mut hasher);
+            hasher.finish()
+        })
+        .await
+    }
+
+    async fn intern_hashed(
+        &mut self,
+        rows: &[Vec<u8>],
+        hash: impl Fn(&[u8]) -> u64,
+    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
+        use std::ops::Bound::{Excluded, Unbounded};
+        // Sweep work grows with arrivals so wide batches cannot outrun reclamation.
+        let sweep_budget = rows.len().saturating_mul(4).max(1024);
+        let keys: Vec<_> = self
+            .entries
+            .range((self.sweep_after.map_or(Unbounded, Excluded), Unbounded))
+            .take(sweep_budget)
+            .map(|(key, _)| *key)
+            .collect();
+        self.sweep_after = if keys.last() == self.entries.last_key_value().map(|(key, _)| key) {
+            None
+        } else {
+            keys.last().copied()
+        };
+        for key in keys {
+            if self.entries[&key].strong_count() == 0 {
+                self.entries.remove(&key);
+            }
+        }
+        let mut builder = self.store.builder();
+        let mut result = Vec::with_capacity(rows.len());
+        let mut owners = Manifest::default();
+        let mut fresh: BTreeMap<u64, Vec<usize>> = BTreeMap::new();
+        let mut cached: Option<ReadLease> = None;
+        for (index, bytes) in rows.iter().enumerate() {
+            let fingerprint = hash(bytes);
+            if let Some(prior) = fresh
+                .get(&fingerprint)
+                .and_then(|indices| indices.iter().find(|i| rows[**i] == *bytes))
+            {
+                result.push(result[*prior]);
+                continue;
+            }
+            let mut found = None;
+            let lower = (
+                fingerprint,
+                RowHandle {
+                    block: 0,
+                    offset: 0,
+                },
+            );
+            let upper = (
+                fingerprint,
+                RowHandle {
+                    block: u64::MAX,
+                    offset: u32::MAX,
+                },
+            );
+            for ((_, row), owner) in self.entries.range(lower..=upper) {
+                let Some(owner) = owner.upgrade() else {
+                    continue;
+                };
+                if cached.as_ref().is_none_or(|lease| lease.get(*row).is_err()) {
+                    // Release the previous reservation before awaiting another block.
+                    drop(cached.take());
+                    let manifest = Manifest {
+                        blocks: BTreeMap::from([(row.block, Arc::clone(&owner))]),
+                    };
+                    cached = Some(self.store.prepare_read([(&manifest, *row)])?.read().await);
+                }
+                if cached.as_ref().expect("loaded candidate").get(*row)? == bytes {
+                    owners.blocks.insert(row.block, owner);
+                    found = Some(*row);
+                    break;
+                }
+            }
+            if let Some(row) = found {
+                result.push(row);
+            } else {
+                result.push(builder.push(bytes)?);
+                fresh.entry(fingerprint).or_default().push(index);
+            }
+        }
+        let fresh_owners = builder.finish();
+        for (hash, indices) in fresh {
+            for index in indices {
+                let row = result[index];
+                let owner = fresh_owners
+                    .blocks
+                    .get(&row.block)
+                    .expect("published payload");
+                self.entries.insert((hash, row), Arc::downgrade(owner));
+            }
+        }
+        owners.blocks.extend(fresh_owners.blocks);
+        Ok((result, owners))
+    }
+}
+
+#[cfg(test)]
+mod interner_tests {
+    use super::*;
+
+    #[mz_ore::test(tokio::test)]
+    async fn exact_identity_handles_collisions_and_weak_ownership() {
+        let pool = mz_ore::pool::Pool::new().unwrap();
+        pool.set_budget(0);
+        pool.set_rss_target(1 << 20);
+        let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
+        let mut interner = PayloadInterner::new(store.clone());
+        let bytes = vec![b"first".to_vec(), b"second".to_vec(), b"first".to_vec()];
+        let (ids, owner) = interner.intern_hashed(&bytes, |_| 0).await.unwrap();
+        assert_eq!(ids[0], ids[2]);
+        assert_ne!(ids[0], ids[1]);
+        let (again, next_owner) = interner
+            .intern_hashed(&[bytes[1].clone(), bytes[0].clone()], |_| 0)
+            .await
+            .unwrap();
+        assert_eq!(again, vec![ids[1], ids[0]]);
+        drop(owner);
+        let lease = store
+            .prepare_read([(&next_owner, again[0]), (&next_owner, again[1])])
+            .unwrap()
+            .read()
+            .await;
+        assert_eq!(lease.get(again[0]).unwrap(), b"second");
+        assert_eq!(lease.get(again[1]).unwrap(), b"first");
+        drop(lease);
+        drop(next_owner);
+        assert_eq!(
+            pool.stats().live_chunks,
+            0,
+            "the equality index must not own blocks"
+        );
+        let (replacement, owner) = interner.intern_hashed(&bytes, |_| 0).await.unwrap();
+        assert_ne!(replacement[0], ids[0]);
+        assert_eq!(replacement[0], replacement[2]);
+        drop(owner);
+        assert_eq!(store.stats().charged_bytes, 0);
+    }
+    #[mz_ore::test(tokio::test)]
+    async fn equality_index_reclaims_dead_entries_during_large_batches() {
+        let pool = mz_ore::pool::Pool::new().unwrap();
+        let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
+        let mut interner = PayloadInterner::new(store);
+        for epoch in 0..12u64 {
+            let rows: Vec<_> = (0..2048)
+                .map(|i| (epoch * 2048 + i).to_le_bytes().to_vec())
+                .collect();
+            let (_, owner) = interner
+                .intern_hashed(&rows, |row| u64::from_le_bytes(row.try_into().unwrap()))
+                .await
+                .unwrap();
+            assert!(
+                interner.entries.len() <= 4096,
+                "dead identities must not accumulate with each batch"
+            );
+            drop(owner);
+        }
+        for _ in 0..4 {
+            interner.intern(&[]).await.unwrap();
+        }
+        assert!(interner.entries.is_empty());
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+}
diff --git a/src/timely-util/src/out_of_core/tests.rs b/src/timely-util/src/out_of_core/tests.rs
new file mode 100644
index 0000000000000..9065cd46cca16
--- /dev/null
+++ b/src/timely-util/src/out_of_core/tests.rs
@@ -0,0 +1,515 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+use std::collections::BTreeMap;
+use std::sync::{Mutex, mpsc};
+use std::time::Duration;
+
+use differential_dataflow::lattice::Lattice;
+use mz_ore::pool::{ExtentCodec, Pool};
+use proptest::prelude::*;
+use timely::order::Product;
+
+use super::*;
+use crate::columnar::chunk::LZ4_CODEC;
+
+fn store(block: usize) -> (Pool, Store) {
+    let pool = Pool::new().unwrap();
+    pool.set_budget(0);
+    // Tests exercise compressed extents, without relying on host swap support.
+    pool.set_rss_target(1 << 20);
+    let store = Store::new(pool.clone(), block, block * 2, 2, &LZ4_CODEC).unwrap();
+    (pool, store)
+}
+
+fn batch<K: Ord, M>(
+    store: &Store,
+    records: impl IntoIterator<Item = (K, M, Option<Vec<u8>>)>,
+) -> Batch<K, M> {
+    let mut builder = store.builder();
+    let records = records
+        .into_iter()
+        .map(|(key, metadata, row)| Record {
+            key,
+            metadata,
+            row: row.map(|row| builder.push(&row).unwrap()),
+        })
+        .collect();
+    Batch::new(records, &[&builder.finish()]).unwrap()
+}
+
+#[mz_ore::test(tokio::test)]
+async fn selection_reuses_blocks_after_input_drop() {
+    let (pool, store) = store(128);
+    let mut input = batch(
+        &store,
+        (0..50).flat_map(|key| {
+            (0..4).map(move |order| {
+                (
+                    (key, 7u64),
+                    order,
+                    (order != 3 || key % 2 == 0).then(|| vec![u8::try_from(key).unwrap(), order]),
+                )
+            })
+        }),
+    );
+    let inserted = pool.stats().inserts;
+    assert_eq!(pool.stats().resident_bytes, 0);
+    for _ in 0..8 {
+        let mut cursor = LatestCursor::new(&input);
+        let mut selected = Vec::new();
+        loop {
+            match cursor.step(1) {
+                SelectionStep::Selected(index) => selected.push(index),
+                SelectionStep::Yield => {}
+                SelectionStep::Done => break,
+            }
+        }
+        input = input.select(selected).unwrap();
+    }
+    assert_eq!(input.records().len(), 50);
+    assert_eq!(
+        pool.stats().inserts,
+        inserted,
+        "metadata rebuilds must not rewrite payloads"
+    );
+    assert_eq!(
+        store.stats().decoded_bytes,
+        0,
+        "selection must not inspect payloads"
+    );
+    let record = &input.records()[0];
+    let row = record.row.unwrap();
+    let request = store.prepare_read([(input.payloads(), row)]).unwrap();
+    drop(input);
+    assert!(
+        pool.stats().live_chunks > 0,
+        "prepared reads retain ownership"
+    );
+    let lease = request.read().await;
+    assert_eq!(lease.get(row).unwrap(), &[0, 3]);
+    assert!(store.stats().charged_bytes > 0);
+    drop(lease);
+    assert_eq!(store.stats().charged_bytes, 0);
+    assert_eq!(pool.stats().live_chunks, 0);
+}
+
+#[mz_ore::test(tokio::test)]
+async fn bulk_reads_coalesce_blocks_and_preserve_equal_rows_at_distinct_handles() {
+    let (pool, store) = store(64);
+    let mut builder = store.builder();
+    let empty = builder.push(b"").unwrap();
+    let first = builder.push(b"same row").unwrap();
+    let second = builder.push(b"same row").unwrap();
+    let other = builder.push(b"other").unwrap();
+    let manifest = builder.finish();
+    assert_ne!(first, second);
+    let lease = store
+        .prepare_read([empty, first, second, other, first].map(|r| (&manifest, r)))
+        .unwrap()
+        .read()
+        .await;
+    assert_eq!(manifest.block_count(), 1);
+    assert_eq!(store.stats().decoded_bytes, 56);
+    assert_eq!(lease.get(first).unwrap(), lease.get(second).unwrap());
+    assert_ne!(lease.get(first).unwrap(), lease.get(other).unwrap());
+    assert_eq!(lease.get(empty).unwrap(), b"");
+    drop(manifest);
+    assert_eq!(pool.stats().live_chunks, 1);
+    drop(lease);
+    assert_eq!(pool.stats().live_chunks, 0);
+}
+
+#[mz_ore::test(tokio::test)]
+async fn oversized_rows_and_read_sets_fail_without_consuming_admission() {
+    let (_, store) = store(64);
+    let mut builder = store.builder();
+    assert_eq!(builder.push(&[0; 57]), Err(StoreError::RowTooLarge));
+    let rows: Vec<_> = (0..3)
+        .map(|value| builder.push(&[value; 56]).unwrap())
+        .collect();
+    let manifest = builder.finish();
+    assert_eq!(manifest.block_count(), 3);
+    assert!(matches!(
+        store.prepare_read(rows.iter().map(|r| (&manifest, *r))),
+        Err(StoreError::ReadTooLarge)
+    ));
+    assert_eq!(store.stats().charged_bytes, 0);
+    let lease = store
+        .prepare_read([(&manifest, rows[0]), (&manifest, rows[1])])
+        .unwrap()
+        .read()
+        .await;
+    assert_eq!(store.stats().charged_bytes, 128);
+    assert_eq!(lease.get(rows[1]).unwrap(), &[1; 56]);
+}
+
+#[mz_ore::test]
+fn independent_stores_do_not_alias_handles() {
+    let (_, a) = store(64);
+    let (_, b) = store(64);
+    let mut a_builder = a.builder();
+    let a_row = a_builder.push(b"a").unwrap();
+    let a_manifest = a_builder.finish();
+    let mut b_builder = b.builder();
+    let b_row = b_builder.push(b"b").unwrap();
+    let b_manifest = b_builder.finish();
+    assert_ne!(a_row, b_row);
+    assert!(matches!(
+        a.prepare_read([(&b_manifest, a_row)]),
+        Err(StoreError::UnownedRow)
+    ));
+    assert!(matches!(
+        Manifest::retain([b_row], [&a_manifest]),
+        Err(StoreError::UnownedRow)
+    ));
+}
+
+#[mz_ore::test(tokio::test)]
+async fn canceled_admission_does_not_leak_a_reservation() {
+    let (_, store) = store(64);
+    let mut builder = store.builder();
+    let a = builder.push(&[0; 56]).unwrap();
+    let b = builder.push(&[1; 56]).unwrap();
+    let manifest = builder.finish();
+    let first = store
+        .prepare_read([(&manifest, a), (&manifest, b)])
+        .unwrap()
+        .read()
+        .await;
+    let mut second = Box::pin(
+        store
+            .prepare_read([(&manifest, a), (&manifest, b)])
+            .unwrap()
+            .read(),
+    );
+    assert!(futures_util::poll!(&mut second).is_pending());
+    assert_eq!(store.stats().charged_bytes, 128);
+    drop(second);
+    drop(first);
+    let third = store
+        .prepare_read([(&manifest, a), (&manifest, b)])
+        .unwrap()
+        .read();
+    let third = tokio::time::timeout(Duration::from_secs(10), third)
+        .await
+        .unwrap();
+    assert!(store.stats().peak_charged_bytes <= 128);
+    drop(third);
+    assert_eq!(store.stats().charged_bytes, 0);
+}
+
+#[derive(Debug)]
+struct GateCodec {
+    entered: Mutex<Option<tokio::sync::oneshot::Sender<()>>>,
+    release: Mutex<mpsc::Receiver<()>>,
+}
+
+impl ExtentCodec for GateCodec {
+    fn encode(&self, body: &[u8], out: &mut Vec<u8>) {
+        out.clear();
+        out.extend_from_slice(body);
+    }
+
+    fn decode(&self, stored: &[u8], body: &mut [u8]) {
+        let entered = self.entered.lock().unwrap().take();
+        if let Some(entered) = entered {
+            let _ = entered.send(());
+            self.release
+                .lock()
+                .unwrap()
+                .recv_timeout(Duration::from_secs(10))
+                .unwrap();
+        }
+        body.copy_from_slice(stored);
+    }
+}
+
+#[mz_ore::test(tokio::test)]
+async fn canceled_decode_owns_its_bytes_and_blocks_until_completion() {
+    let pool = Pool::new().unwrap();
+    pool.set_budget(0);
+    pool.set_rss_target(1 << 20);
+    let (entered, started) = tokio::sync::oneshot::channel();
+    let (release, released) = mpsc::channel();
+    let codec = Box::leak(Box::new(GateCodec {
+        entered: Mutex::new(Some(entered)),
+        release: Mutex::new(released),
+    }));
+    let store = Store::new(pool.clone(), 64, 128, 1, codec).unwrap();
+    let mut builder = store.builder();
+    let row = builder.push(&[7; 56]).unwrap();
+    let manifest = builder.finish();
+    let read = store.prepare_read([(&manifest, row)]).unwrap();
+    let task = mz_ore::task::spawn(|| "canceled_payload_read", read.read());
+    tokio::time::timeout(Duration::from_secs(10), started)
+        .await
+        .unwrap()
+        .unwrap();
+    task.abort_and_wait().await;
+    drop(manifest);
+    assert_eq!(
+        store.stats().charged_bytes,
+        64,
+        "cancellation cannot admit replacement bytes during decode"
+    );
+    assert_eq!(pool.stats().live_chunks, 1);
+    release.send(()).unwrap();
+    tokio::time::timeout(Duration::from_secs(10), async {
+        while store.stats().charged_bytes != 0 || pool.stats().live_chunks != 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+
+#[mz_ore::test(tokio::test)]
+async fn join_streams_a_group_larger_than_the_read_budget() {
+    let (_, store) = store(64);
+    let left = batch(
+        &store,
+        (0..20).map(|i| {
+            (
+                "shared",
+                (Product::new(1u64, 4u64), -2i64),
+                Some(vec![i; 56]),
+            )
+        }),
+    );
+    let right = batch(
+        &store,
+        (0..17).map(|i| {
+            (
+                "shared",
+                (Product::new(3u64, 2u64), 3i64),
+                Some(vec![i; 56]),
+            )
+        }),
+    );
+    let mut cursor = JoinCursor::new(&left, &right);
+    let mut matches = 0;
+    let mut yields = 0;
+    loop {
+        match cursor.step(1) {
+            JoinStep::Match(m) => {
+                assert_eq!(m.time, Product::new(3, 4));
+                assert_eq!(m.diff, -6);
+                let l = m.left.unwrap();
+                let r = m.right.unwrap();
+                let lease = store
+                    .prepare_read([(left.payloads(), l), (right.payloads(), r)])
+                    .unwrap()
+                    .read()
+                    .await;
+                assert_eq!(
+                    lease.get(l).unwrap(),
+                    &[u8::try_from(matches / 17).unwrap(); 56]
+                );
+                assert_eq!(
+                    lease.get(r).unwrap(),
+                    &[u8::try_from(matches % 17).unwrap(); 56]
+                );
+                matches += 1;
+            }
+            JoinStep::Yield => yields += 1,
+            JoinStep::Done => break,
+        }
+    }
+    assert_eq!(matches, 20 * 17);
+    assert_eq!(store.stats().read_jobs, 340);
+    assert_eq!(store.stats().decoded_bytes, 340 * 128);
+    assert!(yields > 0);
+    assert_eq!(store.stats().peak_charged_bytes, 128);
+    assert_eq!(store.stats().charged_bytes, 0);
+}
+
+#[mz_ore::test]
+fn unmatched_keys_yield_and_zero_fuel_does_no_work() {
+    let left = Batch::new(
+        (0..100)
+            .map(|key| Record {
+                key,
+                metadata: (0u64, 1i64),
+                row: None,
+            })
+            .collect(),
+        &[],
+    )
+    .unwrap();
+    let right = Batch::new(
+        vec![Record {
+            key: 100,
+            metadata: (0u64, 1i64),
+            row: None,
+        }],
+        &[],
+    )
+    .unwrap();
+    let mut cursor = JoinCursor::new(&left, &right);
+    assert_eq!(cursor.step(0), JoinStep::Yield);
+    for _ in 0..100 {
+        assert_eq!(cursor.step(1), JoinStep::Yield);
+    }
+    assert_eq!(cursor.step(1), JoinStep::Done);
+    let mut latest = LatestCursor::new(&left);
+    assert_eq!(latest.step(0), SelectionStep::Yield);
+    assert_eq!(latest.step(2), SelectionStep::Selected(0));
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(80))]
+
+    #[mz_ore::test]
+    fn join_matches_reference_with_partial_times_and_retractions(
+        left in prop::collection::vec((0u8..8, 0u64..5, 0u64..5, -3i64..4), 0..35),
+        right in prop::collection::vec((0u8..8, 0u64..5, 0u64..5, -3i64..4), 0..35),
+        fuel in 1usize..9,
+    ) {
+        let make = |rows: &[(u8,u64,u64,i64)]| Batch::new(rows.iter().map(|&(key,x,y,diff)| Record {
+            key: format!("key-{key}"), metadata: (Product::new(x,y), diff), row: None,
+        }).collect(), &[]).unwrap();
+        let l = make(&left);
+        let r = make(&right);
+        let mut expected = BTreeMap::new();
+        for &(lk,lx,ly,ld) in &left {
+            for &(rk,rx,ry,rd) in &right {
+                if lk == rk {
+                    let time = Product::new(lx, ly).join(&Product::new(rx, ry));
+                    *expected.entry((format!("key-{lk}"), time)).or_insert(0) += ld * rd;
+                }
+            }
+        }
+        let mut actual = BTreeMap::new();
+        let mut cursor = JoinCursor::new(&l, &r);
+        loop {
+            match cursor.step(fuel) {
+                JoinStep::Match(m) => {
+                    let key = l.records()[m.left_index].key.clone();
+                    prop_assert_eq!(&key, &r.records()[m.right_index].key);
+                    *actual.entry((key, m.time)).or_insert(0) += m.diff;
+                },
+                JoinStep::Yield => {},
+                JoinStep::Done => break,
+            }
+        }
+        expected.retain(|_,d| *d != 0);
+        actual.retain(|_,d| *d != 0);
+        prop_assert_eq!(actual, expected);
+    }
+
+    #[mz_ore::test]
+    fn latest_matches_reference_across_yields(
+        updates in prop::collection::vec((0u8..20, 0u64..100), 0..200),
+        fuel in 1usize..12,
+    ) {
+        let records = updates.iter().map(|&(key, metadata)| Record {
+            key, metadata, row: None,
+        }).collect();
+        let input = Batch::new(records, &[]).unwrap();
+        let mut expected = BTreeMap::new();
+        for &(key, order) in &updates {
+            expected.entry(key)
+                .and_modify(|best| *best = std::cmp::max(*best, order))
+                .or_insert(order);
+        }
+        let mut cursor = LatestCursor::new(&input);
+        let mut actual = BTreeMap::new();
+        loop {
+            match cursor.step(fuel) {
+                SelectionStep::Selected(index) => {
+                    let r = &input.records()[index];
+                    actual.insert(r.key, r.metadata);
+                }
+                SelectionStep::Yield => {},
+                SelectionStep::Done => break,
+            }
+        }
+        prop_assert_eq!(actual, expected);
+    }
+}
+
+#[mz_ore::test]
+fn single_block_consumers_do_not_require_a_join_sized_budget() {
+    let pool = Pool::new().unwrap();
+    pool.set_budget(0);
+    pool.set_rss_target(1 << 20);
+    assert!(matches!(
+        Store::new(pool.clone(), 63, 128, 1, &LZ4_CODEC),
+        Err(StoreError::BlockSize)
+    ));
+    assert!(matches!(
+        Store::new(pool.clone(), 64, 63, 1, &LZ4_CODEC),
+        Err(StoreError::ReadBudget)
+    ));
+    assert!(matches!(
+        Store::new(pool.clone(), 64, 128, 0, &LZ4_CODEC),
+        Err(StoreError::ReadBudget)
+    ));
+    let store = Store::new(pool, 64, 64, 1, &LZ4_CODEC).unwrap();
+    let mut builder = store.builder();
+    let a = builder.push(&[0; 56]).unwrap();
+    let b = builder.push(&[1; 56]).unwrap();
+    let manifest = builder.finish();
+    assert!(store.prepare_read([(&manifest, a)]).is_ok());
+    assert!(matches!(
+        store.prepare_read([(&manifest, a), (&manifest, b)]),
+        Err(StoreError::ReadTooLarge)
+    ));
+}
+
+#[mz_ore::test(tokio::test)]
+async fn consumers_share_admission_through_ready_output() {
+    let (_, store) = store(64);
+    let mut builder = store.builder();
+    let a = builder.push(&[0; 56]).unwrap();
+    let b = builder.push(&[1; 56]).unwrap();
+    let manifest = builder.finish();
+    let reads = (0..12).map(|_| {
+        let request = store
+            .prepare_read([(&manifest, a), (&manifest, b)])
+            .unwrap();
+        async move {
+            let lease = request.read().await;
+            tokio::task::yield_now().await;
+            assert_eq!(lease.get(a).unwrap(), &[0; 56]);
+            assert_eq!(lease.get(b).unwrap(), &[1; 56]);
+        }
+    });
+    tokio::time::timeout(
+        Duration::from_secs(10),
+        futures_util::future::join_all(reads),
+    )
+    .await
+    .unwrap();
+    assert_eq!(store.stats().charged_bytes, 0);
+    assert_eq!(store.stats().peak_charged_bytes, 128);
+    assert_eq!(store.stats().read_jobs, 12);
+}
+
+#[mz_ore::test(tokio::test)]
+async fn borrowed_output_survives_all_batch_owners_and_does_not_alias_empty_payloads() {
+    let (pool, store) = store(64);
+    let source = batch(&store, [("a", (), Some(Vec::new())), ("b", (), None)]);
+    let selected = source.select([0, 1]).unwrap();
+    drop(source);
+    let row = selected.records()[0].row.unwrap();
+    assert!(selected.records()[1].row.is_none());
+    assert!(matches!(
+        selected.select([2]),
+        Err(StoreError::InvalidIndex)
+    ));
+    let read = store.prepare_read([(selected.payloads(), row)]).unwrap();
+    drop(selected);
+    let lease = read.read().await;
+    assert_eq!(lease.get(row).unwrap(), b"");
+    assert_eq!(pool.stats().live_chunks, 1);
+    drop(lease);
+    assert_eq!(pool.stats().live_chunks, 0);
+}
diff --git a/test/launchdarkly-flag-consistency/mzcompose.py b/test/launchdarkly-flag-consistency/mzcompose.py
index 618411c9e9835..551510cdb4481 100644
--- a/test/launchdarkly-flag-consistency/mzcompose.py
+++ b/test/launchdarkly-flag-consistency/mzcompose.py
@@ -578,6 +578,7 @@
     enable_notices_for_index_too_wide_for_literal_constraints
     enable_refresh_every_mvs
     enable_upsert_chunked_stash
+    enable_upsert_payload_stash
     enable_upsert_paged_spill
     enable_variadic_left_join_lowering
     grpc_client_http2_keep_alive_timeout

From 38753b5110478fd31b1853955d7c6dc8a216994c Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 22:07:52 -0400
Subject: [PATCH 06/31] storage: clarify payload ownership and isolate test
 pool setup

---
 .../src/upsert_continual_feedback_v2.rs       |  72 ++--
 .../upsert_continual_feedback_v2/payload.rs   | 362 ++++++++++--------
 src/timely-util/src/columnar/chunk.rs         |  53 ++-
 src/timely-util/src/columnar/payload.rs       | 171 +++++----
 src/timely-util/src/out_of_core/batch.rs      |   5 +
 src/timely-util/src/out_of_core/operators.rs  |   5 +
 src/timely-util/src/out_of_core/payload.rs    |  39 +-
 7 files changed, 422 insertions(+), 285 deletions(-)

diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index 7551cae9482b3..ec1df11f6dc1b 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -63,7 +63,7 @@
 //!
 //! ## Stash flavors
 //!
-//! [`UpsertStashFlavor`], resolved from `enable_upsert_chunked_stash` at
+//! [`UpsertStashFlavor`], resolved from the replica configuration at
 //! operator construction, selects between three instantiations of the same
 //! loop:
 //!
@@ -459,18 +459,17 @@ where
     );
     match flavor {
         UpsertStashFlavor::Payload => {
-            let store = payload::store();
+            let pool = mz_timely_util::columnar::chunk::spill_pool()
+                .or_else(mz_timely_util::pool_config::global_pool)
+                .expect("payload upsert requires a buffer pool");
+            let store = payload::store(pool);
             let (encoded, token) = payload::encode_feedback(encoded, store.clone());
             let persist_arranged = arrange_core::<
                 _,
                 _,
                 payload::FeedbackChunker<T>,
-                ChunkBatcher<
-                    mz_timely_util::columnar::payload::PayloadChunk<payload::FeedbackLayout, T>,
-                >,
-                ChunkBuilder<
-                    mz_timely_util::columnar::payload::PayloadChunk<payload::FeedbackLayout, T>,
-                >,
+                ChunkBatcher<payload::FeedbackChunk<T>>,
+                ChunkBuilder<payload::FeedbackChunk<T>>,
                 payload::FeedbackSpine<T>,
             >(encoded, Pipeline, "Persist payload feedback");
             let mut persist_token = persist_token.unwrap_or_default();
@@ -933,9 +932,12 @@ where
     O: columnar::Columnar + Default + Ord + Clone + Send + Sync + 'static,
     for<'a> columnar::Ref<'a, O>: Ord + Copy,
 {
+    /// Representation of a value in source metadata.
     type Value: columnar::Columnar + Default + Clone;
 
+    /// Prepare a source value for offset consolidation.
     fn encode(value: Option<Row>, batcher: &mut Self::Batcher) -> Option<Self::Value>;
+    /// Release temporary owners after all buffered updates have entered chunks.
     fn end_flush(_batcher: &mut Self::Batcher) {}
 
     /// The feedback arrangement's spine. `'static` because the operator
@@ -2197,31 +2199,35 @@ mod test {
         let pool = mz_ore::pool::Pool::new().unwrap();
         pool.set_budget(0);
         pool.set_rss_target(1 << 20);
-        let _pool = payload::test_pool(pool.clone());
-        let runtime = tokio::runtime::Runtime::new().unwrap();
-        let _enter = runtime.enter();
-        let baseline = run_payload_feedback_scenario(UpsertStashFlavor::Paged, 32);
-        assert_eq!(
-            baseline,
-            run_payload_feedback_scenario(UpsertStashFlavor::Chunked { async_reads: true }, 32)
-        );
-        assert_eq!(
-            baseline,
-            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 32)
-        );
-        assert_eq!(
-            run_payload_feedback_scenario(UpsertStashFlavor::Chunked { async_reads: true }, 1900),
-            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 1900)
-        );
-        assert_eq!(
-            run_payload_feedback_scenario(UpsertStashFlavor::Paged, 3 << 20),
-            run_payload_feedback_scenario(UpsertStashFlavor::Payload, 3 << 20)
-        );
-        assert_eq!(
-            pool.stats().live_chunks,
-            0,
-            "shutdown must release metadata and payload blocks"
-        );
+        mz_timely_util::columnar::chunk::with_spill_override(pool.clone(), || {
+            let runtime = tokio::runtime::Runtime::new().unwrap();
+            let _enter = runtime.enter();
+            let baseline = run_payload_feedback_scenario(UpsertStashFlavor::Paged, 32);
+            assert_eq!(
+                baseline,
+                run_payload_feedback_scenario(UpsertStashFlavor::Chunked { async_reads: true }, 32)
+            );
+            assert_eq!(
+                baseline,
+                run_payload_feedback_scenario(UpsertStashFlavor::Payload, 32)
+            );
+            assert_eq!(
+                run_payload_feedback_scenario(
+                    UpsertStashFlavor::Chunked { async_reads: true },
+                    1900
+                ),
+                run_payload_feedback_scenario(UpsertStashFlavor::Payload, 1900)
+            );
+            assert_eq!(
+                run_payload_feedback_scenario(UpsertStashFlavor::Paged, 3 << 20),
+                run_payload_feedback_scenario(UpsertStashFlavor::Payload, 3 << 20)
+            );
+            assert_eq!(
+                pool.stats().live_chunks,
+                0,
+                "shutdown must release metadata and payload blocks"
+            );
+        });
     }
 
     fn run_payload_feedback_scenario(
diff --git a/src/storage/src/upsert_continual_feedback_v2/payload.rs b/src/storage/src/upsert_continual_feedback_v2/payload.rs
index 18837852abf5d..10c871b88ee49 100644
--- a/src/storage/src/upsert_continual_feedback_v2/payload.rs
+++ b/src/storage/src/upsert_continual_feedback_v2/payload.rs
@@ -7,25 +7,70 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
-use std::collections::BTreeMap;
+//! Upsert state with row bytes stored separately from mergeable metadata.
+//!
+//! Source commands keep rows inline until offset consolidation chooses winners.
+//! The source batcher then writes those rows to the shared payload store. Persist
+//! feedback uses exact byte interning so insertions and retractions of the same
+//! row have the same metadata identity even when they arrive in different batches.
+//!
+//! Handles do not own rows. Manifests carry that ownership alongside metadata.
+//! Draining probes feedback in bounded key windows and decodes only emitted rows.
+//! See [`super::upsert_inner`] for the frontier and eligibility protocol.
+
+use std::collections::{BTreeMap, VecDeque};
 use std::marker::PhantomData;
 use std::rc::Rc;
 
-use columnar::{Columnar, Index, Len};
+use columnar::{Borrow, Columnar, Index, Len};
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::logging::Logger;
+use differential_dataflow::operators::arrange::agent::TraceAgent;
+use differential_dataflow::trace::chunk::{Chunk, ChunkBatcher, ChunkSpine};
+use differential_dataflow::trace::{Batcher, Description, TraceReader};
 use futures::StreamExt;
-use mz_timely_util::columnar::payload::{PayloadChunk, PayloadChunker, PayloadLayout};
+use mz_ore::pool::Pool;
+use mz_repr::{Diff, GlobalId, Row};
+use mz_timely_util::builder_async::{
+    Event as AsyncEvent, OperatorBuilder as AsyncOperatorBuilder, PressOnDropButton,
+};
+use mz_timely_util::columnar::Column;
+use mz_timely_util::columnar::batcher::ColumnChunker;
+use mz_timely_util::columnar::payload::{
+    PayloadChunk, PayloadChunker, PayloadLayout, PayloadStaging,
+};
+use mz_timely_util::columnar::unload::UnloadBatch;
 use mz_timely_util::out_of_core::{Manifest, PayloadInterner, ReadLease, RowHandle, Store};
-use timely::container::ContainerBuilder;
+use timely::container::{CapacityContainerBuilder, ContainerBuilder, PushInto};
+use timely::dataflow::channels::pact::Pipeline;
+use timely::dataflow::operators::Capability;
+use timely::dataflow::{Stream, StreamVec};
+use timely::order::TotalOrder;
+use timely::progress::Timestamp;
+use timely::progress::frontier::{Antichain, AntichainRef};
 
-use super::*;
+use super::{
+    DrainStats, TimeClass, UpsertDiff, UpsertOutputHandle, UpsertStashArm, UpsertUpdate,
+    classify_time, decode_upsert_value, upsert_value_byte_len,
+};
+use crate::upsert::{UpsertKey, UpsertValue};
 
 const BLOCK_BYTES: usize = 2 << 20;
+// A drain retains two decoded blocks, and feedback interning retains one.
+// Eight blocks leave room to acquire the next read without exhausting admission.
+const READ_BUDGET_BYTES: usize = 8 * BLOCK_BYTES;
+const READ_CONCURRENCY: usize = 2;
+// Each key produces at most one retraction and one insertion per probe window.
+const PROBE_WINDOW_KEYS: usize = 1024;
+const DECODE_CACHE_BLOCKS: usize = 2;
 
+/// A tagged upsert row, either awaiting encoding or stored in a payload block.
+///
+/// Inline rows also cover values too large for a block.
 #[derive(Clone, Debug, Eq, PartialEq, Ord, PartialOrd, columnar::Columnar)]
 #[columnar(derive(PartialEq, Eq, PartialOrd, Ord))]
 pub(super) enum Value {
     External(RowHandle),
-    // Oversized rows retain the existing inline path instead of imposing a row limit.
     Inline(Row),
 }
 
@@ -41,6 +86,7 @@ fn visit(value: columnar::Ref<'_, Value>, rows: &mut Vec<RowHandle>) {
     }
 }
 
+/// Feedback stores the payload handle alongside the key, with an additive diff.
 pub(super) struct FeedbackLayout;
 impl PayloadLayout for FeedbackLayout {
     type Data = (UpsertKey, Value);
@@ -54,6 +100,7 @@ impl PayloadLayout for FeedbackLayout {
     }
 }
 
+/// Source commands carry their payload in the maximum-offset difference.
 pub(super) struct SourceLayout<O>(PhantomData<O>);
 impl<O: Columnar> PayloadLayout for SourceLayout<O> {
     type Data = UpsertKey;
@@ -70,93 +117,52 @@ impl<O: Columnar> PayloadLayout for SourceLayout<O> {
 }
 
 type SourceChunk<T, O> = PayloadChunk<SourceLayout<O>, T>;
-pub(super) type FeedbackSpine<T> = ChunkSpine<PayloadChunk<FeedbackLayout, T>>;
-
-#[cfg(test)]
-thread_local! {
-    static TEST_POOL: std::cell::RefCell<Option<mz_ore::pool::Pool>> =
-        const { std::cell::RefCell::new(None) };
-}
-
-#[cfg(test)]
-pub(super) struct TestPool;
-#[cfg(test)]
-impl Drop for TestPool {
-    fn drop(&mut self) {
-        TEST_POOL.with(|pool| *pool.borrow_mut() = None);
-        mz_timely_util::columnar::chunk::set_spill_override(None);
-    }
-}
-#[cfg(test)]
-pub(super) fn test_pool(pool: mz_ore::pool::Pool) -> TestPool {
-    mz_timely_util::columnar::chunk::set_spill_override(Some(pool.clone()));
-    TEST_POOL.with(|cell| *cell.borrow_mut() = Some(pool));
-    TestPool
-}
+pub(super) type FeedbackChunk<T> = PayloadChunk<FeedbackLayout, T>;
+pub(super) type FeedbackSpine<T> = ChunkSpine<FeedbackChunk<T>>;
+type FeedbackBatch<T> = <FeedbackSpine<T> as TraceReader>::Batch;
 
-pub(super) fn store() -> Store {
-    #[cfg(test)]
-    let pool = TEST_POOL.with(|pool| pool.borrow().clone());
-    #[cfg(not(test))]
-    let pool: Option<mz_ore::pool::Pool> = None;
-    let pool = pool
-        .or_else(mz_timely_util::pool_config::active_pool)
-        .or_else(mz_timely_util::pool_config::global_pool)
-        .expect("payload upsert requires a buffer pool");
+/// Create the store shared by source commands and persist feedback.
+pub(super) fn store(pool: Pool) -> Store {
     Store::new(
         pool,
         BLOCK_BYTES,
-        8 * BLOCK_BYTES,
-        2,
+        READ_BUDGET_BYTES,
+        READ_CONCURRENCY,
         &mz_timely_util::columnar::chunk::LZ4_CODEC,
     )
     .expect("valid payload store configuration")
 }
 
-pub(super) struct SourceBatcher<T, O>
-where
-    T: Timestamp + Lattice + Columnar + Default,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    O: Columnar + Default + Ord + Clone,
-    for<'a> columnar::Ref<'a, O>: Copy + Ord,
-{
-    inner: ChunkBatcher<SourceChunk<T, O>>,
+/// Consolidates source metadata and owns payloads awaiting restashing.
+pub(super) struct SourceBatcher<C: Chunk + Default + 'static> {
+    inner: ChunkBatcher<C>,
     store: Store,
-    owners: Vec<Manifest>,
+    // Draining puts ineligible updates in a separate buffer. These owners keep
+    // their handles valid until flush has attached them to replacement chunks.
+    restash_owners: Vec<Manifest>,
 }
 
-impl<T, O> Batcher for SourceBatcher<T, O>
-where
-    T: Timestamp + Lattice + Columnar + Default,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    O: Columnar + Default + Ord + Clone,
-    for<'a> columnar::Ref<'a, O>: Copy + Ord,
-{
-    type Output = SourceChunk<T, O>;
-    type Time = T;
+impl<C: Chunk + Default + 'static> Batcher for SourceBatcher<C> {
+    type Output = C;
+    type Time = C::Time;
     fn new(_: Option<Logger>, _: usize) -> Self {
         panic!("construct with the shared payload store")
     }
-    fn seal(&mut self, upper: Antichain<T>) -> (Vec<Self::Output>, Description<T>) {
+    fn seal(&mut self, upper: Antichain<C::Time>) -> (Vec<Self::Output>, Description<C::Time>) {
         self.inner.seal(upper)
     }
-    fn frontier(&mut self) -> AntichainRef<'_, T> {
+    fn frontier(&mut self) -> AntichainRef<'_, C::Time> {
         self.inner.frontier()
     }
 }
 
-impl<T, O> PushInto<SourceChunk<T, O>> for SourceBatcher<T, O>
-where
-    T: Timestamp + Lattice + Columnar + Default,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    O: Columnar + Default + Ord + Clone,
-    for<'a> columnar::Ref<'a, O>: Copy + Ord,
-{
-    fn push_into(&mut self, chunk: SourceChunk<T, O>) {
+impl<C: Chunk + Default + 'static> PushInto<C> for SourceBatcher<C> {
+    fn push_into(&mut self, chunk: C) {
         self.inner.push_into(chunk);
     }
 }
 
+/// Connects payload-backed source and feedback batches to the shared upsert loop.
 pub(super) struct PayloadArm;
 impl<T, O> UpsertStashArm<T, O> for PayloadArm
 where
@@ -167,14 +173,14 @@ where
 {
     type Value = Value;
     type Spine = FeedbackSpine<T>;
-    type Batcher = SourceBatcher<T, O>;
+    type Batcher = SourceBatcher<SourceChunk<T, O>>;
 
     fn new_batcher(store: Option<Store>) -> Self::Batcher {
         let store = store.expect("payload arm shares its store with feedback");
         Self::Batcher {
             inner: Batcher::new(None, 0),
             store,
-            owners: Vec::new(),
+            restash_owners: Vec::new(),
         }
     }
 
@@ -183,7 +189,7 @@ where
     }
 
     fn end_flush(batcher: &mut Self::Batcher) {
-        batcher.owners.clear();
+        batcher.restash_owners.clear();
     }
 
     fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Value>>) {
@@ -194,7 +200,7 @@ where
         for index in 0..view.len() {
             let (key, time, diff) = view.get(index);
             let value = diff.value.map(|value| match value {
-                ValueReference::Inline(row) if row.byte_len() + 8 <= BLOCK_BYTES => {
+                ValueReference::Inline(row) if batcher.store.can_store(row.byte_len()) => {
                     Value::External(builder.push(row.data()).expect("row fits payload block"))
                 }
                 value => Value::into_owned(value),
@@ -209,7 +215,7 @@ where
             ));
         }
         let owner = builder.finish();
-        let mut owners: Vec<_> = batcher.owners.iter().collect();
+        let mut owners: Vec<_> = batcher.restash_owners.iter().collect();
         owners.push(&owner);
         batcher
             .inner
@@ -239,14 +245,14 @@ where
             deletes: 0,
             output_count: 0,
         };
-        let mut cache = std::collections::VecDeque::new();
+        let mut decoder = ValueDecoder::default();
         for chunk in sealed {
             let metadata = chunk.metadata_async().await;
             let view = metadata.borrow();
             let mut retained = false;
             let source_owner = Rc::new(chunk.manifest().clone());
-            for start in (0..view.len()).step_by(1024) {
-                let end = (start + 1024).min(view.len());
+            for start in (0..view.len()).step_by(PROBE_WINDOW_KEYS) {
+                let end = (start + PROBE_WINDOW_KEYS).min(view.len());
                 let keys: Vec<_> = (start..end)
                     .filter_map(|i| {
                         let (key, time, _) = view.get(i);
@@ -257,45 +263,7 @@ where
                         .then_some(*key)
                     })
                     .collect();
-                let mut hits: BTreeMap<(UpsertKey, Value), Diff> = BTreeMap::new();
-                let mut staging = mz_timely_util::columnar::payload::PayloadStaging::<(
-                    (UpsertKey, Value),
-                    T,
-                    Diff,
-                )>::default();
-                if !keys.is_empty() {
-                    use columnar::Borrow;
-                    let probes = UpsertKey::as_columns(&keys);
-                    for batch in &batches {
-                        batch
-                            .extract_into_async(probes.borrow(), &mut staging)
-                            .await;
-                    }
-                    let rows = staging.updates.borrow();
-                    for index in 0..rows.len() {
-                        let ((key, value), _, diff) = rows.get(index);
-                        *hits
-                            .entry((*key, Value::into_owned(value)))
-                            .or_insert(Diff::ZERO) += Diff::into_owned(diff);
-                    }
-                }
-                let owners = Manifest::retain(
-                    hits.keys().filter_map(|(_, value)| match value {
-                        Value::External(row) => Some(*row),
-                        Value::Inline(_) => None,
-                    }),
-                    staging.owners.iter().map(|owner| &**owner),
-                )
-                .expect("probe results retain payload ownership");
-                let owners = Rc::new(owners);
-                let mut old = BTreeMap::new();
-                for ((key, value), diff) in hits {
-                    if diff.is_positive() {
-                        assert_eq!(diff, Diff::ONE, "feedback value multiplicity");
-                        let previous = old.insert(key, (value, Rc::clone(&owners)));
-                        assert!(previous.is_none(), "multiple feedback values for one key");
-                    }
-                }
+                let (mut previous_values, feedback_owner) = lookup_feedback(&keys, &batches).await;
                 let mut pending = Vec::with_capacity(2 * (end - start));
                 for index in start..end {
                     let (key, time, diff) = view.get(index);
@@ -310,31 +278,47 @@ where
                         TimeClass::Eligible => {}
                     }
                     stats.eligible += 1;
-                    let previous = old.remove(key);
+                    let previous = previous_values.remove(key);
                     let value = diff.value.map(Value::into_owned);
-                    if let Some((previous, owner)) = previous {
+                    if let Some(previous) = previous {
                         stats.result_count += 1;
                         if value.is_some() {
                             stats.updates += 1;
                         } else {
                             stats.deletes += 1;
                         }
-                        pending.push((previous, owner, time.clone(), Diff::MINUS_ONE));
+                        pending.push(PendingOutput {
+                            value: previous,
+                            owner: Rc::clone(&feedback_owner),
+                            time: time.clone(),
+                            diff: Diff::MINUS_ONE,
+                        });
                     } else if value.is_some() {
                         stats.inserts += 1;
                     }
                     if let Some(value) = value {
-                        pending.push((value, Rc::clone(&source_owner), time, Diff::ONE));
+                        pending.push(PendingOutput {
+                            value,
+                            owner: Rc::clone(&source_owner),
+                            time,
+                            diff: Diff::ONE,
+                        });
                     }
                 }
                 // Differential updates at a completed time can be emitted in any
                 // order. Group reads by physical block within this metadata window.
-                pending.sort_by_key(|(value, _, _, _)| match value {
+                pending.sort_by_key(|update| match &update.value {
                     Value::External(row) => Some(*row),
                     Value::Inline(_) => None,
                 });
-                for (value, owner, time, diff) in pending {
-                    let row = decode(&value, &owner, &batcher.store, &mut cache).await;
+                for PendingOutput {
+                    value,
+                    owner,
+                    time,
+                    diff,
+                } in pending
+                {
+                    let row = decoder.decode(&value, &owner, &batcher.store).await;
                     let size = upsert_value_byte_len(&row);
                     output_handle
                         .give_fueled(output_cap, (row, time, diff), size)
@@ -343,52 +327,112 @@ where
                 }
             }
             if retained {
-                batcher.owners.push(chunk.manifest().clone());
+                batcher.restash_owners.push(chunk.manifest().clone());
             }
         }
         stats
     }
 }
 
-async fn decode(
-    value: &Value,
-    owner: &Manifest,
-    store: &Store,
-    cache: &mut std::collections::VecDeque<ReadLease>,
-) -> UpsertValue {
-    match value {
-        Value::Inline(row) => decode_upsert_value(row.iter()),
-        Value::External(row) => {
-            let hit = cache.iter().position(|lease| lease.get(*row).is_ok());
-            if let Some(index) = hit {
-                let lease = cache.remove(index).expect("observed cached block");
-                cache.push_back(lease);
-            } else {
-                // Two blocks preserve old/new locality. Together with the feedback
-                // interner's one-block cache they fit below the eight-block budget.
-                if cache.len() == 2 {
-                    cache.pop_front();
+/// Look up consolidated feedback for sorted keys without decoding their payloads.
+///
+/// The caller must probe only keys eligible at the current persist frontier.
+/// At that frontier, each key has at most one value with multiplicity one.
+async fn lookup_feedback<T>(
+    keys: &[UpsertKey],
+    batches: &[FeedbackBatch<T>],
+) -> (BTreeMap<UpsertKey, Value>, Rc<Manifest>)
+where
+    T: Timestamp + Lattice + Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+{
+    let mut hits: BTreeMap<(UpsertKey, Value), Diff> = BTreeMap::new();
+    let mut staging = PayloadStaging::<((UpsertKey, Value), T, Diff)>::default();
+    if !keys.is_empty() {
+        let probes = UpsertKey::as_columns(keys);
+        for batch in batches {
+            batch
+                .extract_into_async(probes.borrow(), &mut staging)
+                .await;
+        }
+        let rows = staging.updates.borrow();
+        for index in 0..rows.len() {
+            let ((key, value), _, diff) = rows.get(index);
+            *hits
+                .entry((*key, Value::into_owned(value)))
+                .or_insert(Diff::ZERO) += Diff::into_owned(diff);
+        }
+    }
+    let owners = Manifest::retain(
+        hits.keys().filter_map(|(_, value)| match value {
+            Value::External(row) => Some(*row),
+            Value::Inline(_) => None,
+        }),
+        staging.owners.iter().map(|owner| &**owner),
+    )
+    .expect("probe results retain payload ownership");
+    let owners = Rc::new(owners);
+    let mut previous_values = BTreeMap::new();
+    for ((key, value), diff) in hits {
+        if diff.is_positive() {
+            assert_eq!(diff, Diff::ONE, "feedback value multiplicity");
+            let previous = previous_values.insert(key, value);
+            assert!(previous.is_none(), "multiple feedback values for one key");
+        }
+    }
+    (previous_values, owners)
+}
+
+/// An output row whose owner remains live until decoding and emission finish.
+struct PendingOutput<T> {
+    value: Value,
+    owner: Rc<Manifest>,
+    time: T,
+    diff: Diff,
+}
+
+/// A bounded cache of decoded blocks shared by one drain's output rows.
+#[derive(Default)]
+struct ValueDecoder {
+    blocks: VecDeque<ReadLease>,
+}
+
+impl ValueDecoder {
+    async fn decode(&mut self, value: &Value, owner: &Manifest, store: &Store) -> UpsertValue {
+        match value {
+            Value::Inline(row) => decode_upsert_value(row.iter()),
+            Value::External(row) => {
+                let hit = self.blocks.iter().position(|lease| lease.get(*row).is_ok());
+                if let Some(index) = hit {
+                    let lease = self.blocks.remove(index).expect("observed cached block");
+                    self.blocks.push_back(lease);
+                } else {
+                    if self.blocks.len() == DECODE_CACHE_BLOCKS {
+                        self.blocks.pop_front();
+                    }
+                    self.blocks.push_back(
+                        store
+                            .prepare_read([(owner, *row)])
+                            .expect("owned payload fits admission")
+                            .read()
+                            .await,
+                    );
                 }
-                cache.push_back(
-                    store
-                        .prepare_read([(owner, *row)])
-                        .expect("owned payload fits admission")
-                        .read()
-                        .await,
-                );
+                let bytes = self
+                    .blocks
+                    .back()
+                    .expect("loaded payload")
+                    .get(*row)
+                    .expect("requested row");
+                // SAFETY: bytes came from Row::data and the pool preserves their contents.
+                let row = unsafe { Row::from_bytes_unchecked(bytes) };
+                decode_upsert_value(row.iter())
             }
-            let bytes = cache
-                .back()
-                .expect("loaded payload")
-                .get(*row)
-                .expect("requested row");
-            // SAFETY: bytes came from Row::data and the pool preserves their contents.
-            let row = unsafe { Row::from_bytes_unchecked(bytes) };
-            decode_upsert_value(row.iter())
         }
     }
 }
 
+/// Intern feedback rows before arranging them, retaining their input capabilities.
 pub(super) fn encode_feedback<'scope, T>(
     input: Stream<'scope, T, Column<((UpsertKey, Row), T, Diff)>>,
     store: Store,
@@ -407,7 +451,7 @@ where
     let mut input = builder.new_input_for(input, Pipeline, &output);
     let button = builder.build(move |caps| async move {
         drop(caps);
-        let mut interner = PayloadInterner::new(store);
+        let mut interner = PayloadInterner::new(store.clone());
         let mut chunker: ColumnChunker<((UpsertKey, Value), T, Diff)> = Default::default();
         while let Some(event) = input.next().await {
             if let AsyncEvent::Data(cap, column) = event {
@@ -417,7 +461,7 @@ where
                     .collect();
                 let bytes: Vec<_> = rows
                     .iter()
-                    .filter(|((_, row), _, _)| row.byte_len() + 8 <= BLOCK_BYTES)
+                    .filter(|((_, row), _, _)| store.can_store(row.byte_len()))
                     .map(|((_, row), _, _)| row.data().to_vec())
                     .collect();
                 let (handles, owner) = interner
@@ -427,7 +471,7 @@ where
                 let mut handles = handles.into_iter();
                 let mut metadata: Column<((UpsertKey, Value), T, Diff)> = Default::default();
                 for ((key, row), time, diff) in rows {
-                    let value = if row.byte_len() + 8 > BLOCK_BYTES {
+                    let value = if !store.can_store(row.byte_len()) {
                         Value::Inline(row)
                     } else {
                         Value::External(handles.next().expect("one handle per external row"))
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 92949db84000e..31d3b577a7ba3 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -119,6 +119,22 @@ pub fn set_spill_override(pool: Option<Pool>) {
     SPILL_OVERRIDE.with(|cell| *cell.borrow_mut() = pool);
 }
 
+/// Run a synchronous scope using `pool` for chunk spilling on this thread.
+///
+/// Restores the previous override on return or panic. Other threads do not
+/// inherit it, and returning a future does not extend the override's lifetime.
+pub fn with_spill_override<R>(pool: Pool, f: impl FnOnce() -> R) -> R {
+    struct RestoreOverride(Option<Pool>);
+    impl Drop for RestoreOverride {
+        fn drop(&mut self) {
+            set_spill_override(self.0.take());
+        }
+    }
+    let previous = SPILL_OVERRIDE.with(|cell| cell.replace(Some(pool)));
+    let _restore = RestoreOverride(previous);
+    f()
+}
+
 static DIRECT_COMPRESSED_OUTPUT: AtomicBool = AtomicBool::new(false);
 
 /// Compress eligible spilled bodies directly into extents, bypassing resident slots.
@@ -196,8 +212,11 @@ fn codec_for_depth(depth: u8) -> (&'static dyn ExtentCodec, bool) {
     }
 }
 
-/// The pool committed chunks spill to, if any.
-fn spill_pool() -> Option<Pool> {
+/// Return this thread's spill override, or the active pool when spilling is enabled.
+///
+/// This does not initialize the process pool. See [`set_compute_spill_enabled`]
+/// for the shared gate and [`set_spill_override`] for scoped test configuration.
+pub fn spill_pool() -> Option<Pool> {
     if let Some(pool) = SPILL_OVERRIDE.with(|cell| cell.borrow().clone()) {
         return Some(pool);
     }
@@ -1329,6 +1348,36 @@ mod tests {
 
     use super::*;
 
+    #[mz_ore::test]
+    fn scoped_spill_override_restores_outer_pool_after_panic() {
+        let outer = Pool::new().unwrap();
+        let inner = Pool::new().unwrap();
+        let insert = || {
+            spill_pool()
+                .unwrap()
+                .insert_with(1, ChunkHints::default(), &IDENTITY_CODEC, |words| {
+                    words[0] = 1;
+                })
+        };
+        assert!(SPILL_OVERRIDE.with(|cell| cell.borrow().is_none()));
+        with_spill_override(outer.clone(), || {
+            drop(insert());
+            assert_eq!(outer.stats().inserts, 1);
+            let result = mz_ore::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                with_spill_override(inner.clone(), || {
+                    drop(insert());
+                    assert_eq!(inner.stats().inserts, 1);
+                    panic!("exercise scoped cleanup");
+                });
+            }));
+            assert!(result.is_err());
+            drop(insert());
+            assert_eq!(outer.stats().inserts, 2);
+            assert_eq!(inner.stats().inserts, 1);
+        });
+        assert!(SPILL_OVERRIDE.with(|cell| cell.borrow().is_none()));
+    }
+
     type Tuple = ((u64, u64), u64, i64);
     type TestChunk = ColumnChunk<(u64, u64), u64, i64>;
 
diff --git a/src/timely-util/src/columnar/payload.rs b/src/timely-util/src/columnar/payload.rs
index fa240df576cd4..3c420b9e1f688 100644
--- a/src/timely-util/src/columnar/payload.rs
+++ b/src/timely-util/src/columnar/payload.rs
@@ -8,6 +8,15 @@
 // by the Apache License, Version 2.0.
 
 //! Columnar metadata chunks with independently owned pool-backed payloads.
+//!
+//! [`PayloadLayout`] locates handles inside operator-defined data and differences.
+//! [`PayloadChunk`] delegates ordering, consolidation, and spilling to
+//! [`ColumnChunk`], then retains the blocks referenced by the resulting metadata.
+//! Rewrites can read metadata but never need to decode the external payloads.
+//!
+//! [`PayloadStaging`] carries ownership alongside copied probe results so callers
+//! can release a trace batch before reading its rows. Locators are physical
+//! addresses, so the operator must supply its own logical equality policy.
 
 use std::collections::VecDeque;
 use std::marker::PhantomData;
@@ -30,7 +39,9 @@ pub trait PayloadLayout: 'static {
     type Data: Columnar;
     /// Columnar difference used for consolidation.
     type Diff: Columnar;
-    /// Append all payload locators referenced by this update.
+    /// Append every external locator referenced by this update, including those
+    /// carried in the difference. Duplicates are allowed. Omitting a locator can
+    /// retire its block while the update still refers to it.
     fn visit(
         data: columnar::Ref<'_, Self::Data>,
         diff: columnar::Ref<'_, Self::Diff>,
@@ -39,10 +50,6 @@ pub trait PayloadLayout: 'static {
 }
 
 /// A metadata chunk whose manifest keeps every referenced payload block alive.
-///
-/// Metadata follows `ColumnChunk` spilling and compaction. Rewrites retain only
-/// referenced blocks, and never decode payloads. Identity and equality belong to
-/// the caller's metadata layout, independently of physical payload placement.
 pub struct PayloadChunk<P: PayloadLayout, T: Columnar> {
     metadata: ColumnChunk<P::Data, T, P::Diff>,
     manifest: Rc<Manifest>,
@@ -90,6 +97,8 @@ where
     P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
 {
     /// Attach ownership to sorted, consolidated metadata.
+    ///
+    /// Panics if `owners` does not cover every locator reported by the layout.
     pub fn new(metadata: Column<(P::Data, T, P::Diff)>, owners: &[&Manifest]) -> Self {
         Self::attach(ColumnChunk::from_column(metadata), owners)
     }
@@ -112,7 +121,7 @@ where
         }
     }
 
-    fn unwrap(
+    fn detach_metadata(
         input: &mut VecDeque<Self>,
         owners: &mut Vec<Rc<Manifest>>,
     ) -> VecDeque<ColumnChunk<P::Data, T, P::Diff>> {
@@ -125,7 +134,7 @@ where
             .collect()
     }
 
-    fn wrap(
+    fn attach_metadata(
         input: VecDeque<ColumnChunk<P::Data, T, P::Diff>>,
         owners: &[Rc<Manifest>],
         output: &mut VecDeque<Self>,
@@ -158,16 +167,16 @@ where
         let mut out = VecDeque::new();
         ColumnChunk::merge(&mut a, &mut b, &mut out);
         let mut remaining = VecDeque::new();
-        Self::wrap(a, &owners, &mut remaining);
+        Self::attach_metadata(a, &owners, &mut remaining);
         for chunk in remaining.into_iter().rev() {
             left.push_front(chunk);
         }
         let mut remaining = VecDeque::new();
-        Self::wrap(b, &owners, &mut remaining);
+        Self::attach_metadata(b, &owners, &mut remaining);
         for chunk in remaining.into_iter().rev() {
             right.push_front(chunk);
         }
-        Self::wrap(out, &owners, output);
+        Self::attach_metadata(out, &owners, output);
     }
 
     fn extract(
@@ -185,8 +194,8 @@ where
         let (mut kept, mut shipped) = (VecDeque::new(), VecDeque::new());
         ColumnChunk::extract(&mut columns, frontier, residual, &mut kept, &mut shipped);
         assert!(columns.is_empty());
-        Self::wrap(kept, &owners, keep);
-        Self::wrap(shipped, &owners, ship);
+        Self::attach_metadata(kept, &owners, keep);
+        Self::attach_metadata(shipped, &owners, ship);
     }
 
     fn advance(
@@ -196,20 +205,20 @@ where
         output: &mut VecDeque<Self>,
     ) {
         let mut owners = Vec::new();
-        let mut columns = Self::unwrap(input, &mut owners);
+        let mut columns = Self::detach_metadata(input, &mut owners);
         let mut out = VecDeque::new();
         ColumnChunk::advance(&mut columns, frontier, done, &mut out);
-        Self::wrap(columns, &owners, input);
-        Self::wrap(out, &owners, output);
+        Self::attach_metadata(columns, &owners, input);
+        Self::attach_metadata(out, &owners, output);
     }
 
     fn settle(input: &mut VecDeque<Self>, done: bool, output: &mut VecDeque<Self>) {
         let mut owners = Vec::new();
-        let mut columns = Self::unwrap(input, &mut owners);
+        let mut columns = Self::detach_metadata(input, &mut owners);
         let mut out = VecDeque::new();
         ColumnChunk::settle(&mut columns, done, &mut out);
-        Self::wrap(columns, &owners, input);
-        Self::wrap(out, &owners, output);
+        Self::attach_metadata(columns, &owners, input);
+        Self::attach_metadata(out, &owners, output);
     }
 }
 
@@ -260,6 +269,69 @@ impl<P: PayloadLayout, T: Columnar> timely::container::ContainerBuilder for Payl
     }
 }
 
+/// Copied metadata and the owners needed to keep its external payloads valid.
+pub struct PayloadStaging<U: Columnar> {
+    /// Matching updates, retaining their stored times and differences.
+    pub updates: U::Container,
+    /// Chunk manifests that own the locators in `updates`.
+    pub owners: Vec<Rc<Manifest>>,
+}
+impl<U: Columnar> Default for PayloadStaging<U> {
+    fn default() -> Self {
+        Self {
+            updates: Default::default(),
+            owners: Vec::new(),
+        }
+    }
+}
+
+impl<P, K, V, T> crate::columnar::unload::UnloadChunk for PayloadChunk<P, T>
+where
+    P: PayloadLayout<Data = (K, V)>,
+    K: Columnar,
+    V: Columnar,
+    for<'a> columnar::Ref<'a, K>: Copy + Ord,
+    for<'a> columnar::Ref<'a, V>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
+{
+    type Staging = PayloadStaging<((K, V), T, P::Diff)>;
+    type Probes<'a> =
+        <ColumnChunk<(K, V), T, P::Diff> as crate::columnar::unload::UnloadChunk>::Probes<'a>;
+    fn probe_count(probes: Self::Probes<'_>) -> usize {
+        ColumnChunk::<(K, V), T, P::Diff>::probe_count(probes)
+    }
+    fn locate(&self, probes: Self::Probes<'_>, index: usize) -> std::cmp::Ordering {
+        self.metadata.locate(probes, index)
+    }
+    fn extract_into(
+        &self,
+        probes: Self::Probes<'_>,
+        index: &mut usize,
+        staging: &mut Self::Staging,
+    ) {
+        self.metadata
+            .extract_into(probes, index, &mut staging.updates);
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+    async fn extract_into_async(
+        &self,
+        probes: Self::Probes<'_>,
+        index: &mut usize,
+        staging: &mut Self::Staging,
+    ) {
+        self.metadata
+            .extract_into_async(probes, index, &mut staging.updates)
+            .await;
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+    fn fetch_into(&self, staging: &mut Self::Staging) {
+        self.metadata.fetch_into(&mut staging.updates);
+        staging.owners.push(Rc::clone(&self.manifest));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -327,66 +399,3 @@ mod tests {
         assert_eq!(pool.stats().live_chunks, 0);
     }
 }
-
-/// Copied metadata and the owners needed to keep its external payloads valid.
-pub struct PayloadStaging<U: Columnar> {
-    /// Matching updates, retaining their stored times and differences.
-    pub updates: U::Container,
-    /// Chunk manifests that own the locators in `updates`.
-    pub owners: Vec<Rc<Manifest>>,
-}
-impl<U: Columnar> Default for PayloadStaging<U> {
-    fn default() -> Self {
-        Self {
-            updates: Default::default(),
-            owners: Vec::new(),
-        }
-    }
-}
-
-impl<P, K, V, T> crate::columnar::unload::UnloadChunk for PayloadChunk<P, T>
-where
-    P: PayloadLayout<Data = (K, V)>,
-    K: Columnar,
-    V: Columnar,
-    for<'a> columnar::Ref<'a, K>: Copy + Ord,
-    for<'a> columnar::Ref<'a, V>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
-{
-    type Staging = PayloadStaging<((K, V), T, P::Diff)>;
-    type Probes<'a> =
-        <ColumnChunk<(K, V), T, P::Diff> as crate::columnar::unload::UnloadChunk>::Probes<'a>;
-    fn probe_count(probes: Self::Probes<'_>) -> usize {
-        ColumnChunk::<(K, V), T, P::Diff>::probe_count(probes)
-    }
-    fn locate(&self, probes: Self::Probes<'_>, index: usize) -> std::cmp::Ordering {
-        self.metadata.locate(probes, index)
-    }
-    fn extract_into(
-        &self,
-        probes: Self::Probes<'_>,
-        index: &mut usize,
-        staging: &mut Self::Staging,
-    ) {
-        self.metadata
-            .extract_into(probes, index, &mut staging.updates);
-        staging.owners.push(Rc::clone(&self.manifest));
-    }
-    async fn extract_into_async(
-        &self,
-        probes: Self::Probes<'_>,
-        index: &mut usize,
-        staging: &mut Self::Staging,
-    ) {
-        self.metadata
-            .extract_into_async(probes, index, &mut staging.updates)
-            .await;
-        staging.owners.push(Rc::clone(&self.manifest));
-    }
-    fn fetch_into(&self, staging: &mut Self::Staging) {
-        self.metadata.fetch_into(&mut staging.updates);
-        staging.owners.push(Rc::clone(&self.manifest));
-    }
-}
diff --git a/src/timely-util/src/out_of_core/batch.rs b/src/timely-util/src/out_of_core/batch.rs
index fdac553d1d9d1..92f1c9fc93319 100644
--- a/src/timely-util/src/out_of_core/batch.rs
+++ b/src/timely-util/src/out_of_core/batch.rs
@@ -7,6 +7,11 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
+//! Resident metadata batches that own references to independently stored rows.
+//!
+//! Sorting and selection operate on keys and metadata. The resulting manifest
+//! retains payload blocks before input ownership can be released.
+
 use super::{Manifest, RowHandle, StoreError};
 
 /// Operator-defined index fields with an optional payload locator.
diff --git a/src/timely-util/src/out_of_core/operators.rs b/src/timely-util/src/out_of_core/operators.rs
index ff0ab8302631a..13d13eda70806 100644
--- a/src/timely-util/src/out_of_core/operators.rs
+++ b/src/timely-util/src/out_of_core/operators.rs
@@ -7,6 +7,11 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
+//! Resumable selection and equijoin over finite, resident metadata batches.
+//!
+//! These cursors inspect keys and produce row handles without reading payloads.
+//! Callers own frontier management, batch scheduling, and payload materialization.
+
 use std::cmp::Ordering;
 use std::ops::Range;
 
diff --git a/src/timely-util/src/out_of_core/payload.rs b/src/timely-util/src/out_of_core/payload.rs
index 51490a08e09cd..2c24ae476fe0c 100644
--- a/src/timely-util/src/out_of_core/payload.rs
+++ b/src/timely-util/src/out_of_core/payload.rs
@@ -7,6 +7,17 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
+//! Pool-backed row storage, block ownership, and decoded-read admission.
+//!
+//! Builders publish immutable blocks and non-owning row handles. Manifests keep
+//! referenced blocks alive independently of metadata batches. A prepared read
+//! takes ownership before it can suspend, and its returned lease retains both
+//! decoded bytes and their admission reservation until the consumer releases it.
+//!
+//! The pool governs resident storage. This module separately budgets decoded
+//! copies returned by reads. Builder scratch, manifests, and the interner's
+//! equality index are not charged to that decoded-byte budget.
+
 use std::collections::BTreeMap;
 use std::fmt;
 use std::sync::Arc;
@@ -170,6 +181,11 @@ impl Store {
         })
     }
 
+    /// Whether a row and its length prefix fit in one payload block.
+    pub fn can_store(&self, row_bytes: usize) -> bool {
+        row_bytes <= (self.block_words - 1) * 8
+    }
+
     /// Start a builder with at most one block of word staging.
     pub fn builder(&self) -> PayloadBuilder {
         PayloadBuilder {
@@ -238,10 +254,10 @@ impl PayloadBuilder {
     ///
     /// An oversized row is rejected without modifying the builder.
     pub fn push(&mut self, row: &[u8]) -> Result<RowHandle, StoreError> {
-        let words = 1 + row.len().div_ceil(8);
-        if words > self.store.block_words {
+        if !self.store.can_store(row.len()) {
             return Err(StoreError::RowTooLarge);
         }
+        let words = 1 + row.len().div_ceil(8);
         if self.words.len() + words > self.store.block_words {
             self.flush();
         }
@@ -405,18 +421,12 @@ impl PayloadInterner {
         .await
     }
 
-    async fn intern_hashed(
-        &mut self,
-        rows: &[Vec<u8>],
-        hash: impl Fn(&[u8]) -> u64,
-    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
+    fn sweep_dead_entries(&mut self, budget: usize) {
         use std::ops::Bound::{Excluded, Unbounded};
-        // Sweep work grows with arrivals so wide batches cannot outrun reclamation.
-        let sweep_budget = rows.len().saturating_mul(4).max(1024);
         let keys: Vec<_> = self
             .entries
             .range((self.sweep_after.map_or(Unbounded, Excluded), Unbounded))
-            .take(sweep_budget)
+            .take(budget)
             .map(|(key, _)| *key)
             .collect();
         self.sweep_after = if keys.last() == self.entries.last_key_value().map(|(key, _)| key) {
@@ -429,6 +439,15 @@ impl PayloadInterner {
                 self.entries.remove(&key);
             }
         }
+    }
+
+    async fn intern_hashed(
+        &mut self,
+        rows: &[Vec<u8>],
+        hash: impl Fn(&[u8]) -> u64,
+    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
+        // Sweep work grows with arrivals so wide batches cannot outrun reclamation.
+        self.sweep_dead_entries(rows.len().saturating_mul(4).max(1024));
         let mut builder = self.store.builder();
         let mut result = Vec::with_capacity(rows.len());
         let mut owners = Manifest::default();

From 7689eca484e2d1cc90965eaaef697996ee357285 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 23:08:46 -0400
Subject: [PATCH 07/31] storage: resolve payload equality without a persistent
 interner

---
 .../materialize/parallel_workload/action.py   |   1 +
 .../upsert_continual_feedback_v2/payload.rs   | 157 ++++---
 src/timely-util/Cargo.toml                    |   1 +
 src/timely-util/src/columnar/chunk.rs         |   6 +-
 src/timely-util/src/columnar/payload.rs       |  50 ++-
 .../src/columnar/payload/logical.rs           | 408 ++++++++++++++++++
 src/timely-util/src/out_of_core.rs            |   4 +-
 src/timely-util/src/out_of_core/payload.rs    | 288 +++++--------
 8 files changed, 672 insertions(+), 243 deletions(-)
 create mode 100644 src/timely-util/src/columnar/payload/logical.rs

diff --git a/misc/python/materialize/parallel_workload/action.py b/misc/python/materialize/parallel_workload/action.py
index 7dfdac8e99ccd..91a93c5e646c0 100644
--- a/misc/python/materialize/parallel_workload/action.py
+++ b/misc/python/materialize/parallel_workload/action.py
@@ -3179,6 +3179,7 @@ def __init__(
         ]
         self.flags_with_values["enable_upsert_paged_spill"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_chunked_stash"] = BOOLEAN_FLAG_VALUES
+        self.flags_with_values["enable_upsert_payload_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_async_reads"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_payload_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_column_chunk_direct_compressed_output"] = (
diff --git a/src/storage/src/upsert_continual_feedback_v2/payload.rs b/src/storage/src/upsert_continual_feedback_v2/payload.rs
index 10c871b88ee49..a9f4a1f8660d6 100644
--- a/src/storage/src/upsert_continual_feedback_v2/payload.rs
+++ b/src/storage/src/upsert_continual_feedback_v2/payload.rs
@@ -11,11 +11,12 @@
 //!
 //! Source commands keep rows inline until offset consolidation chooses winners.
 //! The source batcher then writes those rows to the shared payload store. Persist
-//! feedback uses exact byte interning so insertions and retractions of the same
-//! row have the same metadata identity even when they arrive in different batches.
+//! feedback stores fingerprints alongside independent row locators. Logical
+//! consolidation compares payload bytes when matching fingerprints need resolution.
 //!
 //! Handles do not own rows. Manifests carry that ownership alongside metadata.
-//! Draining probes feedback in bounded key windows and decodes only emitted rows.
+//! Draining probes feedback in key windows, resolves logical equality, and decodes
+//! surviving rows for output.
 //! See [`super::upsert_inner`] for the frontier and eligibility protocol.
 
 use std::collections::{BTreeMap, VecDeque};
@@ -35,13 +36,14 @@ use mz_timely_util::builder_async::{
     Event as AsyncEvent, OperatorBuilder as AsyncOperatorBuilder, PressOnDropButton,
 };
 use mz_timely_util::columnar::Column;
-use mz_timely_util::columnar::batcher::ColumnChunker;
 use mz_timely_util::columnar::payload::{
     PayloadChunk, PayloadChunker, PayloadLayout, PayloadStaging,
 };
 use mz_timely_util::columnar::unload::UnloadBatch;
-use mz_timely_util::out_of_core::{Manifest, PayloadInterner, ReadLease, RowHandle, Store};
-use timely::container::{CapacityContainerBuilder, ContainerBuilder, PushInto};
+use mz_timely_util::out_of_core::{
+    Manifest, PayloadComparator, PayloadRef, ReadLease, RowHandle, Store,
+};
+use timely::container::{CapacityContainerBuilder, PushInto};
 use timely::dataflow::channels::pact::Pipeline;
 use timely::dataflow::operators::Capability;
 use timely::dataflow::{Stream, StreamVec};
@@ -56,7 +58,7 @@ use super::{
 use crate::upsert::{UpsertKey, UpsertValue};
 
 const BLOCK_BYTES: usize = 2 << 20;
-// A drain retains two decoded blocks, and feedback interning retains one.
+// A drain retains two decoded blocks.
 // Eight blocks leave room to acquire the next read without exhausting admission.
 const READ_BUDGET_BYTES: usize = 8 * BLOCK_BYTES;
 const READ_CONCURRENCY: usize = 2;
@@ -89,10 +91,25 @@ fn visit(value: columnar::Ref<'_, Value>, rows: &mut Vec<RowHandle>) {
 /// Feedback stores the payload handle alongside the key, with an additive diff.
 pub(super) struct FeedbackLayout;
 impl PayloadLayout for FeedbackLayout {
-    type Data = (UpsertKey, Value);
+    type Data = (UpsertKey, (u64, Value));
     type Diff = Diff;
+    const COMPARE_PAYLOADS: bool = true;
+
+    fn compare<'a>(
+        (ka, (ha, a)): columnar::Ref<'a, Self::Data>,
+        (kb, (hb, b)): columnar::Ref<'a, Self::Data>,
+        owners: &[&Manifest],
+        cache: &mut PayloadComparator,
+    ) -> std::cmp::Ordering {
+        ka.cmp(kb).then_with(|| ha.cmp(hb)).then_with(|| {
+            cache
+                .compare(payload_ref(a), payload_ref(b), owners)
+                .expect("feedback payloads remain owned")
+        })
+    }
+
     fn visit(
-        (_, value): columnar::Ref<'_, Self::Data>,
+        (_, (_, value)): columnar::Ref<'_, Self::Data>,
         _: columnar::Ref<'_, Diff>,
         rows: &mut Vec<RowHandle>,
     ) {
@@ -100,6 +117,20 @@ impl PayloadLayout for FeedbackLayout {
     }
 }
 
+fn payload_ref(value: columnar::Ref<'_, Value>) -> PayloadRef<'_> {
+    match value {
+        ValueReference::External(row) => PayloadRef::External(RowHandle::into_owned(row)),
+        ValueReference::Inline(row) => PayloadRef::Inline(row.data()),
+    }
+}
+
+fn fingerprint(row: &Row) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    row.data().hash(&mut hasher);
+    hasher.finish()
+}
+
 /// Source commands carry their payload in the maximum-offset difference.
 pub(super) struct SourceLayout<O>(PhantomData<O>);
 impl<O: Columnar> PayloadLayout for SourceLayout<O> {
@@ -334,7 +365,7 @@ where
     }
 }
 
-/// Look up consolidated feedback for sorted keys without decoding their payloads.
+/// Look up logical feedback values for sorted keys, resolving equal fingerprints.
 ///
 /// The caller must probe only keys eligible at the current persist frontier.
 /// At that frontier, each key has at most one value with multiplicity one.
@@ -346,8 +377,7 @@ where
     T: Timestamp + Lattice + Columnar + Default,
     for<'a> columnar::Ref<'a, T>: Copy + Ord,
 {
-    let mut hits: BTreeMap<(UpsertKey, Value), Diff> = BTreeMap::new();
-    let mut staging = PayloadStaging::<((UpsertKey, Value), T, Diff)>::default();
+    let mut staging = PayloadStaging::<((UpsertKey, (u64, Value)), T, Diff)>::default();
     if !keys.is_empty() {
         let probes = UpsertKey::as_columns(keys);
         for batch in batches {
@@ -355,31 +385,41 @@ where
                 .extract_into_async(probes.borrow(), &mut staging)
                 .await;
         }
-        let rows = staging.updates.borrow();
-        for index in 0..rows.len() {
-            let ((key, value), _, diff) = rows.get(index);
-            *hits
-                .entry((*key, Value::into_owned(value)))
-                .or_insert(Diff::ZERO) += Diff::into_owned(diff);
-        }
     }
-    let owners = Manifest::retain(
-        hits.keys().filter_map(|(_, value)| match value {
-            Value::External(row) => Some(*row),
-            Value::Inline(_) => None,
-        }),
-        staging.owners.iter().map(|owner| &**owner),
-    )
-    .expect("probe results retain payload ownership");
-    let owners = Rc::new(owners);
+    let owners: Vec<_> = staging.owners.iter().map(|owner| &**owner).collect();
+    let mut hits = Column::default();
+    let rows = staging.updates.borrow();
+    for index in 0..rows.len() {
+        let ((key, (hash, value)), _, diff) = rows.get(index);
+        hits.push_into(&(
+            (*key, (*hash, Value::into_owned(value))),
+            T::default(),
+            Diff::into_owned(diff),
+        ));
+    }
+    // Eligible feedback is read as a collection at its completed frontier.
+    // Distinct physical copies must cancel across trace batches as well as within them.
+    let hits = FeedbackChunk::<T>::consolidate(hits, &owners);
     let mut previous_values = BTreeMap::new();
-    for ((key, value), diff) in hits {
+    let rows = hits.borrow();
+    for index in 0..rows.len() {
+        let ((key, (_, value)), _, diff) = rows.get(index);
         if diff.is_positive() {
             assert_eq!(diff, Diff::ONE, "feedback value multiplicity");
-            let previous = previous_values.insert(key, value);
+            let previous = previous_values.insert(*key, Value::into_owned(value));
             assert!(previous.is_none(), "multiple feedback values for one key");
         }
     }
+    let owners = Rc::new(
+        Manifest::retain(
+            previous_values.values().filter_map(|value| match value {
+                Value::External(row) => Some(*row),
+                Value::Inline(_) => None,
+            }),
+            owners,
+        )
+        .expect("probe results retain payload ownership"),
+    );
     (previous_values, owners)
 }
 
@@ -432,7 +472,7 @@ impl ValueDecoder {
     }
 }
 
-/// Intern feedback rows before arranging them, retaining their input capabilities.
+/// Pack sorted feedback rows into independent payload blocks.
 pub(super) fn encode_feedback<'scope, T>(
     input: Stream<'scope, T, Column<((UpsertKey, Row), T, Diff)>>,
     store: Store,
@@ -451,36 +491,45 @@ where
     let mut input = builder.new_input_for(input, Pipeline, &output);
     let button = builder.build(move |caps| async move {
         drop(caps);
-        let mut interner = PayloadInterner::new(store.clone());
-        let mut chunker: ColumnChunker<((UpsertKey, Value), T, Diff)> = Default::default();
         while let Some(event) = input.next().await {
             if let AsyncEvent::Data(cap, column) = event {
                 let view = column.borrow();
-                let rows: Vec<_> = (0..view.len())
-                    .map(|i| <((UpsertKey, Row), T, Diff)>::into_owned(view.get(i)))
-                    .collect();
-                let bytes: Vec<_> = rows
-                    .iter()
-                    .filter(|((_, row), _, _)| store.can_store(row.byte_len()))
-                    .map(|((_, row), _, _)| row.data().to_vec())
+                let mut rows: Vec<_> = (0..view.len())
+                    .map(|i| {
+                        let ((key, row), time, diff) =
+                            <((UpsertKey, Row), T, Diff)>::into_owned(view.get(i));
+                        ((key, (fingerprint(&row), row)), time, diff)
+                    })
                     .collect();
-                let (handles, owner) = interner
-                    .intern(&bytes)
-                    .await
-                    .expect("feedback payloads fit store");
-                let mut handles = handles.into_iter();
-                let mut metadata: Column<((UpsertKey, Value), T, Diff)> = Default::default();
-                for ((key, row), time, diff) in rows {
-                    let value = if !store.can_store(row.byte_len()) {
-                        Value::Inline(row)
+                // Sort while bytes are already resident, and pack in the same
+                // order to preserve locality for later exact comparisons.
+                rows.sort_by(|((ka, (ha, a)), ta, _), ((kb, (hb, b)), tb, _)| {
+                    (ka, ha, a.data(), ta).cmp(&(kb, hb, b.data(), tb))
+                });
+                rows.dedup_by(|next, previous| {
+                    if next.0 == previous.0 && next.1 == previous.1 {
+                        previous.2 += next.2;
+                        true
                     } else {
-                        Value::External(handles.next().expect("one handle per external row"))
+                        false
+                    }
+                });
+                let mut builder = store.builder();
+                let mut metadata = Column::default();
+                for ((key, (hash, row)), time, diff) in rows {
+                    if diff == Diff::ZERO {
+                        continue;
+                    }
+                    let value = if store.can_store(row.byte_len()) {
+                        Value::External(builder.push(row.data()).expect("feedback row fits block"))
+                    } else {
+                        Value::Inline(row)
                     };
-                    metadata.push_into(&((key, value), time, diff));
+                    metadata.push_into(&((key, (hash, value)), time, diff));
                 }
-                chunker.push_into(&mut metadata);
-                while let Some(column) = chunker.extract() {
-                    output.give(&cap, PayloadChunk::new(std::mem::take(column), &[&owner]));
+                let owner = builder.finish();
+                if !metadata.is_empty() {
+                    output.give(&cap, PayloadChunk::new(metadata, &[&owner]));
                 }
                 tokio::task::yield_now().await;
             }
diff --git a/src/timely-util/Cargo.toml b/src/timely-util/Cargo.toml
index b4c4a0bc57e74..68c3984db3161 100644
--- a/src/timely-util/Cargo.toml
+++ b/src/timely-util/Cargo.toml
@@ -52,6 +52,7 @@ uuid = { workspace = true, features = ["serde", "v4"] }
 allocation-counter = { workspace = true, optional = true }
 
 [dev-dependencies]
+mz-ore = { path = "../ore", default-features = false, features = ["panic"] }
 criterion.workspace = true
 itertools.workspace = true
 proptest.workspace = true
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 31d3b577a7ba3..e1346e6b262b0 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -380,7 +380,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
 
     /// Append byte-bounded pieces, preserving order and generational depth.
     /// A single update may exceed the bound because it cannot be split.
-    fn push_bounded(column: Column<(D, T, R)>, depth: u8, out: &mut VecDeque<Self>) {
+    pub(crate) fn push_bounded(column: Column<(D, T, R)>, depth: u8, out: &mut VecDeque<Self>) {
         let len = column.borrow().len();
         if len <= 1 || column.length_in_bytes() <= COMMIT_BYTES {
             if len > 0 {
@@ -441,7 +441,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
     }
 
     /// The generational depth, from resident state only.
-    fn depth(&self) -> u8 {
+    pub(crate) fn depth(&self) -> u8 {
         match self {
             ColumnChunk::Resident(_, depth) | ColumnChunk::Spilled(_, depth) => *depth,
         }
@@ -532,7 +532,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
     /// consumed. A shared body is skipped because re-spilling this reference
     /// cannot change what the other holder stores, and the compaction merger
     /// that shares bodies rewrites its clones immediately.
-    fn survive_merge(self) -> Self
+    pub(crate) fn survive_merge(self) -> Self
     where
         T: Timestamp,
     {
diff --git a/src/timely-util/src/columnar/payload.rs b/src/timely-util/src/columnar/payload.rs
index 3c420b9e1f688..be8fde5f4d74a 100644
--- a/src/timely-util/src/columnar/payload.rs
+++ b/src/timely-util/src/columnar/payload.rs
@@ -10,9 +10,9 @@
 //! Columnar metadata chunks with independently owned pool-backed payloads.
 //!
 //! [`PayloadLayout`] locates handles inside operator-defined data and differences.
-//! [`PayloadChunk`] delegates ordering, consolidation, and spilling to
-//! [`ColumnChunk`], then retains the blocks referenced by the resulting metadata.
-//! Rewrites can read metadata but never need to decode the external payloads.
+//! Layouts can resolve payloads to define logical ordering and consolidation.
+//! Metadata-only layouts use the native [`ColumnChunk`] merge. Both paths retain
+//! the blocks referenced by surviving updates and spill metadata through the pool.
 //!
 //! [`PayloadStaging`] carries ownership alongside copied probe results so callers
 //! can release a trace batch before reading its rows. Locators are physical
@@ -31,7 +31,9 @@ use timely::progress::frontier::{Antichain, AntichainRef};
 
 use crate::columnar::Column;
 use crate::columnar::chunk::ColumnChunk;
-use crate::out_of_core::{Manifest, RowHandle};
+use crate::out_of_core::{Manifest, PayloadComparator, RowHandle};
+
+mod logical;
 
 /// Identifies every external payload referenced by a metadata update.
 pub trait PayloadLayout: 'static {
@@ -39,6 +41,26 @@ pub trait PayloadLayout: 'static {
     type Data: Columnar;
     /// Columnar difference used for consolidation.
     type Diff: Columnar;
+    /// Enable the custom comparison during trace maintenance. When false,
+    /// the native columnar merge and advancement paths apply.
+    const COMPARE_PAYLOADS: bool = false;
+
+    /// Compare logical data, independently of its physical payload locations.
+    ///
+    /// Must define a total order with equality matching consolidation semantics.
+    /// The order must keep probe keys ascending. All chunk producers must use it.
+    fn compare<'a>(
+        left: columnar::Ref<'a, Self::Data>,
+        right: columnar::Ref<'a, Self::Data>,
+        _owners: &[&Manifest],
+        _cache: &mut PayloadComparator,
+    ) -> std::cmp::Ordering
+    where
+        for<'b> columnar::Ref<'b, Self::Data>: Ord,
+    {
+        left.cmp(&right)
+    }
+
     /// Append every external locator referenced by this update, including those
     /// carried in the difference. Duplicates are allowed. Omitting a locator can
     /// retire its block while the update still refers to it.
@@ -96,7 +118,7 @@ where
     for<'a> columnar::Ref<'a, T>: Copy + Ord,
     P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
 {
-    /// Attach ownership to sorted, consolidated metadata.
+    /// Attach ownership to metadata sorted and consolidated by [`PayloadLayout::compare`].
     ///
     /// Panics if `owners` does not cover every locator reported by the layout.
     pub fn new(metadata: Column<(P::Data, T, P::Diff)>, owners: &[&Manifest]) -> Self {
@@ -159,6 +181,10 @@ where
     }
 
     fn merge(left: &mut VecDeque<Self>, right: &mut VecDeque<Self>, output: &mut VecDeque<Self>) {
+        if P::COMPARE_PAYLOADS {
+            Self::merge_logical(left, right, output);
+            return;
+        }
         let a = left.pop_front().expect("nonempty merge input");
         let b = right.pop_front().expect("nonempty merge input");
         let owners = vec![a.manifest, b.manifest];
@@ -204,6 +230,10 @@ where
         done: bool,
         output: &mut VecDeque<Self>,
     ) {
+        if P::COMPARE_PAYLOADS {
+            Self::advance_logical(input, frontier, done, output);
+            return;
+        }
         let mut owners = Vec::new();
         let mut columns = Self::detach_metadata(input, &mut owners);
         let mut out = VecDeque::new();
@@ -335,7 +365,7 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::out_of_core::{PayloadInterner, Store};
+    use crate::out_of_core::Store;
     use timely::container::PushInto;
 
     struct Layout;
@@ -352,8 +382,12 @@ mod tests {
         let pool = mz_ore::pool::Pool::new().unwrap();
         pool.set_budget(0);
         let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
-        let mut interner = PayloadInterner::new(store.clone());
-        let (ids, owner) = interner.intern(&[vec![1; 96], vec![2; 96]]).await.unwrap();
+        let mut builder = store.builder();
+        let ids = [
+            builder.push(&[1; 96]).unwrap(),
+            builder.push(&[2; 96]).unwrap(),
+        ];
+        let owner = builder.finish();
         let make = |updates: &[((u64, RowHandle), u64, i64)]| {
             let mut column = Column::default();
             for update in updates {
diff --git a/src/timely-util/src/columnar/payload/logical.rs b/src/timely-util/src/columnar/payload/logical.rs
new file mode 100644
index 0000000000000..f87fb480d611a
--- /dev/null
+++ b/src/timely-util/src/columnar/payload/logical.rs
@@ -0,0 +1,408 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Chunk operations whose logical data order can differ from locator order.
+
+use std::cmp::Ordering;
+use std::collections::VecDeque;
+use std::rc::Rc;
+
+use columnar::{Borrow, Columnar, Container, Index, Len, Push};
+use differential_dataflow::difference::{IsZero, Semigroup};
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::trace::chunk::Chunk;
+use timely::progress::Timestamp;
+use timely::progress::frontier::AntichainRef;
+
+use super::{PayloadChunk, PayloadLayout};
+use crate::columnar::Column;
+use crate::columnar::chunk::ColumnChunk;
+use crate::out_of_core::{Manifest, PayloadComparator};
+
+impl<P, T> PayloadChunk<P, T>
+where
+    P: PayloadLayout,
+    for<'a> columnar::Ref<'a, P::Data>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    P::Diff: Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, P::Diff>>,
+{
+    /// Sort and consolidate one resident column by the layout's logical order.
+    /// Scratch grows with this column, so callers must bound their input batches.
+    pub fn consolidate(
+        column: Column<(P::Data, T, P::Diff)>,
+        owners: &[&Manifest],
+    ) -> Column<(P::Data, T, P::Diff)> {
+        let view = column.borrow();
+        let mut cache = PayloadComparator::default();
+        let mut order: Vec<_> = (0..view.len()).collect();
+        order.sort_by(|a, b| {
+            let (a, ta, _) = view.get(*a);
+            let (b, tb, _) = view.get(*b);
+            P::compare(a, b, owners, &mut cache).then_with(|| ta.cmp(&tb))
+        });
+        let mut result = <(P::Data, T, P::Diff) as Columnar>::Container::default();
+        let mut indices = order.into_iter().peekable();
+        while let Some(index) = indices.next() {
+            let (data, time, diff) = view.get(index);
+            let mut diff = P::Diff::into_owned(diff);
+            while let Some(next) = indices.peek() {
+                let (next_data, next_time, next_diff) = view.get(*next);
+                if time != next_time
+                    || P::compare(data, next_data, owners, &mut cache) != Ordering::Equal
+                {
+                    break;
+                }
+                diff.plus_equals(&next_diff);
+                indices.next();
+            }
+            if !diff.is_zero() {
+                result.0.push(data);
+                result.1.push(time);
+                result.2.push(&diff);
+            }
+        }
+        Column::Typed(result)
+    }
+
+    fn publish(
+        column: Column<(P::Data, T, P::Diff)>,
+        depth: u8,
+        owners: &[&Manifest],
+        output: &mut VecDeque<Self>,
+    ) {
+        let mut pieces = VecDeque::new();
+        ColumnChunk::push_bounded(column, depth, &mut pieces);
+        output.extend(pieces.into_iter().map(|piece| Self::attach(piece, owners)));
+    }
+
+    pub(super) fn merge_logical(
+        left: &mut VecDeque<Self>,
+        right: &mut VecDeque<Self>,
+        output: &mut VecDeque<Self>,
+    ) {
+        let a = left.front().expect("nonempty input");
+        let b = right.front().expect("nonempty input");
+        let owners = [a.manifest(), b.manifest()];
+        let mut cache = PayloadComparator::default();
+        if P::compare(a.data_span().1, b.data_span().0, &owners, &mut cache) == Ordering::Less {
+            let mut chunk = left.pop_front().expect("observed front");
+            chunk.metadata = chunk.metadata.survive_merge();
+            output.push_back(chunk);
+            return;
+        }
+        if P::compare(b.data_span().1, a.data_span().0, &owners, &mut cache) == Ordering::Less {
+            let mut chunk = right.pop_front().expect("observed front");
+            chunk.metadata = chunk.metadata.survive_merge();
+            output.push_back(chunk);
+            return;
+        }
+        let a = left.pop_front().expect("observed front");
+        let b = right.pop_front().expect("observed front");
+        let depths = [a.metadata.depth(), b.metadata.depth()];
+        let owners = [a.manifest(), b.manifest()];
+        let ca = a.metadata();
+        let cb = b.metadata();
+        let (va, vb) = (ca.borrow(), cb.borrow());
+        let (mut i, mut j) = (0, 0);
+        let mut result = <(P::Data, T, P::Diff) as Columnar>::Container::default();
+        // Stop when either front ends. Its next chunk can continue the same
+        // logical value, so emitting the other front's tail would miss cancellation.
+        while i < va.len() && j < vb.len() {
+            let (da, ta, ra) = va.get(i);
+            let (db, tb, rb) = vb.get(j);
+            let comparison = P::compare(da, db, &owners, &mut cache).then_with(|| ta.cmp(&tb));
+            let (data, time, diff) = match comparison {
+                Ordering::Less => {
+                    i += 1;
+                    (da, ta, P::Diff::into_owned(ra))
+                }
+                Ordering::Greater => {
+                    j += 1;
+                    (db, tb, P::Diff::into_owned(rb))
+                }
+                Ordering::Equal => {
+                    i += 1;
+                    j += 1;
+                    let mut diff = P::Diff::into_owned(ra);
+                    diff.plus_equals(&rb);
+                    (da, ta, diff)
+                }
+            };
+            if !diff.is_zero() {
+                result.0.push(data);
+                result.1.push(time);
+                result.2.push(&diff);
+            }
+        }
+        Self::publish(
+            Column::Typed(result),
+            depths[0].max(depths[1]).saturating_add(1),
+            &owners,
+            output,
+        );
+        for (view, index, depth, queue) in [(va, i, depths[0], left), (vb, j, depths[1], right)] {
+            if index < view.len() {
+                let mut rest = <(P::Data, T, P::Diff) as Columnar>::Container::default();
+                rest.extend_from_self(view, index..view.len());
+                queue.push_front(Self::attach(
+                    ColumnChunk::Resident(Rc::new(Column::Typed(rest)), depth),
+                    &owners,
+                ));
+            }
+        }
+    }
+
+    pub(super) fn advance_logical(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<T>,
+        done: bool,
+        output: &mut VecDeque<Self>,
+    ) {
+        let mut columns = <(P::Data, T, P::Diff) as Columnar>::Container::default();
+        let mut owners = Vec::new();
+        let mut depth = 0;
+        for chunk in input.drain(..) {
+            depth = depth.max(chunk.metadata.depth());
+            let column = chunk.metadata();
+            let view = column.borrow();
+            columns.extend_from_self(view, 0..view.len());
+            owners.push(chunk.manifest);
+        }
+        let owners: Vec<_> = owners.iter().map(|owner| &**owner).collect();
+        let view = columns.borrow();
+        if view.is_empty() {
+            return;
+        }
+        let mut cache = PayloadComparator::default();
+        let mut canonical = <(P::Data, T, P::Diff) as Columnar>::Container::default();
+        let mut representative = view.get(0).0;
+        for index in 0..view.len() {
+            let (data, time, diff) = view.get(index);
+            if P::compare(representative, data, &owners, &mut cache) != Ordering::Equal {
+                representative = data;
+            }
+            canonical.0.push(representative);
+            canonical.1.push(time);
+            canonical.2.push(diff);
+        }
+        drop(cache);
+        // One representative per adjacent logical group lets native advancement
+        // identify equal data without reading payloads. It sorts only times within
+        // each group, preserving the layout's logical data order.
+        let mut columns = VecDeque::from([ColumnChunk::Resident(
+            Rc::new(Column::Typed(canonical)),
+            depth,
+        )]);
+        let mut advanced = VecDeque::new();
+        ColumnChunk::advance(&mut columns, frontier, done, &mut advanced);
+        input.extend(
+            columns
+                .into_iter()
+                .map(|column| Self::attach(column, &owners)),
+        );
+        output.extend(
+            advanced
+                .into_iter()
+                .map(|column| Self::attach(column, &owners)),
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use mz_ore::pool::{IDENTITY_CODEC, Pool};
+    use timely::container::PushInto;
+    use timely::order::Product;
+
+    use super::*;
+    use crate::out_of_core::{PayloadRef, RowHandle, Store};
+    use timely::progress::Antichain;
+
+    struct Logical;
+    impl PayloadLayout for Logical {
+        type Data = (u64, RowHandle);
+        type Diff = i64;
+        // All values for a key deliberately share a fingerprint.
+        const COMPARE_PAYLOADS: bool = true;
+        fn compare<'a>(
+            (ka, a): columnar::Ref<'a, Self::Data>,
+            (kb, b): columnar::Ref<'a, Self::Data>,
+            owners: &[&Manifest],
+            cache: &mut PayloadComparator,
+        ) -> Ordering {
+            ka.cmp(kb).then_with(|| {
+                cache
+                    .compare(
+                        PayloadRef::External(RowHandle::into_owned(a)),
+                        PayloadRef::External(RowHandle::into_owned(b)),
+                        owners,
+                    )
+                    .unwrap()
+            })
+        }
+        fn visit((_, row): columnar::Ref<'_, Self::Data>, _: &i64, rows: &mut Vec<RowHandle>) {
+            rows.push(RowHandle::into_owned(row));
+        }
+    }
+
+    fn make<T>(store: &Store, updates: &[(u64, u64, T, i64)]) -> PayloadChunk<Logical, T>
+    where
+        T: Columnar + Default + Timestamp + Lattice,
+        for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    {
+        let mut builder = store.builder();
+        let mut column = Column::default();
+        for (key, value, time, diff) in updates {
+            let mut bytes = [0; 96];
+            bytes[..8].copy_from_slice(&value.to_be_bytes());
+            let row = builder.push(&bytes).unwrap();
+            column.push_into(&((*key, row), time.clone(), *diff));
+        }
+        let owner = builder.finish();
+        let column = PayloadChunk::<Logical, T>::consolidate(column, &[&owner]);
+        PayloadChunk::new(column, &[&owner])
+    }
+
+    fn merge<T>(
+        mut a: VecDeque<PayloadChunk<Logical, T>>,
+        mut b: VecDeque<PayloadChunk<Logical, T>>,
+    ) -> VecDeque<PayloadChunk<Logical, T>>
+    where
+        T: Columnar + Default + Timestamp + Lattice,
+        for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    {
+        let mut output = VecDeque::new();
+        while !a.is_empty() && !b.is_empty() {
+            PayloadChunk::merge(&mut a, &mut b, &mut output);
+        }
+        output.extend(a);
+        output.extend(b);
+        output
+    }
+
+    #[mz_ore::test]
+    fn independent_locations_cancel_across_chunk_boundaries() {
+        let pool = Pool::new().unwrap();
+        pool.set_budget(0);
+        let store = Store::new(pool.clone(), 128, 256, 1, &IDENTITY_CODEC).unwrap();
+        let a = VecDeque::from([
+            make(&store, &[(0, 3, 0u64, 1)]),
+            make(&store, &[(0, 4, 0, 1), (1, 9, 0, 1)]),
+        ]);
+        let b = VecDeque::from([
+            make(&store, &[(0, 3, 0, -1), (0, 4, 0, -1)]),
+            make(&store, &[(1, 9, 0, -1)]),
+        ]);
+        let inserts = pool.stats().inserts;
+        assert!(merge(a, b).is_empty());
+        assert_eq!(
+            pool.stats().inserts,
+            inserts,
+            "merging must not rewrite payloads"
+        );
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+
+    #[mz_ore::test]
+    fn cancellation_reads_spilled_metadata_and_releases_all_blocks() {
+        let pool = Pool::new().unwrap();
+        pool.set_budget(0);
+        pool.set_rss_target(1 << 20);
+        crate::columnar::chunk::with_spill_override(pool.clone(), || {
+            let store = Store::new(
+                pool.clone(),
+                4096,
+                8192,
+                1,
+                &crate::columnar::chunk::LZ4_CODEC,
+            )
+            .unwrap();
+            let positives: Vec<_> = (0..4096).map(|value| (0, value, 0u64, 1)).collect();
+            let negatives: Vec<_> = positives
+                .iter()
+                .map(|(key, value, time, _)| (*key, *value, *time, -1))
+                .collect();
+            let mut a = VecDeque::new();
+            let mut b = VecDeque::new();
+            PayloadChunk::settle(
+                &mut VecDeque::from([make(&store, &positives)]),
+                true,
+                &mut a,
+            );
+            PayloadChunk::settle(
+                &mut VecDeque::from([make(&store, &negatives)]),
+                true,
+                &mut b,
+            );
+            assert!(a.iter().chain(&b).all(|chunk| chunk.metadata.is_spilled()));
+            let inserts = pool.stats().inserts;
+            assert!(merge(a, b).is_empty());
+            assert_eq!(pool.stats().inserts, inserts);
+            assert_eq!(pool.stats().live_chunks, 0);
+        });
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn colliding_values_survive_and_advance_matches_reference() {
+        let pool = Pool::new().unwrap();
+        pool.set_budget(0);
+        let store = Store::new(pool.clone(), 128, 256, 1, &IDENTITY_CODEC).unwrap();
+        let mut actual = VecDeque::new();
+        let mut expected = BTreeMap::new();
+        let frontier = Antichain::from(vec![Product::new(3u64, 0u64), Product::new(0, 3)]);
+        for run in 0..12 {
+            let updates: Vec<_> = (0..70)
+                .map(|index| {
+                    let key = index % 3;
+                    let value = (index * 7 + run) % 19;
+                    let mut time = Product::new(index % 5, (index + run) % 5);
+                    let original = time;
+                    time.advance_by(frontier.borrow());
+                    let diff = if (index + run) % 3 == 0 { -1 } else { 1 };
+                    *expected.entry((key, value, time)).or_insert(0) += diff;
+                    (key, value, original, diff)
+                })
+                .collect();
+            actual = merge(actual, VecDeque::from([make(&store, &updates)]));
+        }
+        expected.retain(|_, diff| *diff != 0);
+        let mut carry = VecDeque::new();
+        let mut advanced = VecDeque::new();
+        for chunk in actual {
+            carry.push_back(chunk);
+            PayloadChunk::advance(&mut carry, frontier.borrow(), false, &mut advanced);
+        }
+        PayloadChunk::advance(&mut carry, frontier.borrow(), true, &mut advanced);
+        let mut decoded = BTreeMap::new();
+        for chunk in advanced {
+            let column = chunk.metadata();
+            let view = column.borrow();
+            for index in 0..view.len() {
+                let ((key, row), time, diff) = view.get(index);
+                let row = RowHandle::into_owned(row);
+                let lease = store
+                    .prepare_read([(chunk.manifest(), row)])
+                    .unwrap()
+                    .read()
+                    .await;
+                let value = u64::from_be_bytes(lease.get(row).unwrap()[..8].try_into().unwrap());
+                assert!(
+                    decoded
+                        .insert((*key, value, Product::into_owned(time)), *diff)
+                        .is_none()
+                );
+            }
+        }
+        assert_eq!(decoded, expected);
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+}
diff --git a/src/timely-util/src/out_of_core.rs b/src/timely-util/src/out_of_core.rs
index 703158550e074..0c6796f11541e 100644
--- a/src/timely-util/src/out_of_core.rs
+++ b/src/timely-util/src/out_of_core.rs
@@ -26,8 +26,8 @@ mod payload;
 pub use batch::{Batch, Record};
 pub use operators::{JoinCursor, JoinMatch, JoinStep, LatestCursor, SelectionStep};
 pub use payload::{
-    Manifest, PayloadBuilder, PayloadInterner, ReadLease, ReadRequest, RowHandle, Store,
-    StoreError, StoreStats,
+    Manifest, PayloadBuilder, PayloadComparator, PayloadRef, ReadLease, ReadRequest, RowHandle,
+    Store, StoreError, StoreStats,
 };
 
 #[cfg(test)]
diff --git a/src/timely-util/src/out_of_core/payload.rs b/src/timely-util/src/out_of_core/payload.rs
index 2c24ae476fe0c..48b68b2a2c1e5 100644
--- a/src/timely-util/src/out_of_core/payload.rs
+++ b/src/timely-util/src/out_of_core/payload.rs
@@ -15,8 +15,8 @@
 //! decoded bytes and their admission reservation until the consumer releases it.
 //!
 //! The pool governs resident storage. This module separately budgets decoded
-//! copies returned by reads. Builder scratch, manifests, and the interner's
-//! equality index are not charged to that decoded-byte budget.
+//! copies returned by reads. Builder scratch, manifests, and synchronous comparison
+//! buffers are not charged to that decoded-byte budget.
 
 use std::collections::BTreeMap;
 use std::fmt;
@@ -387,201 +387,137 @@ impl ReadLease {
     }
 }
 
-/// Operator-local exact payload identities, with weak ownership of stored blocks.
-///
-/// Fingerprints select candidates only. Reuse requires byte equality. Dead entries
-/// are swept incrementally, and the index itself remains resident.
-pub struct PayloadInterner {
-    store: Store,
-    entries: BTreeMap<(u64, RowHandle), std::sync::Weak<Block>>,
-    sweep_after: Option<(u64, RowHandle)>,
+/// A payload borrowed inline or addressed through an owning manifest.
+#[derive(Clone, Copy)]
+pub enum PayloadRef<'a> {
+    /// Bytes already available to the caller.
+    Inline(&'a [u8]),
+    /// Bytes resolved through the manifests supplied to the comparison.
+    External(RowHandle),
 }
 
-impl PayloadInterner {
-    /// Create an independent identity domain over a shared payload store.
-    pub fn new(store: Store) -> Self {
-        Self {
-            store,
-            entries: BTreeMap::new(),
-            sweep_after: None,
-        }
-    }
+/// Exact byte comparisons for synchronous trace maintenance.
+///
+/// Retains at most two decoded blocks. These call-scoped buffers are outside
+/// asynchronous read admission. A cache miss blocks the caller on the pool read.
+/// TODO: Drive comparisons through resumable merge work and shared read admission.
+#[derive(Default)]
+pub struct PayloadComparator {
+    left: ComparisonBlock,
+    right: ComparisonBlock,
+}
 
-    /// Store a batch, reusing the identity of any live, byte-identical payload.
-    pub async fn intern(
+impl PayloadComparator {
+    /// Compare payload contents, resolving external rows through `owners`.
+    pub fn compare(
         &mut self,
-        rows: &[Vec<u8>],
-    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
-        use std::hash::{Hash, Hasher};
-        self.intern_hashed(rows, |row| {
-            let mut hasher = std::collections::hash_map::DefaultHasher::new();
-            row.hash(&mut hasher);
-            hasher.finish()
-        })
-        .await
-    }
-
-    fn sweep_dead_entries(&mut self, budget: usize) {
-        use std::ops::Bound::{Excluded, Unbounded};
-        let keys: Vec<_> = self
-            .entries
-            .range((self.sweep_after.map_or(Unbounded, Excluded), Unbounded))
-            .take(budget)
-            .map(|(key, _)| *key)
-            .collect();
-        self.sweep_after = if keys.last() == self.entries.last_key_value().map(|(key, _)| key) {
-            None
-        } else {
-            keys.last().copied()
-        };
-        for key in keys {
-            if self.entries[&key].strong_count() == 0 {
-                self.entries.remove(&key);
+        left: PayloadRef<'_>,
+        right: PayloadRef<'_>,
+        owners: &[&Manifest],
+    ) -> Result<std::cmp::Ordering, StoreError> {
+        if let (PayloadRef::External(a), PayloadRef::External(b)) = (left, right) {
+            if a == b {
+                return Ok(std::cmp::Ordering::Equal);
             }
         }
+        Ok(self
+            .left
+            .resolve(left, owners)?
+            .cmp(self.right.resolve(right, owners)?))
     }
+}
 
-    async fn intern_hashed(
-        &mut self,
-        rows: &[Vec<u8>],
-        hash: impl Fn(&[u8]) -> u64,
-    ) -> Result<(Vec<RowHandle>, Manifest), StoreError> {
-        // Sweep work grows with arrivals so wide batches cannot outrun reclamation.
-        self.sweep_dead_entries(rows.len().saturating_mul(4).max(1024));
-        let mut builder = self.store.builder();
-        let mut result = Vec::with_capacity(rows.len());
-        let mut owners = Manifest::default();
-        let mut fresh: BTreeMap<u64, Vec<usize>> = BTreeMap::new();
-        let mut cached: Option<ReadLease> = None;
-        for (index, bytes) in rows.iter().enumerate() {
-            let fingerprint = hash(bytes);
-            if let Some(prior) = fresh
-                .get(&fingerprint)
-                .and_then(|indices| indices.iter().find(|i| rows[**i] == *bytes))
-            {
-                result.push(result[*prior]);
-                continue;
-            }
-            let mut found = None;
-            let lower = (
-                fingerprint,
-                RowHandle {
-                    block: 0,
-                    offset: 0,
-                },
-            );
-            let upper = (
-                fingerprint,
-                RowHandle {
-                    block: u64::MAX,
-                    offset: u32::MAX,
-                },
-            );
-            for ((_, row), owner) in self.entries.range(lower..=upper) {
-                let Some(owner) = owner.upgrade() else {
-                    continue;
-                };
-                if cached.as_ref().is_none_or(|lease| lease.get(*row).is_err()) {
-                    // Release the previous reservation before awaiting another block.
-                    drop(cached.take());
-                    let manifest = Manifest {
-                        blocks: BTreeMap::from([(row.block, Arc::clone(&owner))]),
-                    };
-                    cached = Some(self.store.prepare_read([(&manifest, *row)])?.read().await);
-                }
-                if cached.as_ref().expect("loaded candidate").get(*row)? == bytes {
-                    owners.blocks.insert(row.block, owner);
-                    found = Some(*row);
-                    break;
-                }
-            }
-            if let Some(row) = found {
-                result.push(row);
-            } else {
-                result.push(builder.push(bytes)?);
-                fresh.entry(fingerprint).or_default().push(index);
-            }
-        }
-        let fresh_owners = builder.finish();
-        for (hash, indices) in fresh {
-            for index in indices {
-                let row = result[index];
-                let owner = fresh_owners
-                    .blocks
-                    .get(&row.block)
-                    .expect("published payload");
-                self.entries.insert((hash, row), Arc::downgrade(owner));
-            }
+#[derive(Default)]
+struct ComparisonBlock {
+    block: Option<u64>,
+    words: Vec<u64>,
+}
+
+impl ComparisonBlock {
+    fn resolve<'a>(
+        &'a mut self,
+        value: PayloadRef<'a>,
+        owners: &[&Manifest],
+    ) -> Result<&'a [u8], StoreError> {
+        let row = match value {
+            PayloadRef::Inline(bytes) => return Ok(bytes),
+            PayloadRef::External(row) => row,
+        };
+        if self.block != Some(row.block) {
+            let owner = owners
+                .iter()
+                .find_map(|owner| owner.blocks.get(&row.block))
+                .ok_or(StoreError::UnownedRow)?;
+            owner.handle.read_into(&mut self.words);
+            self.block = Some(row.block);
         }
-        owners.blocks.extend(fresh_owners.blocks);
-        Ok((result, owners))
+        let offset = usize::cast_from(row.offset);
+        let len = usize::try_from(*self.words.get(offset).ok_or(StoreError::UnownedRow)?)
+            .map_err(|_| StoreError::UnownedRow)?;
+        bytemuck::cast_slice::<u64, u8>(&self.words[offset + 1..])
+            .get(..len)
+            .ok_or(StoreError::UnownedRow)
     }
 }
 
 #[cfg(test)]
-mod interner_tests {
+mod comparison_tests {
     use super::*;
 
-    #[mz_ore::test(tokio::test)]
-    async fn exact_identity_handles_collisions_and_weak_ownership() {
-        let pool = mz_ore::pool::Pool::new().unwrap();
+    #[mz_ore::test]
+    fn comparison_cache_stays_bounded_across_distinct_blocks() {
+        let pool = Pool::new().unwrap();
         pool.set_budget(0);
-        pool.set_rss_target(1 << 20);
         let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
-        let mut interner = PayloadInterner::new(store.clone());
-        let bytes = vec![b"first".to_vec(), b"second".to_vec(), b"first".to_vec()];
-        let (ids, owner) = interner.intern_hashed(&bytes, |_| 0).await.unwrap();
-        assert_eq!(ids[0], ids[2]);
-        assert_ne!(ids[0], ids[1]);
-        let (again, next_owner) = interner
-            .intern_hashed(&[bytes[1].clone(), bytes[0].clone()], |_| 0)
-            .await
-            .unwrap();
-        assert_eq!(again, vec![ids[1], ids[0]]);
+        let mut builder = store.builder();
+        let rows: Vec<_> = (0..200u8)
+            .map(|i| builder.push(&[i; 96]).unwrap())
+            .collect();
+        let owner = builder.finish();
+        let mut cache = PayloadComparator::default();
+        for pair in rows.windows(2) {
+            assert_eq!(
+                cache
+                    .compare(
+                        PayloadRef::External(pair[0]),
+                        PayloadRef::External(pair[1]),
+                        &[&owner]
+                    )
+                    .unwrap(),
+                std::cmp::Ordering::Less
+            );
+            assert!(cache.left.words.capacity() <= 16);
+            assert!(cache.right.words.capacity() <= 16);
+        }
+        let mut builder = store.builder();
+        let copy = builder.push(&[0; 96]).unwrap();
+        let copy_owner = builder.finish();
+        assert_eq!(
+            cache
+                .compare(
+                    PayloadRef::External(rows[0]),
+                    PayloadRef::External(copy),
+                    &[&owner, &copy_owner]
+                )
+                .unwrap(),
+            std::cmp::Ordering::Equal
+        );
+        assert_eq!(
+            cache
+                .compare(
+                    PayloadRef::Inline(&[0; 96]),
+                    PayloadRef::External(copy),
+                    &[&copy_owner]
+                )
+                .unwrap(),
+            std::cmp::Ordering::Equal
+        );
         drop(owner);
-        let lease = store
-            .prepare_read([(&next_owner, again[0]), (&next_owner, again[1])])
-            .unwrap()
-            .read()
-            .await;
-        assert_eq!(lease.get(again[0]).unwrap(), b"second");
-        assert_eq!(lease.get(again[1]).unwrap(), b"first");
-        drop(lease);
-        drop(next_owner);
+        drop(copy_owner);
         assert_eq!(
             pool.stats().live_chunks,
             0,
-            "the equality index must not own blocks"
+            "comparison cache must not own payload blocks"
         );
-        let (replacement, owner) = interner.intern_hashed(&bytes, |_| 0).await.unwrap();
-        assert_ne!(replacement[0], ids[0]);
-        assert_eq!(replacement[0], replacement[2]);
-        drop(owner);
-        assert_eq!(store.stats().charged_bytes, 0);
-    }
-    #[mz_ore::test(tokio::test)]
-    async fn equality_index_reclaims_dead_entries_during_large_batches() {
-        let pool = mz_ore::pool::Pool::new().unwrap();
-        let store = Store::new(pool.clone(), 128, 256, 1, &mz_ore::pool::IDENTITY_CODEC).unwrap();
-        let mut interner = PayloadInterner::new(store);
-        for epoch in 0..12u64 {
-            let rows: Vec<_> = (0..2048)
-                .map(|i| (epoch * 2048 + i).to_le_bytes().to_vec())
-                .collect();
-            let (_, owner) = interner
-                .intern_hashed(&rows, |row| u64::from_le_bytes(row.try_into().unwrap()))
-                .await
-                .unwrap();
-            assert!(
-                interner.entries.len() <= 4096,
-                "dead identities must not accumulate with each batch"
-            );
-            drop(owner);
-        }
-        for _ in 0..4 {
-            interner.intern(&[]).await.unwrap();
-        }
-        assert!(interner.entries.is_empty());
-        assert_eq!(pool.stats().live_chunks, 0);
     }
 }

From d169fb3c10c60057c26bd186bb60e232d8547dec Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 8 Sep 2026 23:24:30 -0400
Subject: [PATCH 08/31] timely-util: benchmark logical payload consolidation

---
 .../materialize/parallel_workload/action.py   |   1 -
 src/timely-util/Cargo.toml                    |   4 +
 .../benches/payload_consolidation.rs          | 427 ++++++++++++++++++
 src/timely-util/src/out_of_core/payload.rs    | 107 ++++-
 4 files changed, 535 insertions(+), 4 deletions(-)
 create mode 100644 src/timely-util/benches/payload_consolidation.rs

diff --git a/misc/python/materialize/parallel_workload/action.py b/misc/python/materialize/parallel_workload/action.py
index 91a93c5e646c0..00b06ea163b1a 100644
--- a/misc/python/materialize/parallel_workload/action.py
+++ b/misc/python/materialize/parallel_workload/action.py
@@ -3181,7 +3181,6 @@ def __init__(
         self.flags_with_values["enable_upsert_chunked_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_payload_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_upsert_async_reads"] = BOOLEAN_FLAG_VALUES
-        self.flags_with_values["enable_upsert_payload_stash"] = BOOLEAN_FLAG_VALUES
         self.flags_with_values["enable_column_chunk_direct_compressed_output"] = (
             BOOLEAN_FLAG_VALUES
         )
diff --git a/src/timely-util/Cargo.toml b/src/timely-util/Cargo.toml
index 68c3984db3161..b0a549d72d9c5 100644
--- a/src/timely-util/Cargo.toml
+++ b/src/timely-util/Cargo.toml
@@ -29,6 +29,10 @@ harness = false
 name = "column_pager"
 harness = false
 
+[[bench]]
+name = "payload_consolidation"
+harness = false
+
 [dependencies]
 ahash.workspace = true
 bytemuck.workspace = true
diff --git a/src/timely-util/benches/payload_consolidation.rs b/src/timely-util/benches/payload_consolidation.rs
new file mode 100644
index 0000000000000..c962e12c23beb
--- /dev/null
+++ b/src/timely-util/benches/payload_consolidation.rs
@@ -0,0 +1,427 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Local, deterministic comparison of logical payload consolidation and a
+//! canonical-handle control. The control receives identities from the fixture,
+//! excluding interning costs. Compare merge times, not end-to-end interner cost.
+//!
+//! Each sample builds fresh inputs, times merge/advance/settle, then verifies
+//! exact output bytes and diffs outside the timer. Compressed mode forces pool
+//! eviction but keeps compressed extents warm. It does not model cold device I/O.
+//! Decode counters cover only payload decompression, not metadata or resident
+//! copies. Pool residency is a sampled storage ledger, not process RSS.
+//!
+//! Run `cargo bench -p mz-timely-util --bench payload_consolidation --profile optimized`.
+//! Environment: `MZ_PAYLOAD_BENCH_ROWS` (8192), `MZ_PAYLOAD_BENCH_WIDTHS` (64,1900),
+//! `MZ_PAYLOAD_BENCH_SAMPLES` (3), `MZ_PAYLOAD_BENCH_CASES`
+//! (unique,cancel,churn,collision,advance), `MZ_PAYLOAD_BENCH_BACKENDS`
+//! (resident,compressed), and `MZ_PAYLOAD_BENCH_BLOCK_BYTES` (2097152).
+//! CSV goes to stdout. Pair order alternates between samples.
+
+use std::cmp::Ordering;
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
+use std::hash::{Hash, Hasher};
+use std::sync::atomic::{AtomicU64, Ordering as AtomicOrdering};
+use std::time::Instant;
+
+use columnar::{Columnar, Index, Len};
+use differential_dataflow::trace::chunk::Chunk;
+use mz_ore::cast::CastFrom;
+use mz_ore::pool::{ExtentCodec, Pool};
+use mz_timely_util::columnar::Column;
+use mz_timely_util::columnar::chunk::{LZ4_CODEC, with_spill_override};
+use mz_timely_util::columnar::payload::{PayloadChunk, PayloadLayout};
+use mz_timely_util::out_of_core::{Manifest, PayloadComparator, PayloadRef, RowHandle, Store};
+use timely::container::PushInto;
+use timely::progress::Antichain;
+
+static PAYLOAD_DECODES: AtomicU64 = AtomicU64::new(0);
+static PAYLOAD_DECODED_BYTES: AtomicU64 = AtomicU64::new(0);
+static PAYLOAD_WRITTEN_BYTES: AtomicU64 = AtomicU64::new(0);
+
+#[derive(Debug)]
+struct CountingCodec;
+impl ExtentCodec for CountingCodec {
+    fn encode(&self, body: &[u8], out: &mut Vec<u8>) {
+        LZ4_CODEC.encode(body, out);
+        PAYLOAD_WRITTEN_BYTES.fetch_add(u64::cast_from(out.len()), AtomicOrdering::Relaxed);
+    }
+    fn decode(&self, stored: &[u8], body: &mut [u8]) {
+        PAYLOAD_DECODES.fetch_add(1, AtomicOrdering::Relaxed);
+        PAYLOAD_DECODED_BYTES.fetch_add(u64::cast_from(body.len()), AtomicOrdering::Relaxed);
+        LZ4_CODEC.decode(stored, body);
+    }
+}
+static CODEC: CountingCodec = CountingCodec;
+
+struct Layout<const LOGICAL: bool>;
+impl<const LOGICAL: bool> PayloadLayout for Layout<LOGICAL> {
+    type Data = (u64, (u64, RowHandle));
+    type Diff = i64;
+    const COMPARE_PAYLOADS: bool = LOGICAL;
+    fn compare<'a>(
+        a: columnar::Ref<'a, Self::Data>,
+        b: columnar::Ref<'a, Self::Data>,
+        owners: &[&Manifest],
+        cache: &mut PayloadComparator,
+    ) -> Ordering {
+        if !LOGICAL {
+            return a.cmp(&b);
+        }
+        a.0.cmp(b.0).then_with(|| a.1.0.cmp(b.1.0)).then_with(|| {
+            cache
+                .compare(
+                    PayloadRef::External(RowHandle::into_owned(a.1.1)),
+                    PayloadRef::External(RowHandle::into_owned(b.1.1)),
+                    owners,
+                )
+                .unwrap()
+        })
+    }
+    fn visit((_, (_, row)): columnar::Ref<'_, Self::Data>, _: &i64, rows: &mut Vec<RowHandle>) {
+        rows.push(RowHandle::into_owned(row));
+    }
+}
+type Part<const LOGICAL: bool> = PayloadChunk<Layout<LOGICAL>, u64>;
+
+#[derive(Clone)]
+struct Update {
+    key: u64,
+    value: u64,
+    hash: u64,
+    time: u64,
+    diff: i64,
+}
+
+fn payload(value: u64, width: usize) -> Vec<u8> {
+    let mut state = value.wrapping_add(0x9e3779b97f4a7c15);
+    let pattern: Vec<_> = (0..(width / 4).max(8))
+        .map(|_| {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state.to_le_bytes()[0]
+        })
+        .collect();
+    let mut bytes: Vec<_> = pattern.iter().copied().cycle().take(width).collect();
+    bytes[..8].copy_from_slice(&value.to_be_bytes());
+    bytes
+}
+
+fn fixture(case: &str, n: usize, width: usize) -> [Vec<Update>; 2] {
+    let make = |key, value, time, diff| {
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        payload(value, width).hash(&mut hasher);
+        Update {
+            key,
+            value,
+            time,
+            diff,
+            hash: if case == "collision" {
+                0
+            } else {
+                hasher.finish()
+            },
+        }
+    };
+    let mut left = Vec::new();
+    let mut right = Vec::new();
+    for i in 0..u64::cast_from(n) {
+        match case {
+            "unique" => {
+                left.push(make(2 * i, 2 * i, 0, 1));
+                right.push(make(2 * i + 1, 2 * i + 1, 0, 1));
+            }
+            "cancel" | "advance" => {
+                left.push(make(i, i, 0, 1));
+                right.push(make(i, i, u64::from(case == "advance"), -1));
+            }
+            "churn" => {
+                left.push(make(i, 2 * i, 0, 1));
+                right.push(make(i, 2 * i, 0, -1));
+                right.push(make(i, 2 * i + 1, 0, 1));
+            }
+            "collision" => {
+                left.push(make(0, 2 * i, 0, 1));
+                right.push(if i % 2 == 0 {
+                    make(0, 2 * i, 0, -1)
+                } else {
+                    make(0, 2 * i + 1, 0, 1)
+                });
+            }
+            other => panic!("unknown case {other}"),
+        }
+    }
+    for updates in [&mut left, &mut right] {
+        updates.sort_by_key(|u| (u.key, u.hash, u.value, u.time));
+    }
+    [left, right]
+}
+
+fn inputs<const LOGICAL: bool>(
+    store: &Store,
+    fixture: &[Vec<Update>; 2],
+    width: usize,
+) -> [VecDeque<Part<LOGICAL>>; 2] {
+    // This fixture-only dictionary is dropped before the merge timer starts.
+    // It provides an oracle control, not an implementation of the removed interner.
+    let mut canonical = BTreeMap::new();
+    let mut builder = store.builder();
+    if !LOGICAL {
+        let values: BTreeSet<_> = fixture
+            .iter()
+            .flatten()
+            .map(|update| update.value)
+            .collect();
+        for value in values {
+            canonical.insert(value, builder.push(&payload(value, width)).unwrap());
+        }
+    }
+    let canonical_owner = builder.finish();
+    std::array::from_fn(|side| {
+        let mut chunks = VecDeque::new();
+        for batch in fixture[side].chunks(512) {
+            let mut builder = store.builder();
+            let mut column = Column::default();
+            for update in batch {
+                let row = if LOGICAL {
+                    builder.push(&payload(update.value, width)).unwrap()
+                } else {
+                    canonical[&update.value]
+                };
+                column.push_into(&((update.key, (update.hash, row)), update.time, update.diff));
+            }
+            let owner = builder.finish();
+            let owners = [&owner, &canonical_owner];
+            // A collision bucket's physical order can differ in the control.
+            let column = Part::<LOGICAL>::consolidate(column, &owners);
+            chunks.push_back(Part::new(column, &owners));
+        }
+        let mut settled = VecDeque::new();
+        Part::settle(&mut chunks, true, &mut settled);
+        settled
+    })
+}
+
+struct Measurement {
+    setup_ms: f64,
+    merge_ms: f64,
+    merge_only_ms: f64,
+    advance_ms: f64,
+    merge_decodes: u64,
+    advance_decodes: u64,
+    decodes: u64,
+    decoded_bytes: u64,
+    payload_written_bytes: u64,
+    merge_extent_bytes: u64,
+    peak_pool_bytes: u64,
+    final_chunks: u64,
+    output_records: usize,
+}
+
+fn measure<const LOGICAL: bool>(
+    fixture: &[Vec<Update>; 2],
+    width: usize,
+    block_bytes: usize,
+    compressed: bool,
+    runtime: &tokio::runtime::Runtime,
+) -> Measurement {
+    let pool = Pool::new().unwrap();
+    pool.set_budget(if compressed { 0 } else { usize::MAX });
+    // Keep compressed extents warm. OS pageout is deliberately outside this microbench.
+    pool.set_rss_target(usize::MAX);
+    let store = Store::new(pool.clone(), block_bytes, block_bytes * 2, 1, &CODEC).unwrap();
+    with_spill_override(pool.clone(), || {
+        PAYLOAD_WRITTEN_BYTES.store(0, AtomicOrdering::Relaxed);
+        let start = Instant::now();
+        let [mut left, mut right] = inputs::<LOGICAL>(&store, fixture, width);
+        let setup_ms = start.elapsed().as_secs_f64() * 1000.0;
+        let mut peak_pool_bytes = pool.stats().resident_bytes;
+        let extent_start = pool.stats().extent_bytes_written;
+        PAYLOAD_DECODES.store(0, AtomicOrdering::Relaxed);
+        PAYLOAD_DECODED_BYTES.store(0, AtomicOrdering::Relaxed);
+        let start = Instant::now();
+        let mut merged = VecDeque::new();
+        let mut settled = VecDeque::new();
+        while !left.is_empty() && !right.is_empty() {
+            Part::merge(&mut left, &mut right, &mut merged);
+            Part::settle(&mut merged, false, &mut settled);
+            peak_pool_bytes = peak_pool_bytes.max(pool.stats().resident_bytes);
+        }
+        merged.extend(left);
+        merged.extend(right);
+        Part::settle(&mut merged, true, &mut settled);
+        let merge_only_ms = start.elapsed().as_secs_f64() * 1000.0;
+        let merge_decodes = PAYLOAD_DECODES.load(AtomicOrdering::Relaxed);
+        let advance_start = Instant::now();
+        let mut carry = VecDeque::new();
+        let mut advanced = VecDeque::new();
+        let mut output = VecDeque::new();
+        let frontier = Antichain::from_elem(2);
+        for chunk in settled {
+            carry.push_back(chunk);
+            Part::advance(&mut carry, frontier.borrow(), false, &mut advanced);
+            Part::settle(&mut advanced, false, &mut output);
+            peak_pool_bytes = peak_pool_bytes.max(pool.stats().resident_bytes);
+        }
+        Part::advance(&mut carry, frontier.borrow(), true, &mut advanced);
+        Part::settle(&mut advanced, true, &mut output);
+        let merge_ms = start.elapsed().as_secs_f64() * 1000.0;
+        let measurement = Measurement {
+            setup_ms,
+            merge_ms,
+            merge_only_ms,
+            advance_ms: advance_start.elapsed().as_secs_f64() * 1000.0,
+            merge_decodes,
+            advance_decodes: PAYLOAD_DECODES.load(AtomicOrdering::Relaxed) - merge_decodes,
+            decodes: PAYLOAD_DECODES.load(AtomicOrdering::Relaxed),
+            decoded_bytes: PAYLOAD_DECODED_BYTES.load(AtomicOrdering::Relaxed),
+            payload_written_bytes: PAYLOAD_WRITTEN_BYTES.load(AtomicOrdering::Relaxed),
+            merge_extent_bytes: pool.stats().extent_bytes_written - extent_start,
+            peak_pool_bytes: peak_pool_bytes.max(pool.stats().resident_bytes),
+            final_chunks: pool.stats().live_chunks,
+            output_records: output.iter().map(Chunk::len).sum(),
+        };
+        runtime.block_on(verify(&store, fixture, width, &output));
+        drop(output);
+        assert_eq!(
+            pool.stats().live_chunks,
+            0,
+            "all payload and metadata blocks must retire"
+        );
+        measurement
+    })
+}
+
+async fn verify<const LOGICAL: bool>(
+    store: &Store,
+    fixture: &[Vec<Update>; 2],
+    width: usize,
+    output: &VecDeque<Part<LOGICAL>>,
+) {
+    let mut expected = BTreeMap::<(u64, u64, u64), i64>::new();
+    for update in fixture.iter().flatten() {
+        *expected
+            .entry((update.key, update.value, update.time.max(2)))
+            .or_default() += update.diff;
+    }
+    expected.retain(|_, diff| *diff != 0);
+    let mut actual = BTreeMap::new();
+    let mut lease: Option<mz_timely_util::out_of_core::ReadLease> = None;
+    for chunk in output {
+        let column = chunk.metadata();
+        let view = column.borrow();
+        for index in 0..view.len() {
+            let ((key, (_, row)), time, diff) = view.get(index);
+            let row = RowHandle::into_owned(row);
+            if lease.as_ref().is_none_or(|lease| lease.get(row).is_err()) {
+                drop(lease.take());
+                lease = Some(
+                    store
+                        .prepare_read([(chunk.manifest(), row)])
+                        .unwrap()
+                        .read()
+                        .await,
+                );
+            }
+            let bytes = lease.as_ref().unwrap().get(row).unwrap();
+            let value = u64::from_be_bytes(bytes[..8].try_into().unwrap());
+            assert_eq!(bytes, payload(value, width));
+            assert!(
+                actual.insert((*key, value, *time), *diff).is_none(),
+                "output must be consolidated"
+            );
+        }
+    }
+    assert_eq!(actual, expected);
+}
+
+fn number(name: &str, default: usize) -> usize {
+    std::env::var(name)
+        .map(|s| s.parse().expect("numeric benchmark option"))
+        .unwrap_or(default)
+}
+fn list(name: &str, default: &str) -> Vec<String> {
+    std::env::var(name)
+        .unwrap_or_else(|_| default.to_owned())
+        .split(',')
+        .map(str::to_owned)
+        .collect()
+}
+
+fn main() {
+    let n = number("MZ_PAYLOAD_BENCH_ROWS", 8192);
+    let samples = number("MZ_PAYLOAD_BENCH_SAMPLES", 3);
+    let block = number("MZ_PAYLOAD_BENCH_BLOCK_BYTES", 2 << 20);
+    assert!(n > 0 && samples > 0);
+    let runtime = tokio::runtime::Runtime::new().unwrap();
+    println!(
+        "case,backend,mode,base_rows,input_records,width,sample,setup_ms,merge_ms,payload_decodes,payload_decoded_bytes,payload_written_bytes,merge_extent_bytes,peak_pool_resident_bytes,live_chunks_after_merge,output_records,merge_only_ms,advance_ms,merge_decodes,advance_decodes"
+    );
+    for width in list("MZ_PAYLOAD_BENCH_WIDTHS", "64,1900") {
+        let width: usize = width.parse().unwrap();
+        assert!(width >= 8 && width + 8 <= block);
+        for case in list(
+            "MZ_PAYLOAD_BENCH_CASES",
+            "unique,cancel,churn,collision,advance",
+        ) {
+            let fixture = fixture(&case, n, width);
+            let input_records: usize = fixture.iter().map(Vec::len).sum();
+            for backend in list("MZ_PAYLOAD_BENCH_BACKENDS", "resident,compressed") {
+                assert!(backend == "resident" || backend == "compressed");
+                for sample in 0..samples {
+                    for logical in if sample % 2 == 0 {
+                        [false, true]
+                    } else {
+                        [true, false]
+                    } {
+                        let m = if logical {
+                            measure::<true>(
+                                &fixture,
+                                width,
+                                block,
+                                backend == "compressed",
+                                &runtime,
+                            )
+                        } else {
+                            measure::<false>(
+                                &fixture,
+                                width,
+                                block,
+                                backend == "compressed",
+                                &runtime,
+                            )
+                        };
+                        let mode = if logical {
+                            "logical"
+                        } else {
+                            "canonical_control"
+                        };
+                        println!(
+                            "{case},{backend},{mode},{n},{input_records},{width},{sample},{:.3},{:.3},{},{},{},{},{},{},{},{:.3},{:.3},{},{}",
+                            m.setup_ms,
+                            m.merge_ms,
+                            m.decodes,
+                            m.decoded_bytes,
+                            m.payload_written_bytes,
+                            m.merge_extent_bytes,
+                            m.peak_pool_bytes,
+                            m.final_chunks,
+                            m.output_records,
+                            m.merge_only_ms,
+                            m.advance_ms,
+                            m.merge_decodes,
+                            m.advance_decodes
+                        );
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/src/timely-util/src/out_of_core/payload.rs b/src/timely-util/src/out_of_core/payload.rs
index 48b68b2a2c1e5..c33fae6b75b3d 100644
--- a/src/timely-util/src/out_of_core/payload.rs
+++ b/src/timely-util/src/out_of_core/payload.rs
@@ -415,10 +415,34 @@ impl PayloadComparator {
         right: PayloadRef<'_>,
         owners: &[&Manifest],
     ) -> Result<std::cmp::Ordering, StoreError> {
-        if let (PayloadRef::External(a), PayloadRef::External(b)) = (left, right) {
-            if a == b {
-                return Ok(std::cmp::Ordering::Equal);
+        match (left, right) {
+            (PayloadRef::External(a), PayloadRef::External(b)) => {
+                if a == b {
+                    return Ok(std::cmp::Ordering::Equal);
+                }
+                // Adjacent values can alternate between input blocks after a
+                // merge. Cache identity follows the block, not the argument side.
+                if self.right.block == Some(a.block)
+                    || (self.left.block == Some(b.block) && self.left.block != Some(a.block))
+                {
+                    std::mem::swap(&mut self.left, &mut self.right);
+                }
+                if a.block == b.block {
+                    self.left.resolve(left, owners)?;
+                    return Ok(self.left.get(a)?.cmp(self.left.get(b)?));
+                }
             }
+            (PayloadRef::External(row), PayloadRef::Inline(_)) => {
+                if self.right.block == Some(row.block) {
+                    std::mem::swap(&mut self.left, &mut self.right);
+                }
+            }
+            (PayloadRef::Inline(_), PayloadRef::External(row)) => {
+                if self.left.block == Some(row.block) {
+                    std::mem::swap(&mut self.left, &mut self.right);
+                }
+            }
+            (PayloadRef::Inline(_), PayloadRef::Inline(_)) => {}
         }
         Ok(self
             .left
@@ -451,6 +475,10 @@ impl ComparisonBlock {
             owner.handle.read_into(&mut self.words);
             self.block = Some(row.block);
         }
+        self.get(row)
+    }
+
+    fn get(&self, row: RowHandle) -> Result<&[u8], StoreError> {
         let offset = usize::cast_from(row.offset);
         let len = usize::try_from(*self.words.get(offset).ok_or(StoreError::UnownedRow)?)
             .map_err(|_| StoreError::UnownedRow)?;
@@ -464,6 +492,79 @@ impl ComparisonBlock {
 mod comparison_tests {
     use super::*;
 
+    #[derive(Debug)]
+    struct CountingCodec;
+    static COMPARISON_DECODES: AtomicU64 = AtomicU64::new(0);
+    static COMPARISON_CODEC: CountingCodec = CountingCodec;
+
+    impl ExtentCodec for CountingCodec {
+        fn encode(&self, body: &[u8], out: &mut Vec<u8>) {
+            mz_ore::pool::IDENTITY_CODEC.encode(body, out);
+        }
+
+        fn decode(&self, stored: &[u8], body: &mut [u8]) {
+            COMPARISON_DECODES.fetch_add(1, Ordering::Relaxed);
+            mz_ore::pool::IDENTITY_CODEC.decode(stored, body);
+        }
+    }
+
+    #[mz_ore::test]
+    fn comparison_cache_reuses_blocks_across_argument_positions() {
+        let pool = Pool::new().unwrap();
+        pool.set_budget(0);
+        let store = Store::new(pool.clone(), 128, 256, 1, &COMPARISON_CODEC).unwrap();
+        let mut builder = store.builder();
+        let a = builder.push(&[0; 48]).unwrap();
+        let a_next = builder.push(&[1; 48]).unwrap();
+        let b = builder.push(&[2; 48]).unwrap();
+        let b_next = builder.push(&[3; 48]).unwrap();
+        let c = builder.push(&[4; 48]).unwrap();
+        let owner = builder.finish();
+        assert_eq!(a.block, a_next.block);
+        assert_ne!(a.block, b.block);
+        assert_ne!(b.block, c.block);
+        COMPARISON_DECODES.store(0, Ordering::Relaxed);
+        let mut cache = PayloadComparator::default();
+        for (left, right) in [(a, b), (b, a), (a, a_next), (b, b_next)] {
+            let expected = left.cmp(&right);
+            assert_eq!(
+                cache
+                    .compare(
+                        PayloadRef::External(left),
+                        PayloadRef::External(right),
+                        &[&owner]
+                    )
+                    .unwrap(),
+                expected,
+            );
+        }
+        for (left, right) in [
+            (PayloadRef::Inline(&[0; 48]), PayloadRef::External(a)),
+            (PayloadRef::External(b), PayloadRef::Inline(&[2; 48])),
+        ] {
+            assert_eq!(
+                cache.compare(left, right, &[&owner]).unwrap(),
+                std::cmp::Ordering::Equal
+            );
+        }
+        assert_eq!(
+            COMPARISON_DECODES.load(Ordering::Relaxed),
+            2,
+            "two cached blocks must survive argument swaps and same-block comparisons"
+        );
+        assert_eq!(
+            cache
+                .compare(PayloadRef::External(c), PayloadRef::External(b), &[&owner])
+                .unwrap(),
+            std::cmp::Ordering::Greater
+        );
+        assert_eq!(
+            COMPARISON_DECODES.load(Ordering::Relaxed),
+            3,
+            "a miss must preserve the other argument's cached block"
+        );
+    }
+
     #[mz_ore::test]
     fn comparison_cache_stays_bounded_across_distinct_blocks() {
         let pool = Pool::new().unwrap();

From 752930c5b68e9b65980912d0b97ab8fe5f068167 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 12:19:55 -0400
Subject: [PATCH 09/31] timely-util: prototype resumable columnar merge reads

---
 src/timely-util/src/columnar/chunk.rs       |   5 +
 src/timely-util/src/columnar/chunk/merge.rs | 744 ++++++++++++++++++++
 2 files changed, 749 insertions(+)
 create mode 100644 src/timely-util/src/columnar/chunk/merge.rs

diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index e1346e6b262b0..57a43c194926c 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -253,6 +253,8 @@ fn with_scratch<Out>(f: impl FnOnce(&mut Vec<u64>) -> Out) -> Out {
 /// of the columnar merge machinery.
 const COMMIT_BYTES: usize = 2 << 20;
 
+pub mod merge;
+
 /// Bodies smaller than this stay resident: the pool's smallest size class is
 /// 64 KiB, so spilling below it trades no meaningful memory for slot waste.
 ///
@@ -300,6 +302,8 @@ fn rr<'b, 'a: 'b, C: Columnar>(item: columnar::Ref<'a, C>) -> columnar::Ref<'b,
 /// [`UnloadChunk::locate`] consults), and the time bounds `extract` consults
 /// to pass frontier-disjoint chunks through without loading them.
 pub struct SpilledBody<D: Columnar, T> {
+    /// Decoded size, available without fetching the body.
+    bytes: usize,
     /// Number of updates in the body.
     records: usize,
     /// The first and last data items, as a two-element container. One
@@ -506,6 +510,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
         );
         ColumnChunk::Spilled(
             Rc::new(SpilledBody {
+                bytes: len_bytes,
                 records,
                 fences,
                 time_lower,
diff --git a/src/timely-util/src/columnar/chunk/merge.rs b/src/timely-util/src/columnar/chunk/merge.rs
new file mode 100644
index 0000000000000..5609ee3dc34d8
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/merge.rs
@@ -0,0 +1,744 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Resumable merging of columnar runs with asynchronous input reads.
+//!
+//! A merge retains its two decoded fronts and positions across steps. Input
+//! admission reserves the largest possible pair before either read starts, so
+//! replacing an exhausted front never waits for memory while holding the other.
+//! Blocking reads retain the reservation through cancellation. Resident bounds
+//! let disjoint fronts pass through without reads or compression migration.
+//!
+//! This driver does not advance timestamps or settle output. Its caller must
+//! retain the appropriate frontier/capability, consume output incrementally,
+//! and yield between steps. Differential's synchronous `Chunk::merge` and trace
+//! drivers do not call this interface. Output allocations, resident input
+//! storage, and metadata are outside decoded-input admission.
+
+use std::collections::VecDeque;
+use std::fmt;
+use std::sync::Arc;
+
+use columnar::{Columnar, Container, Len};
+use differential_dataflow::difference::Semigroup;
+use differential_dataflow::lattice::Lattice;
+use mz_ore::pool::ChunkHandle;
+use mz_ore::task::JoinHandle;
+use timely::dataflow::channels::ContainerBytes;
+use timely::progress::Timestamp;
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+use super::{Column, ColumnChunk, rr};
+
+/// Shared admission for the serialized size of active merge input pairs.
+///
+/// Clone this budget across operators to bound their aggregate decoded inputs.
+/// Reservations last until a merge finishes or is dropped, including any reads
+/// still running after cancellation. Output and typed scratch are not charged.
+#[derive(Clone)]
+pub struct ReadBudget {
+    bytes: Arc<Semaphore>,
+    capacity: u32,
+}
+
+impl ReadBudget {
+    /// Construct a positive decoded-input budget in bytes.
+    pub fn new(bytes: u32) -> Self {
+        assert!(bytes > 0, "merge read budget must be positive");
+        Self {
+            bytes: Arc::new(Semaphore::new(
+                usize::try_from(bytes).expect("u32 fits usize"),
+            )),
+            capacity: bytes,
+        }
+    }
+
+    /// Bytes currently reserved, including cancelled reads still in flight.
+    pub fn reserved_bytes(&self) -> usize {
+        usize::try_from(self.capacity).expect("u32 fits usize") - self.bytes.available_permits()
+    }
+}
+
+/// A run contains an input pair larger than the shared read budget.
+#[derive(Debug)]
+pub struct InsufficientBudget {
+    /// Largest input pair's serialized size.
+    pub required: usize,
+    /// Configured budget in bytes.
+    pub available: u32,
+}
+
+impl fmt::Display for InsufficientBudget {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "merge requires {} input bytes, budget is {}",
+            self.required, self.available
+        )
+    }
+}
+
+impl std::error::Error for InsufficientBudget {}
+
+/// One completed unit of merge work.
+pub enum Step<C> {
+    /// A sorted, consolidated prefix that the caller can consume or settle.
+    Output(C),
+    /// Inputs advanced without output, for example through cancellation.
+    Progress,
+    /// Both runs are exhausted and all output has been returned.
+    Complete,
+}
+
+/// A two-run merge retaining decoded fronts across output and scheduler yields.
+///
+/// Each input must be sorted and consolidated across chunk boundaries. `step`
+/// may await I/O, and performs at most one column merge call before returning.
+/// Cancelling a `step` future leaves the merge resumable. Dropping the merge
+/// discards its work, while submitted reads retain their storage and admission.
+pub struct Merge<D: Columnar, T: Columnar, R: Columnar> {
+    inputs: [VecDeque<ColumnChunk<D, T, R>>; 2],
+    columns: [Column<(D, T, R)>; 2],
+    positions: [usize; 2],
+    loaded: [bool; 2],
+    depths: [u8; 2],
+    ready: VecDeque<ColumnChunk<D, T, R>>,
+    budget: ReadBudget,
+    required: u32,
+    reservation: Option<Arc<OwnedSemaphorePermit>>,
+    pending: Option<JoinHandle<ReadResult>>,
+}
+
+struct ReadResult {
+    buffers: [Option<Vec<u64>>; 2],
+    // Keep completed, unconsumed buffers charged too. Field order releases
+    // buffers before admission when an abandoned task's result is dropped.
+    _reservation: Arc<OwnedSemaphorePermit>,
+}
+
+impl<D, T, R> Merge<D, T, R>
+where
+    D: Columnar,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>>,
+{
+    /// Own two runs, rejecting a read working set that could never be admitted.
+    ///
+    /// Sizing inspects resident metadata only. No reads or reservations occur
+    /// until `step` encounters overlapping fronts.
+    pub fn new(
+        left: VecDeque<ColumnChunk<D, T, R>>,
+        right: VecDeque<ColumnChunk<D, T, R>>,
+        budget: ReadBudget,
+    ) -> Result<Self, InsufficientBudget> {
+        let inputs = [left, right];
+        let required = inputs.iter().fold(0usize, |sum, run| {
+            sum.saturating_add(
+                run.iter()
+                    .map(|chunk| match chunk {
+                        ColumnChunk::Resident(column, _) => column.length_in_bytes(),
+                        ColumnChunk::Spilled(body, _) => body.bytes,
+                    })
+                    .max()
+                    .unwrap_or(0),
+            )
+        });
+        let required = u32::try_from(required)
+            .ok()
+            .filter(|n| *n <= budget.capacity)
+            .ok_or(InsufficientBudget {
+                required,
+                available: budget.capacity,
+            })?;
+        Ok(Self {
+            inputs,
+            columns: [Column::default(), Column::default()],
+            positions: [0; 2],
+            loaded: [false; 2],
+            depths: [0; 2],
+            ready: VecDeque::new(),
+            budget,
+            required,
+            reservation: None,
+            pending: None,
+        })
+    }
+
+    /// Produce one output chunk or yield after one bounded merge operation.
+    ///
+    /// Requires a Tokio runtime when an input body is pool-backed. The caller
+    /// must yield between ready steps to share its worker with other operators.
+    pub async fn step(&mut self) -> Step<ColumnChunk<D, T, R>> {
+        if let Some(chunk) = self.ready.pop_front() {
+            return Step::Output(chunk);
+        }
+        self.finish_reads().await;
+        self.retire_inputs();
+        if self.loaded == [false; 2] {
+            let passthrough = match (self.inputs[0].front(), self.inputs[1].front()) {
+                (None, None) => {
+                    self.reservation = None;
+                    return Step::Complete;
+                }
+                (Some(_), None) => Some((0, false)),
+                (None, Some(_)) => Some((1, false)),
+                (Some(a), Some(b)) => {
+                    let (af, al) = a.data_span();
+                    let (bf, bl) = b.data_span();
+                    if rr::<D>(al) < rr::<D>(bf) {
+                        Some((0, true))
+                    } else if rr::<D>(bl) < rr::<D>(af) {
+                        Some((1, true))
+                    } else {
+                        None
+                    }
+                }
+            };
+            if let Some((side, age)) = passthrough {
+                let mut chunk = self.inputs[side].pop_front().expect("observed front");
+                // Aging must not invoke survive_merge's synchronous codec migration.
+                // Settlement can apply that policy after the caller accepts output.
+                if age {
+                    match &mut chunk {
+                        ColumnChunk::Resident(_, depth) | ColumnChunk::Spilled(_, depth) => {
+                            *depth = depth.saturating_add(1);
+                        }
+                    }
+                }
+                return Step::Output(chunk);
+            }
+        }
+
+        if self.reservation.is_none() {
+            self.reservation = Some(Arc::new(
+                Arc::clone(&self.budget.bytes)
+                    .acquire_many_owned(self.required)
+                    .await
+                    .expect("read budget remains open"),
+            ));
+        }
+        let mut handles = [None, None];
+        for (side, handle) in handles.iter_mut().enumerate() {
+            if !self.loaded[side]
+                && let Some(chunk) = self.inputs[side].pop_front()
+            {
+                self.depths[side] = chunk.depth();
+                match chunk {
+                    ColumnChunk::Spilled(body, _) => *handle = Some(Arc::clone(&body.handle)),
+                    resident @ ColumnChunk::Resident(..) => {
+                        self.columns[side] = resident.into_column();
+                        self.loaded[side] = true;
+                    }
+                }
+            }
+        }
+        if handles.iter().any(Option::is_some) {
+            let reservation = Arc::clone(self.reservation.as_ref().expect("admitted inputs"));
+            self.pending = Some(mz_ore::task::spawn(|| "column_merge_reads", async move {
+                // The task is detached on cancellation, retaining admission until
+                // both read_async calls (including their blocking jobs) finish.
+                let [a, b] = handles;
+                let (a, b) = tokio::join!(read(a), read(b));
+                ReadResult {
+                    buffers: [a, b],
+                    _reservation: reservation,
+                }
+            }));
+            self.finish_reads().await;
+        }
+
+        let mut output = Column::default();
+        let depth = if self.loaded == [true; 2] {
+            let _yielded = output.merge_from(&mut self.columns, &mut self.positions);
+            self.depths[0].max(self.depths[1]).saturating_add(1)
+        } else {
+            let side = usize::from(!self.loaded[0]);
+            let view = self.columns[side].borrow();
+            let mut remaining = <(D, T, R) as Columnar>::Container::default();
+            remaining.extend_from_self(view, self.positions[side]..view.len());
+            self.positions[side] = view.len();
+            output = Column::Typed(remaining);
+            self.depths[side]
+        };
+        self.retire_inputs();
+        ColumnChunk::push_bounded(output, depth, &mut self.ready);
+        self.ready.pop_front().map_or(Step::Progress, Step::Output)
+    }
+
+    async fn finish_reads(&mut self) {
+        if let Some(task) = &mut self.pending {
+            let ReadResult { buffers, .. } = task.await;
+            self.pending = None;
+            for (side, words) in buffers.into_iter().enumerate() {
+                if let Some(words) = words {
+                    self.columns[side] = Column::Align(words);
+                    self.loaded[side] = true;
+                }
+            }
+        }
+    }
+
+    fn retire_inputs(&mut self) {
+        for side in 0..2 {
+            if self.loaded[side] && self.positions[side] == self.columns[side].borrow().len() {
+                self.columns[side] = Column::default();
+                self.positions[side] = 0;
+                self.loaded[side] = false;
+            }
+        }
+    }
+}
+
+async fn read(handle: Option<Arc<ChunkHandle>>) -> Option<Vec<u64>> {
+    match handle {
+        Some(handle) => Some(handle.read_async().await),
+        None => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::{Condvar, Mutex};
+    use std::time::{Duration, Instant};
+
+    use columnar::{Index, Push};
+    use differential_dataflow::consolidation::consolidate_updates;
+    use mz_ore::pool::{ExtentCodec, Pool};
+    use timely::container::PushInto;
+
+    use super::super::{LZ4_CODEC, SpilledBody, spill_column};
+    use super::*;
+
+    type Update = ((u64, String), u64, i64);
+    type TestChunk = ColumnChunk<(u64, String), u64, i64>;
+
+    fn chunk(rows: &[Update], spill: Option<(&Pool, &'static dyn ExtentCodec)>) -> TestChunk {
+        let mut column = Column::default();
+        for row in rows {
+            column.push_into(row);
+        }
+        let Some((pool, codec)) = spill else {
+            return TestChunk::from_column(column);
+        };
+        let bytes = column.length_in_bytes();
+        let (time_lower, time_upper) = TestChunk::time_bounds(&column);
+        let mut fences = <(u64, String) as Columnar>::Container::default();
+        let view = column.borrow();
+        fences.push(view.0.get(0));
+        fences.push(view.0.get(rows.len() - 1));
+        let handle = spill_column(
+            column,
+            pool,
+            bytes,
+            mz_ore::pool::ChunkHints { depth: 1 },
+            codec,
+        );
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        TestChunk::Spilled(
+            Rc::new(SpilledBody {
+                bytes,
+                records: rows.len(),
+                fences,
+                time_lower,
+                time_upper: time_upper.into(),
+                compressed: true,
+                handle: Arc::new(handle),
+            }),
+            1,
+        )
+    }
+
+    fn collect(chunk: TestChunk) -> Vec<Update> {
+        let column = chunk.into_column();
+        let view = column.borrow();
+        (0..view.len())
+            .map(|i| Update::into_owned(view.get(i)))
+            .collect()
+    }
+
+    fn rows(keys: impl Iterator<Item = u64>, width: usize) -> Vec<Update> {
+        keys.map(|k| ((k, "x".repeat(width)), 0, 1)).collect()
+    }
+
+    async fn finish(merge: &mut Merge<(u64, String), u64, i64>) -> Vec<Update> {
+        let mut result = Vec::new();
+        loop {
+            match merge.step().await {
+                Step::Output(chunk) => Extend::extend(&mut result, collect(chunk)),
+                Step::Progress => {}
+                Step::Complete => return result,
+            }
+            tokio::task::yield_now().await;
+        }
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn retains_large_front_across_refills_and_output_yields() {
+        let pool = Pool::new().unwrap();
+        let left = rows((0..1600).step_by(2), 1900);
+        let right = rows((1..1600).step_by(2), 1900);
+        let left = VecDeque::from([chunk(&left, Some((&pool, &LZ4_CODEC)))]);
+        let right = right
+            .chunks(100)
+            .map(|r| chunk(r, Some((&pool, &LZ4_CODEC))))
+            .collect();
+        let budget = ReadBudget::new(4 << 20);
+        let mut merge = Merge::new(left, right, budget.clone()).unwrap();
+        assert_eq!(finish(&mut merge).await, rows(0..1600, 1900));
+        assert_eq!(
+            pool.stats().async_reads,
+            9,
+            "each input is read exactly once"
+        );
+        assert_eq!(budget.reserved_bytes(), 0);
+        assert_eq!(pool.stats().live_chunks, 0);
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn disjoint_runs_and_empty_side_need_no_reads() {
+        let pool = Pool::new().unwrap();
+        for right in [vec![], rows(10..20, 16)] {
+            let left = VecDeque::from([chunk(&rows(0..10, 16), Some((&pool, &LZ4_CODEC)))]);
+            let right = if right.is_empty() {
+                VecDeque::new()
+            } else {
+                VecDeque::from([chunk(&right, Some((&pool, &LZ4_CODEC)))])
+            };
+            let budget = ReadBudget::new(1 << 20);
+            let mut merge = Merge::new(left, right, budget.clone()).unwrap();
+            loop {
+                match merge.step().await {
+                    Step::Output(chunk) => assert!(matches!(chunk, TestChunk::Spilled(..))),
+                    Step::Complete => break,
+                    Step::Progress => panic!("disjoint inputs must pass through"),
+                }
+                assert_eq!(budget.reserved_bytes(), 0);
+            }
+        }
+        assert_eq!(pool.stats().async_reads, 0);
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn output_size_yields_keep_both_decoded_fronts() {
+        let pool = Pool::new().unwrap();
+        let left = chunk(&rows((0..3000).step_by(2), 1900), Some((&pool, &LZ4_CODEC)));
+        let right = chunk(&rows((1..3000).step_by(2), 1900), Some((&pool, &LZ4_CODEC)));
+        let mut merge = Merge::new(
+            VecDeque::from([left]),
+            VecDeque::from([right]),
+            ReadBudget::new(8 << 20),
+        )
+        .unwrap();
+        let mut output = Vec::new();
+        let mut chunks = 0;
+        loop {
+            match merge.step().await {
+                Step::Output(chunk) => {
+                    let TestChunk::Resident(column, _) = &chunk else {
+                        panic!("new merge output must be resident");
+                    };
+                    assert!(column.length_in_bytes() <= super::super::COMMIT_BYTES);
+                    chunks += 1;
+                    Extend::extend(&mut output, collect(chunk));
+                }
+                Step::Progress => {}
+                Step::Complete => break,
+            }
+        }
+        assert!(chunks >= 3);
+        assert_eq!(output, rows(0..3000, 1900));
+        assert_eq!(pool.stats().async_reads, 2);
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn matches_consolidation_across_times_chunks_and_storage_modes() {
+        let pool = Pool::new().unwrap();
+        for seed in 0..12u64 {
+            let mut inputs: [Vec<Update>; 2] = std::array::from_fn(|side| {
+                (0..160u64)
+                    .map(|i| {
+                        (
+                            ((i * 13 + seed) % 23, "value".into()),
+                            (i + seed) % 5,
+                            if (i + u64::try_from(side).unwrap()) % 3 == 0 {
+                                -1
+                            } else {
+                                1
+                            },
+                        )
+                    })
+                    .collect()
+            });
+            let mut expected: Vec<_> = inputs.iter().flatten().cloned().collect();
+            consolidate_updates(&mut expected);
+            for input in &mut inputs {
+                consolidate_updates(input);
+            }
+            let [left, right] = inputs.map(|input| {
+                input
+                    .chunks(7)
+                    .enumerate()
+                    .map(|(i, rows)| chunk(rows, (i % 2 == 0).then_some((&pool, &LZ4_CODEC))))
+                    .collect()
+            });
+            let mut merge = Merge::new(left, right, ReadBudget::new(1 << 20)).unwrap();
+            assert_eq!(finish(&mut merge).await, expected, "seed {seed}");
+        }
+    }
+
+    #[mz_ore::test]
+    fn rejects_unadmittable_pair_before_reading() {
+        let pool = Pool::new().unwrap();
+        let input = chunk(&rows(0..10, 100), Some((&pool, &LZ4_CODEC)));
+        let result = Merge::new(
+            VecDeque::from([input.clone()]),
+            VecDeque::from([input]),
+            ReadBudget::new(1),
+        );
+        assert!(matches!(
+            result,
+            Err(InsufficientBudget { available: 1, .. })
+        ));
+        assert_eq!(pool.stats().async_reads, 0);
+    }
+
+    #[derive(Debug, Default)]
+    struct Gate {
+        entered: AtomicUsize,
+        open: Mutex<bool>,
+        ready: Condvar,
+    }
+
+    impl Gate {
+        fn release(&self) {
+            *self.open.lock().unwrap() = true;
+            self.ready.notify_all();
+        }
+    }
+
+    impl ExtentCodec for Gate {
+        fn encode(&self, body: &[u8], out: &mut Vec<u8>) {
+            LZ4_CODEC.encode(body, out);
+        }
+        fn decode(&self, stored: &[u8], body: &mut [u8]) {
+            self.entered.fetch_add(1, Ordering::SeqCst);
+            let mut open = self.open.lock().unwrap();
+            while !*open {
+                open = self.ready.wait(open).unwrap();
+            }
+            LZ4_CODEC.decode(stored, body);
+        }
+    }
+
+    struct ReleaseOnDrop(&'static Gate);
+    impl Drop for ReleaseOnDrop {
+        fn drop(&mut self) {
+            self.0.release();
+        }
+    }
+
+    async fn wait_for(mut predicate: impl FnMut() -> bool) {
+        tokio::time::timeout(Duration::from_secs(10), async {
+            while !predicate() {
+                tokio::time::sleep(Duration::from_millis(1)).await;
+            }
+        })
+        .await
+        .expect("condition did not become true");
+    }
+
+    fn blocked_merge(
+        pool: &Pool,
+        gate: &'static Gate,
+        budget: ReadBudget,
+    ) -> Merge<(u64, String), u64, i64> {
+        Merge::new(
+            VecDeque::from([chunk(&rows((0..20).step_by(2), 100), Some((pool, gate)))]),
+            VecDeque::from([chunk(&rows((1..20).step_by(2), 100), Some((pool, gate)))]),
+            budget,
+        )
+        .unwrap()
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn cancellation_retains_admission_until_both_reads_finish() {
+        let pool = Pool::new().unwrap();
+        let gate: &'static Gate = Box::leak(Box::new(Gate::default()));
+        let _release = ReleaseOnDrop(gate);
+        let budget = ReadBudget::new(1 << 20);
+        let mut merge = blocked_merge(&pool, gate, budget.clone());
+        let expected = usize::try_from(merge.required).unwrap();
+        let mut step = Box::pin(merge.step());
+        assert!(futures_util::poll!(&mut step).is_pending());
+        wait_for(|| gate.entered.load(Ordering::SeqCst) == 2).await;
+        drop(step);
+        drop(merge);
+        assert_eq!(budget.reserved_bytes(), expected);
+        assert_eq!(pool.stats().live_chunks, 2);
+        gate.release();
+        wait_for(|| budget.reserved_bytes() == 0 && pool.stats().live_chunks == 0).await;
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn cancelled_step_can_resume_without_resubmitting_reads() {
+        let pool = Pool::new().unwrap();
+        let gate: &'static Gate = Box::leak(Box::new(Gate::default()));
+        let _release = ReleaseOnDrop(gate);
+        let budget = ReadBudget::new(1 << 20);
+        let mut merge = blocked_merge(&pool, gate, budget.clone());
+        let mut step = Box::pin(merge.step());
+        assert!(futures_util::poll!(&mut step).is_pending());
+        wait_for(|| gate.entered.load(Ordering::SeqCst) == 2).await;
+        drop(step);
+        gate.release();
+        assert_eq!(finish(&mut merge).await, rows(0..20, 100));
+        assert_eq!(pool.stats().async_reads, 2);
+        assert_eq!(budget.reserved_bytes(), 0);
+    }
+
+    #[mz_ore::test(tokio::test)]
+    async fn concurrent_merges_admit_whole_pairs_and_make_progress() {
+        let pool = Pool::new().unwrap();
+        let gate: &'static Gate = Box::leak(Box::new(Gate::default()));
+        let _release = ReleaseOnDrop(gate);
+        let mut first = blocked_merge(&pool, gate, ReadBudget::new(1 << 20));
+        let budget = ReadBudget::new(first.required);
+        first.budget = budget.clone();
+        let mut second = Merge::new(
+            VecDeque::from([chunk(
+                &rows((0..20).step_by(2), 100),
+                Some((&pool, &LZ4_CODEC)),
+            )]),
+            VecDeque::from([chunk(
+                &rows((1..20).step_by(2), 100),
+                Some((&pool, &LZ4_CODEC)),
+            )]),
+            budget.clone(),
+        )
+        .unwrap();
+        let mut first_step = Box::pin(first.step());
+        assert!(futures_util::poll!(&mut first_step).is_pending());
+        wait_for(|| gate.entered.load(Ordering::SeqCst) == 2).await;
+        drop(first_step);
+        let mut second_step = Box::pin(second.step());
+        assert!(futures_util::poll!(&mut second_step).is_pending());
+        assert_eq!(
+            pool.stats().async_reads,
+            2,
+            "second pair must wait for admission"
+        );
+        assert_eq!(
+            budget.reserved_bytes(),
+            usize::try_from(budget.capacity).unwrap()
+        );
+        drop(second_step);
+        gate.release();
+        assert_eq!(finish(&mut first).await, rows(0..20, 100));
+        assert_eq!(finish(&mut second).await, rows(0..20, 100));
+        assert_eq!(pool.stats().async_reads, 4);
+        assert_eq!(budget.reserved_bytes(), 0);
+    }
+
+    #[mz_ore::test]
+    fn live_operator_yields_during_reads_and_holds_its_frontier() {
+        use crate::builder_async::{Event, OperatorBuilder};
+        use futures_util::StreamExt;
+        use timely::container::CapacityContainerBuilder;
+        use timely::dataflow::channels::pact::Pipeline;
+        use timely::dataflow::operators::vec::Input;
+        use timely::dataflow::operators::{Inspect, Probe};
+
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(2)
+            .enable_all()
+            .build()
+            .unwrap();
+        let _runtime = runtime.enter();
+        let pool = Pool::new().unwrap();
+        let gate: &'static Gate = Box::leak(Box::new(Gate::default()));
+        let _release = ReleaseOnDrop(gate);
+        timely::execute_directly(move |worker| {
+            let mut merge = blocked_merge(&pool, gate, ReadBudget::new(1 << 20));
+            let output_rows = Rc::new(RefCell::new(Vec::new()));
+            let heartbeat = Rc::new(RefCell::new(false));
+            let probe = timely::dataflow::operators::probe::Handle::new();
+            let (mut input, mut other) = worker.dataflow::<u64, _, _>(|scope| {
+                let (input, stream) = scope.new_input::<u64>();
+                let (other, other_stream) = scope.new_input::<u64>();
+                let seen = Rc::clone(&heartbeat);
+                other_stream.inspect(move |_| *seen.borrow_mut() = true);
+                let mut builder = OperatorBuilder::new("Resumable merge".into(), scope.clone());
+                let (output, stream_out) =
+                    builder.new_output::<CapacityContainerBuilder<Vec<Update>>>();
+                let mut input_events = builder.new_input_for(stream, Pipeline, &output);
+                builder.build(move |caps| async move {
+                    drop(caps);
+                    while let Some(event) = input_events.next().await {
+                        if let Event::Data(cap, _) = event {
+                            loop {
+                                match merge.step().await {
+                                    Step::Output(chunk) => {
+                                        for row in collect(chunk) {
+                                            output.give(&cap, row);
+                                        }
+                                    }
+                                    Step::Progress => {}
+                                    Step::Complete => break,
+                                }
+                                tokio::task::yield_now().await;
+                            }
+                        }
+                    }
+                });
+                let rows = Rc::clone(&output_rows);
+                stream_out
+                    .inspect(move |row| rows.borrow_mut().push(row.clone()))
+                    .probe_with(&probe);
+                (input, other)
+            });
+            input.send(0);
+            input.advance_to(1);
+            let deadline = Instant::now() + Duration::from_secs(10);
+            while gate.entered.load(Ordering::SeqCst) < 2 {
+                assert!(
+                    Instant::now() < deadline,
+                    "merge never submitted both reads"
+                );
+                worker.step();
+                std::thread::yield_now();
+            }
+            other.send(0);
+            other.advance_to(1);
+            while !*heartbeat.borrow() {
+                assert!(
+                    Instant::now() < deadline,
+                    "unrelated operator could not progress"
+                );
+                worker.step();
+            }
+            assert!(
+                probe.less_than(&1),
+                "pending merge must retain its capability"
+            );
+            assert!(output_rows.borrow().is_empty());
+            gate.release();
+            while probe.less_than(&1) {
+                assert!(
+                    Instant::now() < deadline,
+                    "read completion did not wake the merge"
+                );
+                worker.step();
+                std::thread::yield_now();
+            }
+            assert_eq!(*output_rows.borrow(), rows(0..20, 100));
+        });
+    }
+}

From 259fe4ad28b52db2db681432203f15497f505df0 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 12:42:17 -0400
Subject: [PATCH 10/31] timely-util: drive resumable columnar batching and
 trace compaction

---
 src/timely-util/src/columnar/chunk.rs         |   1 +
 .../src/columnar/chunk/asynchronous.rs        | 661 ++++++++++++++++++
 src/timely-util/src/columnar/chunk/merge.rs   |  38 +
 3 files changed, 700 insertions(+)
 create mode 100644 src/timely-util/src/columnar/chunk/asynchronous.rs

diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 57a43c194926c..a720f6391ff55 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -253,6 +253,7 @@ fn with_scratch<Out>(f: impl FnOnce(&mut Vec<u64>) -> Out) -> Out {
 /// of the columnar merge machinery.
 const COMMIT_BYTES: usize = 2 << 20;
 
+pub mod asynchronous;
 pub mod merge;
 
 /// Bodies smaller than this stay resident: the pool's smallest size class is
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
new file mode 100644
index 0000000000000..b2e5e6f80699f
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -0,0 +1,661 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Asynchronous columnar batching and trace compaction.
+//!
+//! Runs follow a geometric merge policy. Each merge yields between output
+//! chunks and awaits pool reads, while settlement and timestamp advancement
+//! run on the Timely worker. Trace readers retain the published input batches
+//! until their replacement is complete. No shared-state borrow crosses an await.
+//!
+//! The arranger currently requires totally ordered timestamps. Its trace still
+//! uses `TraceAgent` to aggregate reader compaction holds. It is a separate
+//! driver from Differential's fueled spine, whose synchronous completion
+//! contract cannot represent a pending read.
+
+use std::cell::RefCell;
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::sync::Arc;
+
+use columnar::Columnar;
+use differential_dataflow::difference::Semigroup;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::logging::Logger;
+use differential_dataflow::operators::arrange::{Arranged, TraceAgent};
+use differential_dataflow::trace::chunk::{Chunk, ChunkBatch};
+use differential_dataflow::trace::{
+    Batch, BatchReader, Description, ExertionLogic, Trace, TraceReader,
+};
+use timely::PartialOrder;
+use timely::container::{CapacityContainerBuilder, ContainerBuilder, PushInto};
+use timely::dataflow::Stream;
+use timely::dataflow::channels::pact::Pipeline;
+use timely::dataflow::operators::generic::OperatorInfo;
+use timely::order::TotalOrder;
+use timely::progress::Timestamp;
+use timely::progress::frontier::{Antichain, AntichainRef};
+use tokio::sync::Notify;
+
+use super::merge::{Merge, ReadBudget, Step};
+use super::{ChunkChunker, Column, ColumnChunk};
+use crate::builder_async::{Event, OperatorBuilder, PressOnDropButton};
+
+type Run<D, T, R> = VecDeque<ColumnChunk<D, T, R>>;
+type BatchRef<D, T, R> = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
+
+#[derive(Clone)]
+struct Weighted<B> {
+    data: B,
+    weight: usize,
+}
+
+impl<B> std::ops::Deref for Weighted<B> {
+    type Target = B;
+    fn deref(&self) -> &B {
+        &self.data
+    }
+}
+
+/// Geometrically merged runs with asynchronous insertion and sealing.
+///
+/// A cancelled mutation discards its in-progress work. Callers must retain
+/// capabilities until the operation completes, or shut down the dataflow.
+pub struct Batcher<D: Columnar, T: Columnar, R: Columnar> {
+    runs: Vec<Weighted<Run<D, T, R>>>,
+    lower: Antichain<T>,
+    frontier: Antichain<T>,
+    budget: ReadBudget,
+}
+
+impl<D, T, R> Batcher<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    /// Construct an empty batcher using shared merge-input admission.
+    /// The budget must fit the largest input pair, including indivisible rows.
+    pub fn new(budget: ReadBudget) -> Self {
+        Self {
+            runs: Vec::new(),
+            lower: Antichain::from_elem(T::minimum()),
+            frontier: Antichain::new(),
+            budget,
+        }
+    }
+
+    /// Lower bound on times remaining after the most recent seal.
+    pub fn frontier(&self) -> AntichainRef<'_, T> {
+        self.frontier.borrow()
+    }
+
+    /// Insert a sorted, consolidated chunk and restore geometric run sizes.
+    pub async fn push(&mut self, chunk: ColumnChunk<D, T, R>) {
+        let mut run = VecDeque::from([chunk]);
+        let mut settled = VecDeque::new();
+        ColumnChunk::settle(&mut run, true, &mut settled);
+        self.runs.push(Weighted {
+            weight: weight(&settled),
+            data: settled,
+        });
+        while self.runs.len() > 1 {
+            let n = self.runs.len();
+            if self.runs[n - 1].weight < self.runs[n - 2].weight / 2 {
+                break;
+            }
+            self.merge_last().await;
+        }
+    }
+
+    async fn merge_last(&mut self) {
+        let right = self.runs.pop().expect("right run");
+        let left = self.runs.pop().expect("left run");
+        let merged = merge_runs(left.data, right.data, None, self.budget.clone()).await;
+        self.runs.push(Weighted {
+            weight: weight(&merged),
+            data: merged,
+        });
+    }
+
+    /// Extract updates strictly before `upper`, retaining later updates.
+    /// Unlike an arrangement writer, callers may push older times back after a seal.
+    pub async fn seal(
+        &mut self,
+        upper: Antichain<T>,
+    ) -> (Vec<ColumnChunk<D, T, R>>, Description<T>) {
+        while self.runs.len() > 1 {
+            self.merge_last().await;
+        }
+        let mut input = self.runs.pop().map(|r| r.data).unwrap_or_default();
+        let mut keep = VecDeque::new();
+        let mut retained = VecDeque::new();
+        let mut ship = VecDeque::new();
+        let mut output = VecDeque::new();
+        self.frontier.clear();
+        while let Some(mut chunk) = input.pop_front() {
+            let (lower, high) = chunk.chunk_time_bounds();
+            let split = !high.iter().all(|t| !upper.less_equal(t))
+                && !lower.iter().all(|t| upper.less_equal(t));
+            // Keep partition input admission until extraction has consumed it.
+            let mut reader = split.then(|| {
+                Merge::new(
+                    VecDeque::from([chunk.clone()]),
+                    VecDeque::new(),
+                    self.budget.clone(),
+                )
+                .expect("chunk fits read budget")
+            });
+            if let Some(reader) = &mut reader {
+                chunk = reader.read_output(chunk).await;
+            }
+            let mut one = VecDeque::from([chunk]);
+            ColumnChunk::extract(
+                &mut one,
+                upper.borrow(),
+                &mut self.frontier,
+                &mut keep,
+                &mut ship,
+            );
+            drop(reader);
+            let mut settled = VecDeque::new();
+            ColumnChunk::settle(&mut keep, false, &mut settled);
+            retained.extend(settled);
+            ColumnChunk::settle(&mut ship, false, &mut output);
+            tokio::task::yield_now().await;
+        }
+        let mut settled = VecDeque::new();
+        ColumnChunk::settle(&mut keep, true, &mut settled);
+        retained.extend(settled);
+        if !retained.is_empty() {
+            self.runs.push(Weighted {
+                weight: weight(&retained),
+                data: retained,
+            });
+        }
+        ColumnChunk::settle(&mut ship, true, &mut output);
+        let lower = std::mem::replace(&mut self.lower, upper.clone());
+        (
+            output.into(),
+            Description::new(lower, upper, Antichain::from_elem(T::minimum())),
+        )
+    }
+}
+
+fn weight<D: Columnar, T: Columnar, R: Columnar>(run: &Run<D, T, R>) -> usize
+where
+    ColumnChunk<D, T, R>: Chunk,
+{
+    run.iter().map(Chunk::len).sum::<usize>().max(1)
+}
+
+async fn merge_runs<D, T, R>(
+    left: Run<D, T, R>,
+    right: Run<D, T, R>,
+    since: Option<Antichain<T>>,
+    budget: ReadBudget,
+) -> Run<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    let mut merge = Merge::new(left, right, budget).expect("chunk pair fits read budget");
+    let mut advancing = VecDeque::new();
+    let mut settling = VecDeque::new();
+    let mut output = VecDeque::new();
+    loop {
+        let done = match merge.step().await {
+            Step::Output(chunk) => {
+                if let Some(since) = &since {
+                    advancing.push_back(merge.read_output(chunk).await);
+                    ColumnChunk::advance(&mut advancing, since.borrow(), false, &mut settling);
+                } else {
+                    settling.push_back(chunk);
+                }
+                false
+            }
+            Step::Progress => false,
+            Step::Complete => true,
+        };
+        if done && let Some(since) = &since {
+            ColumnChunk::advance(&mut advancing, since.borrow(), true, &mut settling);
+        }
+        ColumnChunk::settle(&mut settling, done, &mut output);
+        if done {
+            return output;
+        }
+        tokio::task::yield_now().await;
+    }
+}
+
+struct State<C: Chunk> {
+    batches: Vec<Weighted<Rc<ChunkBatch<C>>>>,
+    logical: Antichain<C::Time>,
+    physical: Antichain<C::Time>,
+}
+
+/// A trace whose synchronous methods publish batches and request asynchronous work.
+/// Construct through [`arrange`] so the maintenance driver is installed.
+pub struct Spine<D: Columnar, T: Columnar, R: Columnar>
+where
+    ColumnChunk<D, T, R>: Chunk,
+{
+    state: Rc<RefCell<State<ColumnChunk<D, T, R>>>>,
+    notify: Arc<Notify>,
+    logical: Antichain<T>,
+    physical: Antichain<T>,
+}
+
+impl<D, T, R> TraceReader for Spine<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    type Time = T;
+    type Batch = BatchRef<D, T, R>;
+    fn batches_through(&mut self, upper: AntichainRef<T>) -> Option<Vec<Self::Batch>> {
+        let state = self.state.borrow();
+        if upper.is_empty() {
+            return Some(state.batches.iter().map(|b| Rc::clone(&b.data)).collect());
+        }
+        if !PartialOrder::less_equal(&self.physical.borrow(), &upper) {
+            return None;
+        }
+        if upper == Antichain::from_elem(T::minimum()).borrow() {
+            return Some(Vec::new());
+        }
+        let end = state
+            .batches
+            .iter()
+            .position(|b| b.upper().borrow() == upper)?;
+        Some(
+            state.batches[..=end]
+                .iter()
+                .map(|b| Rc::clone(&b.data))
+                .collect(),
+        )
+    }
+    fn set_logical_compaction(&mut self, frontier: AntichainRef<T>) {
+        assert!(PartialOrder::less_equal(&self.logical.borrow(), &frontier));
+        self.logical = frontier.to_owned();
+        self.state.borrow_mut().logical.clone_from(&self.logical);
+        self.notify.notify_one();
+    }
+    fn get_logical_compaction(&mut self) -> AntichainRef<'_, T> {
+        self.logical.borrow()
+    }
+    fn set_physical_compaction(&mut self, frontier: AntichainRef<T>) {
+        assert!(PartialOrder::less_equal(&self.physical.borrow(), &frontier));
+        self.physical = frontier.to_owned();
+        self.state.borrow_mut().physical.clone_from(&self.physical);
+        self.notify.notify_one();
+    }
+    fn get_physical_compaction(&mut self) -> AntichainRef<'_, T> {
+        self.physical.borrow()
+    }
+    fn map_batches<F: FnMut(&Self::Batch)>(&self, f: F) {
+        self.state
+            .borrow()
+            .batches
+            .iter()
+            .map(|b| &b.data)
+            .for_each(f);
+    }
+}
+
+impl<D, T, R> Trace for Spine<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    fn new(
+        _info: OperatorInfo,
+        _logging: Option<Logger>,
+        _activator: Option<timely::scheduling::Activator>,
+    ) -> Self {
+        let minimum = Antichain::from_elem(T::minimum());
+        Self {
+            state: Rc::new(RefCell::new(State {
+                batches: Vec::new(),
+                logical: minimum.clone(),
+                physical: minimum.clone(),
+            })),
+            notify: Arc::new(Notify::new()),
+            logical: minimum.clone(),
+            physical: minimum,
+        }
+    }
+    fn exert(&mut self) {
+        self.notify.notify_one();
+    }
+    // This driver completes geometric merges incrementally, independently of fueled-spine policy.
+    fn set_exert_logic(&mut self, _logic: ExertionLogic) {}
+    fn insert(&mut self, batch: Self::Batch) {
+        let mut state = self.state.borrow_mut();
+        let lower = state
+            .batches
+            .last()
+            .map(|b| b.upper().clone())
+            .unwrap_or_else(|| Antichain::from_elem(T::minimum()));
+        assert!(PartialOrder::less_equal(&lower, batch.lower()));
+        if &lower != batch.lower() {
+            state.batches.push(Weighted {
+                weight: 1,
+                data: Rc::new(ChunkBatch::empty(lower, batch.lower().clone())),
+            });
+        }
+        state.batches.push(Weighted {
+            weight: batch.len().max(1),
+            data: batch,
+        });
+        self.notify.notify_one();
+    }
+    fn close(&mut self) {
+        let mut upper = Antichain::new();
+        self.read_upper(&mut upper);
+        if !upper.is_empty() {
+            self.insert(Rc::new(ChunkBatch::empty(upper, Antichain::new())));
+        }
+    }
+}
+
+async fn maintain<D, T, R>(state: &RefCell<State<ColumnChunk<D, T, R>>>, budget: ReadBudget)
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    loop {
+        let work = {
+            let state = state.borrow();
+            (1..state.batches.len())
+                .rev()
+                .find(|&i| {
+                    PartialOrder::less_equal(state.batches[i].upper(), &state.physical)
+                        && state.batches[i].weight >= state.batches[i - 1].weight / 2
+                })
+                .map(|i| {
+                    (
+                        i,
+                        state.batches[i - 1].clone(),
+                        state.batches[i].clone(),
+                        state.logical.clone(),
+                    )
+                })
+        };
+        let Some((i, left, right, since)) = work else {
+            return;
+        };
+        let chunks = merge_runs(
+            left.chunks.clone().into(),
+            right.chunks.clone().into(),
+            Some(since.clone()),
+            budget.clone(),
+        )
+        .await;
+        let batch = Rc::new(ChunkBatch {
+            chunks: chunks.into(),
+            description: Description::new(left.lower().clone(), right.upper().clone(), since),
+        });
+        // Only this driver replaces batches. Readers can advance holds while
+        // it awaits, but those frontiers cannot regress past the captured since.
+        state.borrow_mut().batches.splice(
+            i - 1..=i,
+            [Weighted {
+                weight: batch.len().max(1),
+                data: batch,
+            }],
+        );
+    }
+}
+
+/// Arrange a local stream using asynchronous batch and trace merges.
+///
+/// The caller owns the shutdown token. The input must already have the desired
+/// worker partitioning. All clones of `budget` share decoded-input admission.
+pub fn arrange<'scope, D, T, R>(
+    stream: Stream<'scope, T, Column<(D, T, R)>>,
+    budget: ReadBudget,
+    name: &str,
+) -> (
+    Arranged<'scope, TraceAgent<Spine<D, T, R>>>,
+    PressOnDropButton,
+)
+where
+    for<'a> ChunkChunker<D, T, R>: PushInto<&'a mut Column<(D, T, R)>>,
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + TotalOrder,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    let mut builder = OperatorBuilder::new(name.to_owned(), stream.scope());
+    let info = builder.operator_info();
+    let trace = Spine::<D, T, R>::new(info.clone(), None, None);
+    let state = Rc::clone(&trace.state);
+    let notify = Arc::clone(&trace.notify);
+    let (trace, mut writer) = TraceAgent::new(trace, info, None);
+    let (output, result) = builder.new_output::<CapacityContainerBuilder<Vec<BatchRef<D, T, R>>>>();
+    let mut input = builder.new_input_for(stream, Pipeline, &output);
+    let button = builder.build(move |caps| async move {
+        drop(caps);
+        let mut cap: Option<timely::dataflow::operators::Capability<T>> = None;
+        let mut batcher = Batcher::new(budget.clone());
+        let mut chunker = ChunkChunker::<D, T, R>::default();
+        let mut upper = Antichain::from_elem(T::minimum());
+        loop {
+            let event = tokio::select! {
+                _ = input.ready(), if !upper.is_empty() => input.next_sync(),
+                _ = notify.notified() => None,
+            };
+            if let Some(event) = event {
+                match event {
+                    Event::Data(time, mut data) => {
+                        if cap.as_ref().is_none_or(|old| time.time() < old.time()) {
+                            cap = Some(time);
+                        }
+                        chunker.push_into(&mut data);
+                        while let Some(chunk) = chunker.extract() {
+                            batcher.push(std::mem::take(chunk)).await;
+                        }
+                    }
+                    Event::Progress(next) => {
+                        while let Some(chunk) = chunker.finish() {
+                            batcher.push(std::mem::take(chunk)).await;
+                        }
+                        if next != upper {
+                            let (chunks, description) = batcher.seal(next.clone()).await;
+                            let batch = Rc::new(ChunkBatch {
+                                chunks,
+                                description,
+                            });
+                            writer
+                                .insert(Rc::clone(&batch), cap.as_ref().map(|c| c.time().clone()));
+                            if let Some(time) = &cap {
+                                output.give(time, batch);
+                            }
+                            if let Some(t) = batcher.frontier().first() {
+                                cap.as_mut()
+                                    .expect("buffered data has a capability")
+                                    .downgrade(t);
+                            } else {
+                                cap = None;
+                            }
+                            upper = next;
+                        }
+                    }
+                }
+            }
+            maintain(&state, budget.clone()).await;
+        }
+    });
+    (
+        Arranged {
+            stream: result,
+            trace,
+        },
+        button.press_on_drop(),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use columnar::{Index, Len};
+    use differential_dataflow::trace::Batcher as SyncBatcher;
+    use differential_dataflow::trace::chunk::ChunkBatcher;
+    use mz_ore::pool::Pool;
+
+    type TestChunk = ColumnChunk<(u64, Vec<u8>), u64, i64>;
+    type Update = ((u64, Vec<u8>), u64, i64);
+
+    fn chunk(rows: &[Update], pool: &Pool) -> TestChunk {
+        let mut column = Column::default();
+        for row in rows {
+            column.push_into(row);
+        }
+        TestChunk::spill_body(column, pool, 1)
+    }
+
+    fn collect(chunks: impl IntoIterator<Item = TestChunk>) -> Vec<Update> {
+        let mut rows = Vec::new();
+        for chunk in chunks {
+            let column = chunk.into_column();
+            let view = column.borrow();
+            for i in 0..view.len() {
+                rows.push(<Update as Columnar>::into_owned(view.get(i)));
+            }
+        }
+        rows
+    }
+
+    #[mz_ore::test]
+    fn batcher_matches_synchronous_seals_with_spills_and_restash() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        super::super::with_spill_override(pool.clone(), || {
+            tokio::runtime::Runtime::new().unwrap().block_on(async {
+                let budget = ReadBudget::new(1 << 20);
+                let mut asynchronous = Batcher::new(budget.clone());
+                let mut synchronous = ChunkBatcher::<TestChunk>::new(None, 0);
+                for round in 0..12 {
+                    let mut rows = Vec::new();
+                    for i in 0..80 {
+                        rows.push((
+                            (i % 23, vec![42; 128]),
+                            (i + round) % 7,
+                            if (i + round) % 3 == 0 { -1 } else { 1 },
+                        ));
+                    }
+                    differential_dataflow::consolidation::consolidate_updates(&mut rows);
+                    let chunk = chunk(&rows, &pool);
+                    synchronous.push_into(chunk.clone());
+                    asynchronous.push(chunk).await;
+                    if round % 3 == 2 {
+                        let upper = Antichain::from_elem(round / 3 + 1);
+                        let (actual, _) = asynchronous.seal(upper.clone()).await;
+                        let (expected, _) = synchronous.seal(upper);
+                        assert_eq!(collect(actual), collect(expected));
+                        assert_eq!(asynchronous.frontier(), synchronous.frontier());
+                    }
+                }
+                assert_eq!(
+                    collect(asynchronous.seal(Antichain::new()).await.0),
+                    collect(synchronous.seal(Antichain::new()).0)
+                );
+                assert_eq!(budget.reserved_bytes(), 0);
+                assert!(pool.stats().async_reads > 0);
+            });
+        });
+    }
+
+    #[mz_ore::test]
+    fn trace_compaction_respects_all_readers_and_retains_published_batches() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        tokio::runtime::Runtime::new().unwrap().block_on(async {
+            let info = OperatorInfo::new(0, 0, Rc::from([0]));
+            let spine = Spine::<(u64, Vec<u8>), u64, i64>::new(info.clone(), None, None);
+            let state = Rc::clone(&spine.state);
+            let (mut reader, mut writer) = TraceAgent::new(spine, info, None);
+            let mut hold = reader.clone();
+            for time in 0..2 {
+                writer.insert(
+                    Rc::new(ChunkBatch {
+                        chunks: vec![chunk(
+                            &[((1, vec![7; 2048]), time, if time == 0 { 1 } else { -1 })],
+                            &pool,
+                        )],
+                        description: Description::new(
+                            Antichain::from_elem(time),
+                            Antichain::from_elem(time + 1),
+                            Antichain::from_elem(0),
+                        ),
+                    }),
+                    Some(time),
+                );
+            }
+            let snapshot = reader.batches_through(Antichain::new().borrow()).unwrap();
+            let frontier = Antichain::from_elem(2);
+            reader.set_logical_compaction(frontier.borrow());
+            reader.set_physical_compaction(frontier.borrow());
+            let budget = ReadBudget::new(1 << 20);
+            maintain(&state, budget.clone()).await;
+            assert_eq!(
+                state.borrow().batches.len(),
+                2,
+                "another reader still holds the original cut"
+            );
+            hold.set_logical_compaction(frontier.borrow());
+            hold.set_physical_compaction(frontier.borrow());
+            let mut maintenance = Box::pin(maintain(&state, budget.clone()));
+            assert!(futures_util::poll!(&mut maintenance).is_pending());
+            assert_eq!(
+                reader
+                    .batches_through(Antichain::new().borrow())
+                    .unwrap()
+                    .len(),
+                2,
+                "pending compaction must keep both inputs visible"
+            );
+            maintenance.await;
+            let merged = reader.batches_through(Antichain::new().borrow()).unwrap();
+            assert_eq!(merged.len(), 1);
+            assert_eq!(
+                merged[0].len(),
+                0,
+                "advancement cancels opposite diffs across batches"
+            );
+            assert_eq!(merged[0].upper(), &frontier);
+            assert!(
+                reader
+                    .batches_through(Antichain::from_elem(1).borrow())
+                    .is_none()
+            );
+            assert_eq!(
+                snapshot.iter().map(|b| b.len()).sum::<usize>(),
+                2,
+                "published snapshots survive replacement"
+            );
+            assert!(pool.stats().async_reads >= 2);
+            assert_eq!(budget.reserved_bytes(), 0);
+        });
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/merge.rs b/src/timely-util/src/columnar/chunk/merge.rs
index 5609ee3dc34d8..5c615c230a12f 100644
--- a/src/timely-util/src/columnar/chunk/merge.rs
+++ b/src/timely-util/src/columnar/chunk/merge.rs
@@ -269,6 +269,43 @@ where
         self.ready.pop_front().map_or(Step::Progress, Step::Output)
     }
 
+    /// Materialize a passed-through output for timestamp advancement.
+    /// The merge's input reservation also covers this input-sized body.
+    pub(super) async fn read_output(
+        &mut self,
+        chunk: ColumnChunk<D, T, R>,
+    ) -> ColumnChunk<D, T, R> {
+        if matches!(chunk, ColumnChunk::Spilled(..)) {
+            if self.reservation.is_none() {
+                self.reservation = Some(Arc::new(
+                    Arc::clone(&self.budget.bytes)
+                        .acquire_many_owned(self.required)
+                        .await
+                        .expect("read budget remains open"),
+                ));
+            }
+            let depth = chunk.depth();
+            let ColumnChunk::Spilled(body, _) = chunk else {
+                unreachable!()
+            };
+            let handle = Arc::clone(&body.handle);
+            let reservation = Arc::clone(self.reservation.as_ref().expect("admitted output"));
+            let task = mz_ore::task::spawn(|| "column_advance_read", async move {
+                ReadResult {
+                    buffers: [Some(handle.read_async().await), None],
+                    _reservation: reservation,
+                }
+            });
+            let ReadResult { mut buffers, .. } = task.await;
+            ColumnChunk::Resident(
+                std::rc::Rc::new(Column::Align(buffers[0].take().expect("read output"))),
+                depth,
+            )
+        } else {
+            chunk
+        }
+    }
+
     async fn finish_reads(&mut self) {
         if let Some(task) = &mut self.pending {
             let ReadResult { buffers, .. } = task.await;
@@ -339,6 +376,7 @@ mod tests {
             bytes,
             mz_ore::pool::ChunkHints { depth: 1 },
             codec,
+            false,
         );
         pool.set_spill_threads(0);
         pool.set_budget(0);

From 44a8bdde31ba1bb19533fe874e0a10bd7ed27528 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 12:42:17 -0400
Subject: [PATCH 11/31] storage: wire resumable source and feedback merges into
 upsert

---
 misc/python/materialize/mzcompose/__init__.py |   5 +
 src/storage-types/src/dyncfgs.rs              |  11 ++
 .../src/upsert_continual_feedback_v2.rs       | 181 ++++++++++++++++--
 .../upsert_continual_feedback_v2/payload.rs   |   9 +-
 4 files changed, 192 insertions(+), 14 deletions(-)

diff --git a/misc/python/materialize/mzcompose/__init__.py b/misc/python/materialize/mzcompose/__init__.py
index de91f84b6a89e..303f4dc6d359c 100644
--- a/misc/python/materialize/mzcompose/__init__.py
+++ b/misc/python/materialize/mzcompose/__init__.py
@@ -374,6 +374,11 @@ def get_variable_system_parameters(
             "true",
             ["true", "false"],
         ),
+        VariableSystemParameter(
+            "enable_upsert_async_merges",
+            "true",
+            ["true", "false"],
+        ),
         VariableSystemParameter(
             "enable_upsert_async_reads",
             "true",
diff --git a/src/storage-types/src/dyncfgs.rs b/src/storage-types/src/dyncfgs.rs
index 066e8f53b1bf9..960bc2a89d669 100644
--- a/src/storage-types/src/dyncfgs.rs
+++ b/src/storage-types/src/dyncfgs.rs
@@ -452,6 +452,16 @@ pub const ENABLE_UPSERT_ASYNC_READS: Config<bool> = Config::new(
     ParameterScope::Replica,
 );
 
+/// Yield during source-stash merges and feedback compaction reads.
+/// Applies to newly constructed chunked upsert-v2 dataflows without payload separation.
+/// Independent of drain/probe read offload in `ENABLE_UPSERT_ASYNC_READS`.
+pub const ENABLE_UPSERT_ASYNC_MERGES: Config<bool> = Config::new(
+    "enable_upsert_async_merges",
+    false,
+    "Use resumable source and feedback merges in chunked upsert-v2. Takes effect on new dataflows. Decoded merge inputs share a 256 MiB process budget.",
+    ParameterScope::Replica,
+);
+
 /// Separate upsert-v2 payload blocks from columnar merge metadata.
 /// Read once per dataflow. Uses the process pool and asynchronous payload reads.
 pub const ENABLE_UPSERT_PAYLOAD_STASH: Config<bool> = Config::new(
@@ -586,6 +596,7 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&ENABLE_UPSERT_PAGED_SPILL)
         .add(&ENABLE_UPSERT_CHUNKED_STASH)
         .add(&ENABLE_UPSERT_ASYNC_READS)
+        .add(&ENABLE_UPSERT_ASYNC_MERGES)
         .add(&ENABLE_UPSERT_PAYLOAD_STASH)
         .add(&WALLCLOCK_GLOBAL_LAG_HISTOGRAM_RETENTION_INTERVAL)
         .add(&WALLCLOCK_LAG_HISTORY_RETENTION_INTERVAL)
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index ec1df11f6dc1b..1ac4e37fef0a6 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -113,7 +113,8 @@ use mz_repr::{Datum, Diff, GlobalId, Row};
 use mz_row_spine::DatumSeq;
 use mz_row_spine::{ValRowColPagedBuilder, ValRowSpine};
 use mz_storage_types::dyncfgs::{
-    ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH, ENABLE_UPSERT_PAYLOAD_STASH,
+    ENABLE_UPSERT_ASYNC_MERGES, ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH,
+    ENABLE_UPSERT_PAYLOAD_STASH,
 };
 use mz_storage_types::errors::{DataflowError, EnvelopeError, UpsertError};
 use mz_timely_util::builder_async::{
@@ -160,6 +161,8 @@ pub enum UpsertStashFlavor {
     /// Chunk merge batcher stash, chunk-spine feedback arrangement,
     /// bulk-probe drain. Spills through the process buffer pool.
     Chunked { async_reads: bool },
+    /// Async source batching and feedback trace compaction.
+    Resumable { async_reads: bool },
 }
 
 impl UpsertStashFlavor {
@@ -169,6 +172,11 @@ impl UpsertStashFlavor {
     pub fn from_config(config: &ConfigSet) -> Self {
         if ENABLE_UPSERT_PAYLOAD_STASH.get(config) {
             Self::Payload
+        } else if ENABLE_UPSERT_CHUNKED_STASH.get(config) && ENABLE_UPSERT_ASYNC_MERGES.get(config)
+        {
+            Self::Resumable {
+                async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
+            }
         } else if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
             Self::Chunked {
                 async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
@@ -486,6 +494,26 @@ where
             )
         }
 
+        UpsertStashFlavor::Resumable { async_reads } => {
+            let (persist_arranged, token) = mz_timely_util::columnar::chunk::asynchronous::arrange(
+                encoded,
+                merge_read_budget(),
+                "Persist resumable feedback",
+            );
+            let mut persist_token = persist_token.unwrap_or_default();
+            persist_token.push(token);
+            build_upsert_operator::<ResumableArm, _, _>(
+                input,
+                resume_upper,
+                persist_arranged,
+                Some(persist_token),
+                upsert_metrics,
+                source_config,
+                async_reads,
+                None,
+            )
+        }
+
         UpsertStashFlavor::Chunked { async_reads } => {
             // Chains and sealed batches alike are `FeedbackChunk`s whose
             // bodies spill to the buffer pool, behind the same process spill
@@ -758,7 +786,7 @@ where
             // Flush buffered events through the chunker into the batcher. This
             // triggers the chunker + geometric chain merging, which consolidates
             // entries for the same (key, time) via the UpsertDiff Semigroup.
-            A::flush(&mut push_buffer, &mut chunker, &mut batcher);
+            A::flush(&mut push_buffer, &mut chunker, &mut batcher).await;
 
             // Step 2: Read persist frontier.
             // The persist probe tells us which output times have been
@@ -841,9 +869,9 @@ where
                 // Step 1 already consolidated `push_buffer` through the chunker
                 // (which readies a complete chunk per `push_into`), so the
                 // chunker holds nothing pending here and we can seal directly.
-                let (sealed, _description) = batcher.seal(input_upper.clone());
+                let sealed = A::seal(&mut batcher, input_upper.clone()).await;
                 // Frontier of data remaining in the batcher (ts >= input_upper).
-                let remaining_frontier = batcher.frontier().to_owned();
+                let remaining_frontier = A::frontier(&mut batcher);
 
                 let mut ineligible = Vec::new();
                 // The drain emits eligible output directly through
@@ -884,7 +912,7 @@ where
                 // remaining data: either entries still in the batcher (above
                 // input_upper) or ineligible entries being pushed back.
                 let min_ineligible_ts = ineligible.iter().map(|(_, ts, _)| ts).min().cloned();
-                A::flush(&mut ineligible, &mut chunker, &mut batcher);
+                A::flush(&mut ineligible, &mut chunker, &mut batcher).await;
 
                 // `Option::min` alone would be wrong here, `None` sorts low.
                 // Chain the candidates and take the min over present ones.
@@ -945,20 +973,29 @@ where
     type Spine: TraceReader<Time = T> + 'static;
     /// The source-stash batcher. `'static` because the operator future owns
     /// it.
-    type Batcher: Batcher<Time = T> + 'static;
+    type Batcher: 'static;
+    type Sealed;
+
+    /// Seal complete input, allowing the worker to yield during merges.
+    async fn seal(batcher: &mut Self::Batcher, upper: Antichain<T>) -> Self::Sealed;
+    /// Times remaining after the most recent seal.
+    fn frontier(batcher: &mut Self::Batcher) -> Antichain<T>;
 
     /// A new stash batcher for one source dataflow.
     fn new_batcher(store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher;
 
     /// Push one sorted, consolidated `Column` chunk into the batcher, in the
     /// batcher's chunk representation.
-    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Self::Value>>);
+    async fn push_chunk(
+        batcher: &mut Self::Batcher,
+        chunk: Column<UpsertUpdate<T, O, Self::Value>>,
+    );
 
     /// Consolidate `updates` through `chunker` into `Column` chunks and push
     /// them into `batcher`, emptying `updates` (keeping its capacity). The
     /// chunker readies a fully-consolidated chunk per `push_into`, so the
     /// `extract` loop drains everything it produced.
-    fn flush(
+    async fn flush(
         updates: &mut Vec<UpsertUpdate<T, O, Self::Value>>,
         chunker: &mut UpsertChunker<T, O, Self::Value>,
         batcher: &mut Self::Batcher,
@@ -975,7 +1012,7 @@ where
         }
         chunker.push_into(&mut raw);
         while let Some(chunk) = chunker.extract() {
-            Self::push_chunk(batcher, std::mem::take(chunk));
+            Self::push_chunk(batcher, std::mem::take(chunk)).await;
         }
         Self::end_flush(batcher);
     }
@@ -983,7 +1020,7 @@ where
     /// Classify one sealed stash against `persist_upper` and emit eligible
     /// output; see [`DrainStats`].
     async fn drain(
-        sealed: Vec<<Self::Batcher as Batcher>::Output>,
+        sealed: Self::Sealed,
         ineligible: &mut Vec<UpsertUpdate<T, O, Self::Value>>,
         output_handle: &UpsertOutputHandle<T>,
         output_cap: &Capability<T>,
@@ -1025,12 +1062,19 @@ where
 
     type Spine = FeedbackSpine<T>;
     type Batcher = UpsertChunkBatcher<T, O>;
+    type Sealed = Vec<UpsertChunk<T, O>>;
+    async fn seal(batcher: &mut Self::Batcher, upper: Antichain<T>) -> Self::Sealed {
+        batcher.seal(upper).0
+    }
+    fn frontier(batcher: &mut Self::Batcher) -> Antichain<T> {
+        batcher.frontier().to_owned()
+    }
 
     fn new_batcher(_store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher {
         Batcher::new(None, 0)
     }
 
-    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>) {
+    async fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>) {
         batcher.push_into(ColumnChunk::from_column(chunk));
     }
 
@@ -1061,6 +1105,79 @@ where
     }
 }
 
+/// Production arm for resumable columnar batching and compaction.
+struct ResumableArm;
+
+fn merge_read_budget() -> mz_timely_util::columnar::chunk::merge::ReadBudget {
+    // Shared across source and feedback operators on every worker in this process.
+    // This bounds decoded merge inputs only, independently of pool residency.
+    static BUDGET: std::sync::OnceLock<mz_timely_util::columnar::chunk::merge::ReadBudget> =
+        std::sync::OnceLock::new();
+    BUDGET
+        .get_or_init(|| mz_timely_util::columnar::chunk::merge::ReadBudget::new(256 << 20))
+        .clone()
+}
+
+impl<T, O> UpsertStashArm<T, O> for ResumableArm
+where
+    T: Timestamp + TotalOrder + Lattice + Sync,
+    T: columnation::Columnation + columnar::Columnar + Default,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    O: columnar::Columnar + Default + Ord + Clone + Send + Sync + 'static,
+    for<'a> columnar::Ref<'a, O>: Ord + Copy,
+{
+    type Value = Row;
+
+    fn encode(value: Option<Row>, _batcher: &mut Self::Batcher) -> Option<Row> {
+        value
+    }
+
+    type Spine = mz_timely_util::columnar::chunk::asynchronous::Spine<(UpsertKey, Row), T, Diff>;
+    type Batcher =
+        mz_timely_util::columnar::chunk::asynchronous::Batcher<UpsertKey, T, UpsertDiff<O, Row>>;
+    type Sealed = Vec<UpsertChunk<T, O>>;
+    async fn seal(batcher: &mut Self::Batcher, upper: Antichain<T>) -> Self::Sealed {
+        batcher.seal(upper).await.0
+    }
+    fn frontier(batcher: &mut Self::Batcher) -> Antichain<T> {
+        batcher.frontier().to_owned()
+    }
+
+    fn new_batcher(_store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher {
+        Self::Batcher::new(merge_read_budget())
+    }
+
+    async fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>) {
+        batcher.push(ColumnChunk::from_column(chunk)).await;
+    }
+
+    async fn drain(
+        sealed: Vec<UpsertChunk<T, O>>,
+        ineligible: &mut Vec<UpsertUpdate<T, O>>,
+        output_handle: &UpsertOutputHandle<T>,
+        output_cap: &Capability<T>,
+        persist_upper: &Antichain<T>,
+        trace: &mut TraceAgent<Self::Spine>,
+        worker_id: usize,
+        source_id: GlobalId,
+        async_reads: bool,
+        _batcher: &mut Self::Batcher,
+    ) -> DrainStats {
+        drain_sealed_input_chunked(
+            sealed.into_iter(),
+            ineligible,
+            output_handle,
+            output_cap,
+            persist_upper,
+            trace,
+            worker_id,
+            source_id,
+            async_reads,
+        )
+        .await
+    }
+}
+
 /// The paged flavor: [`UpsertPagedBatcher`] stash, `ValRowSpine` feedback
 /// arrangement, cursor drain. Cold chains page out of RSS through the
 /// storage-owned column pager, captured once per batcher at construction.
@@ -1082,6 +1199,13 @@ where
 
     type Spine = ValRowSpine<UpsertKey, T, Diff>;
     type Batcher = UpsertPagedBatcher<T, O>;
+    type Sealed = Vec<Column<UpsertUpdate<T, O>>>;
+    async fn seal(batcher: &mut Self::Batcher, upper: Antichain<T>) -> Self::Sealed {
+        batcher.seal(upper).0
+    }
+    fn frontier(batcher: &mut Self::Batcher) -> Antichain<T> {
+        batcher.frontier().to_owned()
+    }
 
     fn new_batcher(_store: Option<mz_timely_util::out_of_core::Store>) -> Self::Batcher {
         let mut batcher: UpsertPagedBatcher<T, O> = Batcher::new(None, 0);
@@ -1089,7 +1213,7 @@ where
         batcher
     }
 
-    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>) {
+    async fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O>>) {
         batcher.push_into(chunk);
     }
 
@@ -1193,7 +1317,7 @@ async fn drain_sealed_input_chunked<T, O>(
     output_handle: &UpsertOutputHandle<T>,
     output_cap: &Capability<T>,
     persist_upper: &Antichain<T>,
-    trace: &mut TraceAgent<FeedbackSpine<T>>,
+    trace: &mut impl TraceReader<Time = T, Batch = <FeedbackSpine<T> as TraceReader>::Batch>,
     worker_id: usize,
     source_id: GlobalId,
     async_reads: bool,
@@ -2194,6 +2318,37 @@ mod test {
         differential_dataflow::consolidation::consolidate_updates(&mut emitted);
         (frontier, emitted)
     }
+    #[mz_ore::test]
+    fn resumable_state_matches_feedback_across_resume_and_restash() {
+        let pool = mz_ore::pool::Pool::new().unwrap();
+        pool.set_budget(0);
+        pool.set_spill_threads(0);
+        mz_timely_util::columnar::chunk::with_spill_override(pool.clone(), || {
+            let runtime = tokio::runtime::Runtime::new().unwrap();
+            let _enter = runtime.enter();
+            for width in [32, 1900, 3 << 20] {
+                let baseline = run_payload_feedback_scenario(
+                    UpsertStashFlavor::Chunked { async_reads: false },
+                    width,
+                );
+                let reads = pool.stats().async_reads;
+                assert_eq!(
+                    baseline,
+                    run_payload_feedback_scenario(
+                        UpsertStashFlavor::Resumable { async_reads: false },
+                        width
+                    )
+                );
+                if width >= 1900 {
+                    assert!(
+                        pool.stats().async_reads > reads,
+                        "merge reads must be offloaded with drain offload disabled"
+                    );
+                }
+            }
+        });
+    }
+
     #[mz_ore::test]
     fn payload_state_matches_columnar_feedback_across_resume_and_restash() {
         let pool = mz_ore::pool::Pool::new().unwrap();
diff --git a/src/storage/src/upsert_continual_feedback_v2/payload.rs b/src/storage/src/upsert_continual_feedback_v2/payload.rs
index a9f4a1f8660d6..c564fea81ba31 100644
--- a/src/storage/src/upsert_continual_feedback_v2/payload.rs
+++ b/src/storage/src/upsert_continual_feedback_v2/payload.rs
@@ -205,6 +205,13 @@ where
     type Value = Value;
     type Spine = FeedbackSpine<T>;
     type Batcher = SourceBatcher<SourceChunk<T, O>>;
+    type Sealed = Vec<SourceChunk<T, O>>;
+    async fn seal(batcher: &mut Self::Batcher, upper: Antichain<T>) -> Self::Sealed {
+        batcher.seal(upper).0
+    }
+    fn frontier(batcher: &mut Self::Batcher) -> Antichain<T> {
+        batcher.frontier().to_owned()
+    }
 
     fn new_batcher(store: Option<Store>) -> Self::Batcher {
         let store = store.expect("payload arm shares its store with feedback");
@@ -223,7 +230,7 @@ where
         batcher.restash_owners.clear();
     }
 
-    fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Value>>) {
+    async fn push_chunk(batcher: &mut Self::Batcher, chunk: Column<UpsertUpdate<T, O, Value>>) {
         // Publish only the initial chunker's winners, packed in metadata order.
         let mut builder = batcher.store.builder();
         let mut metadata = Column::default();

From f98f0ac73e1728085e20131d0b6516399b470f81 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 14:58:15 -0400
Subject: [PATCH 12/31] timely-util: drive async merges with the vendored
 differential spine

---
 src/timely-util/src/columnar/chunk.rs         |    1 +
 .../src/columnar/chunk/asynchronous.rs        |  469 +------
 src/timely-util/src/columnar/chunk/merge.rs   |   48 +-
 src/timely-util/src/columnar/chunk/native.rs  |  305 +++++
 .../src/columnar/chunk/native/pool_chunk.rs   |  396 ++++++
 .../src/columnar/chunk/native/vendor.rs       |   28 +
 .../src/columnar/chunk/native/vendor/LICENSE  |   22 +
 .../columnar/chunk/native/vendor/batcher.rs   |  451 +++++++
 .../src/columnar/chunk/native/vendor/chunk.rs |  782 +++++++++++
 .../src/columnar/chunk/native/vendor/spine.rs | 1147 +++++++++++++++++
 .../src/columnar/chunk/native/vendor/tests.rs |    6 +
 .../chunk/native/vendor/tests/chunk.rs        |  211 +++
 .../chunk/native/vendor/tests/spine.rs        |  157 +++
 13 files changed, 3564 insertions(+), 459 deletions(-)
 create mode 100644 src/timely-util/src/columnar/chunk/native.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/pool_chunk.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/LICENSE
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/spine.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/tests.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs
 create mode 100644 src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs

diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index a720f6391ff55..8085a9d4d1bd6 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -255,6 +255,7 @@ const COMMIT_BYTES: usize = 2 << 20;
 
 pub mod asynchronous;
 pub mod merge;
+mod native;
 
 /// Bodies smaller than this stay resident: the pool's smallest size class is
 /// 64 KiB, so spilling below it trades no meaningful memory for slot waste.
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index b2e5e6f80699f..2d256ee7afa8c 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -1,429 +1,33 @@
 // Copyright Materialize, Inc. and contributors. All rights reserved.
-//
 // Use of this software is governed by the Business Source License
 // included in the LICENSE file.
 
-//! Asynchronous columnar batching and trace compaction.
+//! Worker integration for Differential's native pollable batching and compaction.
 //!
-//! Runs follow a geometric merge policy. Each merge yields between output
-//! chunks and awaits pool reads, while settlement and timestamp advancement
-//! run on the Timely worker. Trace readers retain the published input batches
-//! until their replacement is complete. No shared-state borrow crosses an await.
-//!
-//! The arranger currently requires totally ordered timestamps. Its trace still
-//! uses `TraceAgent` to aggregate reader compaction holds. It is a separate
-//! driver from Differential's fueled spine, whose synchronous completion
-//! contract cannot represent a pending read.
-
-use std::cell::RefCell;
-use std::collections::VecDeque;
-use std::rc::Rc;
-use std::sync::Arc;
+//! Capabilities cover pending insertion and sealing. Differential owns merge
+//! levels, fuel accounting, publication, and compaction. Pool reads wake this
+//! operator, which resumes maintenance on its Timely worker.
 
+use super::merge::ReadBudget;
+use super::native::maintain;
+pub use super::native::{Batcher, Spine};
+use super::{ChunkChunker, Column, ColumnChunk};
+use crate::builder_async::{Event, OperatorBuilder, PressOnDropButton};
 use columnar::Columnar;
 use differential_dataflow::difference::Semigroup;
 use differential_dataflow::lattice::Lattice;
-use differential_dataflow::logging::Logger;
 use differential_dataflow::operators::arrange::{Arranged, TraceAgent};
-use differential_dataflow::trace::chunk::{Chunk, ChunkBatch};
-use differential_dataflow::trace::{
-    Batch, BatchReader, Description, ExertionLogic, Trace, TraceReader,
-};
-use timely::PartialOrder;
+use differential_dataflow::trace::chunk::ChunkBatch;
+use differential_dataflow::trace::{ExertionLogic, Trace};
+use std::rc::Rc;
+use std::sync::Arc;
 use timely::container::{CapacityContainerBuilder, ContainerBuilder, PushInto};
 use timely::dataflow::Stream;
 use timely::dataflow::channels::pact::Pipeline;
-use timely::dataflow::operators::generic::OperatorInfo;
 use timely::order::TotalOrder;
-use timely::progress::Timestamp;
-use timely::progress::frontier::{Antichain, AntichainRef};
-use tokio::sync::Notify;
-
-use super::merge::{Merge, ReadBudget, Step};
-use super::{ChunkChunker, Column, ColumnChunk};
-use crate::builder_async::{Event, OperatorBuilder, PressOnDropButton};
-
-type Run<D, T, R> = VecDeque<ColumnChunk<D, T, R>>;
+use timely::progress::{Timestamp, frontier::Antichain};
 type BatchRef<D, T, R> = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
 
-#[derive(Clone)]
-struct Weighted<B> {
-    data: B,
-    weight: usize,
-}
-
-impl<B> std::ops::Deref for Weighted<B> {
-    type Target = B;
-    fn deref(&self) -> &B {
-        &self.data
-    }
-}
-
-/// Geometrically merged runs with asynchronous insertion and sealing.
-///
-/// A cancelled mutation discards its in-progress work. Callers must retain
-/// capabilities until the operation completes, or shut down the dataflow.
-pub struct Batcher<D: Columnar, T: Columnar, R: Columnar> {
-    runs: Vec<Weighted<Run<D, T, R>>>,
-    lower: Antichain<T>,
-    frontier: Antichain<T>,
-    budget: ReadBudget,
-}
-
-impl<D, T, R> Batcher<D, T, R>
-where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
-{
-    /// Construct an empty batcher using shared merge-input admission.
-    /// The budget must fit the largest input pair, including indivisible rows.
-    pub fn new(budget: ReadBudget) -> Self {
-        Self {
-            runs: Vec::new(),
-            lower: Antichain::from_elem(T::minimum()),
-            frontier: Antichain::new(),
-            budget,
-        }
-    }
-
-    /// Lower bound on times remaining after the most recent seal.
-    pub fn frontier(&self) -> AntichainRef<'_, T> {
-        self.frontier.borrow()
-    }
-
-    /// Insert a sorted, consolidated chunk and restore geometric run sizes.
-    pub async fn push(&mut self, chunk: ColumnChunk<D, T, R>) {
-        let mut run = VecDeque::from([chunk]);
-        let mut settled = VecDeque::new();
-        ColumnChunk::settle(&mut run, true, &mut settled);
-        self.runs.push(Weighted {
-            weight: weight(&settled),
-            data: settled,
-        });
-        while self.runs.len() > 1 {
-            let n = self.runs.len();
-            if self.runs[n - 1].weight < self.runs[n - 2].weight / 2 {
-                break;
-            }
-            self.merge_last().await;
-        }
-    }
-
-    async fn merge_last(&mut self) {
-        let right = self.runs.pop().expect("right run");
-        let left = self.runs.pop().expect("left run");
-        let merged = merge_runs(left.data, right.data, None, self.budget.clone()).await;
-        self.runs.push(Weighted {
-            weight: weight(&merged),
-            data: merged,
-        });
-    }
-
-    /// Extract updates strictly before `upper`, retaining later updates.
-    /// Unlike an arrangement writer, callers may push older times back after a seal.
-    pub async fn seal(
-        &mut self,
-        upper: Antichain<T>,
-    ) -> (Vec<ColumnChunk<D, T, R>>, Description<T>) {
-        while self.runs.len() > 1 {
-            self.merge_last().await;
-        }
-        let mut input = self.runs.pop().map(|r| r.data).unwrap_or_default();
-        let mut keep = VecDeque::new();
-        let mut retained = VecDeque::new();
-        let mut ship = VecDeque::new();
-        let mut output = VecDeque::new();
-        self.frontier.clear();
-        while let Some(mut chunk) = input.pop_front() {
-            let (lower, high) = chunk.chunk_time_bounds();
-            let split = !high.iter().all(|t| !upper.less_equal(t))
-                && !lower.iter().all(|t| upper.less_equal(t));
-            // Keep partition input admission until extraction has consumed it.
-            let mut reader = split.then(|| {
-                Merge::new(
-                    VecDeque::from([chunk.clone()]),
-                    VecDeque::new(),
-                    self.budget.clone(),
-                )
-                .expect("chunk fits read budget")
-            });
-            if let Some(reader) = &mut reader {
-                chunk = reader.read_output(chunk).await;
-            }
-            let mut one = VecDeque::from([chunk]);
-            ColumnChunk::extract(
-                &mut one,
-                upper.borrow(),
-                &mut self.frontier,
-                &mut keep,
-                &mut ship,
-            );
-            drop(reader);
-            let mut settled = VecDeque::new();
-            ColumnChunk::settle(&mut keep, false, &mut settled);
-            retained.extend(settled);
-            ColumnChunk::settle(&mut ship, false, &mut output);
-            tokio::task::yield_now().await;
-        }
-        let mut settled = VecDeque::new();
-        ColumnChunk::settle(&mut keep, true, &mut settled);
-        retained.extend(settled);
-        if !retained.is_empty() {
-            self.runs.push(Weighted {
-                weight: weight(&retained),
-                data: retained,
-            });
-        }
-        ColumnChunk::settle(&mut ship, true, &mut output);
-        let lower = std::mem::replace(&mut self.lower, upper.clone());
-        (
-            output.into(),
-            Description::new(lower, upper, Antichain::from_elem(T::minimum())),
-        )
-    }
-}
-
-fn weight<D: Columnar, T: Columnar, R: Columnar>(run: &Run<D, T, R>) -> usize
-where
-    ColumnChunk<D, T, R>: Chunk,
-{
-    run.iter().map(Chunk::len).sum::<usize>().max(1)
-}
-
-async fn merge_runs<D, T, R>(
-    left: Run<D, T, R>,
-    right: Run<D, T, R>,
-    since: Option<Antichain<T>>,
-    budget: ReadBudget,
-) -> Run<D, T, R>
-where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
-{
-    let mut merge = Merge::new(left, right, budget).expect("chunk pair fits read budget");
-    let mut advancing = VecDeque::new();
-    let mut settling = VecDeque::new();
-    let mut output = VecDeque::new();
-    loop {
-        let done = match merge.step().await {
-            Step::Output(chunk) => {
-                if let Some(since) = &since {
-                    advancing.push_back(merge.read_output(chunk).await);
-                    ColumnChunk::advance(&mut advancing, since.borrow(), false, &mut settling);
-                } else {
-                    settling.push_back(chunk);
-                }
-                false
-            }
-            Step::Progress => false,
-            Step::Complete => true,
-        };
-        if done && let Some(since) = &since {
-            ColumnChunk::advance(&mut advancing, since.borrow(), true, &mut settling);
-        }
-        ColumnChunk::settle(&mut settling, done, &mut output);
-        if done {
-            return output;
-        }
-        tokio::task::yield_now().await;
-    }
-}
-
-struct State<C: Chunk> {
-    batches: Vec<Weighted<Rc<ChunkBatch<C>>>>,
-    logical: Antichain<C::Time>,
-    physical: Antichain<C::Time>,
-}
-
-/// A trace whose synchronous methods publish batches and request asynchronous work.
-/// Construct through [`arrange`] so the maintenance driver is installed.
-pub struct Spine<D: Columnar, T: Columnar, R: Columnar>
-where
-    ColumnChunk<D, T, R>: Chunk,
-{
-    state: Rc<RefCell<State<ColumnChunk<D, T, R>>>>,
-    notify: Arc<Notify>,
-    logical: Antichain<T>,
-    physical: Antichain<T>,
-}
-
-impl<D, T, R> TraceReader for Spine<D, T, R>
-where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
-{
-    type Time = T;
-    type Batch = BatchRef<D, T, R>;
-    fn batches_through(&mut self, upper: AntichainRef<T>) -> Option<Vec<Self::Batch>> {
-        let state = self.state.borrow();
-        if upper.is_empty() {
-            return Some(state.batches.iter().map(|b| Rc::clone(&b.data)).collect());
-        }
-        if !PartialOrder::less_equal(&self.physical.borrow(), &upper) {
-            return None;
-        }
-        if upper == Antichain::from_elem(T::minimum()).borrow() {
-            return Some(Vec::new());
-        }
-        let end = state
-            .batches
-            .iter()
-            .position(|b| b.upper().borrow() == upper)?;
-        Some(
-            state.batches[..=end]
-                .iter()
-                .map(|b| Rc::clone(&b.data))
-                .collect(),
-        )
-    }
-    fn set_logical_compaction(&mut self, frontier: AntichainRef<T>) {
-        assert!(PartialOrder::less_equal(&self.logical.borrow(), &frontier));
-        self.logical = frontier.to_owned();
-        self.state.borrow_mut().logical.clone_from(&self.logical);
-        self.notify.notify_one();
-    }
-    fn get_logical_compaction(&mut self) -> AntichainRef<'_, T> {
-        self.logical.borrow()
-    }
-    fn set_physical_compaction(&mut self, frontier: AntichainRef<T>) {
-        assert!(PartialOrder::less_equal(&self.physical.borrow(), &frontier));
-        self.physical = frontier.to_owned();
-        self.state.borrow_mut().physical.clone_from(&self.physical);
-        self.notify.notify_one();
-    }
-    fn get_physical_compaction(&mut self) -> AntichainRef<'_, T> {
-        self.physical.borrow()
-    }
-    fn map_batches<F: FnMut(&Self::Batch)>(&self, f: F) {
-        self.state
-            .borrow()
-            .batches
-            .iter()
-            .map(|b| &b.data)
-            .for_each(f);
-    }
-}
-
-impl<D, T, R> Trace for Spine<D, T, R>
-where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
-{
-    fn new(
-        _info: OperatorInfo,
-        _logging: Option<Logger>,
-        _activator: Option<timely::scheduling::Activator>,
-    ) -> Self {
-        let minimum = Antichain::from_elem(T::minimum());
-        Self {
-            state: Rc::new(RefCell::new(State {
-                batches: Vec::new(),
-                logical: minimum.clone(),
-                physical: minimum.clone(),
-            })),
-            notify: Arc::new(Notify::new()),
-            logical: minimum.clone(),
-            physical: minimum,
-        }
-    }
-    fn exert(&mut self) {
-        self.notify.notify_one();
-    }
-    // This driver completes geometric merges incrementally, independently of fueled-spine policy.
-    fn set_exert_logic(&mut self, _logic: ExertionLogic) {}
-    fn insert(&mut self, batch: Self::Batch) {
-        let mut state = self.state.borrow_mut();
-        let lower = state
-            .batches
-            .last()
-            .map(|b| b.upper().clone())
-            .unwrap_or_else(|| Antichain::from_elem(T::minimum()));
-        assert!(PartialOrder::less_equal(&lower, batch.lower()));
-        if &lower != batch.lower() {
-            state.batches.push(Weighted {
-                weight: 1,
-                data: Rc::new(ChunkBatch::empty(lower, batch.lower().clone())),
-            });
-        }
-        state.batches.push(Weighted {
-            weight: batch.len().max(1),
-            data: batch,
-        });
-        self.notify.notify_one();
-    }
-    fn close(&mut self) {
-        let mut upper = Antichain::new();
-        self.read_upper(&mut upper);
-        if !upper.is_empty() {
-            self.insert(Rc::new(ChunkBatch::empty(upper, Antichain::new())));
-        }
-    }
-}
-
-async fn maintain<D, T, R>(state: &RefCell<State<ColumnChunk<D, T, R>>>, budget: ReadBudget)
-where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
-{
-    loop {
-        let work = {
-            let state = state.borrow();
-            (1..state.batches.len())
-                .rev()
-                .find(|&i| {
-                    PartialOrder::less_equal(state.batches[i].upper(), &state.physical)
-                        && state.batches[i].weight >= state.batches[i - 1].weight / 2
-                })
-                .map(|i| {
-                    (
-                        i,
-                        state.batches[i - 1].clone(),
-                        state.batches[i].clone(),
-                        state.logical.clone(),
-                    )
-                })
-        };
-        let Some((i, left, right, since)) = work else {
-            return;
-        };
-        let chunks = merge_runs(
-            left.chunks.clone().into(),
-            right.chunks.clone().into(),
-            Some(since.clone()),
-            budget.clone(),
-        )
-        .await;
-        let batch = Rc::new(ChunkBatch {
-            chunks: chunks.into(),
-            description: Description::new(left.lower().clone(), right.upper().clone(), since),
-        });
-        // Only this driver replaces batches. Readers can advance holds while
-        // it awaits, but those frontiers cannot regress past the captured since.
-        state.borrow_mut().batches.splice(
-            i - 1..=i,
-            [Weighted {
-                weight: batch.len().max(1),
-                data: batch,
-            }],
-        );
-    }
-}
-
 /// Arrange a local stream using asynchronous batch and trace merges.
 ///
 /// The caller owns the shutdown token. The input must already have the desired
@@ -446,7 +50,16 @@ where
 {
     let mut builder = OperatorBuilder::new(name.to_owned(), stream.scope());
     let info = builder.operator_info();
-    let trace = Spine::<D, T, R>::new(info.clone(), None, None);
+    let mut trace = Spine::<D, T, R>::with_budget(info.clone(), budget.clone());
+    if let Some(logic) = stream
+        .scope()
+        .worker()
+        .config()
+        .get::<ExertionLogic>("differential/default_exert_logic")
+        .cloned()
+    {
+        trace.set_exert_logic(logic);
+    }
     let state = Rc::clone(&trace.state);
     let notify = Arc::clone(&trace.notify);
     let (trace, mut writer) = TraceAgent::new(trace, info, None);
@@ -501,7 +114,8 @@ where
                     }
                 }
             }
-            maintain(&state, budget.clone()).await;
+            maintain(&state, &notify).await;
+            tokio::task::yield_now().await;
         }
     });
     (
@@ -519,7 +133,9 @@ mod tests {
     use columnar::{Index, Len};
     use differential_dataflow::trace::Batcher as SyncBatcher;
     use differential_dataflow::trace::chunk::ChunkBatcher;
+    use differential_dataflow::trace::{BatchReader, Description, TraceReader};
     use mz_ore::pool::Pool;
+    use timely::dataflow::operators::generic::OperatorInfo;
 
     type TestChunk = ColumnChunk<(u64, Vec<u8>), u64, i64>;
     type Update = ((u64, Vec<u8>), u64, i64);
@@ -592,7 +208,13 @@ mod tests {
         pool.set_budget(0);
         tokio::runtime::Runtime::new().unwrap().block_on(async {
             let info = OperatorInfo::new(0, 0, Rc::from([0]));
-            let spine = Spine::<(u64, Vec<u8>), u64, i64>::new(info.clone(), None, None);
+            let budget = ReadBudget::new(1 << 20);
+            let mut spine =
+                Spine::<(u64, Vec<u8>), u64, i64>::with_budget(info.clone(), budget.clone());
+            spine.set_exert_logic(Arc::new(|levels| {
+                (levels.iter().map(|(_, n, _)| n).sum::<usize>() > 1).then_some(100)
+            }));
+            let notify = Arc::clone(&spine.notify);
             let state = Rc::clone(&spine.state);
             let (mut reader, mut writer) = TraceAgent::new(spine, info, None);
             let mut hold = reader.clone();
@@ -616,16 +238,19 @@ mod tests {
             let frontier = Antichain::from_elem(2);
             reader.set_logical_compaction(frontier.borrow());
             reader.set_physical_compaction(frontier.borrow());
-            let budget = ReadBudget::new(1 << 20);
-            maintain(&state, budget.clone()).await;
+
+            maintain(&state, &notify).await;
             assert_eq!(
-                state.borrow().batches.len(),
+                reader
+                    .batches_through(Antichain::new().borrow())
+                    .unwrap()
+                    .len(),
                 2,
                 "another reader still holds the original cut"
             );
             hold.set_logical_compaction(frontier.borrow());
             hold.set_physical_compaction(frontier.borrow());
-            let mut maintenance = Box::pin(maintain(&state, budget.clone()));
+            let mut maintenance = Box::pin(maintain(&state, &notify));
             assert!(futures_util::poll!(&mut maintenance).is_pending());
             assert_eq!(
                 reader
@@ -637,13 +262,13 @@ mod tests {
             );
             maintenance.await;
             let merged = reader.batches_through(Antichain::new().borrow()).unwrap();
-            assert_eq!(merged.len(), 1);
-            assert_eq!(
-                merged[0].len(),
-                0,
+            assert!(
+                merged.is_empty(),
                 "advancement cancels opposite diffs across batches"
             );
-            assert_eq!(merged[0].upper(), &frontier);
+            let mut upper = Antichain::new();
+            reader.read_upper(&mut upper);
+            assert_eq!(upper, frontier);
             assert!(
                 reader
                     .batches_through(Antichain::from_elem(1).borrow())
diff --git a/src/timely-util/src/columnar/chunk/merge.rs b/src/timely-util/src/columnar/chunk/merge.rs
index 5c615c230a12f..916c6fce0492f 100644
--- a/src/timely-util/src/columnar/chunk/merge.rs
+++ b/src/timely-util/src/columnar/chunk/merge.rs
@@ -55,6 +55,17 @@ impl ReadBudget {
         }
     }
 
+    pub(super) async fn reserve(&self, bytes: usize) -> Arc<OwnedSemaphorePermit> {
+        let bytes = u32::try_from(bytes).expect("merge inputs fit u32");
+        assert!(bytes <= self.capacity, "merge inputs exceed read admission");
+        Arc::new(
+            Arc::clone(&self.bytes)
+                .acquire_many_owned(bytes)
+                .await
+                .expect("read admission remains open"),
+        )
+    }
+
     /// Bytes currently reserved, including cancelled reads still in flight.
     pub fn reserved_bytes(&self) -> usize {
         usize::try_from(self.capacity).expect("u32 fits usize") - self.bytes.available_permits()
@@ -269,43 +280,6 @@ where
         self.ready.pop_front().map_or(Step::Progress, Step::Output)
     }
 
-    /// Materialize a passed-through output for timestamp advancement.
-    /// The merge's input reservation also covers this input-sized body.
-    pub(super) async fn read_output(
-        &mut self,
-        chunk: ColumnChunk<D, T, R>,
-    ) -> ColumnChunk<D, T, R> {
-        if matches!(chunk, ColumnChunk::Spilled(..)) {
-            if self.reservation.is_none() {
-                self.reservation = Some(Arc::new(
-                    Arc::clone(&self.budget.bytes)
-                        .acquire_many_owned(self.required)
-                        .await
-                        .expect("read budget remains open"),
-                ));
-            }
-            let depth = chunk.depth();
-            let ColumnChunk::Spilled(body, _) = chunk else {
-                unreachable!()
-            };
-            let handle = Arc::clone(&body.handle);
-            let reservation = Arc::clone(self.reservation.as_ref().expect("admitted output"));
-            let task = mz_ore::task::spawn(|| "column_advance_read", async move {
-                ReadResult {
-                    buffers: [Some(handle.read_async().await), None],
-                    _reservation: reservation,
-                }
-            });
-            let ReadResult { mut buffers, .. } = task.await;
-            ColumnChunk::Resident(
-                std::rc::Rc::new(Column::Align(buffers[0].take().expect("read output"))),
-                depth,
-            )
-        } else {
-            chunk
-        }
-    }
-
     async fn finish_reads(&mut self) {
         if let Some(task) = &mut self.pending {
             let ReadResult { buffers, .. } = task.await;
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
new file mode 100644
index 0000000000000..5c6d2dd7c83a7
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -0,0 +1,305 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! MZ trace interfaces over vendored Differential maintenance machinery.
+//!
+//! [`Batcher`] accepts columnar input and seals it at a frontier. [`Spine`] exposes
+//! published batches through DD's trace traits. Both use the resumable algorithms
+//! in [`vendor`]. DD still supplies trace readers, reader holds, descriptions, and
+//! difference and lattice semantics. All types use MZ's existing Timely dependency.
+//!
+//! [`pool_chunk`] supplies columnar kernels and buffer-pool reads.
+//! [`super::asynchronous::arrange`] owns the Timely operator and calls [`maintain`]
+//! when compaction or read completion makes work available. Batch conversion clones
+//! chunk handles, preserving shared ownership of their bodies.
+
+use std::cell::RefCell;
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::task::{Wake, Waker};
+
+use columnar::Columnar;
+use differential_dataflow::difference::Semigroup;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::trace::chunk::ChunkBatch;
+use differential_dataflow::trace::{Description, ExertionLogic, Trace, TraceReader};
+use timely::progress::{Antichain, Timestamp, frontier::AntichainRef};
+use tokio::sync::Notify;
+
+use super::ColumnChunk;
+use super::merge::ReadBudget;
+use pool_chunk::{PoolChunk, PreparedChunker};
+
+mod pool_chunk;
+mod vendor;
+
+type NativeBatcher<D, T, R> =
+    vendor::chunk::ChunkBatcher<PreparedChunker<D, T, R>, PoolChunk<D, T, R>>;
+type NativeSpine<D, T, R> = vendor::chunk::ChunkSpine<PoolChunk<D, T, R>>;
+type NativeSpan<D, T, R> =
+    vendor::spine::Span<T, Rc<vendor::chunk::ChunkBatch<PoolChunk<D, T, R>>>>;
+
+/// Columnar stash backed by Differential's pollable merge batcher.
+///
+/// Complete each `push` or `seal` before starting another operation. Cancelling
+/// either future requires dropping the batcher: DD may already own its input and
+/// retain an unfinished operation that must not be mistaken for the next one.
+pub struct Batcher<D: Columnar, T: Columnar, R: Columnar>
+where
+    PoolChunk<D, T, R>: vendor::chunk::Chunk,
+{
+    inner: NativeBatcher<D, T, R>,
+    /// Lower frontier for the next batch description.
+    lower: Antichain<T>,
+    frontier: Antichain<T>,
+    budget: ReadBudget,
+}
+impl<D, T, R> Batcher<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    /// Construct a batcher with shared admission for decoded merge inputs.
+    pub fn new(budget: ReadBudget) -> Self {
+        Self {
+            inner: NativeBatcher::new(None, 0),
+            lower: Antichain::from_elem(T::minimum()),
+            frontier: Antichain::new(),
+            budget,
+        }
+    }
+
+    /// Lower bound on updates retained by the most recent seal.
+    pub fn frontier(&self) -> AntichainRef<'_, T> {
+        self.frontier.borrow()
+    }
+
+    /// Insert a sorted, consolidated chunk.
+    pub async fn push(&mut self, chunk: ColumnChunk<D, T, R>) {
+        use vendor::batcher::Batcher as _;
+        use vendor::chunk::Chunk as _;
+        let mut input = VecDeque::from([PoolChunk {
+            chunk,
+            budget: self.budget.clone(),
+        }]);
+        let mut settled = VecDeque::new();
+        PoolChunk::settle(&mut input, true, &mut settled);
+        let mut chunks: Vec<_> = settled.into();
+        futures_util::future::poll_fn(|cx| self.inner.poll_insert(&mut chunks, cx)).await;
+    }
+
+    /// Extract updates before `upper`, retaining later updates for another seal.
+    pub async fn seal(
+        &mut self,
+        upper: Antichain<T>,
+    ) -> (Vec<ColumnChunk<D, T, R>>, Description<T>) {
+        use vendor::batcher::Batcher as _;
+        let target = upper.clone();
+        let (batch, retained) =
+            futures_util::future::poll_fn(|cx| self.inner.poll_extract(target.borrow(), cx)).await;
+        self.frontier = retained;
+        let lower = std::mem::replace(&mut self.lower, upper.clone());
+        (
+            batch
+                .into_iter()
+                .flat_map(|b| b.chunks)
+                .map(|c| c.chunk)
+                .collect(),
+            Description::new(lower, upper, Antichain::from_elem(T::minimum())),
+        )
+    }
+}
+
+/// MZ's trace interface over the vendored Differential fueled spine.
+///
+/// The arranger and trace readers share `state` on one Timely worker. Compaction
+/// frontiers are cached so the reader trait can return
+/// references without borrowing the native spine through its `RefCell`.
+pub struct Spine<D: Columnar, T: Columnar, R: Columnar>
+where
+    PoolChunk<D, T, R>: vendor::chunk::Chunk,
+{
+    pub(super) state: Rc<RefCell<NativeSpine<D, T, R>>>,
+    pub(super) notify: Arc<Notify>,
+    logical: Antichain<T>,
+    physical: Antichain<T>,
+    budget: ReadBudget,
+}
+impl<D, T, R> Spine<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    /// Construct a trace using the caller's shared decoded-input budget.
+    pub(super) fn with_budget(
+        info: timely::dataflow::operators::generic::OperatorInfo,
+        budget: ReadBudget,
+    ) -> Self {
+        let notify = Arc::new(Notify::new());
+        let mut native = NativeSpine::new(info, None, None);
+        native.set_waker(Waker::from(Arc::new(NotifyWake(Arc::clone(&notify)))));
+        Self {
+            state: Rc::new(RefCell::new(native)),
+            notify,
+            logical: Antichain::from_elem(T::minimum()),
+            physical: Antichain::from_elem(T::minimum()),
+            budget,
+        }
+    }
+
+    fn to_mz_batch(span: &NativeSpan<D, T, R>) -> Rc<ChunkBatch<ColumnChunk<D, T, R>>> {
+        let chunks = span
+            .inner
+            .iter()
+            .flat_map(|batch| batch.chunks.iter())
+            .map(|chunk| chunk.chunk.clone())
+            .collect();
+        let description = span.desc.clone();
+        Rc::new(ChunkBatch {
+            chunks,
+            description,
+        })
+    }
+
+    fn to_native_span(&self, batch: &ChunkBatch<ColumnChunk<D, T, R>>) -> NativeSpan<D, T, R> {
+        let description = batch.description.clone();
+        let inner = if batch.chunks.is_empty() {
+            None
+        } else {
+            let chunks = batch
+                .chunks
+                .iter()
+                .map(|chunk| PoolChunk {
+                    chunk: chunk.clone(),
+                    budget: self.budget.clone(),
+                })
+                .collect();
+            Some(Rc::new(vendor::chunk::ChunkBatch::new(chunks)))
+        };
+        vendor::spine::Span::new(description, inner)
+    }
+}
+impl<D, T, R> TraceReader for Spine<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    type Time = T;
+    type Batch = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
+    fn batches_through(&mut self, upper: AntichainRef<T>) -> Option<Vec<Self::Batch>> {
+        if !timely::PartialOrder::less_equal(&self.physical.borrow(), &upper) {
+            return None;
+        }
+        let upper = upper.to_owned();
+        self.state
+            .borrow_mut()
+            .spans_through(upper.borrow())
+            .map(|spans| spans.iter().map(Self::to_mz_batch).collect())
+    }
+
+    fn set_logical_compaction(&mut self, frontier: AntichainRef<T>) {
+        assert!(timely::PartialOrder::less_equal(
+            &self.logical.borrow(),
+            &frontier
+        ));
+        self.logical = frontier.to_owned();
+        self.state.borrow_mut().set_logical_compaction(frontier);
+        self.notify.notify_one();
+    }
+    fn get_logical_compaction(&mut self) -> AntichainRef<'_, T> {
+        self.logical.borrow()
+    }
+    fn set_physical_compaction(&mut self, frontier: AntichainRef<T>) {
+        assert!(timely::PartialOrder::less_equal(
+            &self.physical.borrow(),
+            &frontier
+        ));
+        self.physical = frontier.to_owned();
+        self.state.borrow_mut().set_physical_compaction(frontier);
+        self.notify.notify_one();
+    }
+    fn get_physical_compaction(&mut self) -> AntichainRef<'_, T> {
+        self.physical.borrow()
+    }
+    fn map_batches<F: FnMut(&Self::Batch)>(&self, mut f: F) {
+        self.state
+            .borrow()
+            .map_spans(|span| f(&Self::to_mz_batch(span)));
+    }
+}
+impl<D, T, R> Trace for Spine<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    fn new(
+        info: timely::dataflow::operators::generic::OperatorInfo,
+        _logging: Option<differential_dataflow::logging::Logger>,
+        _activator: Option<timely::scheduling::Activator>,
+    ) -> Self {
+        Self::with_budget(info, ReadBudget::new(256 << 20))
+    }
+    fn exert(&mut self) {
+        self.state.borrow_mut().exert();
+    }
+    fn set_exert_logic(&mut self, logic: ExertionLogic) {
+        self.state.borrow_mut().set_exert_logic(logic);
+    }
+    fn insert(&mut self, batch: Self::Batch) {
+        let span = self.to_native_span(&batch);
+        self.state.borrow_mut().insert(span);
+        self.notify.notify_one();
+    }
+    fn close(&mut self) {
+        self.state.borrow_mut().close();
+        self.notify.notify_one();
+    }
+}
+
+struct NotifyWake(Arc<Notify>);
+impl Wake for NotifyWake {
+    fn wake(self: Arc<Self>) {
+        self.wake_by_ref();
+    }
+    fn wake_by_ref(self: &Arc<Self>) {
+        self.0.notify_one();
+    }
+}
+
+/// Finish the outstanding native maintenance operation, yielding while it waits for I/O.
+///
+/// This does not force all batches to compact. DD's exertion policy determines
+/// the work allowance. The caller must use the notification installed by
+/// `Spine::with_budget` and poll this future on the owning Timely worker.
+pub(super) async fn maintain<D, T, R>(state: &RefCell<NativeSpine<D, T, R>>, notify: &Notify)
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    loop {
+        state.borrow_mut().exert();
+        if !state.borrow().maintenance_pending() {
+            return;
+        }
+        // No trace borrow may cross this await. Reader compaction can change the
+        // same spine while a read is pending, and its wakeup uses this notification.
+        notify.notified().await;
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
new file mode 100644
index 0000000000000..859184af3cb6b
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -0,0 +1,396 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Columnar storage operations for native Differential's chunk machinery.
+//!
+//! [`PoolChunk`] adapts the existing synchronous columnar kernels. Its poll methods
+//! first load any required pool bodies through [`ReadState`], then call those kernels
+//! on the worker. Disjoint ranges can pass through using resident metadata.
+//! Differential retains the merge phase and queues across each pending call.
+
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::task::{Context, Poll, ready};
+
+use super::vendor;
+use columnar::Columnar;
+use differential_dataflow::difference::Semigroup;
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::trace::chunk::Chunk as MzChunk;
+use futures_util::FutureExt;
+use futures_util::future::LocalBoxFuture;
+use timely::dataflow::channels::ContainerBytes;
+use timely::progress::Timestamp;
+use tokio::sync::OwnedSemaphorePermit;
+
+use super::super::merge::ReadBudget;
+use super::super::{Column, ColumnChunk};
+
+/// A columnar chunk with shared admission for native Differential merge reads.
+pub struct PoolChunk<D: Columnar, T: Columnar, R: Columnar> {
+    pub(super) chunk: ColumnChunk<D, T, R>,
+    pub(super) budget: ReadBudget,
+}
+impl<D: Columnar, T: Columnar, R: Columnar> PoolChunk<D, T, R> {
+    fn take_columns(chunks: &mut VecDeque<Self>) -> VecDeque<ColumnChunk<D, T, R>> {
+        chunks.drain(..).map(|chunk| chunk.chunk).collect()
+    }
+
+    fn extend_columns(
+        output: &mut VecDeque<Self>,
+        columns: VecDeque<ColumnChunk<D, T, R>>,
+        budget: &ReadBudget,
+    ) {
+        output.extend(columns.into_iter().map(|chunk| Self {
+            chunk,
+            budget: budget.clone(),
+        }));
+    }
+}
+
+impl<D: Columnar, T: Columnar, R: Columnar> Clone for PoolChunk<D, T, R> {
+    fn clone(&self) -> Self {
+        Self {
+            chunk: self.chunk.clone(),
+            budget: self.budget.clone(),
+        }
+    }
+}
+impl<D: Columnar, T: Columnar, R: Columnar> Default for PoolChunk<D, T, R> {
+    fn default() -> Self {
+        Self {
+            chunk: ColumnChunk::Resident(Rc::new(Column::default()), 0),
+            // DD uses Default to replace a chunk after moving it into a run.
+            // This empty placeholder is never read and carries no input admission.
+            budget: ReadBudget::new(1),
+        }
+    }
+}
+
+/// Read state retained for one native merge or extraction, across all its chunk operations.
+///
+/// The reservation lasts until this state is dropped. It covers the largest input
+/// pair in the original runs, so progressing to another pair never requires more
+/// admission while retaining an earlier reservation. Output and compaction carry
+/// are outside this input budget.
+pub struct ReadState<D: Columnar, T: Columnar, R: Columnar> {
+    budget: Option<ReadBudget>,
+    required_bytes: usize,
+    reservation: Option<Arc<OwnedSemaphorePermit>>,
+    pending: Option<LocalBoxFuture<'static, LoadedInputs<D, T, R>>>,
+}
+impl<D: Columnar, T: Columnar, R: Columnar> Default for ReadState<D, T, R> {
+    fn default() -> Self {
+        Self {
+            budget: None,
+            required_bytes: 0,
+            reservation: None,
+            pending: None,
+        }
+    }
+}
+struct LoadedInputs<D: Columnar, T: Columnar, R: Columnar> {
+    chunks: Vec<ColumnChunk<D, T, R>>,
+    reservation: Arc<OwnedSemaphorePermit>,
+}
+
+impl<D, T, R> ReadState<D, T, R>
+where
+    D: Columnar + 'static,
+    T: Columnar + 'static,
+    R: Columnar + 'static,
+{
+    /// Load the supplied chunks in order, resuming the same read after `Pending`.
+    ///
+    /// The caller must keep the inputs unchanged until this returns `Ready`.
+    fn poll_load(
+        &mut self,
+        chunks: Vec<ColumnChunk<D, T, R>>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Vec<ColumnChunk<D, T, R>>> {
+        if self.pending.is_none() {
+            let budget = self.budget.clone().expect("operation has input admission");
+            self.pending = Some(
+                Self::load_inputs(
+                    chunks,
+                    budget,
+                    self.required_bytes,
+                    self.reservation.clone(),
+                )
+                .boxed_local(),
+            );
+        }
+        let loaded = ready!(self.pending.as_mut().unwrap().as_mut().poll(cx));
+        self.pending = None;
+        self.reservation = Some(loaded.reservation);
+        Poll::Ready(loaded.chunks)
+    }
+
+    async fn load_inputs(
+        chunks: Vec<ColumnChunk<D, T, R>>,
+        budget: ReadBudget,
+        required_bytes: usize,
+        reservation: Option<Arc<OwnedSemaphorePermit>>,
+    ) -> LoadedInputs<D, T, R> {
+        let reservation = match reservation {
+            Some(reservation) => reservation,
+            None => budget.reserve(required_bytes).await,
+        };
+        let reads = chunks
+            .into_iter()
+            .map(|chunk| Self::load_chunk(chunk, Arc::clone(&reservation)));
+        let chunks = futures_util::future::join_all(reads).await;
+        LoadedInputs {
+            chunks,
+            reservation,
+        }
+    }
+
+    async fn load_chunk(
+        chunk: ColumnChunk<D, T, R>,
+        reservation: Arc<OwnedSemaphorePermit>,
+    ) -> ColumnChunk<D, T, R> {
+        match chunk {
+            ColumnChunk::Spilled(body, depth) => {
+                let handle = Arc::clone(&body.handle);
+                // NOTE: Dropping the operator cannot cancel a submitted blocking
+                // read. This owned task keeps input admission until that read ends.
+                let task = mz_ore::task::spawn(|| "native_merge_read", async move {
+                    let words = handle.read_async().await;
+                    (words, reservation)
+                });
+                let (words, _reservation) = task.await;
+                ColumnChunk::Resident(Rc::new(Column::Align(words)), depth)
+            }
+            chunk @ ColumnChunk::Resident(..) => chunk,
+        }
+    }
+}
+
+impl<D, T, R> vendor::chunk::Chunk for PoolChunk<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    type Time = T;
+    type Pending = ReadState<D, T, R>;
+    const TARGET: usize = <ColumnChunk<D, T, R> as MzChunk>::TARGET;
+    fn len(&self) -> usize {
+        self.chunk.len()
+    }
+    fn pending_for(left: &[Self], right: &[Self]) -> Self::Pending {
+        let largest_chunk_bytes = |run: &[Self]| {
+            run.iter()
+                .map(|chunk| match &chunk.chunk {
+                    ColumnChunk::Resident(column, _) => column.length_in_bytes(),
+                    ColumnChunk::Spilled(body, _) => body.bytes,
+                })
+                .max()
+                .unwrap_or(0)
+        };
+        ReadState {
+            budget: left
+                .first()
+                .or_else(|| right.first())
+                .map(|chunk| chunk.budget.clone()),
+            required_bytes: largest_chunk_bytes(left).saturating_add(largest_chunk_bytes(right)),
+            ..ReadState::default()
+        }
+    }
+
+    fn merge(left: &mut VecDeque<Self>, right: &mut VecDeque<Self>, output: &mut VecDeque<Self>) {
+        let budget = left
+            .front()
+            .or_else(|| right.front())
+            .unwrap()
+            .budget
+            .clone();
+        let mut left_columns = Self::take_columns(left);
+        let mut right_columns = Self::take_columns(right);
+        let mut merged = VecDeque::new();
+        ColumnChunk::merge(&mut left_columns, &mut right_columns, &mut merged);
+        Self::extend_columns(left, left_columns, &budget);
+        Self::extend_columns(right, right_columns, &budget);
+        Self::extend_columns(output, merged, &budget);
+    }
+
+    fn advance(
+        input: &mut VecDeque<Self>,
+        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        done: bool,
+        output: &mut VecDeque<Self>,
+    ) {
+        let Some(budget) = input.front().map(|chunk| chunk.budget.clone()) else {
+            return;
+        };
+        let mut columns = Self::take_columns(input);
+        let mut advanced = VecDeque::new();
+        let frontier = frontier.to_owned();
+        ColumnChunk::advance(&mut columns, frontier.borrow(), done, &mut advanced);
+        Self::extend_columns(input, columns, &budget);
+        Self::extend_columns(output, advanced, &budget);
+    }
+
+    fn extract(
+        input: &mut VecDeque<Self>,
+        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        residual: &mut timely::progress::Antichain<Self::Time>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) {
+        let Some(budget) = input.front().map(|chunk| chunk.budget.clone()) else {
+            return;
+        };
+        let mut columns = Self::take_columns(input);
+        let mut kept = VecDeque::new();
+        let mut shipped = VecDeque::new();
+        let frontier = frontier.to_owned();
+        let mut remaining = residual.clone();
+        ColumnChunk::extract(
+            &mut columns,
+            frontier.borrow(),
+            &mut remaining,
+            &mut kept,
+            &mut shipped,
+        );
+        *residual = remaining;
+        Self::extend_columns(input, columns, &budget);
+        Self::extend_columns(keep, kept, &budget);
+        Self::extend_columns(ship, shipped, &budget);
+    }
+
+    fn settle(input: &mut VecDeque<Self>, done: bool, output: &mut VecDeque<Self>) {
+        let Some(budget) = input.front().map(|chunk| chunk.budget.clone()) else {
+            return;
+        };
+        let mut columns = Self::take_columns(input);
+        let mut settled = VecDeque::new();
+        ColumnChunk::settle(&mut columns, done, &mut settled);
+        Self::extend_columns(input, columns, &budget);
+        Self::extend_columns(output, settled, &budget);
+    }
+
+    fn poll_merge(
+        io: &mut Self::Pending,
+        cx: &mut Context<'_>,
+        left: &mut VecDeque<Self>,
+        right: &mut VecDeque<Self>,
+        output: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        let (left_first, left_last) = left.front().unwrap().chunk.data_span();
+        let (right_first, right_last) = right.front().unwrap().chunk.data_span();
+        let disjoint = if super::super::rr::<D>(left_last) < super::super::rr::<D>(right_first) {
+            Some(&mut *left)
+        } else if super::super::rr::<D>(right_last) < super::super::rr::<D>(left_first) {
+            Some(&mut *right)
+        } else {
+            None
+        };
+        if let Some(disjoint) = disjoint {
+            // The synchronous survivor path may migrate codecs by reading the body.
+            // Keep this metadata-only path cold, while retaining merge-depth accounting.
+            let mut chunk = disjoint.pop_front().unwrap();
+            match &mut chunk.chunk {
+                ColumnChunk::Resident(_, depth) | ColumnChunk::Spilled(_, depth) => {
+                    *depth = depth.saturating_add(1)
+                }
+            }
+            output.push_back(chunk);
+            return Poll::Ready(());
+        }
+        let loaded = ready!(io.poll_load(
+            vec![
+                left.front().unwrap().chunk.clone(),
+                right.front().unwrap().chunk.clone()
+            ],
+            cx
+        ));
+        let mut loaded = loaded.into_iter();
+        left.front_mut().unwrap().chunk = loaded.next().unwrap();
+        right.front_mut().unwrap().chunk = loaded.next().unwrap();
+        Self::merge(left, right, output);
+        Poll::Ready(())
+    }
+    fn poll_advance(
+        io: &mut Self::Pending,
+        cx: &mut Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        if input
+            .iter()
+            .any(|c| matches!(c.chunk, ColumnChunk::Spilled(..)))
+        {
+            let loaded = ready!(io.poll_load(input.iter().map(|c| c.chunk.clone()).collect(), cx));
+            assert_eq!(input.len(), loaded.len());
+            for (index, chunk) in loaded.into_iter().enumerate() {
+                input[index].chunk = chunk;
+            }
+        }
+        Self::advance(input, frontier, done, out);
+        Poll::Ready(())
+    }
+    fn poll_extract(
+        io: &mut Self::Pending,
+        cx: &mut Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        residual: &mut timely::progress::Antichain<Self::Time>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        if let Some(chunk) = input.front() {
+            let (low, high) = chunk.chunk.chunk_time_bounds();
+            let upper = frontier.to_owned();
+            let entirely_before = high.iter().all(|time| !upper.less_equal(time));
+            let entirely_after = low.iter().all(|time| upper.less_equal(time));
+            let straddles_frontier = !entirely_before && !entirely_after;
+            if straddles_frontier && matches!(chunk.chunk, ColumnChunk::Spilled(..)) {
+                let loaded = ready!(io.poll_load(vec![chunk.chunk.clone()], cx));
+                input.front_mut().unwrap().chunk = loaded.into_iter().next().unwrap();
+            }
+        }
+        Self::extract(input, frontier, residual, keep, ship);
+        Poll::Ready(())
+    }
+}
+
+/// Feeds already sorted chunks to Differential's batcher without sorting them again.
+pub struct PreparedChunker<D: Columnar, T: Columnar, R: Columnar> {
+    queued: VecDeque<PoolChunk<D, T, R>>,
+    ready: PoolChunk<D, T, R>,
+}
+impl<D: Columnar, T: Columnar, R: Columnar> Default for PreparedChunker<D, T, R> {
+    fn default() -> Self {
+        Self {
+            queued: VecDeque::new(),
+            ready: PoolChunk::default(),
+        }
+    }
+}
+impl<D: Columnar, T: Columnar, R: Columnar> timely::container::ContainerBuilder
+    for PreparedChunker<D, T, R>
+{
+    type Container = PoolChunk<D, T, R>;
+    fn extract(&mut self) -> Option<&mut Self::Container> {
+        self.ready = self.queued.pop_front()?;
+        Some(&mut self.ready)
+    }
+    fn finish(&mut self) -> Option<&mut Self::Container> {
+        self.extract()
+    }
+}
+impl<D: Columnar, T: Columnar, R: Columnar>
+    timely::container::PushInto<&mut Vec<PoolChunk<D, T, R>>> for PreparedChunker<D, T, R>
+{
+    fn push_into(&mut self, input: &mut Vec<PoolChunk<D, T, R>>) {
+        self.queued.extend(input.drain(..));
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor.rs b/src/timely-util/src/columnar/chunk/native/vendor.rs
new file mode 100644
index 0000000000000..5ddda26d2330b
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor.rs
@@ -0,0 +1,28 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See vendor/LICENSE.
+
+//! Resumable maintenance machinery vendored from Differential Dataflow.
+//!
+//! Source: `TimelyDataflow/differential-dataflow`, upstream base
+//! `626c80ce`, with the local async changes at `339f01522823171f2a8c710967502f3e1d09360b`.
+//! The source files are `trace/implementations/spine_fueled.rs`,
+//! `trace/chunk/mod.rs`, and `batcher/{mod.rs,merge/mod.rs}`.
+//!
+//! This copy uses MZ's existing Differential and Timely dependencies for timestamps,
+//! lattices, descriptions, and logging. The enclosing adapter implements DD's trace
+//! interfaces, leaving reader holds and operator progress with DD and Timely.
+//! The local methods preserve the source spine's fuel, level, and publication policy.
+//! Cursor implementations, general operators, and reference storage backends are
+//! outside this module.
+
+// Preserve the synchronous entry points and generic helpers alongside their
+// pollable counterparts so the vendored algorithms remain comparable to DD.
+#![allow(dead_code)]
+
+pub mod batcher;
+pub mod chunk;
+pub mod spine;
+
+#[cfg(test)]
+mod tests;
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/LICENSE b/src/timely-util/src/columnar/chunk/native/vendor/LICENSE
new file mode 100644
index 0000000000000..bb8307788edcc
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Frank McSherry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs b/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
new file mode 100644
index 0000000000000..728a477872fb5
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
@@ -0,0 +1,451 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See LICENSE in this directory.
+
+//! A `Batcher` implementation based on merge sort.
+//!
+//! The `MergeBatcher` requires a "merger" that implements the [`Merger`] trait, which provides
+//! hooks for manipulating sorted "chains" of chunks as needed by the merge batcher: merging
+//! chunks and also splitting them apart based on time.
+//!
+//! Raw input containers are fed to the batcher via [`Batcher::insert`], which chunks them with
+//! its `Chu` before merging: forming sorted, consolidated chunks is the first stage of the
+//! batcher's own work rather than something a caller arranges.
+
+use std::task::{Context, Poll, ready};
+
+use timely::container::{ContainerBuilder, PushInto};
+use timely::progress::frontier::AntichainRef;
+use timely::progress::{Timestamp, frontier::Antichain};
+
+use differential_dataflow::logging::{BatcherEvent, Logger};
+
+/// Creates batches from chunks of sorted, consolidated tuples.
+///
+/// Chunking input is `Chu`'s business, merging chunks is `M`'s, and sealing the extracted chain
+/// into a batch is `S`'s; the batcher's own work is the geometric ladder of chains and the
+/// carve-by-frontier.
+pub struct MergeBatcher<Chu, M: Merger, S> {
+    /// Melds input containers into sorted, consolidated chunks.
+    chunker: Chu,
+    /// Sorted, consolidated chains, each paired with its cached summed update count.
+    ///
+    /// The cached count is the chain's *merge weight*: the geometric ladder weighs
+    /// chains by updates, not chunk counts, since regrading decouples the two. A
+    /// chain is immutable until merged, so the weight is computed once at push.
+    ///
+    /// Do not push/pop directly but use the corresponding functions ([`Self::chain_push`]/[`Self::chain_pop`]).
+    chains: Vec<(usize, Vec<M::Chunk>)>,
+    /// Stash of empty chunks, recycled through the merging process.
+    stash: Vec<M::Chunk>,
+    /// Merges consolidated chunks, and extracts the subset of an update chain that lies in an interval of time.
+    merger: M,
+    /// The lower-bound frontier of the data, after the last call to extract.
+    frontier: Antichain<M::Time>,
+    /// Logger for size accounting.
+    logger: Option<Logger>,
+    /// Timely operator ID.
+    operator_id: usize,
+    /// Seals each extracted chain into a batch.
+    sealer: std::marker::PhantomData<S>,
+    inserting: bool,
+    merging: Option<(Vec<M::Chunk>, Vec<M::Chunk>, Vec<M::Chunk>)>,
+    extracting: Option<(
+        Antichain<M::Time>,
+        Vec<M::Chunk>,
+        Vec<M::Chunk>,
+        Vec<M::Chunk>,
+    )>,
+}
+
+impl<C, Chu, M, S> Batcher<C> for MergeBatcher<Chu, M, S>
+where
+    M: Merger<Time: Timestamp>,
+    Chu: ContainerBuilder<Container = M::Chunk> + for<'a> PushInto<&'a mut C>,
+    S: Sealer<M::Chunk>,
+{
+    type Time = M::Time;
+    type Output = S::Output;
+
+    fn insert(&mut self, container: &mut C) {
+        self.chunker.push_into(container);
+        while let Some(chunk) = self.chunker.extract().map(std::mem::take) {
+            self.insert_chain(vec![chunk]);
+        }
+    }
+
+    // Extraction means finding those updates with times not greater or equal to any time in
+    // `upper`. All updates must have time greater or equal to the previously used `upper`, by
+    // assumption that after extracting from a batcher we receive no more updates with times not
+    // greater or equal to `upper`.
+    fn extract<'a>(
+        &'a mut self,
+        upper: AntichainRef<'_, M::Time>,
+    ) -> (Option<S::Output>, AntichainRef<'a, M::Time>) {
+        // Flush whatever the chunker is still accumulating: a partial final chunk would
+        // otherwise never reach the merge ladder.
+        while let Some(chunk) = self.chunker.finish().map(std::mem::take) {
+            self.insert_chain(vec![chunk]);
+        }
+
+        // Merge all remaining chains into a single chain.
+        while self.chains.len() > 1 {
+            let list1 = self.chain_pop().unwrap();
+            let list2 = self.chain_pop().unwrap();
+            let merged = self.merge_by(list1, list2);
+            self.chain_push(merged);
+        }
+        let merged = self.chain_pop().unwrap_or_default();
+
+        // Extract readied data.
+        let mut kept = Vec::new();
+        let mut readied = Vec::new();
+        self.frontier.clear();
+
+        self.merger.extract(
+            merged,
+            upper,
+            &mut self.frontier,
+            &mut readied,
+            &mut kept,
+            &mut self.stash,
+        );
+
+        if !kept.is_empty() {
+            self.chain_push(kept);
+        }
+
+        self.stash.clear();
+
+        (S::seal(&mut readied), self.frontier.borrow())
+    }
+    fn poll_insert(&mut self, container: &mut C, cx: &mut Context<'_>) -> Poll<()> {
+        assert!(self.extracting.is_none(), "cannot insert during extraction");
+        if !self.inserting {
+            self.chunker.push_into(container);
+            self.inserting = true;
+        }
+        ready!(self.poll_ladder(false, cx));
+        while let Some(chunk) = self.chunker.extract().map(std::mem::take) {
+            if M::len(&chunk) > 0 {
+                self.chain_push(vec![chunk]);
+            }
+            ready!(self.poll_ladder(false, cx));
+        }
+        self.inserting = false;
+        Poll::Ready(())
+    }
+
+    fn poll_extract(
+        &mut self,
+        upper: AntichainRef<'_, M::Time>,
+        cx: &mut Context<'_>,
+    ) -> Poll<(Option<S::Output>, Antichain<M::Time>)> {
+        assert!(!self.inserting, "finish insertion before extracting");
+        if self.extracting.is_none() {
+            ready!(self.poll_ladder(false, cx));
+            while let Some(chunk) = self.chunker.finish().map(std::mem::take) {
+                if M::len(&chunk) > 0 {
+                    self.chain_push(vec![chunk]);
+                }
+                ready!(self.poll_ladder(false, cx));
+            }
+            ready!(self.poll_ladder(true, cx));
+            let merged = self.chain_pop().unwrap_or_default();
+            self.frontier.clear();
+            self.extracting = Some((upper.to_owned(), merged, Vec::new(), Vec::new()));
+        }
+        let (saved, merged, readied, kept) = self.extracting.as_mut().unwrap();
+        assert_eq!(
+            saved.borrow(),
+            upper,
+            "extraction frontier changed while pending"
+        );
+        ready!(self.merger.poll_extract(
+            merged,
+            saved.borrow(),
+            &mut self.frontier,
+            readied,
+            kept,
+            &mut self.stash,
+            cx
+        ));
+        let (_, _, mut readied, kept) = self.extracting.take().unwrap();
+        if !kept.is_empty() {
+            self.chain_push(kept);
+        }
+        self.stash.clear();
+        Poll::Ready((S::seal(&mut readied), self.frontier.clone()))
+    }
+}
+
+impl<Chu: Default, M: Merger, S> MergeBatcher<Chu, M, S> {
+    /// Allocates a new empty batcher.
+    ///
+    /// The logger and operator identifier are used to report the batcher's memory footprint,
+    /// attributed to the operator that owns it.
+    pub fn new(logger: Option<Logger>, operator_id: usize) -> Self {
+        Self {
+            logger,
+            operator_id,
+            merger: M::default(),
+            chunker: Chu::default(),
+            chains: Vec::new(),
+            stash: Vec::new(),
+            frontier: Antichain::new(),
+            sealer: std::marker::PhantomData,
+            inserting: false,
+            merging: None,
+            extracting: None,
+        }
+    }
+}
+
+impl<Chu, M: Merger, S> MergeBatcher<Chu, M, S> {
+    fn poll_ladder(&mut self, all: bool, cx: &mut Context<'_>) -> Poll<()> {
+        loop {
+            if self.merging.is_none() {
+                let n = self.chains.len();
+                if n < 2 || (!all && self.chains[n - 1].0 < self.chains[n - 2].0 / 2) {
+                    return Poll::Ready(());
+                }
+                let a = self.chain_pop().unwrap();
+                let b = self.chain_pop().unwrap();
+                self.merging = Some((a, b, Vec::new()));
+            }
+            let (a, b, output) = self.merging.as_mut().unwrap();
+            ready!(self.merger.poll_merge(a, b, output, &mut self.stash, cx));
+            let (_, _, output) = self.merging.take().unwrap();
+            self.chain_push(output);
+        }
+    }
+
+    /// Insert a chain and maintain chain properties: Chains are geometrically sized
+    /// (by summed updates) and ordered by decreasing update weight.
+    fn insert_chain(&mut self, chain: Vec<M::Chunk>) {
+        if !chain.is_empty() {
+            self.chain_push(chain);
+            while self.chains.len() > 1
+                && (self.chains[self.chains.len() - 1].0
+                    >= self.chains[self.chains.len() - 2].0 / 2)
+            {
+                let list1 = self.chain_pop().unwrap();
+                let list2 = self.chain_pop().unwrap();
+                let merged = self.merge_by(list1, list2);
+                self.chain_push(merged);
+            }
+        }
+    }
+
+    // merges two sorted input lists into one sorted output list.
+    fn merge_by(&mut self, list1: Vec<M::Chunk>, list2: Vec<M::Chunk>) -> Vec<M::Chunk> {
+        // TODO: `list1` and `list2` get dropped; would be better to reuse?
+        let mut output = Vec::with_capacity(list1.len() + list2.len());
+        self.merger
+            .merge(list1, list2, &mut output, &mut self.stash);
+
+        output
+    }
+
+    /// Pop a chain and account size changes.
+    #[inline]
+    fn chain_pop(&mut self) -> Option<Vec<M::Chunk>> {
+        let (_weight, chain) = self.chains.pop()?;
+        self.account(chain.iter().map(Self::record), -1);
+        Some(chain)
+    }
+
+    /// Push a chain and account size changes.
+    ///
+    /// Caches the chain's summed update count alongside it for the ladder.
+    #[inline]
+    fn chain_push(&mut self, chain: Vec<M::Chunk>) {
+        let weight = chain.iter().map(M::len).sum();
+        self.account(chain.iter().map(Self::record), 1);
+        self.chains.push((weight, chain));
+    }
+
+    /// The `(records, size, capacity, allocations)` logger tuple for one chunk,
+    /// assembled from the two focused `Merger` methods.
+    #[inline]
+    fn record(chunk: &M::Chunk) -> (usize, usize, usize, usize) {
+        let (size, capacity, allocations) = M::allocation(chunk);
+        (M::len(chunk), size, capacity, allocations)
+    }
+
+    /// Account size changes. Only performs work if a logger exists.
+    ///
+    /// Calculate the size based on the iterator passed along, with each attribute
+    /// multiplied by `diff`. Usually, one wants to pass 1 or -1 as the diff.
+    #[inline]
+    fn account<I: IntoIterator<Item = (usize, usize, usize, usize)>>(&self, items: I, diff: isize) {
+        if let Some(logger) = &self.logger {
+            let (mut records, mut size, mut capacity, mut allocations) =
+                (0isize, 0isize, 0isize, 0isize);
+            for (records_, size_, capacity_, allocations_) in items {
+                records = records.saturating_add_unsigned(records_);
+                size = size.saturating_add_unsigned(size_);
+                capacity = capacity.saturating_add_unsigned(capacity_);
+                allocations = allocations.saturating_add_unsigned(allocations_);
+            }
+            logger.log(BatcherEvent {
+                operator: self.operator_id,
+                records_diff: records * diff,
+                size_diff: size * diff,
+                capacity_diff: capacity * diff,
+                allocations_diff: allocations * diff,
+            })
+        }
+    }
+}
+
+impl<Chu, M: Merger, S> Drop for MergeBatcher<Chu, M, S> {
+    fn drop(&mut self) {
+        // Cleanup chain to retract accounting information.
+        while self.chain_pop().is_some() {}
+    }
+}
+
+/// A trait to describe interesting moments in a merge batcher.
+pub trait Merger: Default {
+    /// The internal representation of chunks of data.
+    type Chunk: Default;
+    /// The type of time in frontiers to extract updates.
+    type Time;
+    /// Merge chains into an output chain.
+    fn merge(
+        &mut self,
+        list1: Vec<Self::Chunk>,
+        list2: Vec<Self::Chunk>,
+        output: &mut Vec<Self::Chunk>,
+        stash: &mut Vec<Self::Chunk>,
+    );
+    /// Extract ready updates based on the `upper` frontier.
+    fn extract(
+        &mut self,
+        merged: Vec<Self::Chunk>,
+        upper: AntichainRef<Self::Time>,
+        frontier: &mut Antichain<Self::Time>,
+        readied: &mut Vec<Self::Chunk>,
+        kept: &mut Vec<Self::Chunk>,
+        stash: &mut Vec<Self::Chunk>,
+    );
+
+    /// Poll a chain merge, consuming input allocations at most once.
+    fn poll_merge(
+        &mut self,
+        a: &mut Vec<Self::Chunk>,
+        b: &mut Vec<Self::Chunk>,
+        output: &mut Vec<Self::Chunk>,
+        stash: &mut Vec<Self::Chunk>,
+        _cx: &mut Context<'_>,
+    ) -> Poll<()> {
+        self.merge(std::mem::take(a), std::mem::take(b), output, stash);
+        Poll::Ready(())
+    }
+    /// Poll extraction with stable queues and frontier until completion.
+    fn poll_extract(
+        &mut self,
+        input: &mut Vec<Self::Chunk>,
+        upper: AntichainRef<Self::Time>,
+        frontier: &mut Antichain<Self::Time>,
+        readied: &mut Vec<Self::Chunk>,
+        kept: &mut Vec<Self::Chunk>,
+        stash: &mut Vec<Self::Chunk>,
+        _cx: &mut Context<'_>,
+    ) -> Poll<()> {
+        self.extract(std::mem::take(input), upper, frontier, readied, kept, stash);
+        Poll::Ready(())
+    }
+
+    /// The number of updates in a chunk.
+    ///
+    /// Drives the geometric ladder (chains are weighed by summed updates, not chunk
+    /// counts, since regrading decouples the two) and the `records` field of the
+    /// size logger.
+    fn len(chunk: &Self::Chunk) -> usize;
+
+    /// Backing-allocation figures for a chunk: `(size, capacity, allocations)`, for
+    /// the size logger's memory telemetry.
+    ///
+    /// Defaults to zero — most chunk types do not track this. Override to report
+    /// real figures (e.g. Materialize's memory accounting).
+    fn allocation(_chunk: &Self::Chunk) -> (usize, usize, usize) {
+        (0, 0, 0)
+    }
+}
+
+/// Forms a batch from a whole chain of updates at once.
+///
+/// Named rather than a bare `fn(&mut Vec<C>) -> Option<B>` so that implementors can name the
+/// batch they produce. There is no receiver: the chain goes in and the batch comes out, leaving
+/// nowhere for an update to be retained.
+pub trait Sealer<C> {
+    /// Output batch type.
+    type Output;
+
+    /// Builds a batch from a chain of updates.
+    ///
+    /// This method relies on the chain only containing updates greater or equal to the lower frontier,
+    /// and not greater or equal to the upper frontier, of the interval the caller means to describe.
+    /// Chains must also be sorted and consolidated.
+    ///
+    /// Having the whole chain in hand, an implementor can size itself before it fills.
+    fn seal(chain: &mut Vec<C>) -> Option<Self::Output>;
+}
+
+/// A type capable of accepting containers of updates, and carving them out by time as batches.
+///
+/// Updates are accepted as `C0`, the containers that arrive on the dataflow edge, and released as
+/// `Output`, whatever the implementor means by a batch. The two need not agree: an implementor
+/// staging updates in a form of its own can release that form directly, and one whose batch is a
+/// sequence of chunks names a sequence as its output.
+///
+/// The implementor determines the meaning of extraction by a frontier; it is not required to be by
+/// antichain partial order.
+pub trait Batcher<C0> {
+    /// The timestamps by which updates are carved out.
+    type Time;
+    /// The batches released by extraction.
+    type Output;
+
+    /// Takes the updates in `container`, leaving it in an undefined state.
+    ///
+    /// The implementor decides whether to claim the container's allocation or to drain it and
+    /// leave the allocation with the caller, who is free to reuse the container either way.
+    fn insert(&mut self, container: &mut C0);
+    /// Extracts the updates `upper` unblocks as a batch, and lower bounds the times of those retained.
+    ///
+    /// What `upper` unblocks is the implementor's to decide. It can be based on the antichain up
+    /// set, or it can be based on the total order of times (as used in delta join constructions).
+    /// Absent a batch, `upper` unblocked no updates.
+    ///
+    /// The reported lower bound should accurately reflect the times of all accepted updates that
+    /// have not been extracted. Over approximation can result in stalling dataflows, and under
+    /// approximation is simply incorrect.
+    fn extract<'a>(
+        &'a mut self,
+        upper: AntichainRef<'_, Self::Time>,
+    ) -> (Option<Self::Output>, AntichainRef<'a, Self::Time>);
+    /// Poll insertion, retaining the same container until completion.
+    fn poll_insert(
+        &mut self,
+        container: &mut C0,
+        _cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<()> {
+        self.insert(container);
+        std::task::Poll::Ready(())
+    }
+    /// Poll extraction at a fixed frontier, retaining capabilities until ready.
+    fn poll_extract(
+        &mut self,
+        upper: AntichainRef<'_, Self::Time>,
+        _cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<(Option<Self::Output>, Antichain<Self::Time>)>
+    where
+        Self::Time: Clone,
+    {
+        let (batch, retained) = self.extract(upper);
+        std::task::Poll::Ready((batch, retained.to_owned()))
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs b/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
new file mode 100644
index 0000000000000..55c5db768e7ae
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
@@ -0,0 +1,782 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See LICENSE in this directory.
+
+//! Sorted chunk operations, resumable merge pipelines, and batch assembly.
+//!
+//! The storage backend implements [`Chunk`]. [`ChunkMerger`] drives batch formation,
+//! while [`ChunkBatchMerger`] merges published batches and advances their timestamps.
+//! Both retain their current pipeline phase across a pending storage operation.
+
+use std::collections::VecDeque;
+
+use super::spine::SpineBatch;
+use differential_dataflow::lattice::Lattice;
+use timely::progress::Antichain;
+use timely::progress::frontier::AntichainRef;
+
+/// A non-empty, bounded, consolidated, sorted sequence of `(data, time, diff)`.
+///
+/// An implementor gains access to types and trait implementations that provide
+/// batch formation and trace maintenance with no additional effort.
+///
+/// The necessary implementations are either "data" or "metadata" operations.
+/// The "data" operations transform lists of chunks, are expected to do roughly
+/// "one chunk's worth" of work at a time; they can afford to compress and page.
+/// The "metadata" operations provide chunk information, and should be lightweight.
+///
+/// The trait exposes only time, which trace maintenance needs.
+/// Reading a chunk's contents is separate from trace maintenance.
+pub trait Chunk: Sized + Clone {
+    /// Retained I/O state for one chunk operation. It must not borrow the trace.
+    type Pending: Default;
+
+    /// Prepare operation state from resident metadata before reading any input.
+    fn pending_for(_left: &[Self], _right: &[Self]) -> Self::Pending {
+        Self::Pending::default()
+    }
+
+    /// The timestamp type of the chunk's updates.
+    ///
+    /// Trace maintenance uses time to describe intervals and to advance and compact updates.
+    type Time: Lattice + timely::progress::Timestamp;
+
+    /// The intended maximum chunk size.
+    const TARGET: usize;
+
+    /// The number of updates in the chunk.
+    fn len(&self) -> usize;
+
+    /// Merge the fronts of two input deques through their shared horizon.
+    ///
+    /// Both deques are non-empty (the caller guarantees it). The two queues are both
+    /// the heads of lists of chunks, and the implementor should only merge through the
+    /// least last `(key, val, time)` update, or risk emitting an unconsolidated
+    /// output chunk.
+    ///
+    /// When a chunk cannot be completely retired, perhaps it had the larger last update,
+    /// it should be rewritten as a new chunk and pushed back to the front of the queue.
+    /// The invocation is expected to consume at least one of its inputs, and the harness
+    /// may continually re-invoke if this doesn't happen.
+    ///
+    /// A merge concludes when the harness sees that either input is now empty, at which
+    /// point it appends the queue to the output without the method's assistance.
+    fn merge(in1: &mut VecDeque<Self>, in2: &mut VecDeque<Self>, out: &mut VecDeque<Self>);
+
+    /// Partition `input` updates into `keep` (greater or equal `frontier`) or not (`ship`).
+    ///
+    /// An implementation should yield with some frequency to allow the output to "settle".
+    /// The harness may guard against this, but it prefers to provide as much context as it
+    /// can in order to allow broader chunk fusion where needed.
+    fn extract(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<Self::Time>,
+        residual: &mut Antichain<Self::Time>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    );
+
+    /// Advance times by `frontier` producing consolidated chunks.
+    ///
+    /// An output for `(key, val)` should generally not be produced until a later pair
+    /// is observed, or `done` is set, to ensure the output chunks are consolidated.
+    /// Incomplete work can be pushed back to the front of `input`.
+    ///
+    /// On `done` a single `(key, val)` group may span the whole input; advancing and
+    /// consolidating it should cost time linear in its size, not quadratic.
+    fn advance(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<Self::Time>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    );
+
+    /// Reshape `input` to a sequence that maintains the "grading" structural invariant.
+    ///
+    /// Specifically, the chunks in `output` should have a maximum size of `TARGET` and
+    /// each adjacent pair should have lengths that sum to more than `TARGET`.
+    /// This is also a good moment to consider compression or paging out the contents.
+    /// When `done` is set the input must be moved to the output.
+    ///
+    /// This method may be called on already settled data, and should be efficient then.
+    ///
+    /// Implementors that want the standard maximal packing can delegate to the
+    /// [`pack`] helper, supplying their layout's coalesce / split / commit closures.
+    fn settle(input: &mut VecDeque<Self>, done: bool, out: &mut VecDeque<Self>);
+
+    /// Poll a merge tick, retaining progress and registering a wakeup when blocked.
+    fn poll_merge(
+        _state: &mut Self::Pending,
+        _cx: &mut std::task::Context<'_>,
+        in1: &mut VecDeque<Self>,
+        in2: &mut VecDeque<Self>,
+        out: &mut VecDeque<Self>,
+    ) -> std::task::Poll<()> {
+        Self::merge(in1, in2, out);
+        std::task::Poll::Ready(())
+    }
+    /// Poll timestamp advancement. `done` and `frontier` stay fixed while pending.
+    fn poll_advance(
+        _state: &mut Self::Pending,
+        _cx: &mut std::task::Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<Self::Time>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) -> std::task::Poll<()> {
+        Self::advance(input, frontier, done, out);
+        std::task::Poll::Ready(())
+    }
+    /// Poll extraction. The frontier and output queues stay fixed while pending.
+    fn poll_extract(
+        _state: &mut Self::Pending,
+        _cx: &mut std::task::Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<Self::Time>,
+        residual: &mut Antichain<Self::Time>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) -> std::task::Poll<()> {
+        Self::extract(input, frontier, residual, keep, ship);
+        std::task::Poll::Ready(())
+    }
+    /// Poll settlement, preserving both carry and output across suspension.
+    fn poll_settle(
+        _state: &mut Self::Pending,
+        _cx: &mut std::task::Context<'_>,
+        input: &mut VecDeque<Self>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) -> std::task::Poll<()> {
+        Self::settle(input, done, out);
+        std::task::Poll::Ready(())
+    }
+}
+
+/// Maximal-packing driver an implementor's [`Chunk::settle`] may delegate to.
+///
+/// Holds a `carry` chunk under construction, grown by `combine` until it reaches
+/// `TARGET` (then emitted) and emitted early when the next chunk can't be absorbed
+/// without exceeding `TARGET`; over-sized chunks are peeled with `split`. Each
+/// committed chunk is passed through `seal` (the compress / spill hook — use the
+/// identity closure when there's nothing to do). The closures are the only
+/// layout-specific pieces:
+///
+/// * `combine(&mut acc, next)` — append `next` onto `acc` (caller guarantees their
+///   lengths sum to at most `TARGET`, and `next` follows `acc` in one sorted,
+///   consolidated chain), so packing a run of small chunks stays linear.
+/// * `split(chunk, n)` — the first `n` updates and the remaining `len - n`.
+/// * `seal(chunk)` — commit a chunk (e.g. compress or spill); identity to keep it.
+pub fn pack<C: Chunk>(
+    input: &mut VecDeque<C>,
+    done: bool,
+    out: &mut VecDeque<C>,
+    mut combine: impl FnMut(&mut C, C),
+    mut split: impl FnMut(C, usize) -> (C, C),
+    mut seal: impl FnMut(C) -> C,
+) {
+    let mut carry: Option<C> = None;
+    while let Some(chunk) = input.pop_front() {
+        match carry.take() {
+            None => pack_absorb(chunk, &mut carry, out, &mut split, &mut seal),
+            Some(mut c) if c.len() + chunk.len() <= C::TARGET => {
+                // Combines into one legal chunk; coalesce in place.
+                combine(&mut c, chunk);
+                if c.len() == C::TARGET {
+                    out.push_back(seal(c));
+                } else {
+                    carry = Some(c);
+                }
+            }
+            Some(c) => {
+                // `c` is maximal against this neighbour; emit it and absorb afresh.
+                out.push_back(seal(c));
+                pack_absorb(chunk, &mut carry, out, &mut split, &mut seal);
+            }
+        }
+    }
+    if let Some(c) = carry {
+        if done {
+            out.push_back(seal(c));
+        } else {
+            input.push_front(c);
+        }
+    }
+}
+
+/// Absorb `chunk` into an empty `carry` (a [`pack`] helper): pass a `TARGET` chunk
+/// straight through (sealed), hold a smaller one as the new carry, or peel
+/// `TARGET`-sized pieces off a larger one and carry the remainder.
+fn pack_absorb<C, S, L>(
+    chunk: C,
+    carry: &mut Option<C>,
+    out: &mut VecDeque<C>,
+    split: &mut S,
+    seal: &mut L,
+) where
+    C: Chunk,
+    S: FnMut(C, usize) -> (C, C),
+    L: FnMut(C) -> C,
+{
+    match chunk.len().cmp(&C::TARGET) {
+        std::cmp::Ordering::Equal => out.push_back(seal(chunk)),
+        std::cmp::Ordering::Less => *carry = Some(chunk),
+        std::cmp::Ordering::Greater => {
+            let mut rest = chunk;
+            loop {
+                let (head, tail) = split(rest, C::TARGET);
+                out.push_back(seal(head));
+                if tail.len() >= C::TARGET {
+                    rest = tail;
+                } else {
+                    if tail.len() > 0 {
+                        *carry = Some(tail);
+                    }
+                    break;
+                }
+            }
+        }
+    }
+}
+
+/// A batch: an ordered [`Chunk`] sequence whose concatenation is its updates.
+pub struct ChunkBatch<C: Chunk> {
+    /// Ordered, consolidated chunks; their concatenation is the batch.
+    pub chunks: Vec<C>,
+}
+
+impl<C: Chunk> ChunkBatch<C> {
+    /// Assemble a batch from ordered chunks.
+    pub fn new(chunks: Vec<C>) -> Self {
+        for chunk in &chunks {
+            assert!(chunk.len() > 0, "ChunkBatch chunks must be non-empty");
+        }
+        ChunkBatch { chunks }
+    }
+}
+
+impl<C: Chunk + 'static> SpineBatch for ChunkBatch<C>
+where
+    C::Time: timely::progress::Timestamp + Lattice + Ord,
+{
+    type Time = C::Time;
+    type Merger = ChunkBatchMerger<C>;
+    fn len(&self) -> usize {
+        self.chunks.iter().map(C::len).sum()
+    }
+}
+
+/// A merge-batcher [`Merger`](super::batcher::Merger)
+/// over chains of [`Chunk`]s.
+///
+/// `merge` runs the whole-chain binary merger; `extract` splits by the seal frontier
+/// using [`Chunk::extract`]. The batcher consolidates equal `(data, time)` updates
+/// but does *not* advance times — time advancement is advance's job, handled later in
+/// the trace. Both settle their output, since the batcher's chains want to be graded.
+pub type ChunkBatcher<Chu, C> = super::batcher::MergeBatcher<Chu, ChunkMerger<C>, ChunkBuilder<C>>;
+
+/// A spine of `Rc`-shared [`ChunkBatch`]s of type `C`: the trace type for `arrange`.
+pub type ChunkSpine<C> = super::spine::Spine<std::rc::Rc<ChunkBatch<C>>>;
+
+/// A [`ChunkBatch`] builder over chunks of type `C`, emitting `Rc`-shared updates.
+pub type ChunkBuilder<C> = ChunkBatchBuilder<C>;
+
+/// A merge-batcher [`Merger`](super::batcher::Merger)
+/// over chains of [`Chunk`]s.
+///
+/// `merge` runs the whole-chain binary merger; `extract` splits by the seal frontier
+/// using [`Chunk::extract`]. The batcher consolidates equal `(data, time)` updates
+/// but does *not* advance times — time advancement is advance's job, handled later in
+/// the trace. Both settle their output, since the batcher's chains want to be graded.
+pub struct ChunkMerger<C: Chunk> {
+    merge: Option<ChainMerge<C>>,
+    extract: Option<ChainExtract<C>>,
+}
+
+enum ChainPhase {
+    Choose,
+    Merge,
+    Settle(bool),
+}
+struct ChainMerge<C: Chunk> {
+    a: VecDeque<C>,
+    b: VecDeque<C>,
+    staged: VecDeque<C>,
+    settled: VecDeque<C>,
+    io: C::Pending,
+    phase: ChainPhase,
+}
+enum ExtractPhase {
+    Choose,
+    Extract,
+    Keep(bool),
+    Ship(bool),
+}
+struct ChainExtract<C: Chunk> {
+    input: VecDeque<C>,
+    keep: VecDeque<C>,
+    ship: VecDeque<C>,
+    kept: VecDeque<C>,
+    shipped: VecDeque<C>,
+    io: C::Pending,
+    phase: ExtractPhase,
+}
+impl<C: Chunk> Default for ChunkMerger<C> {
+    fn default() -> Self {
+        Self {
+            merge: None,
+            extract: None,
+        }
+    }
+}
+
+impl<C> super::batcher::Merger for ChunkMerger<C>
+where
+    C: Chunk + Default + 'static,
+    C::Time: Clone + timely::PartialOrder + 'static,
+{
+    type Chunk = C;
+    type Time = C::Time;
+
+    fn merge(&mut self, list1: Vec<C>, list2: Vec<C>, output: &mut Vec<C>, _stash: &mut Vec<C>) {
+        // Settle the output after each merge, to maintain bounded active chunks.
+        let mut in1: VecDeque<C> = list1.into();
+        let mut in2: VecDeque<C> = list2.into();
+        let (mut staged, mut settled) = (VecDeque::new(), VecDeque::new());
+        while !in1.is_empty() && !in2.is_empty() {
+            C::merge(&mut in1, &mut in2, &mut staged);
+            C::settle(&mut staged, false, &mut settled);
+        }
+        // Append the non-empty tail from either input, settle as we go.
+        for tail in in1.drain(..).chain(in2.drain(..)) {
+            staged.push_back(tail);
+            C::settle(&mut staged, false, &mut settled);
+        }
+        C::settle(&mut staged, true, &mut settled);
+        output.extend(settled);
+    }
+
+    fn extract(
+        &mut self,
+        merged: Vec<C>,
+        upper: AntichainRef<C::Time>,
+        frontier: &mut Antichain<C::Time>,
+        ship: &mut Vec<C>,
+        kept: &mut Vec<C>,
+        _stash: &mut Vec<C>,
+    ) {
+        // `extract` keeps updates greater-or-equal `upper` and ships the rest, folding
+        // the lower envelope of kept times into `frontier`. Drive it a bounded amount
+        // per call (≈ one input chunk) and `settle` each side as it accumulates, so
+        // neither `keep` (retained across yields) nor `ship` (handed to the builder)
+        // builds up unsettled in core. `settle` may withhold a sub-`TARGET` carry
+        // between calls; the final `settle(done)` flushes it.
+        let mut input: VecDeque<C> = merged.into();
+        let (mut keep, mut shipped) = (VecDeque::new(), VecDeque::new());
+        let (mut kept_q, mut shipped_q) = (VecDeque::new(), VecDeque::new());
+        while !input.is_empty() {
+            C::extract(&mut input, upper, frontier, &mut keep, &mut shipped);
+            C::settle(&mut keep, false, &mut kept_q);
+            C::settle(&mut shipped, false, &mut shipped_q);
+        }
+        C::settle(&mut keep, true, &mut kept_q);
+        C::settle(&mut shipped, true, &mut shipped_q);
+        kept.extend(kept_q);
+        ship.extend(shipped_q);
+    }
+
+    fn poll_merge(
+        &mut self,
+        a: &mut Vec<C>,
+        b: &mut Vec<C>,
+        output: &mut Vec<C>,
+        _stash: &mut Vec<C>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<()> {
+        use std::task::{Poll, ready};
+        let work = self.merge.get_or_insert_with(|| ChainMerge {
+            io: C::pending_for(a, b),
+            a: std::mem::take(a).into(),
+            b: std::mem::take(b).into(),
+            staged: VecDeque::new(),
+            settled: VecDeque::new(),
+            phase: ChainPhase::Choose,
+        });
+        loop {
+            match work.phase {
+                ChainPhase::Choose => {
+                    work.phase = if !work.a.is_empty() && !work.b.is_empty() {
+                        ChainPhase::Merge
+                    } else if let Some(tail) = work.a.pop_front().or_else(|| work.b.pop_front()) {
+                        work.staged.push_back(tail);
+                        ChainPhase::Settle(false)
+                    } else {
+                        ChainPhase::Settle(true)
+                    };
+                }
+                ChainPhase::Merge => {
+                    ready!(C::poll_merge(
+                        &mut work.io,
+                        cx,
+                        &mut work.a,
+                        &mut work.b,
+                        &mut work.staged
+                    ));
+                    work.phase = ChainPhase::Settle(false);
+                }
+                ChainPhase::Settle(done) => {
+                    ready!(C::poll_settle(
+                        &mut work.io,
+                        cx,
+                        &mut work.staged,
+                        done,
+                        &mut work.settled
+                    ));
+                    if done {
+                        output.extend(self.merge.take().unwrap().settled);
+                        return Poll::Ready(());
+                    }
+                    work.phase = ChainPhase::Choose;
+                }
+            }
+        }
+    }
+
+    fn poll_extract(
+        &mut self,
+        input: &mut Vec<C>,
+        upper: AntichainRef<C::Time>,
+        frontier: &mut Antichain<C::Time>,
+        ship: &mut Vec<C>,
+        kept: &mut Vec<C>,
+        _stash: &mut Vec<C>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<()> {
+        use std::task::{Poll, ready};
+        let work = self.extract.get_or_insert_with(|| ChainExtract {
+            io: C::pending_for(input, &[]),
+            input: std::mem::take(input).into(),
+            keep: VecDeque::new(),
+            ship: VecDeque::new(),
+            kept: VecDeque::new(),
+            shipped: VecDeque::new(),
+            phase: ExtractPhase::Choose,
+        });
+        loop {
+            match work.phase {
+                ExtractPhase::Choose => {
+                    work.phase = if work.input.is_empty() {
+                        ExtractPhase::Keep(true)
+                    } else {
+                        ExtractPhase::Extract
+                    };
+                }
+                ExtractPhase::Extract => {
+                    ready!(C::poll_extract(
+                        &mut work.io,
+                        cx,
+                        &mut work.input,
+                        upper,
+                        frontier,
+                        &mut work.keep,
+                        &mut work.ship
+                    ));
+                    work.phase = ExtractPhase::Keep(false);
+                }
+                ExtractPhase::Keep(done) => {
+                    ready!(C::poll_settle(
+                        &mut work.io,
+                        cx,
+                        &mut work.keep,
+                        done,
+                        &mut work.kept
+                    ));
+                    work.phase = ExtractPhase::Ship(done);
+                }
+                ExtractPhase::Ship(done) => {
+                    ready!(C::poll_settle(
+                        &mut work.io,
+                        cx,
+                        &mut work.ship,
+                        done,
+                        &mut work.shipped
+                    ));
+                    if done {
+                        let work = self.extract.take().unwrap();
+                        ship.extend(work.shipped);
+                        kept.extend(work.kept);
+                        return Poll::Ready(());
+                    }
+                    work.phase = ExtractPhase::Choose;
+                }
+            }
+        }
+    }
+
+    fn len(chunk: &C) -> usize {
+        chunk.len()
+    }
+}
+
+enum BatchMergePhase {
+    Choose,
+    Merge,
+    Account,
+    Advance,
+    Settle,
+}
+
+/// The resumable [`SpineBatch::Merger`] for [`ChunkBatch`]: merges two updates and advances
+/// their times to the compaction frontier, a fuel-bounded step at a time.
+///
+/// Each step pipelines [`merge`](Chunk::merge) → [`advance`](Chunk::advance) →
+/// [`settle`](Chunk::settle) and settles its output, so a suspended merge holds only
+/// graded chunks. The sources are read by cloning (a cheap refcount bump) and must be
+/// supplied unchanged on every call.
+pub struct ChunkBatchMerger<C: Chunk> {
+    /// Compaction frontier supplied at construction.
+    frontier: Antichain<C::Time>,
+    /// Input deques, refilled from the sources (clones) head-of-list at a time.
+    in1: VecDeque<C>,
+    in2: VecDeque<C>,
+    /// Next source chunk to clone into `in1` / `in2`.
+    idx1: usize,
+    idx2: usize,
+    /// `advance`'s input: the merge output plus advance's withheld carry at the front.
+    merged: VecDeque<C>,
+    /// `advance`'s output and `settle`'s input: merged-and-advanced chunks, with
+    /// settle's withheld sub-`TARGET` carry at the front.
+    advanced: VecDeque<C>,
+    /// `settle`'s output: the committed, graded result, grown by `work`. Graded at
+    /// every yield, so a suspended merge holds well-formed (spillable) chunk state.
+    settled: VecDeque<C>,
+    /// Set once both sources are drained and advance's and settle's final flushes ran.
+    complete: bool,
+    io: C::Pending,
+    phase: BatchMergePhase,
+    work: usize,
+    produced: VecDeque<C>,
+}
+
+impl<C> super::spine::Merger<ChunkBatch<C>> for ChunkBatchMerger<C>
+where
+    C: Chunk + 'static,
+    C::Time: timely::progress::Timestamp + Lattice + Ord + 'static,
+{
+    fn new(
+        source1: &ChunkBatch<C>,
+        source2: &ChunkBatch<C>,
+        frontier: AntichainRef<C::Time>,
+    ) -> Self {
+        Self {
+            frontier: frontier.to_owned(),
+            in1: VecDeque::new(),
+            in2: VecDeque::new(),
+            idx1: 0,
+            idx2: 0,
+            merged: VecDeque::new(),
+            advanced: VecDeque::new(),
+            settled: VecDeque::new(),
+            complete: false,
+            io: C::pending_for(&source1.chunks, &source2.chunks),
+            phase: BatchMergePhase::Choose,
+            work: 0,
+            produced: VecDeque::new(),
+        }
+    }
+
+    fn work(&mut self, source1: &ChunkBatch<C>, source2: &ChunkBatch<C>, fuel: &mut isize) {
+        let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
+        assert!(
+            self.poll_work(source1, source2, &mut cx, fuel).is_ready(),
+            "pending chunk merger requires poll_work"
+        );
+    }
+
+    fn poll_work(
+        &mut self,
+        source1: &ChunkBatch<C>,
+        source2: &ChunkBatch<C>,
+        cx: &mut std::task::Context<'_>,
+        fuel: &mut isize,
+    ) -> std::task::Poll<super::spine::MergeStatus> {
+        use super::spine::MergeStatus;
+        use std::task::{Poll, ready};
+        loop {
+            match self.phase {
+                BatchMergePhase::Choose => {
+                    if self.complete {
+                        return Poll::Ready(MergeStatus::Complete);
+                    }
+                    if *fuel <= 0 {
+                        return Poll::Ready(MergeStatus::InProgress);
+                    }
+                    const BURST: usize = 8;
+                    while self.in1.len() < BURST && self.idx1 < source1.chunks.len() {
+                        self.in1.push_back(source1.chunks[self.idx1].clone());
+                        self.idx1 += 1;
+                    }
+                    while self.in2.len() < BURST && self.idx2 < source2.chunks.len() {
+                        self.in2.push_back(source2.chunks[self.idx2].clone());
+                        self.idx2 += 1;
+                    }
+                    if !self.in1.is_empty() && !self.in2.is_empty() {
+                        self.phase = BatchMergePhase::Merge;
+                    } else {
+                        if let Some(chunk) = self.in1.pop_front().or_else(|| self.in2.pop_front()) {
+                            self.produced.push_back(chunk);
+                        } else {
+                            self.complete = true;
+                        }
+                        self.phase = BatchMergePhase::Account;
+                    }
+                }
+                BatchMergePhase::Merge => {
+                    ready!(C::poll_merge(
+                        &mut self.io,
+                        cx,
+                        &mut self.in1,
+                        &mut self.in2,
+                        &mut self.produced
+                    ));
+                    self.phase = BatchMergePhase::Account;
+                }
+                BatchMergePhase::Account => {
+                    self.work = self.produced.iter().map(C::len).sum();
+                    self.merged.append(&mut self.produced);
+                    self.phase = BatchMergePhase::Advance;
+                }
+                BatchMergePhase::Advance => {
+                    ready!(C::poll_advance(
+                        &mut self.io,
+                        cx,
+                        &mut self.merged,
+                        self.frontier.borrow(),
+                        self.complete,
+                        &mut self.advanced
+                    ));
+                    self.phase = BatchMergePhase::Settle;
+                }
+                BatchMergePhase::Settle => {
+                    ready!(C::poll_settle(
+                        &mut self.io,
+                        cx,
+                        &mut self.advanced,
+                        self.complete,
+                        &mut self.settled
+                    ));
+                    *fuel -= self.work.cast_signed();
+                    self.phase = BatchMergePhase::Choose;
+                }
+            }
+        }
+    }
+
+    fn done(self) -> Option<ChunkBatch<C>> {
+        debug_assert!(self.merged.is_empty() && self.advanced.is_empty());
+        wrap(self.settled.into())
+    }
+}
+
+/// A builder that collects a chunk sequence into a [`ChunkBatch`].
+pub struct ChunkBatchBuilder<C: Chunk> {
+    /// Pushed chunks awaiting settling; holds settle's sub-`TARGET` carry at the front.
+    input: VecDeque<C>,
+    /// The graded chunks emitted so far.
+    output: VecDeque<C>,
+}
+
+impl<C: Chunk> Default for ChunkBatchBuilder<C> {
+    fn default() -> Self {
+        Self {
+            input: VecDeque::new(),
+            output: VecDeque::new(),
+        }
+    }
+}
+
+impl<C> ChunkBatchBuilder<C>
+where
+    C: Chunk + Default + 'static,
+    C::Time: timely::progress::Timestamp,
+{
+    pub fn push(&mut self, chunk: &mut C) {
+        let chunk = std::mem::take(chunk);
+        if chunk.len() > 0 {
+            self.input.push_back(chunk);
+            C::settle(&mut self.input, false, &mut self.output);
+        }
+    }
+
+    pub fn done(self) -> Option<ChunkBatch<C>> {
+        let ChunkBatchBuilder {
+            mut input,
+            mut output,
+        } = self;
+        C::settle(&mut input, true, &mut output);
+        let chunks: Vec<C> = output.into();
+        wrap(chunks)
+    }
+}
+
+impl<C> super::batcher::Sealer<C> for ChunkBatchBuilder<C>
+where
+    C: Chunk + Default + 'static,
+    C::Time: timely::progress::Timestamp,
+{
+    type Output = ChunkBatch<C>;
+
+    fn seal(chain: &mut Vec<C>) -> Option<Self::Output> {
+        // We settle the chain because we are not guaranteed to received pre-settled data.
+        // This should be efficient on pre-settled data.
+        wrap(settle_all(std::mem::take(chain)))
+    }
+}
+
+/// Wraps settled chunks as a batch, absent when there are no chunks.
+fn wrap<C: Chunk>(chunks: Vec<C>) -> Option<ChunkBatch<C>> {
+    (!chunks.is_empty()).then(|| ChunkBatch::new(chunks))
+}
+
+/// Whether `chunks` satisfy the [`Chunk::TARGET`] grading invariant: every chunk
+/// at most `TARGET`, and every adjacent pair summing to more than `TARGET` (so no
+/// two neighbours could be combined into one legal chunk — a *maximal packing*).
+///
+/// This is the post-[`settle`](Chunk::settle) shape; useful as a test/debug check.
+pub fn is_graded<C: Chunk>(chunks: &[C]) -> bool {
+    chunks.iter().all(|c| c.len() <= C::TARGET)
+        && chunks
+            .windows(2)
+            .all(|w| w[0].len() + w[1].len() > C::TARGET)
+}
+
+/// Settle `input` to completion into a fresh graded `Vec` (see [`Chunk::settle`]).
+///
+/// A convenience for the one-shot callers (batch sealing, the batcher's merge and
+/// extract) that have a whole sequence in hand and want it graded; the streaming
+/// callers drive [`Chunk::settle`] directly across ticks.
+pub fn settle_all<C: Chunk>(input: impl IntoIterator<Item = C>) -> Vec<C> {
+    let mut input: VecDeque<C> = input.into_iter().collect();
+    let mut out = VecDeque::new();
+    C::settle(&mut input, true, &mut out);
+    debug_assert!(input.is_empty());
+    out.into()
+}
+
+/// Merge two full chains of chunks into one, to completion, appending to `out`.
+///
+/// The plain whole-chain driver: ticks [`Chunk::merge`] until one deque empties, then
+/// appends the other's remainder (the verbatim tail). Output is near-graded, not
+/// settled. The batcher's `merge` runs the same loop but settles after each push (the
+/// bounded-footprint discipline) and so does not use this; it stays as the simplest way
+/// to drive [`Chunk::merge`] to completion.
+pub fn merge_chains<C: Chunk>(chain1: Vec<C>, chain2: Vec<C>, out: &mut VecDeque<C>) {
+    let mut in1: VecDeque<C> = chain1.into();
+    let mut in2: VecDeque<C> = chain2.into();
+    while !in1.is_empty() && !in2.is_empty() {
+        C::merge(&mut in1, &mut in2, out);
+    }
+    // One deque is empty; the other's remainder is all greater than everything merged.
+    out.extend(in1.drain(..));
+    out.extend(in2.drain(..));
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
new file mode 100644
index 0000000000000..e50e57ccf188d
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -0,0 +1,1147 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See LICENSE in this directory.
+
+//! An append-only collection of update batches.
+//!
+//! The `Spine` is a general-purpose trace implementation based on collection and merging
+//! immutable batches of updates. It is generic with respect to the batch type, and can be
+//! instantiated for any implementor of [`SpineBatch`].
+//!
+//! ## Design
+//!
+//! This spine is represented as a list of layers, where each element in the list is either
+//!
+//!   1. MergeState::Vacant  empty
+//!   2. MergeState::Single  a single span
+//!   3. MergeState::Double  a pair of spans
+//!
+//! Each "span" has the option to be `None`, indicating a non-span that nonetheless acts
+//! as a number of updates proportionate to the level at which it exists (for bookkeeping).
+//!
+//! Each of the spans at layer i contains at most 2^i elements. The sequence of spans
+//! should have the upper bound of one match the lower bound of the next. Spans may carry
+//! no updates, with matching upper and lower bounds, as a bookkeeping mechanism.
+//!
+//! Each batch at layer i is treated as if it contains exactly 2^i elements, even though it
+//! may actually contain fewer elements. This allows us to decouple the physical representation
+//! from logical amounts of effort invested in each batch. It allows us to begin compaction and
+//! to reduce the number of updates, without compromising our ability to continue to move
+//! updates along the spine. We are explicitly making the trade-off that while some batches
+//! might compact at lower levels, we want to treat them as if they contained their full set of
+//! updates for accounting reasons (to apply work to higher levels).
+//!
+//! We maintain the invariant that for any in-progress merge at level k there should be fewer
+//! than 2^k records at levels lower than k. That is, even if we were to apply an unbounded
+//! amount of effort to those records, we would not have enough records to prompt a merge into
+//! the in-progress merge. Ideally, we maintain the extended invariant that for any in-progress
+//! merge at level k, the remaining effort required (number of records minus applied effort) is
+//! less than the number of records that would need to be added to reach 2^k records in layers
+//! below.
+//!
+//! ## Mathematics
+//!
+//! When a merge is initiated, there should be a non-negative *deficit* of updates before the layers
+//! below could plausibly produce a new batch for the currently merging layer. We must determine a
+//! factor of proportionality, so that newly arrived updates provide at least that amount of "fuel"
+//! towards the merging layer, so that the merge completes before lower levels invade.
+//!
+//! ### Deficit:
+//!
+//! A new merge is initiated only in response to the completion of a prior merge, or the introduction
+//! of new records from outside. The latter case is special, and will maintain our invariant trivially,
+//! so we will focus on the former case.
+//!
+//! When a merge at level k completes, assuming we have maintained our invariant then there should be
+//! fewer than 2^k records at lower levels. The newly created merge at level k+1 will require up to
+//! 2^k+2 units of work, and should not expect a new batch until strictly more than 2^k records are
+//! added. This means that a factor of proportionality of four should be sufficient to ensure that
+//! the merge completes before a new merge is initiated.
+//!
+//! When new records get introduced, we will need to roll up any batches at lower levels, which we
+//! treat as the introduction of records. Each of these virtual records introduced should either be
+//! accounted for the fuel it should contribute, as it results in the promotion of batches closer to
+//! in-progress merges.
+//!
+//! ### Fuel sharing
+//!
+//! We like the idea of applying fuel preferentially to merges at *lower* levels, under the idea that
+//! they are easier to complete, and we benefit from fewer total merges in progress. This does delay
+//! the completion of merges at higher levels, and may not obviously be a total win. If we choose to
+//! do this, we should make sure that we correctly account for completed merges at low layers: they
+//! should still extract fuel from new updates even though they have completed, at least until they
+//! have paid back any "debt" to higher layers by continuing to provide fuel as updates arrive.
+
+use std::collections::VecDeque;
+use std::rc::Rc;
+use std::task::{Context, Poll, Waker};
+
+use differential_dataflow::lattice::Lattice;
+use differential_dataflow::logging::Logger;
+use differential_dataflow::trace::{Description, ExertionLogic};
+use mz_ore::cast::CastFrom;
+
+use ::timely::dataflow::operators::generic::OperatorInfo;
+use ::timely::order::PartialOrder;
+use ::timely::progress::{Antichain, Timestamp, frontier::AntichainRef};
+
+/// An interval of a trace's history: a description of the times it covers, and the batch of
+/// updates within it, absent exactly when there are none.
+///
+/// The interval is never empty, but the batch may be missing; a span records that its times
+/// happened and brought no updates.
+#[derive(Clone, Debug)]
+pub struct Span<T, B> {
+    /// The lower and upper bounds of contained update times, and the compaction frontier.
+    pub desc: Description<T>,
+    /// The updates within the interval; absent exactly when there are none.
+    pub inner: Option<B>,
+}
+
+impl<T, B> Span<T, B> {
+    /// A span from a description and the batch within it, absent when there are no updates.
+    pub fn new(desc: Description<T>, inner: Option<B>) -> Self {
+        Self { desc, inner }
+    }
+    /// All times in the span are greater or equal to an element of `lower`.
+    pub fn lower(&self) -> &Antichain<T> {
+        self.desc.lower()
+    }
+    /// All times in the span are not greater or equal to any element of `upper`.
+    pub fn upper(&self) -> &Antichain<T> {
+        self.desc.upper()
+    }
+    /// True if the span carries a batch of updates.
+    ///
+    /// This is about the updates, not the interval, which is never empty.
+    pub fn has_updates(&self) -> bool {
+        self.inner.is_some()
+    }
+}
+
+impl<T: Timestamp, B> Span<T, B> {
+    /// A span over the indicated interval carrying no updates.
+    pub fn empty(lower: Antichain<T>, upper: Antichain<T>) -> Self {
+        Self {
+            desc: Description::new(lower, upper, Antichain::from_elem(T::minimum())),
+            inner: None,
+        }
+    }
+}
+
+/// The requirements this spine imposes on the batches its spans carry.
+///
+/// These are opinions of this spine, not properties of batches in general: a batch must
+/// support progressive (fuel-limited) merging through a [`Merger`], and must report its
+/// size, which drives the spine's geometric layering and its logging.
+pub trait SpineBatch: Sized {
+    /// The timestamp type of the batch's updates.
+    type Time: Timestamp + Lattice;
+
+    /// A type used to progressively merge batches.
+    type Merger: Merger<Self>;
+
+    /// The number of updates in the batch.
+    ///
+    /// A span with nothing in it is meant to carry no batch at all rather than an empty one,
+    /// so this should be positive. The spine does not rely on that: it asks this method
+    /// rather than asking whether a span carries a batch, so a producer that hands it an
+    /// empty batch costs an extra merge rather than behaving differently from the absent
+    /// case.
+    fn len(&self) -> usize;
+}
+
+/// Whether a polled merger finished or exhausted its work allowance.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MergeStatus {
+    /// More CPU work is required.
+    InProgress,
+    /// All output is ready for extraction.
+    Complete,
+}
+
+/// A progressive merge of consecutive batches, optionally waiting for I/O.
+pub trait Merger<Output: SpineBatch> {
+    /// Creates a new merger to merge the supplied batches, optionally compacting
+    /// up to the supplied frontier.
+    fn new(
+        source1: &Output,
+        source2: &Output,
+        compaction_frontier: AntichainRef<Output::Time>,
+    ) -> Self;
+    /// Perform some amount of work, decrementing `fuel`.
+    ///
+    /// If `fuel` is non-zero after the call, the merging is complete and
+    /// one should call `done` to extract the merged results.
+    fn work(&mut self, _source1: &Output, _source2: &Output, _fuel: &mut isize) {
+        panic!("this merger requires poll_work")
+    }
+    /// Perform admitted work, registering `cx` before returning pending.
+    ///
+    /// A pending call retains all progress, including consumed fuel. Polling again
+    /// must not resubmit reads or require the inputs to change. Waiting consumes no
+    /// fuel. Implementations must be ready to observe read completion even at zero fuel.
+    fn poll_work(
+        &mut self,
+        source1: &Output,
+        source2: &Output,
+        cx: &mut Context<'_>,
+        fuel: &mut isize,
+    ) -> Poll<MergeStatus> {
+        let _ = cx;
+        self.work(source1, source2, fuel);
+        Poll::Ready(if *fuel > 0 {
+            MergeStatus::Complete
+        } else {
+            MergeStatus::InProgress
+        })
+    }
+    /// Extracts merged results, absent if the merge cancelled to nothing.
+    ///
+    /// Call only after `poll_work` reports `Complete`, or the synchronous
+    /// `work` adapter reports completion through its remaining fuel.
+    fn done(self) -> Option<Output>;
+}
+
+impl<B: SpineBatch> SpineBatch for Rc<B> {
+    type Time = B::Time;
+    type Merger = RcMerger<B>;
+    fn len(&self) -> usize {
+        (**self).len()
+    }
+}
+
+/// Wrapper type for merging reference counted batches.
+pub struct RcMerger<B: SpineBatch> {
+    merger: B::Merger,
+}
+
+impl<B: SpineBatch> Merger<Rc<B>> for RcMerger<B> {
+    fn new(source1: &Rc<B>, source2: &Rc<B>, compaction_frontier: AntichainRef<B::Time>) -> Self {
+        RcMerger {
+            merger: B::Merger::new(source1, source2, compaction_frontier),
+        }
+    }
+    fn work(&mut self, source1: &Rc<B>, source2: &Rc<B>, fuel: &mut isize) {
+        self.merger.work(source1, source2, fuel)
+    }
+    fn poll_work(
+        &mut self,
+        source1: &Rc<B>,
+        source2: &Rc<B>,
+        cx: &mut Context<'_>,
+        fuel: &mut isize,
+    ) -> Poll<MergeStatus> {
+        self.merger.poll_work(source1, source2, cx, fuel)
+    }
+    fn done(self) -> Option<Rc<B>> {
+        self.merger.done().map(Rc::new)
+    }
+}
+
+/// The number of updates in a span: its batch's length, or zero when it carries none.
+///
+/// This is how the spine asks whether a span has updates. `Span::has_updates` answers the
+/// weaker question of whether a batch is *present*, which agrees with this only for
+/// producers that report absence when they built nothing; the spine can measure instead,
+/// and does.
+fn span_len<B: SpineBatch>(span: &Span<B::Time, B>) -> usize {
+    span.inner.as_ref().map(|b| b.len()).unwrap_or(0)
+}
+
+// A continuation of the existing introduction algorithm. No action owns a
+// published span: results move directly between levels before a poll can yield.
+enum Maintenance {
+    Fuel {
+        level: usize,
+        grant: isize,
+        remaining: isize,
+    },
+    RollUp {
+        target: usize,
+        next: Option<usize>,
+        remaining: isize,
+    },
+    Insert {
+        level: usize,
+        pending: bool,
+    },
+    FuseEmpty {
+        level: usize,
+        remaining: isize,
+    },
+    Tidy,
+}
+
+/// An append-only collection of update tuples.
+///
+/// A spine maintains a small number of immutable collections of update tuples, merging the collections when
+/// two have similar sizes. In this way, it allows the addition of more tuples, which may then be merged with
+/// other immutable collections.
+pub struct Spine<B: SpineBatch> {
+    operator: OperatorInfo,
+    logger: Option<Logger>,
+    logical_frontier: Antichain<B::Time>, // Times after which the trace must accumulate correctly.
+    physical_frontier: Antichain<B::Time>, // Times after which the trace must be able to subset its inputs.
+    merging: Vec<MergeState<B>>,           // Several possibly shared collections of updates.
+    pending: Vec<Span<B::Time, B>>,        // Spans at times in advance of `frontier`.
+    upper: Antichain<B::Time>,
+    effort: usize,
+    activator: Option<timely::scheduling::activate::Activator>,
+    /// Parameters to `exert_logic`, containing tuples of `(index, count, length)`.
+    exert_logic_param: Vec<(usize, usize, usize)>,
+    /// Logic to indicate whether and how many records we should introduce in the absence of actual updates.
+    exert_logic: Option<ExertionLogic>,
+    maintenance: VecDeque<Maintenance>,
+    waker: Option<Waker>,
+}
+
+impl<B: SpineBatch + Clone + 'static> Spine<B> {
+    /// Return published spans through a clean cut at or beyond physical compaction.
+    pub fn spans_through(&self, upper: AntichainRef<B::Time>) -> Option<Vec<Span<B::Time, B>>> {
+        // If `upper` is the minimum frontier, we can return an empty cursor.
+        // This can happen with operators that are written to expect the ability to acquire cursors
+        // for their prior frontiers, and which start at `[T::minimum()]`, such as `Reduce`, sadly.
+        if upper.less_equal(&<B::Time as timely::progress::Timestamp>::minimum()) {
+            return Some(Vec::new());
+        }
+
+        // The supplied `upper` should have the property that for each of our
+        // batch `lower` and `upper` frontiers, the supplied upper is comparable
+        // to the frontier; it should not be incomparable, because the frontiers
+        // that we created form a total order. If it is, there is a bug.
+        //
+        // We should acquire a cursor including all batches whose upper is less
+        // or equal to the supplied upper, excluding all batches whose lower is
+        // greater or equal to the supplied upper, and if a batch straddles the
+        // supplied upper it had better be empty.
+
+        // We shouldn't grab a cursor into a closed trace, right?
+        assert!(self.logical_frontier.borrow().len() > 0);
+
+        // Check that `upper` is greater or equal to `self.physical_frontier`.
+        // Otherwise, the cut could be in `self.merging` and it is user error anyhow.
+        assert!(PartialOrder::less_equal(
+            &self.physical_frontier.borrow(),
+            &upper
+        ));
+
+        let mut storage = Vec::new();
+
+        for merge_state in self.merging.iter().rev() {
+            match merge_state {
+                MergeState::Double(variant) => match variant {
+                    MergeVariant::InProgress(batch1, batch2, _, _) => {
+                        if span_len(batch1) > 0 {
+                            storage.push(batch1.clone());
+                        }
+                        if span_len(batch2) > 0 {
+                            storage.push(batch2.clone());
+                        }
+                    }
+                    MergeVariant::Complete(Some((batch, _))) => {
+                        if span_len(batch) > 0 {
+                            storage.push(batch.clone());
+                        }
+                    }
+                    MergeVariant::Complete(None) => {}
+                },
+                MergeState::Single(Some(batch)) => {
+                    if span_len(batch) > 0 {
+                        storage.push(batch.clone());
+                    }
+                }
+                MergeState::Single(None) => {}
+                MergeState::Vacant => {}
+            }
+        }
+
+        for batch in self.pending.iter() {
+            if span_len(batch) > 0 {
+                // For a non-empty `batch`, it is a catastrophic error if `upper`
+                // requires some-but-not-all of the updates in the batch. We can
+                // determine this from `upper` and the lower and upper bounds of
+                // the batch itself.
+                //
+                // TODO: It is not clear if this is the 100% correct logic, due
+                // to the possible non-total-orderedness of the frontiers.
+
+                let include_lower = PartialOrder::less_equal(&batch.lower().borrow(), &upper);
+                let include_upper = PartialOrder::less_equal(&batch.upper().borrow(), &upper);
+
+                if include_lower != include_upper && upper != batch.lower().borrow() {
+                    panic!("`spans_through`: `upper` straddles batch");
+                }
+
+                // include pending batches
+                if include_upper {
+                    storage.push(batch.clone());
+                }
+            }
+        }
+
+        Some(storage)
+    }
+    #[inline]
+    /// Advance the frontier through which update timestamps may be compacted.
+    pub fn set_logical_compaction(&mut self, frontier: AntichainRef<B::Time>) {
+        self.logical_frontier.clear();
+        self.logical_frontier.extend(frontier.iter().cloned());
+    }
+    #[inline]
+    /// Return the current logical compaction frontier.
+    pub fn get_logical_compaction(&self) -> AntichainRef<'_, B::Time> {
+        self.logical_frontier.borrow()
+    }
+    #[inline]
+    /// Advance the frontier through which published batches may be merged.
+    pub fn set_physical_compaction(&mut self, frontier: AntichainRef<'_, B::Time>) {
+        // We should never request to rewind the frontier.
+        debug_assert!(
+            PartialOrder::less_equal(&self.physical_frontier.borrow(), &frontier),
+            "FAIL\tthrough frontier !<= new frontier {:?} {:?}\n",
+            self.physical_frontier,
+            frontier
+        );
+        self.physical_frontier.clear();
+        self.physical_frontier.extend(frontier.iter().cloned());
+        self.consider_merges();
+    }
+    #[inline]
+    /// Return the current physical compaction frontier.
+    pub fn get_physical_compaction(&self) -> AntichainRef<'_, B::Time> {
+        self.physical_frontier.borrow()
+    }
+
+    #[inline]
+    pub fn map_spans<F: FnMut(&Span<B::Time, B>)>(&self, mut f: F) {
+        for batch in self.merging.iter().rev() {
+            match batch {
+                MergeState::Double(MergeVariant::InProgress(batch1, batch2, _, _)) => {
+                    f(batch1);
+                    f(batch2);
+                }
+                MergeState::Double(MergeVariant::Complete(Some((batch, _)))) => f(batch),
+                MergeState::Single(Some(batch)) => f(batch),
+                _ => {}
+            }
+        }
+        for batch in self.pending.iter() {
+            f(batch);
+        }
+    }
+}
+
+impl<B: SpineBatch + Clone + 'static> Spine<B> {
+    /// Construct an empty spine with the default effort multiplier.
+    pub fn new(
+        info: ::timely::dataflow::operators::generic::OperatorInfo,
+        logging: Option<differential_dataflow::logging::Logger>,
+        activator: Option<timely::scheduling::activate::Activator>,
+    ) -> Self {
+        Self::with_effort(1, info, logging, activator)
+    }
+
+    /// Apply some amount of effort to trace maintenance.
+    ///
+    /// Whether and how much effort to apply is determined by `self.exert_logic`, a closure the user can set.
+    pub fn exert(&mut self) {
+        // Finish the old grant before asking policy for another one.
+        if !self.drive_maintenance() {
+            return;
+        }
+        self.consider_merges();
+        if !self.maintenance.is_empty() {
+            return;
+        }
+        self.tidy_layers();
+        if let Some(effort) = self.exert_effort() {
+            if self.merging.iter().any(|b| b.is_double()) {
+                self.queue_fuel(effort.cast_signed());
+            } else {
+                let level = usize::cast_from(effort.next_power_of_two().trailing_zeros());
+                self.queue_introduction(level, false);
+            }
+            if self.drive_maintenance() {
+                self.activate();
+            }
+        }
+    }
+
+    /// Install the owning operator's wakeup before any maintenance can return pending.
+    pub fn set_waker(&mut self, waker: Waker) {
+        self.waker = Some(waker);
+    }
+    /// Whether an earlier maintenance continuation still needs to finish.
+    pub fn maintenance_pending(&self) -> bool {
+        !self.maintenance.is_empty()
+    }
+
+    /// Set the policy that grants maintenance fuel in the absence of new updates.
+    pub fn set_exert_logic(&mut self, logic: ExertionLogic) {
+        self.exert_logic = Some(logic);
+    }
+
+    // Ideally, this method acts as insertion of `span`, even if we are not yet able to begin
+    // merging its batch. This means it is a good time to perform amortized work proportional
+    // to the size of that batch.
+    /// Append a span whose lower frontier equals the current upper frontier.
+    pub fn insert(&mut self, span: Span<B::Time, B>) {
+        // Log the introduction of a batch.
+        self.logger.as_ref().map(|l| {
+            l.log(differential_dataflow::logging::BatchEvent {
+                operator: self.operator.global_id,
+                length: span_len(&span),
+            })
+        });
+
+        assert!(span.lower() != span.upper());
+        assert_eq!(span.lower(), &self.upper);
+
+        self.upper.clone_from(span.upper());
+
+        // TODO: Consolidate or discard spans with no updates.
+        self.pending.push(span);
+        self.consider_merges();
+    }
+
+    /// Completes the trace with a final empty batch.
+    /// Append an update-free span completing the trace.
+    pub fn close(&mut self) {
+        if !self.upper.borrow().is_empty() {
+            self.insert(Span::empty(self.upper.clone(), Antichain::new()));
+        }
+    }
+}
+
+// Drop implementation allows us to log batch drops, to zero out maintained totals.
+impl<B: SpineBatch> Drop for Spine<B> {
+    fn drop(&mut self) {
+        self.drop_batches();
+    }
+}
+
+impl<B: SpineBatch> Spine<B> {
+    /// Drops and logs batches. Used in `set_logical_compaction` and drop.
+    fn drop_batches(&mut self) {
+        if let Some(logger) = &self.logger {
+            for batch in self.merging.drain(..) {
+                match batch {
+                    MergeState::Single(Some(batch)) => {
+                        logger.log(differential_dataflow::logging::DropEvent {
+                            operator: self.operator.global_id,
+                            length: span_len(&batch),
+                        });
+                    }
+                    MergeState::Double(MergeVariant::InProgress(batch1, batch2, _, _)) => {
+                        logger.log(differential_dataflow::logging::DropEvent {
+                            operator: self.operator.global_id,
+                            length: span_len(&batch1),
+                        });
+                        logger.log(differential_dataflow::logging::DropEvent {
+                            operator: self.operator.global_id,
+                            length: span_len(&batch2),
+                        });
+                    }
+                    MergeState::Double(MergeVariant::Complete(Some((batch, _)))) => {
+                        logger.log(differential_dataflow::logging::DropEvent {
+                            operator: self.operator.global_id,
+                            length: span_len(&batch),
+                        });
+                    }
+                    _ => {}
+                }
+            }
+            for batch in self.pending.drain(..) {
+                logger.log(differential_dataflow::logging::DropEvent {
+                    operator: self.operator.global_id,
+                    length: span_len(&batch),
+                });
+            }
+        }
+    }
+}
+
+impl<B: SpineBatch> Spine<B> {
+    fn activate(&self) {
+        if let Some(activator) = &self.activator {
+            activator.activate();
+        } else if let Some(waker) = &self.waker {
+            waker.wake_by_ref();
+        }
+    }
+
+    /// Determine the amount of effort we should exert in the absence of updates.
+    ///
+    /// This method prepares an iterator over batches, including the level, count, and length of each layer.
+    /// It supplies this to `self.exert_logic`, who produces the response of the amount of exertion to apply.
+    fn exert_effort(&mut self) -> Option<usize> {
+        self.exert_logic.as_ref().and_then(|exert_logic| {
+            self.exert_logic_param.clear();
+            self.exert_logic_param
+                .extend(
+                    self.merging
+                        .iter()
+                        .enumerate()
+                        .rev()
+                        .map(|(index, batch)| match batch {
+                            MergeState::Vacant => (index, 0, 0),
+                            MergeState::Single(_) => (index, 1, batch.len()),
+                            MergeState::Double(_) => (index, 2, batch.len()),
+                        }),
+                );
+
+            (exert_logic)(&self.exert_logic_param[..])
+        })
+    }
+
+    /// Allocates a fueled `Spine` with a specified effort multiplier.
+    ///
+    /// This trace will merge batches progressively, with each inserted batch applying a multiple
+    /// of the batch's length in effort to each merge. The `effort` parameter is that multiplier.
+    /// This value should be at least one for the merging to happen; a value of zero is not helpful.
+    pub fn with_effort(
+        mut effort: usize,
+        operator: OperatorInfo,
+        logger: Option<differential_dataflow::logging::Logger>,
+        activator: Option<timely::scheduling::activate::Activator>,
+    ) -> Self {
+        // Zero effort is .. not smart.
+        if effort == 0 {
+            effort = 1;
+        }
+
+        Spine {
+            operator,
+            logger,
+            logical_frontier: Antichain::from_elem(
+                <B::Time as timely::progress::Timestamp>::minimum(),
+            ),
+            physical_frontier: Antichain::from_elem(
+                <B::Time as timely::progress::Timestamp>::minimum(),
+            ),
+            merging: Vec::new(),
+            pending: Vec::new(),
+            upper: Antichain::from_elem(<B::Time as timely::progress::Timestamp>::minimum()),
+            effort,
+            activator,
+            exert_logic_param: Vec::default(),
+            exert_logic: None,
+            maintenance: VecDeque::new(),
+            waker: None,
+        }
+    }
+
+    /// Migrate data from `self.pending` into `self.merging`.
+    ///
+    /// This method reflects on the bookmarks held by others that may prevent merging, and in the
+    /// case that new batches can be introduced to the pile of mergeable batches, it gets on that.
+    #[inline(never)]
+    fn consider_merges(&mut self) {
+        if !self.drive_maintenance() {
+            return;
+        }
+        while !self.pending.is_empty()
+            && PartialOrder::less_equal(self.pending[0].upper(), &self.physical_frontier)
+        {
+            if span_len(&self.pending[0]) == 0 {
+                if let Some(level) = self.merging.iter().position(|m| !m.is_vacant()) {
+                    if self.merging[level].is_single() && self.merging[level].len() == 0 {
+                        let batch = self.pending.remove(0);
+                        self.insert_at(Some(batch), level);
+                        self.maintenance.push_back(Maintenance::FuseEmpty {
+                            level,
+                            remaining: isize::MAX,
+                        });
+                        if !self.drive_maintenance() {
+                            return;
+                        }
+                        continue;
+                    }
+                }
+            }
+            let level = usize::cast_from(
+                span_len(&self.pending[0])
+                    .next_power_of_two()
+                    .trailing_zeros(),
+            );
+            self.queue_introduction(level, true);
+            if !self.drive_maintenance() {
+                return;
+            }
+        }
+        if self.exert_effort().is_some() {
+            self.activate();
+        }
+    }
+
+    fn queue_fuel(&mut self, grant: isize) {
+        self.maintenance.push_back(Maintenance::Fuel {
+            level: 0,
+            grant,
+            remaining: grant,
+        });
+    }
+
+    fn queue_introduction(&mut self, level: usize, pending: bool) {
+        assert!(self.maintenance.is_empty());
+        // Preserve the fueled spine's virtual update accounting, independent of
+        // cancellation and of how many times a read wakes its continuation.
+        self.queue_fuel(((8usize << level) * self.effort).cast_signed());
+        self.maintenance.push_back(Maintenance::RollUp {
+            target: level,
+            next: None,
+            remaining: isize::MAX,
+        });
+        self.maintenance
+            .push_back(Maintenance::Insert { level, pending });
+        self.maintenance.push_back(Maintenance::Tidy);
+    }
+
+    fn drive_maintenance(&mut self) -> bool {
+        let waker = self.waker.clone();
+        let mut cx = Context::from_waker(waker.as_ref().unwrap_or(Waker::noop()));
+        while let Some(mut action) = self.maintenance.pop_front() {
+            let ready = match &mut action {
+                Maintenance::Fuel {
+                    level,
+                    grant,
+                    remaining,
+                } => {
+                    let mut ready = true;
+                    while *level < self.merging.len() {
+                        if self.merging[*level]
+                            .poll_work(&mut cx, remaining)
+                            .is_pending()
+                        {
+                            ready = false;
+                            break;
+                        }
+                        if self.merging[*level].is_complete() {
+                            let complete = self.complete_at(*level);
+                            self.insert_at(complete, *level + 1);
+                        }
+                        *level += 1;
+                        *remaining = *grant;
+                    }
+                    ready
+                }
+                Maintenance::RollUp {
+                    target,
+                    next,
+                    remaining,
+                } => {
+                    while self.merging.len() <= *target {
+                        self.merging.push(MergeState::Vacant);
+                    }
+                    if next.is_none() && self.merging[..*target].iter().any(|m| !m.is_vacant()) {
+                        self.insert_at(None, 0);
+                        *next = Some(0);
+                    }
+                    let mut ready = true;
+                    if let Some(level) = next {
+                        while *level < *target
+                            || (*level == *target && self.merging[*target].is_double())
+                        {
+                            if self.merging[*level]
+                                .poll_work(&mut cx, remaining)
+                                .is_pending()
+                            {
+                                ready = false;
+                                break;
+                            }
+                            // Extraction and installation cannot be separated by a yield.
+                            let complete = self.complete_at(*level);
+                            self.insert_at(complete, *level + 1);
+                            *level += 1;
+                            *remaining = isize::MAX;
+                        }
+                    }
+                    ready
+                }
+                Maintenance::FuseEmpty { level, remaining } => {
+                    if self.merging[*level]
+                        .poll_work(&mut cx, remaining)
+                        .is_pending()
+                    {
+                        false
+                    } else {
+                        let merged = self.complete_at(*level);
+                        self.merging[*level] = MergeState::Single(merged);
+                        true
+                    }
+                }
+                Maintenance::Insert { level, pending } => {
+                    let batch = if *pending {
+                        Some(self.pending.remove(0))
+                    } else {
+                        None
+                    };
+                    self.insert_at(batch, *level);
+                    true
+                }
+                Maintenance::Tidy => {
+                    self.tidy_layers();
+                    true
+                }
+            };
+            if !ready {
+                assert!(
+                    waker.is_some(),
+                    "pending trace maintenance requires a waker"
+                );
+                self.maintenance.push_front(action);
+                return false;
+            }
+        }
+        true
+    }
+
+    /// Inserts a batch at a specific location.
+    ///
+    /// This is a non-public internal method that can panic if we try and insert into a
+    /// layer which already contains two batches (and is still in the process of merging).
+    fn insert_at(&mut self, batch: Option<Span<B::Time, B>>, index: usize) {
+        // Ensure the spine is large enough.
+        while self.merging.len() <= index {
+            self.merging.push(MergeState::Vacant);
+        }
+
+        // Insert the batch at the location.
+        match self.merging[index].take() {
+            MergeState::Vacant => {
+                self.merging[index] = MergeState::Single(batch);
+            }
+            MergeState::Single(old) => {
+                // Log the initiation of a merge.
+                self.logger.as_ref().map(|l| {
+                    l.log(differential_dataflow::logging::MergeEvent {
+                        operator: self.operator.global_id,
+                        scale: index,
+                        length1: old.as_ref().map(span_len).unwrap_or(0),
+                        length2: batch.as_ref().map(span_len).unwrap_or(0),
+                        complete: None,
+                    })
+                });
+                let compaction_frontier = self.logical_frontier.borrow();
+                self.merging[index] = MergeState::begin_merge(old, batch, compaction_frontier);
+            }
+            MergeState::Double(_) => {
+                panic!("Attempted to insert batch into incomplete merge!")
+            }
+        };
+    }
+
+    /// Extract a completed layer, preserving merge-completion logging.
+    fn complete_at(&mut self, index: usize) -> Option<Span<B::Time, B>> {
+        if let Some((merged, inputs)) = self.merging[index].complete() {
+            if let Some((input1, input2)) = inputs {
+                // Log the completion of a merge from existing parts.
+                self.logger.as_ref().map(|l| {
+                    l.log(differential_dataflow::logging::MergeEvent {
+                        operator: self.operator.global_id,
+                        scale: index,
+                        length1: span_len(&input1),
+                        length2: span_len(&input2),
+                        complete: Some(span_len(&merged)),
+                    })
+                });
+            }
+            Some(merged)
+        } else {
+            None
+        }
+    }
+
+    /// Attempts to draw down large layers to size appropriate layers.
+    fn tidy_layers(&mut self) {
+        // If the largest layer is complete (not merging), we can attempt
+        // to draw it down to the next layer. This is permitted if we can
+        // maintain our invariant that below each merge there are at most
+        // half the records that would be required to invade the merge.
+        if !self.merging.is_empty() {
+            let mut length = self.merging.len();
+            if self.merging[length - 1].is_single() {
+                // To move a batch down, we require that it contain few
+                // enough records that the lower level is appropriate,
+                // and that moving the batch would not create a merge
+                // violating our invariant.
+
+                let appropriate_level = usize::cast_from(
+                    self.merging[length - 1]
+                        .len()
+                        .next_power_of_two()
+                        .trailing_zeros(),
+                );
+
+                // Continue only as far as is appropriate
+                while appropriate_level < length - 1 {
+                    match self.merging[length - 2].take() {
+                        // Vacant or structurally empty batches can be absorbed.
+                        MergeState::Vacant | MergeState::Single(None) => {
+                            self.merging.remove(length - 2);
+                            length = self.merging.len();
+                        }
+                        // Single batches may initiate a merge, if sizes are
+                        // within bounds, but terminate the loop either way.
+                        MergeState::Single(Some(batch)) => {
+                            // Determine the number of records that might lead
+                            // to a merge. Importantly, this is not the number
+                            // of actual records, but the sum of upper bounds
+                            // based on indices.
+                            let mut smaller = 0;
+                            for (index, batch) in self.merging[..(length - 2)].iter().enumerate() {
+                                match batch {
+                                    MergeState::Vacant => {}
+                                    MergeState::Single(_) => {
+                                        smaller += 1 << index;
+                                    }
+                                    MergeState::Double(_) => {
+                                        smaller += 2 << index;
+                                    }
+                                }
+                            }
+
+                            if smaller <= (1 << length) / 8 {
+                                self.merging.remove(length - 2);
+                                self.insert_at(Some(batch), length - 2);
+                            } else {
+                                self.merging[length - 2] = MergeState::Single(Some(batch));
+                            }
+                            return;
+                        }
+                        // If a merge is in progress there is nothing to do.
+                        MergeState::Double(state) => {
+                            self.merging[length - 2] = MergeState::Double(state);
+                            return;
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Describes the state of a layer.
+///
+/// A layer can be empty, contain a single span, or contain a pair of spans
+/// that are in the process of merging into a span for the next layer.
+///
+/// Note the two distinct kinds of nothing here: `Single(None)` is a *structural*
+/// absence, a stand-in for virtual updates with no description at all, used for
+/// fuel bookkeeping; a present span carrying no batch is a *recorded* update-free
+/// interval of time, with a real description.
+enum MergeState<B: SpineBatch> {
+    /// An empty layer, containing no updates.
+    Vacant,
+    /// A layer containing a single span.
+    ///
+    /// The `None` variant is used to represent a structurally empty layer present
+    /// to ensure the progress of maintenance work.
+    Single(Option<Span<B::Time, B>>),
+    /// A layer containing two spans, in the process of merging.
+    Double(MergeVariant<B>),
+}
+
+impl<B: SpineBatch> MergeState<B> {
+    /// The number of actual updates contained in the level.
+    fn len(&self) -> usize {
+        match self {
+            MergeState::Single(Some(b)) => span_len(b),
+            MergeState::Double(MergeVariant::InProgress(b1, b2, _, _)) => {
+                span_len(b1) + span_len(b2)
+            }
+            MergeState::Double(MergeVariant::Complete(Some((b, _)))) => span_len(b),
+            _ => 0,
+        }
+    }
+
+    /// True only for the MergeState::Vacant variant.
+    fn is_vacant(&self) -> bool {
+        if let MergeState::Vacant = self {
+            true
+        } else {
+            false
+        }
+    }
+
+    /// True only for the MergeState::Single variant.
+    fn is_single(&self) -> bool {
+        if let MergeState::Single(_) = self {
+            true
+        } else {
+            false
+        }
+    }
+
+    /// True only for the MergeState::Double variant.
+    fn is_double(&self) -> bool {
+        if let MergeState::Double(_) = self {
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Extract a completed merge or a single span.
+    ///
+    /// The result is either a batch, if there is a non-trivial batch to return
+    /// or `None` if there is no meaningful batch to return. This does not distinguish
+    /// between Vacant entries and structurally empty batches, which should be done
+    /// with the `is_complete()` method.
+    ///
+    /// There is the additional option of input batches.
+    fn complete(
+        &mut self,
+    ) -> Option<(
+        Span<B::Time, B>,
+        Option<(Span<B::Time, B>, Span<B::Time, B>)>,
+    )> {
+        match std::mem::replace(self, MergeState::Vacant) {
+            MergeState::Vacant => None,
+            MergeState::Single(batch) => batch.map(|b| (b, None)),
+            MergeState::Double(variant) => variant.complete(),
+        }
+    }
+
+    /// True iff the layer is a complete merge, ready for extraction.
+    fn is_complete(&self) -> bool {
+        if let MergeState::Double(MergeVariant::Complete(_)) = self {
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Performs a bounded amount of work towards a merge.
+    ///
+    /// If the merge completes, the resulting batch is returned.
+    /// If a batch is returned, it is the obligation of the caller
+    /// to correctly install the result.
+    fn poll_work(&mut self, cx: &mut Context<'_>, fuel: &mut isize) -> Poll<()> {
+        if let MergeState::Double(layer) = self {
+            layer.poll_work(cx, fuel)
+        } else {
+            Poll::Ready(())
+        }
+    }
+
+    /// Extract the merge state, typically temporarily.
+    fn take(&mut self) -> Self {
+        std::mem::replace(self, MergeState::Vacant)
+    }
+
+    /// Initiates the merge of an "old" batch with a "new" batch.
+    ///
+    /// The upper frontier of the old batch should match the lower
+    /// frontier of the new batch, with the resulting batch describing
+    /// their composed interval, from the lower frontier of the old
+    /// batch to the upper frontier of the new batch.
+    ///
+    /// Either batch may be `None` which corresponds to a structurally
+    /// empty batch whose upper and lower frontiers are equal. This
+    /// option exists purely for bookkeeping purposes, and no computation
+    /// is performed to merge the two batches.
+    fn begin_merge(
+        batch1: Option<Span<B::Time, B>>,
+        batch2: Option<Span<B::Time, B>>,
+        compaction_frontier: AntichainRef<B::Time>,
+    ) -> MergeState<B> {
+        let variant = match (batch1, batch2) {
+            (Some(batch1), Some(batch2)) => {
+                assert!(batch1.upper() == batch2.lower());
+                let since = batch1
+                    .desc
+                    .since()
+                    .join(batch2.desc.since())
+                    .join(&compaction_frontier.to_owned());
+                let description =
+                    Description::new(batch1.lower().clone(), batch2.upper().clone(), since);
+                match (&batch1.inner, &batch2.inner) {
+                    (Some(source1), Some(source2)) => {
+                        let merger = B::Merger::new(source1, source2, description.since().borrow());
+                        MergeVariant::InProgress(batch1, batch2, description, merger)
+                    }
+                    // With at most one side carrying updates there is nothing to merge, and the
+                    // surviving updates' times are not advanced by the compaction frontier.
+                    _ => {
+                        let inner = batch1.inner.or(batch2.inner);
+                        MergeVariant::Complete(Some((Span::new(description, inner), None)))
+                    }
+                }
+            }
+            (None, Some(x)) => MergeVariant::Complete(Some((x, None))),
+            (Some(x), None) => MergeVariant::Complete(Some((x, None))),
+            (None, None) => MergeVariant::Complete(None),
+        };
+
+        MergeState::Double(variant)
+    }
+}
+
+enum MergeVariant<B: SpineBatch> {
+    /// Describes an actual in-progress merge between two non-trivial batches.
+    ///
+    /// Beyond the two source batches, this records the description their merge
+    /// will bear (their composed interval, with the compaction frontier as its
+    /// `since`) and the merger itself.
+    InProgress(
+        Span<B::Time, B>,
+        Span<B::Time, B>,
+        Description<B::Time>,
+        B::Merger,
+    ),
+    /// A merge that requires no further work. May or may not represent a non-trivial batch.
+    Complete(
+        Option<(
+            Span<B::Time, B>,
+            Option<(Span<B::Time, B>, Span<B::Time, B>)>,
+        )>,
+    ),
+}
+
+impl<B: SpineBatch> MergeVariant<B> {
+    /// Extract a completed batch, unless structurally empty.
+    ///
+    /// The result is either `None`, for structurally empty batches,
+    /// or a batch and optionally input batches from which it derived.
+    fn complete(
+        self,
+    ) -> Option<(
+        Span<B::Time, B>,
+        Option<(Span<B::Time, B>, Span<B::Time, B>)>,
+    )> {
+        if let MergeVariant::Complete(batch) = self {
+            batch
+        } else {
+            panic!("Failed to complete a merge!");
+        }
+    }
+
+    /// Applies some amount of work, potentially completing the merge.
+    ///
+    /// In case the work completes, the source batches are returned.
+    /// This allows the caller to manage the released resources.
+    fn poll_work(&mut self, cx: &mut Context<'_>, fuel: &mut isize) -> Poll<()> {
+        if let MergeVariant::InProgress(b1, b2, _, merge) = self {
+            match merge.poll_work(
+                b1.inner.as_ref().unwrap(),
+                b2.inner.as_ref().unwrap(),
+                cx,
+                fuel,
+            ) {
+                Poll::Pending => return Poll::Pending,
+                Poll::Ready(MergeStatus::InProgress) => return Poll::Ready(()),
+                Poll::Ready(MergeStatus::Complete) => {}
+            }
+            if let MergeVariant::InProgress(b1, b2, description, merge) =
+                std::mem::replace(self, MergeVariant::Complete(None))
+            {
+                let inner = merge.done();
+                *self =
+                    MergeVariant::Complete(Some((Span::new(description, inner), Some((b1, b2)))));
+            }
+        }
+        Poll::Ready(())
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests.rs
new file mode 100644
index 0000000000000..4a7053f123c7f
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests.rs
@@ -0,0 +1,6 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See LICENSE.
+
+mod chunk;
+mod spine;
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs
new file mode 100644
index 0000000000000..8055d880abb94
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs
@@ -0,0 +1,211 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See ../LICENSE.
+
+use std::collections::VecDeque;
+use std::task::{Context, Poll, Waker};
+
+use super::super::batcher::Merger as ChainMerger;
+use super::super::chunk::{Chunk, ChunkBatch, ChunkBatchMerger, ChunkMerger};
+use super::super::spine::{MergeStatus, Merger};
+use differential_dataflow::trace::chunk::{Chunk as MzChunk, vec::VecChunk};
+use differential_dataflow::trace::{Cursor, Navigable};
+use timely::container::PushInto;
+use timely::progress::{Antichain, frontier::AntichainRef};
+
+type Inner = VecChunk<u64, (), u64, i64>;
+#[derive(Clone, Default)]
+struct Delayed(Inner);
+#[derive(Default)]
+struct Pending {
+    operation: Option<&'static str>,
+}
+impl Pending {
+    // Complete the primitive's mutation before suspending. Its input may now be
+    // empty, but the driver must still poll the same primitive to completion.
+    fn poll(&mut self, operation: &'static str, cx: &Context<'_>, work: impl FnOnce()) -> Poll<()> {
+        if let Some(saved) = self.operation.take() {
+            assert_eq!(saved, operation, "resumed a different primitive");
+            Poll::Ready(())
+        } else {
+            work();
+            self.operation = Some(operation);
+            cx.waker().wake_by_ref();
+            Poll::Pending
+        }
+    }
+}
+fn raw(queue: &mut VecDeque<Delayed>) -> VecDeque<Inner> {
+    queue.drain(..).map(|c| c.0).collect()
+}
+fn restore(queue: &mut VecDeque<Delayed>, chunks: VecDeque<Inner>) {
+    queue.extend(chunks.into_iter().map(Delayed));
+}
+impl Chunk for Delayed {
+    type Time = u64;
+    type Pending = Pending;
+    const TARGET: usize = Inner::TARGET;
+    fn len(&self) -> usize {
+        self.0.len()
+    }
+    fn merge(a: &mut VecDeque<Self>, b: &mut VecDeque<Self>, out: &mut VecDeque<Self>) {
+        let (mut aa, mut bb, mut result) = (raw(a), raw(b), VecDeque::new());
+        Inner::merge(&mut aa, &mut bb, &mut result);
+        restore(a, aa);
+        restore(b, bb);
+        restore(out, result);
+    }
+    fn advance(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<u64>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) {
+        let (mut aa, mut result) = (raw(input), VecDeque::new());
+        Inner::advance(&mut aa, frontier, done, &mut result);
+        restore(input, aa);
+        restore(out, result);
+    }
+    fn extract(
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<u64>,
+        residual: &mut Antichain<u64>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) {
+        let (mut aa, mut kept, mut shipped) = (raw(input), VecDeque::new(), VecDeque::new());
+        Inner::extract(&mut aa, frontier, residual, &mut kept, &mut shipped);
+        restore(input, aa);
+        restore(keep, kept);
+        restore(ship, shipped);
+    }
+    fn settle(input: &mut VecDeque<Self>, done: bool, out: &mut VecDeque<Self>) {
+        let (mut aa, mut result) = (raw(input), VecDeque::new());
+        Inner::settle(&mut aa, done, &mut result);
+        restore(input, aa);
+        restore(out, result);
+    }
+    fn poll_merge(
+        state: &mut Pending,
+        cx: &mut Context<'_>,
+        a: &mut VecDeque<Self>,
+        b: &mut VecDeque<Self>,
+        out: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        state.poll("merge", cx, || Self::merge(a, b, out))
+    }
+    fn poll_advance(
+        state: &mut Pending,
+        cx: &mut Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<u64>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        state.poll("advance", cx, || Self::advance(input, frontier, done, out))
+    }
+    fn poll_extract(
+        state: &mut Pending,
+        cx: &mut Context<'_>,
+        input: &mut VecDeque<Self>,
+        frontier: AntichainRef<u64>,
+        residual: &mut Antichain<u64>,
+        keep: &mut VecDeque<Self>,
+        ship: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        state.poll("extract", cx, || {
+            Self::extract(input, frontier, residual, keep, ship)
+        })
+    }
+    fn poll_settle(
+        state: &mut Pending,
+        cx: &mut Context<'_>,
+        input: &mut VecDeque<Self>,
+        done: bool,
+        out: &mut VecDeque<Self>,
+    ) -> Poll<()> {
+        state.poll("settle", cx, || Self::settle(input, done, out))
+    }
+}
+fn chunk(rows: &[(u64, u64, i64)]) -> Delayed {
+    let mut chunk = Inner::default();
+    for &(key, time, diff) in rows {
+        chunk.push_into(((key, ()), time, diff));
+    }
+    Delayed(chunk)
+}
+fn rows(chunks: &[Delayed]) -> Vec<((u64, ()), u64, i64)> {
+    let mut rows = Vec::new();
+    for Delayed(chunk) in chunks {
+        let mut cursor = chunk.cursor();
+        while cursor.key_valid(chunk) {
+            let key = *cursor.key(chunk);
+            cursor.map_times(chunk, |time, diff| rows.push(((key, ()), *time, *diff)));
+            cursor.step_key(chunk);
+        }
+    }
+    rows
+}
+
+fn finish(mut poll: impl FnMut(&mut Context<'_>) -> Poll<()>) {
+    let mut cx = Context::from_waker(Waker::noop());
+    for _ in 0..1000 {
+        if poll(&mut cx).is_ready() {
+            return;
+        }
+    }
+    panic!("chunk operation did not complete");
+}
+#[mz_ore::test]
+fn batch_merge_resumes_each_phase_after_consuming_input() {
+    let a = ChunkBatch {
+        chunks: vec![chunk(&[(0, 0, 1), (1, 0, 2)]), chunk(&[(2, 0, 1)])],
+    };
+    let b = ChunkBatch {
+        chunks: vec![chunk(&[(0, 1, -1), (1, 1, 3)]), chunk(&[(3, 1, 1)])],
+    };
+    let mut merge = ChunkBatchMerger::new(&a, &b, Antichain::from_elem(2).borrow());
+    let mut fuel = 1;
+    let mut yields = 0;
+    finish(|cx| match merge.poll_work(&a, &b, cx, &mut fuel) {
+        Poll::Pending => {
+            yields += 1;
+            Poll::Pending
+        }
+        Poll::Ready(MergeStatus::InProgress) => {
+            assert!(fuel <= 0);
+            fuel = 1;
+            Poll::Pending
+        }
+        Poll::Ready(MergeStatus::Complete) => Poll::Ready(()),
+    });
+    assert!(yields >= 3);
+    assert_eq!(
+        rows(&merge.done().unwrap().chunks),
+        vec![((1, ()), 2, 5), ((2, ()), 2, 1), ((3, ()), 2, 1)]
+    );
+}
+#[mz_ore::test]
+fn chain_merge_and_extraction_resume_before_reusing_state() {
+    let mut a = vec![chunk(&[(0, 0, 1), (1, 3, 1)])];
+    let mut b = vec![chunk(&[(0, 0, -1), (2, 1, 1)])];
+    let mut merger = ChunkMerger::<Delayed>::default();
+    let (mut merged, mut stash) = (Vec::new(), Vec::new());
+    finish(|cx| merger.poll_merge(&mut a, &mut b, &mut merged, &mut stash, cx));
+    assert_eq!(rows(&merged), vec![((1, ()), 3, 1), ((2, ()), 1, 1)]);
+    let (mut ship, mut kept, mut frontier) = (Vec::new(), Vec::new(), Antichain::new());
+    finish(|cx| {
+        merger.poll_extract(
+            &mut merged,
+            Antichain::from_elem(2).borrow(),
+            &mut frontier,
+            &mut ship,
+            &mut kept,
+            &mut stash,
+            cx,
+        )
+    });
+    assert_eq!(rows(&ship), vec![((2, ()), 1, 1)]);
+    assert_eq!(rows(&kept), vec![((1, ()), 3, 1)]);
+    assert_eq!(frontier, Antichain::from_elem(3));
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
new file mode 100644
index 0000000000000..f1b22bda55e97
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -0,0 +1,157 @@
+// Copyright (c) 2015 Frank McSherry
+// SPDX-License-Identifier: MIT
+// See ../LICENSE.
+
+use super::super::spine::Span;
+use super::super::spine::{MergeStatus, Merger, Spine, SpineBatch};
+use differential_dataflow::trace::Description;
+use std::sync::{Arc, Mutex};
+use std::task::{Context, Poll, Wake, Waker};
+use timely::dataflow::operators::generic::OperatorInfo;
+use timely::progress::{Antichain, frontier::AntichainRef};
+
+#[derive(Default)]
+struct Gate {
+    permits: usize,
+    waker: Option<Waker>,
+    polls: usize,
+}
+struct WakeCount(std::sync::atomic::AtomicUsize);
+impl Wake for WakeCount {
+    fn wake(self: Arc<Self>) {
+        self.wake_by_ref();
+    }
+    fn wake_by_ref(self: &Arc<Self>) {
+        self.0.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    }
+}
+#[derive(Clone)]
+struct Batch {
+    rows: Vec<(u64, u64, i64)>,
+    gate: Arc<Mutex<Gate>>,
+}
+impl SpineBatch for Batch {
+    type Time = u64;
+    type Merger = Merge;
+    fn len(&self) -> usize {
+        self.rows.len()
+    }
+}
+struct Merge {
+    rows: Vec<(u64, u64, i64)>,
+    position: usize,
+    since: u64,
+    gate: Arc<Mutex<Gate>>,
+}
+impl Merger<Batch> for Merge {
+    fn new(a: &Batch, b: &Batch, since: AntichainRef<u64>) -> Self {
+        Self {
+            rows: a.rows.iter().chain(&b.rows).cloned().collect(),
+            position: 0,
+            since: since.first().copied().unwrap_or(0),
+            gate: Arc::clone(&a.gate),
+        }
+    }
+    fn poll_work(
+        &mut self,
+        _: &Batch,
+        _: &Batch,
+        cx: &mut Context<'_>,
+        fuel: &mut isize,
+    ) -> Poll<MergeStatus> {
+        while self.position < self.rows.len() && *fuel > 0 {
+            let mut gate = self.gate.lock().unwrap();
+            gate.polls += 1;
+            if gate.permits == 0 {
+                gate.waker = Some(cx.waker().clone());
+                return Poll::Pending;
+            }
+            gate.permits -= 1;
+            self.rows[self.position].1 = self.rows[self.position].1.max(self.since);
+            self.position += 1;
+            *fuel -= 1;
+        }
+        Poll::Ready(if self.position == self.rows.len() {
+            MergeStatus::Complete
+        } else {
+            MergeStatus::InProgress
+        })
+    }
+    fn done(mut self) -> Option<Batch> {
+        assert_eq!(
+            self.position,
+            self.rows.len(),
+            "extracted an incomplete merge"
+        );
+        differential_dataflow::consolidation::consolidate_updates(&mut self.rows);
+        (!self.rows.is_empty()).then_some(Batch {
+            rows: self.rows,
+            gate: self.gate,
+        })
+    }
+}
+fn contents(trace: &Spine<Batch>) -> Vec<(u64, u64, i64)> {
+    let mut rows = Vec::new();
+    trace.map_spans(|span| {
+        if let Some(batch) = &span.inner {
+            rows.extend_from_slice(&batch.rows);
+        }
+    });
+    differential_dataflow::consolidation::consolidate_updates(&mut rows);
+    rows
+}
+fn drive(trace: &mut Spine<Batch>, gate: &Mutex<Gate>, expected: &[(u64, u64, i64)]) {
+    for _ in 0..200_000 {
+        assert_eq!(
+            contents(trace),
+            expected,
+            "published contents changed while suspended"
+        );
+        if !trace.maintenance_pending() {
+            return;
+        }
+        let wake = {
+            let mut g = gate.lock().unwrap();
+            g.permits += 3;
+            g.waker.take()
+        };
+        if let Some(wake) = wake {
+            wake.wake();
+        }
+        trace.exert();
+    }
+    panic!("maintenance failed to resume");
+}
+#[mz_ore::test]
+fn pending_reads_preserve_rollup_and_every_published_update() {
+    let gate = Arc::new(Mutex::new(Gate::default()));
+    let wake = Arc::new(WakeCount(std::sync::atomic::AtomicUsize::new(0)));
+    let mut trace = Spine::new(OperatorInfo::new(0, 0, [].into()), None, None);
+    trace.set_waker(Arc::clone(&wake).into());
+    let mut expected = Vec::new();
+    for time in 0..70u64 {
+        let count = [1, 1, 2, 1, 32, 3, 1, 128, 2, 7][usize::try_from(time % 10).unwrap()];
+        let rows = (0..count).map(|key| (key, time, 1)).collect::<Vec<_>>();
+        expected.extend_from_slice(&rows);
+        differential_dataflow::consolidation::consolidate_updates(&mut expected);
+        trace.insert(Span::new(
+            Description::new(
+                Antichain::from_elem(time),
+                Antichain::from_elem(time + 1),
+                Antichain::from_elem(0),
+            ),
+            Some(Batch {
+                rows,
+                gate: Arc::clone(&gate),
+            }),
+        ));
+        trace.set_physical_compaction(Antichain::from_elem(time + 1).borrow());
+        assert_eq!(contents(&trace), expected);
+        // Some arrivals deliberately queue behind an earlier blocked introduction.
+        if time % 5 == 4 {
+            drive(&mut trace, &gate, &expected);
+        }
+    }
+    drive(&mut trace, &gate, &expected);
+    assert!(wake.0.load(std::sync::atomic::Ordering::Relaxed) > 0);
+}

From d55eddf15e1f20b6707ce7fdca5be8039d120fc7 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 15:02:42 -0400
Subject: [PATCH 13/31] timely-util: restore vendored chunk documentation

---
 .../src/columnar/chunk/native/vendor.rs       |  3 +-
 .../src/columnar/chunk/native/vendor/chunk.rs | 38 +++++++++++++++++--
 .../src/columnar/chunk/native/vendor/spine.rs |  1 -
 3 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/native/vendor.rs b/src/timely-util/src/columnar/chunk/native/vendor.rs
index 5ddda26d2330b..07d6bebd733b3 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor.rs
@@ -7,7 +7,8 @@
 //! Source: `TimelyDataflow/differential-dataflow`, upstream base
 //! `626c80ce`, with the local async changes at `339f01522823171f2a8c710967502f3e1d09360b`.
 //! The source files are `trace/implementations/spine_fueled.rs`,
-//! `trace/chunk/mod.rs`, and `batcher/{mod.rs,merge/mod.rs}`.
+//! `trace/chunk/mod.rs`, and `batcher/{mod.rs,merge/mod.rs}`. The `Span` type
+//! comes from `trace/mod.rs`.
 //!
 //! This copy uses MZ's existing Differential and Timely dependencies for timestamps,
 //! lattices, descriptions, and logging. The enclosing adapter implements DD's trace
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs b/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
index 55c5db768e7ae..cdbcb5537fc3e 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
@@ -2,11 +2,41 @@
 // SPDX-License-Identifier: MIT
 // See LICENSE in this directory.
 
-//! Sorted chunk operations, resumable merge pipelines, and batch assembly.
+//! Sorted, consolidated runs of updates, and operators over sequences of them.
 //!
-//! The storage backend implements [`Chunk`]. [`ChunkMerger`] drives batch formation,
-//! while [`ChunkBatchMerger`] merges published batches and advances their timestamps.
-//! Both retain their current pipeline phase across a pending storage operation.
+//! A [`Chunk`] is a consolidated, sorted run of `(data, time, diff)` updates.
+//! A sequence of chunks is also expected to be consolidated and sorted.
+//!
+//! The [`Chunk`] trait exposes whole-chunk operations, so that the implementor can internally divert to their best implementations, with amortized overhead.
+//! Each operation is invoked as if "streaming", providing input and output queues.
+//! An implementor is expected to drain as much as possible of the inputs, and any chunk written to the output is "committed" and likely to be shipped onward.
+//!
+//! # Wiring a `Chunk` into an arrangement
+//!
+//! Implementing [`Chunk`] for a type `C` is the only bespoke code needed; three aliases then expand into a full trace:
+//!
+//! * [`ChunkBatcher<Chu, C>`](ChunkBatcher): the merge batcher.
+//! * [`ChunkBuilder<C>`](ChunkBuilder): the batch builder.
+//! * [`ChunkSpine<C>`](ChunkSpine): the trace, a spine of `Rc`-shared batches.
+//!
+//! These aliases use [`ChunkBatch`], [`ChunkMerger`], [`ChunkBatchMerger`], and [`ChunkBatchBuilder`] for batch formation and trace maintenance.
+//!
+//! In this vendored module, the enclosing Materialize adapter supplies the trace
+//! interfaces. Differential's arrangement wiring, reference chunk backend, and
+//! cursor implementations are not included here.
+//!
+//! # Bounded footprint
+//!
+//! There is a `TARGET` associated constant that signals the intended chunk size.
+//! The constant should be chosen large enough to amortize overheads, but small enough that per-chunk work does not "stall" the system when invoked.
+//! The implementor is trusted to make a reasonable choice here.
+//!
+//! The [`Chunk::settle`] method "settles" sequences of chunks, and is called as chunks are no longer expected to be needed in the near future.
+//! The implementor should ensure the chunks are "graded", in that the sequence of chunks are all at most `TARGET` in size, any two in order sum to strictly more than `TARGET`.
+//! This is also an opportunity to compress data, or spill to disk or cloud storage.
+//!
+//! Producers settle their committed output as they go, keeping the active, unsettled chunk set small.
+//! Implementors must keep [`len`](Chunk::len) cheap even when a chunk's body is paged out.
 
 use std::collections::VecDeque;
 
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index e50e57ccf188d..65daee2d33c7c 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -506,7 +506,6 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
     }
 
     /// Completes the trace with a final empty batch.
-    /// Append an update-free span completing the trace.
     pub fn close(&mut self) {
         if !self.upper.borrow().is_empty() {
             self.insert(Span::empty(self.upper.clone(), Antichain::new()));

From 09ed476925278025aed3aa35df08fa07e5d5fd10 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Wed, 9 Sep 2026 15:26:26 -0400
Subject: [PATCH 14/31] timely-util: consume DD async APIs and vendor only the
 spine

---
 Cargo.lock                                    | 187 ++--
 Cargo.toml                                    |   2 +
 deny.toml                                     |  13 +
 src/timely-util/Cargo.toml                    |   2 +
 src/timely-util/src/columnar/chunk/native.rs  |  82 +-
 .../src/columnar/chunk/native/pool_chunk.rs   |  96 ++-
 .../src/columnar/chunk/native/timestamp.rs    | 135 +++
 .../src/columnar/chunk/native/vendor.rs       |  23 +-
 .../columnar/chunk/native/vendor/batcher.rs   | 451 ----------
 .../src/columnar/chunk/native/vendor/chunk.rs | 812 ------------------
 .../src/columnar/chunk/native/vendor/spine.rs | 204 +----
 .../src/columnar/chunk/native/vendor/tests.rs |   1 -
 .../chunk/native/vendor/tests/chunk.rs        | 211 -----
 .../chunk/native/vendor/tests/spine.rs        |  29 +-
 14 files changed, 449 insertions(+), 1799 deletions(-)
 create mode 100644 src/timely-util/src/columnar/chunk/native/timestamp.rs
 delete mode 100644 src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
 delete mode 100644 src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
 delete mode 100644 src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs

diff --git a/Cargo.lock b/Cargo.lock
index 3cae880092d6e..61c3c479be3e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3324,7 +3324,21 @@ dependencies = [
  "paste",
  "serde",
  "smallvec",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "differential-dataflow"
+version = "0.25.1"
+source = "git+https://github.com/DAlperin/differential-dataflow?rev=3659671246e0b5635a8128cc27d65f12ecf7dda5#3659671246e0b5635a8128cc27d65f12ecf7dda5"
+dependencies = [
+ "columnar",
+ "columnation",
+ "fnv",
+ "paste",
+ "serde",
+ "smallvec",
+ "timely 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
 ]
 
 [[package]]
@@ -3333,9 +3347,9 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52c9eee4acc936da45f096424617c91df981c619a92f3f8b4b2a324db7969b34"
 dependencies = [
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "serde",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
@@ -6326,7 +6340,7 @@ dependencies = [
  "datadriven",
  "dec",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "enum-kinds",
  "fail",
  "futures",
@@ -6398,7 +6412,7 @@ dependencies = [
  "smallvec",
  "static_assertions",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-postgres",
  "tokio-stream",
@@ -6422,7 +6436,7 @@ dependencies = [
  "mz-storage-types",
  "serde",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
@@ -6668,7 +6682,7 @@ dependencies = [
  "bytesize",
  "chrono",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "insta",
  "ipnet",
@@ -6713,7 +6727,7 @@ dependencies = [
  "sha2 0.10.9",
  "static_assertions",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -6844,7 +6858,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "lgalloc",
  "mz-cluster-client",
@@ -6852,7 +6866,7 @@ dependencies = [
  "mz-service",
  "rand 0.9.4",
  "regex",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -6884,7 +6898,7 @@ dependencies = [
  "mz-dyncfg",
  "mz-ore",
  "mz-repr",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
 ]
@@ -6948,7 +6962,7 @@ dependencies = [
  "mz-transform",
  "serde",
  "tempfile",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -6967,7 +6981,7 @@ dependencies = [
  "core_affinity",
  "criterion",
  "dec",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "differential-dogs3",
  "fail",
  "futures",
@@ -7002,7 +7016,7 @@ dependencies = [
  "serde",
  "smallvec",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -7018,7 +7032,7 @@ dependencies = [
  "bytesize",
  "chrono",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "mz-build-info",
  "mz-cluster-client",
@@ -7039,7 +7053,7 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -7052,7 +7066,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "columnar",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "fail",
  "itertools 0.14.0",
  "mz-dyncfg",
@@ -7064,7 +7078,7 @@ dependencies = [
  "serde",
  "serde-reflection",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tracing",
 ]
 
@@ -7095,7 +7109,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -7200,11 +7214,11 @@ dependencies = [
 name = "mz-durable-cache"
 version = "0.0.0"
 dependencies = [
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "mz-ore",
  "mz-persist-client",
  "mz-persist-types",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
 ]
@@ -7377,7 +7391,7 @@ dependencies = [
  "sysctl",
  "tempfile",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-metrics",
  "tokio-postgres",
@@ -7588,7 +7602,7 @@ dependencies = [
  "chrono",
  "clap",
  "criterion",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "itertools 0.14.0",
  "maplit",
  "mz-avro",
@@ -7605,7 +7619,7 @@ dependencies = [
  "seahash",
  "serde",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -7936,7 +7950,7 @@ dependencies = [
  "criterion",
  "ctor",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "either",
  "futures",
  "hibitset",
@@ -8023,7 +8037,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "deadpool-postgres",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "fail",
  "futures-util",
  "itertools 0.14.0",
@@ -8049,7 +8063,7 @@ dependencies = [
  "sha2 0.10.9",
  "tempfile",
  "time",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-postgres",
  "tracing",
@@ -8072,7 +8086,7 @@ dependencies = [
  "clap",
  "criterion",
  "datadriven",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "futures-task",
  "futures-util",
@@ -8099,7 +8113,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-metrics",
  "tokio-stream",
@@ -8409,7 +8423,7 @@ dependencies = [
  "compact_bytes",
  "criterion",
  "dec",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "enum-kinds",
  "hex",
  "insta",
@@ -8442,7 +8456,7 @@ dependencies = [
  "static_assertions",
  "strsim",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio-postgres",
  "tracing",
  "tracing-core",
@@ -8487,11 +8501,11 @@ dependencies = [
  "ahash 0.8.12",
  "columnar",
  "columnation",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "mz-ore",
  "mz-repr",
  "mz-timely-util",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
@@ -8754,7 +8768,7 @@ dependencies = [
  "static_assertions",
  "thiserror 2.0.18",
  "tiberius",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -8852,7 +8866,7 @@ dependencies = [
  "columnation",
  "crossbeam-channel",
  "dec",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "fail",
  "futures",
  "humantime",
@@ -8910,7 +8924,7 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.18",
  "tiberius",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-postgres",
  "tokio-stream",
@@ -8928,7 +8942,7 @@ dependencies = [
  "aws-sdk-glue",
  "aws-smithy-mocks",
  "chrono",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "itertools 0.14.0",
  "mz-aws-glue-schema-registry",
@@ -8952,7 +8966,7 @@ dependencies = [
  "serde",
  "serde_json",
  "smallvec",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -8966,7 +8980,7 @@ dependencies = [
  "async-trait",
  "chrono",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "itertools 0.14.0",
  "mz-build-info",
@@ -8984,7 +8998,7 @@ dependencies = [
  "mz-timely-util",
  "mz-txn-wal",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -9009,7 +9023,7 @@ dependencies = [
  "columnation",
  "csv-async",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "glob",
  "http 1.4.2",
@@ -9034,7 +9048,7 @@ dependencies = [
  "serde",
  "smallvec",
  "thiserror 2.0.18",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-util",
  "tracing",
@@ -9062,7 +9076,7 @@ dependencies = [
  "csv-core",
  "dec",
  "derivative",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "gcp_auth",
  "hex",
  "http 1.4.2",
@@ -9114,7 +9128,7 @@ dependencies = [
  "serde_json",
  "thiserror 2.0.18",
  "tiberius",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tokio-postgres",
  "tracing",
@@ -9224,7 +9238,8 @@ dependencies = [
  "columnar",
  "columnation",
  "criterion",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "differential-dataflow 0.25.1 (git+https://github.com/DAlperin/differential-dataflow?rev=3659671246e0b5635a8128cc27d65f12ecf7dda5)",
  "futures-util",
  "itertools 0.14.0",
  "lz4_flex 0.12.1",
@@ -9235,7 +9250,8 @@ dependencies = [
  "serde",
  "smallvec",
  "tempfile",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
  "tokio",
  "tracing",
  "uuid",
@@ -9290,7 +9306,7 @@ name = "mz-transform"
 version = "0.0.0"
 dependencies = [
  "datadriven",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "enum-kinds",
  "fail",
  "itertools 0.14.0",
@@ -9315,7 +9331,7 @@ version = "0.0.0"
 dependencies = [
  "bytes",
  "crossbeam-channel",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "itertools 0.14.0",
  "mz-build-tools",
@@ -9329,7 +9345,7 @@ dependencies = [
  "prost-build",
  "rand 0.9.4",
  "serde",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -10382,7 +10398,7 @@ dependencies = [
  "axum",
  "bytes",
  "clap",
- "differential-dataflow",
+ "differential-dataflow 0.25.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "futures",
  "humantime",
  "mz-dyncfg",
@@ -10400,7 +10416,7 @@ dependencies = [
  "prometheus",
  "serde",
  "serde_json",
- "timely",
+ "timely 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "tokio",
  "tracing",
  "uuid",
@@ -11061,7 +11077,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
  "heck",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "petgraph",
@@ -11082,7 +11098,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -13483,10 +13499,28 @@ dependencies = [
  "itertools 0.14.0",
  "serde",
  "smallvec",
- "timely_bytes",
- "timely_communication",
- "timely_container",
- "timely_logging",
+ "timely_bytes 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely_communication 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely_container 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely_logging 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "timely"
+version = "0.31.0"
+source = "git+https://github.com/TimelyDataflow/timely-dataflow#c2c336c5a473f855b0fec02cd8b0c95d0abe0aa4"
+dependencies = [
+ "bincode",
+ "byteorder",
+ "columnar",
+ "columnation",
+ "itertools 0.14.0",
+ "serde",
+ "smallvec",
+ "timely_bytes 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
+ "timely_communication 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
+ "timely_container 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
+ "timely_logging 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
 ]
 
 [[package]]
@@ -13495,6 +13529,11 @@ version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad328384fad249cbe20f742d842ee9e3d2c6086bcde6277fb11bb154f21fb92e"
 
+[[package]]
+name = "timely_bytes"
+version = "0.31.0"
+source = "git+https://github.com/TimelyDataflow/timely-dataflow#c2c336c5a473f855b0fec02cd8b0c95d0abe0aa4"
+
 [[package]]
 name = "timely_communication"
 version = "0.31.0"
@@ -13505,9 +13544,22 @@ dependencies = [
  "columnar",
  "getopts",
  "serde",
- "timely_bytes",
- "timely_container",
- "timely_logging",
+ "timely_bytes 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely_container 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "timely_logging 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "timely_communication"
+version = "0.31.0"
+source = "git+https://github.com/TimelyDataflow/timely-dataflow#c2c336c5a473f855b0fec02cd8b0c95d0abe0aa4"
+dependencies = [
+ "byteorder",
+ "columnar",
+ "serde",
+ "timely_bytes 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
+ "timely_container 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
+ "timely_logging 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
 ]
 
 [[package]]
@@ -13516,13 +13568,26 @@ version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de8c518a66e00ef8af9e9fae7e01b7d2628b970948f32855dfc89e503403ff5a"
 
+[[package]]
+name = "timely_container"
+version = "0.31.0"
+source = "git+https://github.com/TimelyDataflow/timely-dataflow#c2c336c5a473f855b0fec02cd8b0c95d0abe0aa4"
+
 [[package]]
 name = "timely_logging"
 version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ae9187f19aec95c932196b95c1981708090d9c35213ae266d7bac0f32432886"
 dependencies = [
- "timely_container",
+ "timely_container 0.31.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "timely_logging"
+version = "0.31.0"
+source = "git+https://github.com/TimelyDataflow/timely-dataflow#c2c336c5a473f855b0fec02cd8b0c95d0abe0aa4"
+dependencies = [
+ "timely_container 0.31.0 (git+https://github.com/TimelyDataflow/timely-dataflow)",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index d6de0f6ce2336..8405caac4ec6b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -342,6 +342,7 @@ deadpool-postgres = "0.10.3"
 dec = "0.4.9"
 derivative = "2.2.0"
 differential-dataflow = "0.25.0"
+differential-dataflow-next = { package = "differential-dataflow", git = "https://github.com/DAlperin/differential-dataflow", rev = "3659671246e0b5635a8128cc27d65f12ecf7dda5", default-features = false }
 differential-dogs3 = "0.25.0"
 digest = "0.10.7"
 dirs = "6.0.0"
@@ -526,6 +527,7 @@ tikv-jemalloc-ctl = { version = "0.6", features = ["stats", "use_std"] }
 tikv-jemallocator = { version = "0.6", features = ["background_threads", "profiling", "stats", "unprefixed_malloc_on_supported_platforms"] }
 time = "0.3.17"
 timely = "0.31.0"
+timely-next = { package = "timely", git = "https://github.com/TimelyDataflow/timely-dataflow", default-features = false }
 tokio = { version = "1.52.3", features = ["full", "test-util"] }
 tokio-metrics = "0.5.0"
 tokio-native-tls = "0.3.1"
diff --git a/deny.toml b/deny.toml
index ec3704b00ef8a..0c642a679d0b9 100644
--- a/deny.toml
+++ b/deny.toml
@@ -16,6 +16,14 @@ multiple-versions = "deny"
 # Materialize-maintained fork that avoids the duplicated transitive
 # dependencies.
 skip = [
+    # The DNM async-merge prototype consumes two DD/Timely APIs.
+    { name = "differential-dataflow", version = "=0.25.1" },
+    { name = "timely", version = "=0.31.0" },
+    { name = "timely_bytes", version = "=0.31.0" },
+    { name = "timely_communication", version = "=0.31.0" },
+    { name = "timely_container", version = "=0.31.0" },
+    { name = "timely_logging", version = "=0.31.0" },
+
     # arrayvec had a significant API change in 0.7
     { name = "arrayvec", version = "0.5.2" },
     # One-time exception for base64 due to its prevalence in the crate graph.
@@ -367,6 +375,11 @@ license-files = [
 [sources]
 unknown-git = "deny"
 unknown-registry = "deny"
+# DNM-only exceptions for the async-merge prototype, pinned in Cargo.lock.
+allow-git = [
+    "https://github.com/DAlperin/differential-dataflow",
+    "https://github.com/TimelyDataflow/timely-dataflow",
+]
 # Do not allow non-MaterializeInc Git repositories here! Git repositories must
 # be owned by the MaterializeInc organization so that maintainership is shared
 # amongst Materialize employees and so that historical versions of Materialize
diff --git a/src/timely-util/Cargo.toml b/src/timely-util/Cargo.toml
index b0a549d72d9c5..fd609555a5dad 100644
--- a/src/timely-util/Cargo.toml
+++ b/src/timely-util/Cargo.toml
@@ -39,6 +39,7 @@ bytemuck.workspace = true
 columnar.workspace = true
 columnation.workspace = true
 differential-dataflow.workspace = true
+differential-dataflow-next.workspace = true
 futures-util.workspace = true
 lz4_flex.workspace = true
 mz-ore = { path = "../ore", default-features = false, features = ["async", "process", "tracing", "test", "num-traits", "region", "differential-dataflow", "overflowing", "pager", "pool"] }
@@ -46,6 +47,7 @@ num-traits.workspace = true
 serde.workspace = true
 smallvec.workspace = true
 timely.workspace = true
+timely-next.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 uuid = { workspace = true, features = ["serde", "v4"] }
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index 5c6d2dd7c83a7..a7a37ff1d0a49 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -2,12 +2,12 @@
 // Use of this software is governed by the Business Source License
 // included in the LICENSE file.
 
-//! MZ trace interfaces over vendored Differential maintenance machinery.
+//! MZ trace interfaces over Differential's pollable batcher and a vendored spine.
 //!
 //! [`Batcher`] accepts columnar input and seals it at a frontier. [`Spine`] exposes
-//! published batches through DD's trace traits. Both use the resumable algorithms
-//! in [`vendor`]. DD still supplies trace readers, reader holds, descriptions, and
-//! difference and lattice semantics. All types use MZ's existing Timely dependency.
+//! published batches through DD's trace traits. DD supplies the chunk, batcher,
+//! and merger contracts. The vendored spine owns scheduling and publication across
+//! suspension. [`timestamp`] bridges the two DD/Timely versions at this boundary.
 //!
 //! [`pool_chunk`] supplies columnar kernels and buffer-pool reads.
 //! [`super::asynchronous::arrange`] owns the Timely operator and calls [`maintain`]
@@ -25,21 +25,26 @@ use differential_dataflow::difference::Semigroup;
 use differential_dataflow::lattice::Lattice;
 use differential_dataflow::trace::chunk::ChunkBatch;
 use differential_dataflow::trace::{Description, ExertionLogic, Trace, TraceReader};
+use differential_dataflow_next::trace::Span;
+use differential_dataflow_next::trace::chunk::{
+    ChunkBatch as NativeChunkBatch,
+    asynchronous::{AsyncChunk, ChunkBatcher},
+};
 use timely::progress::{Antichain, Timestamp, frontier::AntichainRef};
 use tokio::sync::Notify;
 
 use super::ColumnChunk;
 use super::merge::ReadBudget;
 use pool_chunk::{PoolChunk, PreparedChunker};
+use timestamp::{Time, to_mz, to_native};
 
 mod pool_chunk;
+mod timestamp;
 mod vendor;
 
-type NativeBatcher<D, T, R> =
-    vendor::chunk::ChunkBatcher<PreparedChunker<D, T, R>, PoolChunk<D, T, R>>;
-type NativeSpine<D, T, R> = vendor::chunk::ChunkSpine<PoolChunk<D, T, R>>;
-type NativeSpan<D, T, R> =
-    vendor::spine::Span<T, Rc<vendor::chunk::ChunkBatch<PoolChunk<D, T, R>>>>;
+type NativeBatcher<D, T, R> = ChunkBatcher<PreparedChunker<D, T, R>, PoolChunk<D, T, R>>;
+type NativeSpine<D, T, R> = vendor::spine::Spine<Rc<NativeChunkBatch<PoolChunk<D, T, R>>>>;
+type NativeSpan<D, T, R> = Span<Time<T>, Rc<NativeChunkBatch<PoolChunk<D, T, R>>>>;
 
 /// Columnar stash backed by Differential's pollable merge batcher.
 ///
@@ -48,7 +53,7 @@ type NativeSpan<D, T, R> =
 /// retain an unfinished operation that must not be mistaken for the next one.
 pub struct Batcher<D: Columnar, T: Columnar, R: Columnar>
 where
-    PoolChunk<D, T, R>: vendor::chunk::Chunk,
+    PoolChunk<D, T, R>: AsyncChunk,
 {
     inner: NativeBatcher<D, T, R>,
     /// Lower frontier for the next batch description.
@@ -56,6 +61,7 @@ where
     frontier: Antichain<T>,
     budget: ReadBudget,
 }
+
 impl<D, T, R> Batcher<D, T, R>
 where
     D: Columnar + 'static,
@@ -81,8 +87,8 @@ where
 
     /// Insert a sorted, consolidated chunk.
     pub async fn push(&mut self, chunk: ColumnChunk<D, T, R>) {
-        use vendor::batcher::Batcher as _;
-        use vendor::chunk::Chunk as _;
+        use differential_dataflow_next::batcher::asynchronous::Batcher as _;
+        use differential_dataflow_next::trace::chunk::Chunk as _;
         let mut input = VecDeque::from([PoolChunk {
             chunk,
             budget: self.budget.clone(),
@@ -98,11 +104,11 @@ where
         &mut self,
         upper: Antichain<T>,
     ) -> (Vec<ColumnChunk<D, T, R>>, Description<T>) {
-        use vendor::batcher::Batcher as _;
-        let target = upper.clone();
+        use differential_dataflow_next::batcher::asynchronous::Batcher as _;
+        let target = to_native(upper.borrow());
         let (batch, retained) =
             futures_util::future::poll_fn(|cx| self.inner.poll_extract(target.borrow(), cx)).await;
-        self.frontier = retained;
+        self.frontier = to_mz(retained.borrow());
         let lower = std::mem::replace(&mut self.lower, upper.clone());
         (
             batch
@@ -122,7 +128,7 @@ where
 /// references without borrowing the native spine through its `RefCell`.
 pub struct Spine<D: Columnar, T: Columnar, R: Columnar>
 where
-    PoolChunk<D, T, R>: vendor::chunk::Chunk,
+    PoolChunk<D, T, R>: AsyncChunk,
 {
     pub(super) state: Rc<RefCell<NativeSpine<D, T, R>>>,
     pub(super) notify: Arc<Notify>,
@@ -130,6 +136,7 @@ where
     physical: Antichain<T>,
     budget: ReadBudget,
 }
+
 impl<D, T, R> Spine<D, T, R>
 where
     D: Columnar + 'static,
@@ -144,6 +151,11 @@ where
         budget: ReadBudget,
     ) -> Self {
         let notify = Arc::new(Notify::new());
+        let info = timely_next::dataflow::operators::generic::OperatorInfo::new(
+            info.local_id,
+            info.global_id,
+            info.address,
+        );
         let mut native = NativeSpine::new(info, None, None);
         native.set_waker(Waker::from(Arc::new(NotifyWake(Arc::clone(&notify)))));
         Self {
@@ -162,7 +174,11 @@ where
             .flat_map(|batch| batch.chunks.iter())
             .map(|chunk| chunk.chunk.clone())
             .collect();
-        let description = span.desc.clone();
+        let description = Description::new(
+            to_mz(span.desc.lower().borrow()),
+            to_mz(span.desc.upper().borrow()),
+            to_mz(span.desc.since().borrow()),
+        );
         Rc::new(ChunkBatch {
             chunks,
             description,
@@ -170,7 +186,11 @@ where
     }
 
     fn to_native_span(&self, batch: &ChunkBatch<ColumnChunk<D, T, R>>) -> NativeSpan<D, T, R> {
-        let description = batch.description.clone();
+        let description = differential_dataflow_next::trace::Description::new(
+            to_native(batch.description.lower().borrow()),
+            to_native(batch.description.upper().borrow()),
+            to_native(batch.description.since().borrow()),
+        );
         let inner = if batch.chunks.is_empty() {
             None
         } else {
@@ -182,11 +202,12 @@ where
                     budget: self.budget.clone(),
                 })
                 .collect();
-            Some(Rc::new(vendor::chunk::ChunkBatch::new(chunks)))
+            Some(Rc::new(NativeChunkBatch::new(chunks)))
         };
-        vendor::spine::Span::new(description, inner)
+        Span::new(description, inner)
     }
 }
+
 impl<D, T, R> TraceReader for Spine<D, T, R>
 where
     D: Columnar + 'static,
@@ -197,11 +218,12 @@ where
 {
     type Time = T;
     type Batch = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
+
     fn batches_through(&mut self, upper: AntichainRef<T>) -> Option<Vec<Self::Batch>> {
         if !timely::PartialOrder::less_equal(&self.physical.borrow(), &upper) {
             return None;
         }
-        let upper = upper.to_owned();
+        let upper = to_native(upper);
         self.state
             .borrow_mut()
             .spans_through(upper.borrow())
@@ -214,30 +236,39 @@ where
             &frontier
         ));
         self.logical = frontier.to_owned();
-        self.state.borrow_mut().set_logical_compaction(frontier);
+        self.state
+            .borrow_mut()
+            .set_logical_compaction(to_native(frontier).borrow());
         self.notify.notify_one();
     }
+
     fn get_logical_compaction(&mut self) -> AntichainRef<'_, T> {
         self.logical.borrow()
     }
+
     fn set_physical_compaction(&mut self, frontier: AntichainRef<T>) {
         assert!(timely::PartialOrder::less_equal(
             &self.physical.borrow(),
             &frontier
         ));
         self.physical = frontier.to_owned();
-        self.state.borrow_mut().set_physical_compaction(frontier);
+        self.state
+            .borrow_mut()
+            .set_physical_compaction(to_native(frontier).borrow());
         self.notify.notify_one();
     }
+
     fn get_physical_compaction(&mut self) -> AntichainRef<'_, T> {
         self.physical.borrow()
     }
+
     fn map_batches<F: FnMut(&Self::Batch)>(&self, mut f: F) {
         self.state
             .borrow()
             .map_spans(|span| f(&Self::to_mz_batch(span)));
     }
 }
+
 impl<D, T, R> Trace for Spine<D, T, R>
 where
     D: Columnar + 'static,
@@ -253,17 +284,21 @@ where
     ) -> Self {
         Self::with_budget(info, ReadBudget::new(256 << 20))
     }
+
     fn exert(&mut self) {
         self.state.borrow_mut().exert();
     }
+
     fn set_exert_logic(&mut self, logic: ExertionLogic) {
         self.state.borrow_mut().set_exert_logic(logic);
     }
+
     fn insert(&mut self, batch: Self::Batch) {
         let span = self.to_native_span(&batch);
         self.state.borrow_mut().insert(span);
         self.notify.notify_one();
     }
+
     fn close(&mut self) {
         self.state.borrow_mut().close();
         self.notify.notify_one();
@@ -275,6 +310,7 @@ impl Wake for NotifyWake {
     fn wake(self: Arc<Self>) {
         self.wake_by_ref();
     }
+
     fn wake_by_ref(self: &Arc<Self>) {
         self.0.notify_one();
     }
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index 859184af3cb6b..ff476b7b975d4 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -14,11 +14,11 @@ use std::rc::Rc;
 use std::sync::Arc;
 use std::task::{Context, Poll, ready};
 
-use super::vendor;
 use columnar::Columnar;
 use differential_dataflow::difference::Semigroup;
 use differential_dataflow::lattice::Lattice;
 use differential_dataflow::trace::chunk::Chunk as MzChunk;
+use differential_dataflow_next::trace::chunk::{Chunk as NativeChunk, asynchronous::AsyncChunk};
 use futures_util::FutureExt;
 use futures_util::future::LocalBoxFuture;
 use timely::dataflow::channels::ContainerBytes;
@@ -27,12 +27,14 @@ use tokio::sync::OwnedSemaphorePermit;
 
 use super::super::merge::ReadBudget;
 use super::super::{Column, ColumnChunk};
+use super::timestamp::{Time, to_mz, to_native};
 
 /// A columnar chunk with shared admission for native Differential merge reads.
 pub struct PoolChunk<D: Columnar, T: Columnar, R: Columnar> {
     pub(super) chunk: ColumnChunk<D, T, R>,
     pub(super) budget: ReadBudget,
 }
+
 impl<D: Columnar, T: Columnar, R: Columnar> PoolChunk<D, T, R> {
     fn take_columns(chunks: &mut VecDeque<Self>) -> VecDeque<ColumnChunk<D, T, R>> {
         chunks.drain(..).map(|chunk| chunk.chunk).collect()
@@ -58,6 +60,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> Clone for PoolChunk<D, T, R> {
         }
     }
 }
+
 impl<D: Columnar, T: Columnar, R: Columnar> Default for PoolChunk<D, T, R> {
     fn default() -> Self {
         Self {
@@ -81,6 +84,7 @@ pub struct ReadState<D: Columnar, T: Columnar, R: Columnar> {
     reservation: Option<Arc<OwnedSemaphorePermit>>,
     pending: Option<LocalBoxFuture<'static, LoadedInputs<D, T, R>>>,
 }
+
 impl<D: Columnar, T: Columnar, R: Columnar> Default for ReadState<D, T, R> {
     fn default() -> Self {
         Self {
@@ -91,6 +95,7 @@ impl<D: Columnar, T: Columnar, R: Columnar> Default for ReadState<D, T, R> {
         }
     }
 }
+
 struct LoadedInputs<D: Columnar, T: Columnar, R: Columnar> {
     chunks: Vec<ColumnChunk<D, T, R>>,
     reservation: Arc<OwnedSemaphorePermit>,
@@ -169,7 +174,7 @@ where
     }
 }
 
-impl<D, T, R> vendor::chunk::Chunk for PoolChunk<D, T, R>
+impl<D, T, R> NativeChunk for PoolChunk<D, T, R>
 where
     D: Columnar + 'static,
     for<'a> columnar::Ref<'a, D>: Copy + Ord,
@@ -177,31 +182,12 @@ where
     for<'a> columnar::Ref<'a, T>: Copy + Ord,
     R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
 {
-    type Time = T;
-    type Pending = ReadState<D, T, R>;
+    type Time = Time<T>;
     const TARGET: usize = <ColumnChunk<D, T, R> as MzChunk>::TARGET;
+
     fn len(&self) -> usize {
         self.chunk.len()
     }
-    fn pending_for(left: &[Self], right: &[Self]) -> Self::Pending {
-        let largest_chunk_bytes = |run: &[Self]| {
-            run.iter()
-                .map(|chunk| match &chunk.chunk {
-                    ColumnChunk::Resident(column, _) => column.length_in_bytes(),
-                    ColumnChunk::Spilled(body, _) => body.bytes,
-                })
-                .max()
-                .unwrap_or(0)
-        };
-        ReadState {
-            budget: left
-                .first()
-                .or_else(|| right.first())
-                .map(|chunk| chunk.budget.clone()),
-            required_bytes: largest_chunk_bytes(left).saturating_add(largest_chunk_bytes(right)),
-            ..ReadState::default()
-        }
-    }
 
     fn merge(left: &mut VecDeque<Self>, right: &mut VecDeque<Self>, output: &mut VecDeque<Self>) {
         let budget = left
@@ -221,7 +207,7 @@ where
 
     fn advance(
         input: &mut VecDeque<Self>,
-        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        frontier: timely_next::progress::frontier::AntichainRef<Self::Time>,
         done: bool,
         output: &mut VecDeque<Self>,
     ) {
@@ -230,7 +216,7 @@ where
         };
         let mut columns = Self::take_columns(input);
         let mut advanced = VecDeque::new();
-        let frontier = frontier.to_owned();
+        let frontier = to_mz(frontier);
         ColumnChunk::advance(&mut columns, frontier.borrow(), done, &mut advanced);
         Self::extend_columns(input, columns, &budget);
         Self::extend_columns(output, advanced, &budget);
@@ -238,8 +224,8 @@ where
 
     fn extract(
         input: &mut VecDeque<Self>,
-        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
-        residual: &mut timely::progress::Antichain<Self::Time>,
+        frontier: timely_next::progress::frontier::AntichainRef<Self::Time>,
+        residual: &mut timely_next::progress::Antichain<Self::Time>,
         keep: &mut VecDeque<Self>,
         ship: &mut VecDeque<Self>,
     ) {
@@ -249,8 +235,8 @@ where
         let mut columns = Self::take_columns(input);
         let mut kept = VecDeque::new();
         let mut shipped = VecDeque::new();
-        let frontier = frontier.to_owned();
-        let mut remaining = residual.clone();
+        let frontier = to_mz(frontier);
+        let mut remaining = to_mz(residual.borrow());
         ColumnChunk::extract(
             &mut columns,
             frontier.borrow(),
@@ -258,7 +244,7 @@ where
             &mut kept,
             &mut shipped,
         );
-        *residual = remaining;
+        *residual = to_native(remaining.borrow());
         Self::extend_columns(input, columns, &budget);
         Self::extend_columns(keep, kept, &budget);
         Self::extend_columns(ship, shipped, &budget);
@@ -274,6 +260,37 @@ where
         Self::extend_columns(input, columns, &budget);
         Self::extend_columns(output, settled, &budget);
     }
+}
+
+impl<D, T, R> AsyncChunk for PoolChunk<D, T, R>
+where
+    D: Columnar + 'static,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+{
+    type Pending = ReadState<D, T, R>;
+
+    fn pending_for(left: &[Self], right: &[Self]) -> Self::Pending {
+        let largest_chunk_bytes = |run: &[Self]| {
+            run.iter()
+                .map(|chunk| match &chunk.chunk {
+                    ColumnChunk::Resident(column, _) => column.length_in_bytes(),
+                    ColumnChunk::Spilled(body, _) => body.bytes,
+                })
+                .max()
+                .unwrap_or(0)
+        };
+        ReadState {
+            budget: left
+                .first()
+                .or_else(|| right.first())
+                .map(|chunk| chunk.budget.clone()),
+            required_bytes: largest_chunk_bytes(left).saturating_add(largest_chunk_bytes(right)),
+            ..ReadState::default()
+        }
+    }
 
     fn poll_merge(
         io: &mut Self::Pending,
@@ -316,11 +333,12 @@ where
         Self::merge(left, right, output);
         Poll::Ready(())
     }
+
     fn poll_advance(
         io: &mut Self::Pending,
         cx: &mut Context<'_>,
         input: &mut VecDeque<Self>,
-        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
+        frontier: timely_next::progress::frontier::AntichainRef<Self::Time>,
         done: bool,
         out: &mut VecDeque<Self>,
     ) -> Poll<()> {
@@ -337,18 +355,19 @@ where
         Self::advance(input, frontier, done, out);
         Poll::Ready(())
     }
+
     fn poll_extract(
         io: &mut Self::Pending,
         cx: &mut Context<'_>,
         input: &mut VecDeque<Self>,
-        frontier: timely::progress::frontier::AntichainRef<Self::Time>,
-        residual: &mut timely::progress::Antichain<Self::Time>,
+        frontier: timely_next::progress::frontier::AntichainRef<Self::Time>,
+        residual: &mut timely_next::progress::Antichain<Self::Time>,
         keep: &mut VecDeque<Self>,
         ship: &mut VecDeque<Self>,
     ) -> Poll<()> {
         if let Some(chunk) = input.front() {
             let (low, high) = chunk.chunk.chunk_time_bounds();
-            let upper = frontier.to_owned();
+            let upper = to_mz(frontier);
             let entirely_before = high.iter().all(|time| !upper.less_equal(time));
             let entirely_after = low.iter().all(|time| upper.less_equal(time));
             let straddles_frontier = !entirely_before && !entirely_after;
@@ -367,6 +386,7 @@ pub struct PreparedChunker<D: Columnar, T: Columnar, R: Columnar> {
     queued: VecDeque<PoolChunk<D, T, R>>,
     ready: PoolChunk<D, T, R>,
 }
+
 impl<D: Columnar, T: Columnar, R: Columnar> Default for PreparedChunker<D, T, R> {
     fn default() -> Self {
         Self {
@@ -375,20 +395,24 @@ impl<D: Columnar, T: Columnar, R: Columnar> Default for PreparedChunker<D, T, R>
         }
     }
 }
-impl<D: Columnar, T: Columnar, R: Columnar> timely::container::ContainerBuilder
+
+impl<D: Columnar, T: Columnar, R: Columnar> timely_next::container::ContainerBuilder
     for PreparedChunker<D, T, R>
 {
     type Container = PoolChunk<D, T, R>;
+
     fn extract(&mut self) -> Option<&mut Self::Container> {
         self.ready = self.queued.pop_front()?;
         Some(&mut self.ready)
     }
+
     fn finish(&mut self) -> Option<&mut Self::Container> {
         self.extract()
     }
 }
+
 impl<D: Columnar, T: Columnar, R: Columnar>
-    timely::container::PushInto<&mut Vec<PoolChunk<D, T, R>>> for PreparedChunker<D, T, R>
+    timely_next::container::PushInto<&mut Vec<PoolChunk<D, T, R>>> for PreparedChunker<D, T, R>
 {
     fn push_into(&mut self, input: &mut Vec<PoolChunk<D, T, R>>) {
         self.queued.extend(input.drain(..));
diff --git a/src/timely-util/src/columnar/chunk/native/timestamp.rs b/src/timely-util/src/columnar/chunk/native/timestamp.rs
new file mode 100644
index 0000000000000..2bd4d2036e019
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/native/timestamp.rs
@@ -0,0 +1,135 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Timestamp and frontier conversion between MZ's Timely and the local DD dependency.
+//!
+//! Chunk bodies retain MZ timestamps. Only maintenance frontiers use [`Time`],
+//! which delegates ordering, lattice operations, and path summaries to the original
+//! type. No Timely scopes, capabilities, or operators cross this boundary.
+
+use serde::{Deserialize, Serialize};
+use timely::progress::Timestamp;
+
+/// An MZ timestamp or path summary implementing the local DD dependency's traits.
+#[derive(
+    Clone,
+    Debug,
+    Default,
+    Eq,
+    PartialEq,
+    Ord,
+    PartialOrd,
+    Serialize,
+    Deserialize
+)]
+#[serde(transparent)]
+pub struct Time<T>(pub T);
+
+impl<T: timely::PartialOrder> timely_next::PartialOrder for Time<T> {
+    fn less_equal(&self, other: &Self) -> bool {
+        self.0.less_equal(&other.0)
+    }
+}
+
+impl<T: Timestamp> timely_next::progress::Timestamp for Time<T> {
+    type Summary = Time<T::Summary>;
+
+    fn minimum() -> Self {
+        Time(T::minimum())
+    }
+}
+
+impl<T: Timestamp, S: timely::progress::timestamp::PathSummary<T>>
+    timely_next::progress::timestamp::PathSummary<Time<T>> for Time<S>
+{
+    fn results_in(&self, src: &Time<T>) -> Option<Time<T>> {
+        self.0.results_in(&src.0).map(Time)
+    }
+
+    fn followed_by(&self, other: &Self) -> Option<Self> {
+        self.0.followed_by(&other.0).map(Time)
+    }
+}
+
+impl<T: differential_dataflow::lattice::Lattice> differential_dataflow_next::lattice::Lattice
+    for Time<T>
+{
+    fn join(&self, other: &Self) -> Self {
+        Time(self.0.join(&other.0))
+    }
+
+    fn meet(&self, other: &Self) -> Self {
+        Time(self.0.meet(&other.0))
+    }
+}
+
+/// Convert a maintenance frontier to the local DD timestamp type.
+pub(super) fn to_native<T: Timestamp>(
+    frontier: timely::progress::frontier::AntichainRef<'_, T>,
+) -> timely_next::progress::Antichain<Time<T>> {
+    frontier.iter().cloned().map(Time).collect()
+}
+
+/// Convert a maintenance frontier back to MZ's timestamp type.
+pub(super) fn to_mz<T: Timestamp>(
+    frontier: timely_next::progress::frontier::AntichainRef<'_, Time<T>>,
+) -> timely::progress::Antichain<T> {
+    frontier.iter().map(|time| time.0.clone()).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Time, to_mz, to_native};
+    use differential_dataflow_next::lattice::Lattice;
+    use timely::order::Product;
+    use timely::progress::Antichain;
+    use timely_next::PartialOrder;
+    use timely_next::progress::timestamp::PathSummary;
+
+    #[mz_ore::test]
+    fn partial_order_and_frontiers_survive_conversion() {
+        let a = Product::new(1u64, 3u64);
+        let b = Product::new(3u64, 1u64);
+        assert!(!Time(a).less_equal(&Time(b)));
+        assert!(!Time(b).less_equal(&Time(a)));
+        assert_eq!(Time(a).join(&Time(b)), Time(Product::new(3, 3)));
+        assert_eq!(Time(a).meet(&Time(b)), Time(Product::new(1, 1)));
+
+        let frontier = Antichain::from_iter([a, b]);
+        let native = to_native(frontier.borrow());
+        assert_eq!(native.len(), 2);
+        assert!(native.less_equal(&Time(Product::new(2, 4))));
+        assert!(!native.less_equal(&Time(Product::new(2, 2))));
+        assert_eq!(to_mz(native.borrow()), frontier);
+
+        let empty = Antichain::<Product<u64, u64>>::new();
+        assert_eq!(to_mz(to_native(empty.borrow()).borrow()), empty);
+    }
+
+    #[mz_ore::test]
+    fn summaries_preserve_composition_and_overflow() {
+        let summary = Time(Product::new(1u64, 2u64));
+        let next = Time(Product::new(3u64, 4u64));
+        let time = Time(Product::new(5u64, 6u64));
+        assert_eq!(summary.results_in(&time), Some(Time(Product::new(6, 8))));
+        let composed =
+            PathSummary::<Time<Product<u64, u64>>>::followed_by(&summary, &next).unwrap();
+        assert_eq!(composed, Time(Product::new(4, 6)));
+        assert_eq!(
+            composed.results_in(&time),
+            summary.results_in(&time).and_then(|t| next.results_in(&t))
+        );
+        assert_eq!(
+            summary.results_in(&Time(Product::new(u64::MAX, 0u64))),
+            None
+        );
+        assert_eq!(
+            PathSummary::<Time<Product<u64, u64>>>::followed_by(
+                &summary,
+                &Time(Product::new(u64::MAX, 0u64))
+            ),
+            None
+        );
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor.rs b/src/timely-util/src/columnar/chunk/native/vendor.rs
index 07d6bebd733b3..9b206a549d2dd 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor.rs
@@ -2,27 +2,16 @@
 // SPDX-License-Identifier: MIT
 // See vendor/LICENSE.
 
-//! Resumable maintenance machinery vendored from Differential Dataflow.
+//! Differential spine scheduling with resumable maintenance.
 //!
-//! Source: `TimelyDataflow/differential-dataflow`, upstream base
-//! `626c80ce`, with the local async changes at `339f01522823171f2a8c710967502f3e1d09360b`.
-//! The source files are `trace/implementations/spine_fueled.rs`,
-//! `trace/chunk/mod.rs`, and `batcher/{mod.rs,merge/mod.rs}`. The `Span` type
-//! comes from `trace/mod.rs`.
-//!
-//! This copy uses MZ's existing Differential and Timely dependencies for timestamps,
-//! lattices, descriptions, and logging. The enclosing adapter implements DD's trace
-//! interfaces, leaving reader holds and operator progress with DD and Timely.
-//! The local methods preserve the source spine's fuel, level, and publication policy.
-//! Cursor implementations, general operators, and reference storage backends are
-//! outside this module.
+//! The spine is based on `TimelyDataflow/differential-dataflow` at `626c80ce`,
+//! with local scheduling changes from `339f01522823171f2a8c710967502f3e1d09360b`.
+//! It owns fuel grants, layer promotion, and atomic publication across suspension.
+//! Batch storage, chunk operations, and polling contracts come from the
+//! `differential-dataflow-next` dependency.
 
-// Preserve the synchronous entry points and generic helpers alongside their
-// pollable counterparts so the vendored algorithms remain comparable to DD.
 #![allow(dead_code)]
 
-pub mod batcher;
-pub mod chunk;
 pub mod spine;
 
 #[cfg(test)]
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs b/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
deleted file mode 100644
index 728a477872fb5..0000000000000
--- a/src/timely-util/src/columnar/chunk/native/vendor/batcher.rs
+++ /dev/null
@@ -1,451 +0,0 @@
-// Copyright (c) 2015 Frank McSherry
-// SPDX-License-Identifier: MIT
-// See LICENSE in this directory.
-
-//! A `Batcher` implementation based on merge sort.
-//!
-//! The `MergeBatcher` requires a "merger" that implements the [`Merger`] trait, which provides
-//! hooks for manipulating sorted "chains" of chunks as needed by the merge batcher: merging
-//! chunks and also splitting them apart based on time.
-//!
-//! Raw input containers are fed to the batcher via [`Batcher::insert`], which chunks them with
-//! its `Chu` before merging: forming sorted, consolidated chunks is the first stage of the
-//! batcher's own work rather than something a caller arranges.
-
-use std::task::{Context, Poll, ready};
-
-use timely::container::{ContainerBuilder, PushInto};
-use timely::progress::frontier::AntichainRef;
-use timely::progress::{Timestamp, frontier::Antichain};
-
-use differential_dataflow::logging::{BatcherEvent, Logger};
-
-/// Creates batches from chunks of sorted, consolidated tuples.
-///
-/// Chunking input is `Chu`'s business, merging chunks is `M`'s, and sealing the extracted chain
-/// into a batch is `S`'s; the batcher's own work is the geometric ladder of chains and the
-/// carve-by-frontier.
-pub struct MergeBatcher<Chu, M: Merger, S> {
-    /// Melds input containers into sorted, consolidated chunks.
-    chunker: Chu,
-    /// Sorted, consolidated chains, each paired with its cached summed update count.
-    ///
-    /// The cached count is the chain's *merge weight*: the geometric ladder weighs
-    /// chains by updates, not chunk counts, since regrading decouples the two. A
-    /// chain is immutable until merged, so the weight is computed once at push.
-    ///
-    /// Do not push/pop directly but use the corresponding functions ([`Self::chain_push`]/[`Self::chain_pop`]).
-    chains: Vec<(usize, Vec<M::Chunk>)>,
-    /// Stash of empty chunks, recycled through the merging process.
-    stash: Vec<M::Chunk>,
-    /// Merges consolidated chunks, and extracts the subset of an update chain that lies in an interval of time.
-    merger: M,
-    /// The lower-bound frontier of the data, after the last call to extract.
-    frontier: Antichain<M::Time>,
-    /// Logger for size accounting.
-    logger: Option<Logger>,
-    /// Timely operator ID.
-    operator_id: usize,
-    /// Seals each extracted chain into a batch.
-    sealer: std::marker::PhantomData<S>,
-    inserting: bool,
-    merging: Option<(Vec<M::Chunk>, Vec<M::Chunk>, Vec<M::Chunk>)>,
-    extracting: Option<(
-        Antichain<M::Time>,
-        Vec<M::Chunk>,
-        Vec<M::Chunk>,
-        Vec<M::Chunk>,
-    )>,
-}
-
-impl<C, Chu, M, S> Batcher<C> for MergeBatcher<Chu, M, S>
-where
-    M: Merger<Time: Timestamp>,
-    Chu: ContainerBuilder<Container = M::Chunk> + for<'a> PushInto<&'a mut C>,
-    S: Sealer<M::Chunk>,
-{
-    type Time = M::Time;
-    type Output = S::Output;
-
-    fn insert(&mut self, container: &mut C) {
-        self.chunker.push_into(container);
-        while let Some(chunk) = self.chunker.extract().map(std::mem::take) {
-            self.insert_chain(vec![chunk]);
-        }
-    }
-
-    // Extraction means finding those updates with times not greater or equal to any time in
-    // `upper`. All updates must have time greater or equal to the previously used `upper`, by
-    // assumption that after extracting from a batcher we receive no more updates with times not
-    // greater or equal to `upper`.
-    fn extract<'a>(
-        &'a mut self,
-        upper: AntichainRef<'_, M::Time>,
-    ) -> (Option<S::Output>, AntichainRef<'a, M::Time>) {
-        // Flush whatever the chunker is still accumulating: a partial final chunk would
-        // otherwise never reach the merge ladder.
-        while let Some(chunk) = self.chunker.finish().map(std::mem::take) {
-            self.insert_chain(vec![chunk]);
-        }
-
-        // Merge all remaining chains into a single chain.
-        while self.chains.len() > 1 {
-            let list1 = self.chain_pop().unwrap();
-            let list2 = self.chain_pop().unwrap();
-            let merged = self.merge_by(list1, list2);
-            self.chain_push(merged);
-        }
-        let merged = self.chain_pop().unwrap_or_default();
-
-        // Extract readied data.
-        let mut kept = Vec::new();
-        let mut readied = Vec::new();
-        self.frontier.clear();
-
-        self.merger.extract(
-            merged,
-            upper,
-            &mut self.frontier,
-            &mut readied,
-            &mut kept,
-            &mut self.stash,
-        );
-
-        if !kept.is_empty() {
-            self.chain_push(kept);
-        }
-
-        self.stash.clear();
-
-        (S::seal(&mut readied), self.frontier.borrow())
-    }
-    fn poll_insert(&mut self, container: &mut C, cx: &mut Context<'_>) -> Poll<()> {
-        assert!(self.extracting.is_none(), "cannot insert during extraction");
-        if !self.inserting {
-            self.chunker.push_into(container);
-            self.inserting = true;
-        }
-        ready!(self.poll_ladder(false, cx));
-        while let Some(chunk) = self.chunker.extract().map(std::mem::take) {
-            if M::len(&chunk) > 0 {
-                self.chain_push(vec![chunk]);
-            }
-            ready!(self.poll_ladder(false, cx));
-        }
-        self.inserting = false;
-        Poll::Ready(())
-    }
-
-    fn poll_extract(
-        &mut self,
-        upper: AntichainRef<'_, M::Time>,
-        cx: &mut Context<'_>,
-    ) -> Poll<(Option<S::Output>, Antichain<M::Time>)> {
-        assert!(!self.inserting, "finish insertion before extracting");
-        if self.extracting.is_none() {
-            ready!(self.poll_ladder(false, cx));
-            while let Some(chunk) = self.chunker.finish().map(std::mem::take) {
-                if M::len(&chunk) > 0 {
-                    self.chain_push(vec![chunk]);
-                }
-                ready!(self.poll_ladder(false, cx));
-            }
-            ready!(self.poll_ladder(true, cx));
-            let merged = self.chain_pop().unwrap_or_default();
-            self.frontier.clear();
-            self.extracting = Some((upper.to_owned(), merged, Vec::new(), Vec::new()));
-        }
-        let (saved, merged, readied, kept) = self.extracting.as_mut().unwrap();
-        assert_eq!(
-            saved.borrow(),
-            upper,
-            "extraction frontier changed while pending"
-        );
-        ready!(self.merger.poll_extract(
-            merged,
-            saved.borrow(),
-            &mut self.frontier,
-            readied,
-            kept,
-            &mut self.stash,
-            cx
-        ));
-        let (_, _, mut readied, kept) = self.extracting.take().unwrap();
-        if !kept.is_empty() {
-            self.chain_push(kept);
-        }
-        self.stash.clear();
-        Poll::Ready((S::seal(&mut readied), self.frontier.clone()))
-    }
-}
-
-impl<Chu: Default, M: Merger, S> MergeBatcher<Chu, M, S> {
-    /// Allocates a new empty batcher.
-    ///
-    /// The logger and operator identifier are used to report the batcher's memory footprint,
-    /// attributed to the operator that owns it.
-    pub fn new(logger: Option<Logger>, operator_id: usize) -> Self {
-        Self {
-            logger,
-            operator_id,
-            merger: M::default(),
-            chunker: Chu::default(),
-            chains: Vec::new(),
-            stash: Vec::new(),
-            frontier: Antichain::new(),
-            sealer: std::marker::PhantomData,
-            inserting: false,
-            merging: None,
-            extracting: None,
-        }
-    }
-}
-
-impl<Chu, M: Merger, S> MergeBatcher<Chu, M, S> {
-    fn poll_ladder(&mut self, all: bool, cx: &mut Context<'_>) -> Poll<()> {
-        loop {
-            if self.merging.is_none() {
-                let n = self.chains.len();
-                if n < 2 || (!all && self.chains[n - 1].0 < self.chains[n - 2].0 / 2) {
-                    return Poll::Ready(());
-                }
-                let a = self.chain_pop().unwrap();
-                let b = self.chain_pop().unwrap();
-                self.merging = Some((a, b, Vec::new()));
-            }
-            let (a, b, output) = self.merging.as_mut().unwrap();
-            ready!(self.merger.poll_merge(a, b, output, &mut self.stash, cx));
-            let (_, _, output) = self.merging.take().unwrap();
-            self.chain_push(output);
-        }
-    }
-
-    /// Insert a chain and maintain chain properties: Chains are geometrically sized
-    /// (by summed updates) and ordered by decreasing update weight.
-    fn insert_chain(&mut self, chain: Vec<M::Chunk>) {
-        if !chain.is_empty() {
-            self.chain_push(chain);
-            while self.chains.len() > 1
-                && (self.chains[self.chains.len() - 1].0
-                    >= self.chains[self.chains.len() - 2].0 / 2)
-            {
-                let list1 = self.chain_pop().unwrap();
-                let list2 = self.chain_pop().unwrap();
-                let merged = self.merge_by(list1, list2);
-                self.chain_push(merged);
-            }
-        }
-    }
-
-    // merges two sorted input lists into one sorted output list.
-    fn merge_by(&mut self, list1: Vec<M::Chunk>, list2: Vec<M::Chunk>) -> Vec<M::Chunk> {
-        // TODO: `list1` and `list2` get dropped; would be better to reuse?
-        let mut output = Vec::with_capacity(list1.len() + list2.len());
-        self.merger
-            .merge(list1, list2, &mut output, &mut self.stash);
-
-        output
-    }
-
-    /// Pop a chain and account size changes.
-    #[inline]
-    fn chain_pop(&mut self) -> Option<Vec<M::Chunk>> {
-        let (_weight, chain) = self.chains.pop()?;
-        self.account(chain.iter().map(Self::record), -1);
-        Some(chain)
-    }
-
-    /// Push a chain and account size changes.
-    ///
-    /// Caches the chain's summed update count alongside it for the ladder.
-    #[inline]
-    fn chain_push(&mut self, chain: Vec<M::Chunk>) {
-        let weight = chain.iter().map(M::len).sum();
-        self.account(chain.iter().map(Self::record), 1);
-        self.chains.push((weight, chain));
-    }
-
-    /// The `(records, size, capacity, allocations)` logger tuple for one chunk,
-    /// assembled from the two focused `Merger` methods.
-    #[inline]
-    fn record(chunk: &M::Chunk) -> (usize, usize, usize, usize) {
-        let (size, capacity, allocations) = M::allocation(chunk);
-        (M::len(chunk), size, capacity, allocations)
-    }
-
-    /// Account size changes. Only performs work if a logger exists.
-    ///
-    /// Calculate the size based on the iterator passed along, with each attribute
-    /// multiplied by `diff`. Usually, one wants to pass 1 or -1 as the diff.
-    #[inline]
-    fn account<I: IntoIterator<Item = (usize, usize, usize, usize)>>(&self, items: I, diff: isize) {
-        if let Some(logger) = &self.logger {
-            let (mut records, mut size, mut capacity, mut allocations) =
-                (0isize, 0isize, 0isize, 0isize);
-            for (records_, size_, capacity_, allocations_) in items {
-                records = records.saturating_add_unsigned(records_);
-                size = size.saturating_add_unsigned(size_);
-                capacity = capacity.saturating_add_unsigned(capacity_);
-                allocations = allocations.saturating_add_unsigned(allocations_);
-            }
-            logger.log(BatcherEvent {
-                operator: self.operator_id,
-                records_diff: records * diff,
-                size_diff: size * diff,
-                capacity_diff: capacity * diff,
-                allocations_diff: allocations * diff,
-            })
-        }
-    }
-}
-
-impl<Chu, M: Merger, S> Drop for MergeBatcher<Chu, M, S> {
-    fn drop(&mut self) {
-        // Cleanup chain to retract accounting information.
-        while self.chain_pop().is_some() {}
-    }
-}
-
-/// A trait to describe interesting moments in a merge batcher.
-pub trait Merger: Default {
-    /// The internal representation of chunks of data.
-    type Chunk: Default;
-    /// The type of time in frontiers to extract updates.
-    type Time;
-    /// Merge chains into an output chain.
-    fn merge(
-        &mut self,
-        list1: Vec<Self::Chunk>,
-        list2: Vec<Self::Chunk>,
-        output: &mut Vec<Self::Chunk>,
-        stash: &mut Vec<Self::Chunk>,
-    );
-    /// Extract ready updates based on the `upper` frontier.
-    fn extract(
-        &mut self,
-        merged: Vec<Self::Chunk>,
-        upper: AntichainRef<Self::Time>,
-        frontier: &mut Antichain<Self::Time>,
-        readied: &mut Vec<Self::Chunk>,
-        kept: &mut Vec<Self::Chunk>,
-        stash: &mut Vec<Self::Chunk>,
-    );
-
-    /// Poll a chain merge, consuming input allocations at most once.
-    fn poll_merge(
-        &mut self,
-        a: &mut Vec<Self::Chunk>,
-        b: &mut Vec<Self::Chunk>,
-        output: &mut Vec<Self::Chunk>,
-        stash: &mut Vec<Self::Chunk>,
-        _cx: &mut Context<'_>,
-    ) -> Poll<()> {
-        self.merge(std::mem::take(a), std::mem::take(b), output, stash);
-        Poll::Ready(())
-    }
-    /// Poll extraction with stable queues and frontier until completion.
-    fn poll_extract(
-        &mut self,
-        input: &mut Vec<Self::Chunk>,
-        upper: AntichainRef<Self::Time>,
-        frontier: &mut Antichain<Self::Time>,
-        readied: &mut Vec<Self::Chunk>,
-        kept: &mut Vec<Self::Chunk>,
-        stash: &mut Vec<Self::Chunk>,
-        _cx: &mut Context<'_>,
-    ) -> Poll<()> {
-        self.extract(std::mem::take(input), upper, frontier, readied, kept, stash);
-        Poll::Ready(())
-    }
-
-    /// The number of updates in a chunk.
-    ///
-    /// Drives the geometric ladder (chains are weighed by summed updates, not chunk
-    /// counts, since regrading decouples the two) and the `records` field of the
-    /// size logger.
-    fn len(chunk: &Self::Chunk) -> usize;
-
-    /// Backing-allocation figures for a chunk: `(size, capacity, allocations)`, for
-    /// the size logger's memory telemetry.
-    ///
-    /// Defaults to zero — most chunk types do not track this. Override to report
-    /// real figures (e.g. Materialize's memory accounting).
-    fn allocation(_chunk: &Self::Chunk) -> (usize, usize, usize) {
-        (0, 0, 0)
-    }
-}
-
-/// Forms a batch from a whole chain of updates at once.
-///
-/// Named rather than a bare `fn(&mut Vec<C>) -> Option<B>` so that implementors can name the
-/// batch they produce. There is no receiver: the chain goes in and the batch comes out, leaving
-/// nowhere for an update to be retained.
-pub trait Sealer<C> {
-    /// Output batch type.
-    type Output;
-
-    /// Builds a batch from a chain of updates.
-    ///
-    /// This method relies on the chain only containing updates greater or equal to the lower frontier,
-    /// and not greater or equal to the upper frontier, of the interval the caller means to describe.
-    /// Chains must also be sorted and consolidated.
-    ///
-    /// Having the whole chain in hand, an implementor can size itself before it fills.
-    fn seal(chain: &mut Vec<C>) -> Option<Self::Output>;
-}
-
-/// A type capable of accepting containers of updates, and carving them out by time as batches.
-///
-/// Updates are accepted as `C0`, the containers that arrive on the dataflow edge, and released as
-/// `Output`, whatever the implementor means by a batch. The two need not agree: an implementor
-/// staging updates in a form of its own can release that form directly, and one whose batch is a
-/// sequence of chunks names a sequence as its output.
-///
-/// The implementor determines the meaning of extraction by a frontier; it is not required to be by
-/// antichain partial order.
-pub trait Batcher<C0> {
-    /// The timestamps by which updates are carved out.
-    type Time;
-    /// The batches released by extraction.
-    type Output;
-
-    /// Takes the updates in `container`, leaving it in an undefined state.
-    ///
-    /// The implementor decides whether to claim the container's allocation or to drain it and
-    /// leave the allocation with the caller, who is free to reuse the container either way.
-    fn insert(&mut self, container: &mut C0);
-    /// Extracts the updates `upper` unblocks as a batch, and lower bounds the times of those retained.
-    ///
-    /// What `upper` unblocks is the implementor's to decide. It can be based on the antichain up
-    /// set, or it can be based on the total order of times (as used in delta join constructions).
-    /// Absent a batch, `upper` unblocked no updates.
-    ///
-    /// The reported lower bound should accurately reflect the times of all accepted updates that
-    /// have not been extracted. Over approximation can result in stalling dataflows, and under
-    /// approximation is simply incorrect.
-    fn extract<'a>(
-        &'a mut self,
-        upper: AntichainRef<'_, Self::Time>,
-    ) -> (Option<Self::Output>, AntichainRef<'a, Self::Time>);
-    /// Poll insertion, retaining the same container until completion.
-    fn poll_insert(
-        &mut self,
-        container: &mut C0,
-        _cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<()> {
-        self.insert(container);
-        std::task::Poll::Ready(())
-    }
-    /// Poll extraction at a fixed frontier, retaining capabilities until ready.
-    fn poll_extract(
-        &mut self,
-        upper: AntichainRef<'_, Self::Time>,
-        _cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<(Option<Self::Output>, Antichain<Self::Time>)>
-    where
-        Self::Time: Clone,
-    {
-        let (batch, retained) = self.extract(upper);
-        std::task::Poll::Ready((batch, retained.to_owned()))
-    }
-}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs b/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
deleted file mode 100644
index cdbcb5537fc3e..0000000000000
--- a/src/timely-util/src/columnar/chunk/native/vendor/chunk.rs
+++ /dev/null
@@ -1,812 +0,0 @@
-// Copyright (c) 2015 Frank McSherry
-// SPDX-License-Identifier: MIT
-// See LICENSE in this directory.
-
-//! Sorted, consolidated runs of updates, and operators over sequences of them.
-//!
-//! A [`Chunk`] is a consolidated, sorted run of `(data, time, diff)` updates.
-//! A sequence of chunks is also expected to be consolidated and sorted.
-//!
-//! The [`Chunk`] trait exposes whole-chunk operations, so that the implementor can internally divert to their best implementations, with amortized overhead.
-//! Each operation is invoked as if "streaming", providing input and output queues.
-//! An implementor is expected to drain as much as possible of the inputs, and any chunk written to the output is "committed" and likely to be shipped onward.
-//!
-//! # Wiring a `Chunk` into an arrangement
-//!
-//! Implementing [`Chunk`] for a type `C` is the only bespoke code needed; three aliases then expand into a full trace:
-//!
-//! * [`ChunkBatcher<Chu, C>`](ChunkBatcher): the merge batcher.
-//! * [`ChunkBuilder<C>`](ChunkBuilder): the batch builder.
-//! * [`ChunkSpine<C>`](ChunkSpine): the trace, a spine of `Rc`-shared batches.
-//!
-//! These aliases use [`ChunkBatch`], [`ChunkMerger`], [`ChunkBatchMerger`], and [`ChunkBatchBuilder`] for batch formation and trace maintenance.
-//!
-//! In this vendored module, the enclosing Materialize adapter supplies the trace
-//! interfaces. Differential's arrangement wiring, reference chunk backend, and
-//! cursor implementations are not included here.
-//!
-//! # Bounded footprint
-//!
-//! There is a `TARGET` associated constant that signals the intended chunk size.
-//! The constant should be chosen large enough to amortize overheads, but small enough that per-chunk work does not "stall" the system when invoked.
-//! The implementor is trusted to make a reasonable choice here.
-//!
-//! The [`Chunk::settle`] method "settles" sequences of chunks, and is called as chunks are no longer expected to be needed in the near future.
-//! The implementor should ensure the chunks are "graded", in that the sequence of chunks are all at most `TARGET` in size, any two in order sum to strictly more than `TARGET`.
-//! This is also an opportunity to compress data, or spill to disk or cloud storage.
-//!
-//! Producers settle their committed output as they go, keeping the active, unsettled chunk set small.
-//! Implementors must keep [`len`](Chunk::len) cheap even when a chunk's body is paged out.
-
-use std::collections::VecDeque;
-
-use super::spine::SpineBatch;
-use differential_dataflow::lattice::Lattice;
-use timely::progress::Antichain;
-use timely::progress::frontier::AntichainRef;
-
-/// A non-empty, bounded, consolidated, sorted sequence of `(data, time, diff)`.
-///
-/// An implementor gains access to types and trait implementations that provide
-/// batch formation and trace maintenance with no additional effort.
-///
-/// The necessary implementations are either "data" or "metadata" operations.
-/// The "data" operations transform lists of chunks, are expected to do roughly
-/// "one chunk's worth" of work at a time; they can afford to compress and page.
-/// The "metadata" operations provide chunk information, and should be lightweight.
-///
-/// The trait exposes only time, which trace maintenance needs.
-/// Reading a chunk's contents is separate from trace maintenance.
-pub trait Chunk: Sized + Clone {
-    /// Retained I/O state for one chunk operation. It must not borrow the trace.
-    type Pending: Default;
-
-    /// Prepare operation state from resident metadata before reading any input.
-    fn pending_for(_left: &[Self], _right: &[Self]) -> Self::Pending {
-        Self::Pending::default()
-    }
-
-    /// The timestamp type of the chunk's updates.
-    ///
-    /// Trace maintenance uses time to describe intervals and to advance and compact updates.
-    type Time: Lattice + timely::progress::Timestamp;
-
-    /// The intended maximum chunk size.
-    const TARGET: usize;
-
-    /// The number of updates in the chunk.
-    fn len(&self) -> usize;
-
-    /// Merge the fronts of two input deques through their shared horizon.
-    ///
-    /// Both deques are non-empty (the caller guarantees it). The two queues are both
-    /// the heads of lists of chunks, and the implementor should only merge through the
-    /// least last `(key, val, time)` update, or risk emitting an unconsolidated
-    /// output chunk.
-    ///
-    /// When a chunk cannot be completely retired, perhaps it had the larger last update,
-    /// it should be rewritten as a new chunk and pushed back to the front of the queue.
-    /// The invocation is expected to consume at least one of its inputs, and the harness
-    /// may continually re-invoke if this doesn't happen.
-    ///
-    /// A merge concludes when the harness sees that either input is now empty, at which
-    /// point it appends the queue to the output without the method's assistance.
-    fn merge(in1: &mut VecDeque<Self>, in2: &mut VecDeque<Self>, out: &mut VecDeque<Self>);
-
-    /// Partition `input` updates into `keep` (greater or equal `frontier`) or not (`ship`).
-    ///
-    /// An implementation should yield with some frequency to allow the output to "settle".
-    /// The harness may guard against this, but it prefers to provide as much context as it
-    /// can in order to allow broader chunk fusion where needed.
-    fn extract(
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<Self::Time>,
-        residual: &mut Antichain<Self::Time>,
-        keep: &mut VecDeque<Self>,
-        ship: &mut VecDeque<Self>,
-    );
-
-    /// Advance times by `frontier` producing consolidated chunks.
-    ///
-    /// An output for `(key, val)` should generally not be produced until a later pair
-    /// is observed, or `done` is set, to ensure the output chunks are consolidated.
-    /// Incomplete work can be pushed back to the front of `input`.
-    ///
-    /// On `done` a single `(key, val)` group may span the whole input; advancing and
-    /// consolidating it should cost time linear in its size, not quadratic.
-    fn advance(
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<Self::Time>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    );
-
-    /// Reshape `input` to a sequence that maintains the "grading" structural invariant.
-    ///
-    /// Specifically, the chunks in `output` should have a maximum size of `TARGET` and
-    /// each adjacent pair should have lengths that sum to more than `TARGET`.
-    /// This is also a good moment to consider compression or paging out the contents.
-    /// When `done` is set the input must be moved to the output.
-    ///
-    /// This method may be called on already settled data, and should be efficient then.
-    ///
-    /// Implementors that want the standard maximal packing can delegate to the
-    /// [`pack`] helper, supplying their layout's coalesce / split / commit closures.
-    fn settle(input: &mut VecDeque<Self>, done: bool, out: &mut VecDeque<Self>);
-
-    /// Poll a merge tick, retaining progress and registering a wakeup when blocked.
-    fn poll_merge(
-        _state: &mut Self::Pending,
-        _cx: &mut std::task::Context<'_>,
-        in1: &mut VecDeque<Self>,
-        in2: &mut VecDeque<Self>,
-        out: &mut VecDeque<Self>,
-    ) -> std::task::Poll<()> {
-        Self::merge(in1, in2, out);
-        std::task::Poll::Ready(())
-    }
-    /// Poll timestamp advancement. `done` and `frontier` stay fixed while pending.
-    fn poll_advance(
-        _state: &mut Self::Pending,
-        _cx: &mut std::task::Context<'_>,
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<Self::Time>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    ) -> std::task::Poll<()> {
-        Self::advance(input, frontier, done, out);
-        std::task::Poll::Ready(())
-    }
-    /// Poll extraction. The frontier and output queues stay fixed while pending.
-    fn poll_extract(
-        _state: &mut Self::Pending,
-        _cx: &mut std::task::Context<'_>,
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<Self::Time>,
-        residual: &mut Antichain<Self::Time>,
-        keep: &mut VecDeque<Self>,
-        ship: &mut VecDeque<Self>,
-    ) -> std::task::Poll<()> {
-        Self::extract(input, frontier, residual, keep, ship);
-        std::task::Poll::Ready(())
-    }
-    /// Poll settlement, preserving both carry and output across suspension.
-    fn poll_settle(
-        _state: &mut Self::Pending,
-        _cx: &mut std::task::Context<'_>,
-        input: &mut VecDeque<Self>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    ) -> std::task::Poll<()> {
-        Self::settle(input, done, out);
-        std::task::Poll::Ready(())
-    }
-}
-
-/// Maximal-packing driver an implementor's [`Chunk::settle`] may delegate to.
-///
-/// Holds a `carry` chunk under construction, grown by `combine` until it reaches
-/// `TARGET` (then emitted) and emitted early when the next chunk can't be absorbed
-/// without exceeding `TARGET`; over-sized chunks are peeled with `split`. Each
-/// committed chunk is passed through `seal` (the compress / spill hook — use the
-/// identity closure when there's nothing to do). The closures are the only
-/// layout-specific pieces:
-///
-/// * `combine(&mut acc, next)` — append `next` onto `acc` (caller guarantees their
-///   lengths sum to at most `TARGET`, and `next` follows `acc` in one sorted,
-///   consolidated chain), so packing a run of small chunks stays linear.
-/// * `split(chunk, n)` — the first `n` updates and the remaining `len - n`.
-/// * `seal(chunk)` — commit a chunk (e.g. compress or spill); identity to keep it.
-pub fn pack<C: Chunk>(
-    input: &mut VecDeque<C>,
-    done: bool,
-    out: &mut VecDeque<C>,
-    mut combine: impl FnMut(&mut C, C),
-    mut split: impl FnMut(C, usize) -> (C, C),
-    mut seal: impl FnMut(C) -> C,
-) {
-    let mut carry: Option<C> = None;
-    while let Some(chunk) = input.pop_front() {
-        match carry.take() {
-            None => pack_absorb(chunk, &mut carry, out, &mut split, &mut seal),
-            Some(mut c) if c.len() + chunk.len() <= C::TARGET => {
-                // Combines into one legal chunk; coalesce in place.
-                combine(&mut c, chunk);
-                if c.len() == C::TARGET {
-                    out.push_back(seal(c));
-                } else {
-                    carry = Some(c);
-                }
-            }
-            Some(c) => {
-                // `c` is maximal against this neighbour; emit it and absorb afresh.
-                out.push_back(seal(c));
-                pack_absorb(chunk, &mut carry, out, &mut split, &mut seal);
-            }
-        }
-    }
-    if let Some(c) = carry {
-        if done {
-            out.push_back(seal(c));
-        } else {
-            input.push_front(c);
-        }
-    }
-}
-
-/// Absorb `chunk` into an empty `carry` (a [`pack`] helper): pass a `TARGET` chunk
-/// straight through (sealed), hold a smaller one as the new carry, or peel
-/// `TARGET`-sized pieces off a larger one and carry the remainder.
-fn pack_absorb<C, S, L>(
-    chunk: C,
-    carry: &mut Option<C>,
-    out: &mut VecDeque<C>,
-    split: &mut S,
-    seal: &mut L,
-) where
-    C: Chunk,
-    S: FnMut(C, usize) -> (C, C),
-    L: FnMut(C) -> C,
-{
-    match chunk.len().cmp(&C::TARGET) {
-        std::cmp::Ordering::Equal => out.push_back(seal(chunk)),
-        std::cmp::Ordering::Less => *carry = Some(chunk),
-        std::cmp::Ordering::Greater => {
-            let mut rest = chunk;
-            loop {
-                let (head, tail) = split(rest, C::TARGET);
-                out.push_back(seal(head));
-                if tail.len() >= C::TARGET {
-                    rest = tail;
-                } else {
-                    if tail.len() > 0 {
-                        *carry = Some(tail);
-                    }
-                    break;
-                }
-            }
-        }
-    }
-}
-
-/// A batch: an ordered [`Chunk`] sequence whose concatenation is its updates.
-pub struct ChunkBatch<C: Chunk> {
-    /// Ordered, consolidated chunks; their concatenation is the batch.
-    pub chunks: Vec<C>,
-}
-
-impl<C: Chunk> ChunkBatch<C> {
-    /// Assemble a batch from ordered chunks.
-    pub fn new(chunks: Vec<C>) -> Self {
-        for chunk in &chunks {
-            assert!(chunk.len() > 0, "ChunkBatch chunks must be non-empty");
-        }
-        ChunkBatch { chunks }
-    }
-}
-
-impl<C: Chunk + 'static> SpineBatch for ChunkBatch<C>
-where
-    C::Time: timely::progress::Timestamp + Lattice + Ord,
-{
-    type Time = C::Time;
-    type Merger = ChunkBatchMerger<C>;
-    fn len(&self) -> usize {
-        self.chunks.iter().map(C::len).sum()
-    }
-}
-
-/// A merge-batcher [`Merger`](super::batcher::Merger)
-/// over chains of [`Chunk`]s.
-///
-/// `merge` runs the whole-chain binary merger; `extract` splits by the seal frontier
-/// using [`Chunk::extract`]. The batcher consolidates equal `(data, time)` updates
-/// but does *not* advance times — time advancement is advance's job, handled later in
-/// the trace. Both settle their output, since the batcher's chains want to be graded.
-pub type ChunkBatcher<Chu, C> = super::batcher::MergeBatcher<Chu, ChunkMerger<C>, ChunkBuilder<C>>;
-
-/// A spine of `Rc`-shared [`ChunkBatch`]s of type `C`: the trace type for `arrange`.
-pub type ChunkSpine<C> = super::spine::Spine<std::rc::Rc<ChunkBatch<C>>>;
-
-/// A [`ChunkBatch`] builder over chunks of type `C`, emitting `Rc`-shared updates.
-pub type ChunkBuilder<C> = ChunkBatchBuilder<C>;
-
-/// A merge-batcher [`Merger`](super::batcher::Merger)
-/// over chains of [`Chunk`]s.
-///
-/// `merge` runs the whole-chain binary merger; `extract` splits by the seal frontier
-/// using [`Chunk::extract`]. The batcher consolidates equal `(data, time)` updates
-/// but does *not* advance times — time advancement is advance's job, handled later in
-/// the trace. Both settle their output, since the batcher's chains want to be graded.
-pub struct ChunkMerger<C: Chunk> {
-    merge: Option<ChainMerge<C>>,
-    extract: Option<ChainExtract<C>>,
-}
-
-enum ChainPhase {
-    Choose,
-    Merge,
-    Settle(bool),
-}
-struct ChainMerge<C: Chunk> {
-    a: VecDeque<C>,
-    b: VecDeque<C>,
-    staged: VecDeque<C>,
-    settled: VecDeque<C>,
-    io: C::Pending,
-    phase: ChainPhase,
-}
-enum ExtractPhase {
-    Choose,
-    Extract,
-    Keep(bool),
-    Ship(bool),
-}
-struct ChainExtract<C: Chunk> {
-    input: VecDeque<C>,
-    keep: VecDeque<C>,
-    ship: VecDeque<C>,
-    kept: VecDeque<C>,
-    shipped: VecDeque<C>,
-    io: C::Pending,
-    phase: ExtractPhase,
-}
-impl<C: Chunk> Default for ChunkMerger<C> {
-    fn default() -> Self {
-        Self {
-            merge: None,
-            extract: None,
-        }
-    }
-}
-
-impl<C> super::batcher::Merger for ChunkMerger<C>
-where
-    C: Chunk + Default + 'static,
-    C::Time: Clone + timely::PartialOrder + 'static,
-{
-    type Chunk = C;
-    type Time = C::Time;
-
-    fn merge(&mut self, list1: Vec<C>, list2: Vec<C>, output: &mut Vec<C>, _stash: &mut Vec<C>) {
-        // Settle the output after each merge, to maintain bounded active chunks.
-        let mut in1: VecDeque<C> = list1.into();
-        let mut in2: VecDeque<C> = list2.into();
-        let (mut staged, mut settled) = (VecDeque::new(), VecDeque::new());
-        while !in1.is_empty() && !in2.is_empty() {
-            C::merge(&mut in1, &mut in2, &mut staged);
-            C::settle(&mut staged, false, &mut settled);
-        }
-        // Append the non-empty tail from either input, settle as we go.
-        for tail in in1.drain(..).chain(in2.drain(..)) {
-            staged.push_back(tail);
-            C::settle(&mut staged, false, &mut settled);
-        }
-        C::settle(&mut staged, true, &mut settled);
-        output.extend(settled);
-    }
-
-    fn extract(
-        &mut self,
-        merged: Vec<C>,
-        upper: AntichainRef<C::Time>,
-        frontier: &mut Antichain<C::Time>,
-        ship: &mut Vec<C>,
-        kept: &mut Vec<C>,
-        _stash: &mut Vec<C>,
-    ) {
-        // `extract` keeps updates greater-or-equal `upper` and ships the rest, folding
-        // the lower envelope of kept times into `frontier`. Drive it a bounded amount
-        // per call (≈ one input chunk) and `settle` each side as it accumulates, so
-        // neither `keep` (retained across yields) nor `ship` (handed to the builder)
-        // builds up unsettled in core. `settle` may withhold a sub-`TARGET` carry
-        // between calls; the final `settle(done)` flushes it.
-        let mut input: VecDeque<C> = merged.into();
-        let (mut keep, mut shipped) = (VecDeque::new(), VecDeque::new());
-        let (mut kept_q, mut shipped_q) = (VecDeque::new(), VecDeque::new());
-        while !input.is_empty() {
-            C::extract(&mut input, upper, frontier, &mut keep, &mut shipped);
-            C::settle(&mut keep, false, &mut kept_q);
-            C::settle(&mut shipped, false, &mut shipped_q);
-        }
-        C::settle(&mut keep, true, &mut kept_q);
-        C::settle(&mut shipped, true, &mut shipped_q);
-        kept.extend(kept_q);
-        ship.extend(shipped_q);
-    }
-
-    fn poll_merge(
-        &mut self,
-        a: &mut Vec<C>,
-        b: &mut Vec<C>,
-        output: &mut Vec<C>,
-        _stash: &mut Vec<C>,
-        cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<()> {
-        use std::task::{Poll, ready};
-        let work = self.merge.get_or_insert_with(|| ChainMerge {
-            io: C::pending_for(a, b),
-            a: std::mem::take(a).into(),
-            b: std::mem::take(b).into(),
-            staged: VecDeque::new(),
-            settled: VecDeque::new(),
-            phase: ChainPhase::Choose,
-        });
-        loop {
-            match work.phase {
-                ChainPhase::Choose => {
-                    work.phase = if !work.a.is_empty() && !work.b.is_empty() {
-                        ChainPhase::Merge
-                    } else if let Some(tail) = work.a.pop_front().or_else(|| work.b.pop_front()) {
-                        work.staged.push_back(tail);
-                        ChainPhase::Settle(false)
-                    } else {
-                        ChainPhase::Settle(true)
-                    };
-                }
-                ChainPhase::Merge => {
-                    ready!(C::poll_merge(
-                        &mut work.io,
-                        cx,
-                        &mut work.a,
-                        &mut work.b,
-                        &mut work.staged
-                    ));
-                    work.phase = ChainPhase::Settle(false);
-                }
-                ChainPhase::Settle(done) => {
-                    ready!(C::poll_settle(
-                        &mut work.io,
-                        cx,
-                        &mut work.staged,
-                        done,
-                        &mut work.settled
-                    ));
-                    if done {
-                        output.extend(self.merge.take().unwrap().settled);
-                        return Poll::Ready(());
-                    }
-                    work.phase = ChainPhase::Choose;
-                }
-            }
-        }
-    }
-
-    fn poll_extract(
-        &mut self,
-        input: &mut Vec<C>,
-        upper: AntichainRef<C::Time>,
-        frontier: &mut Antichain<C::Time>,
-        ship: &mut Vec<C>,
-        kept: &mut Vec<C>,
-        _stash: &mut Vec<C>,
-        cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<()> {
-        use std::task::{Poll, ready};
-        let work = self.extract.get_or_insert_with(|| ChainExtract {
-            io: C::pending_for(input, &[]),
-            input: std::mem::take(input).into(),
-            keep: VecDeque::new(),
-            ship: VecDeque::new(),
-            kept: VecDeque::new(),
-            shipped: VecDeque::new(),
-            phase: ExtractPhase::Choose,
-        });
-        loop {
-            match work.phase {
-                ExtractPhase::Choose => {
-                    work.phase = if work.input.is_empty() {
-                        ExtractPhase::Keep(true)
-                    } else {
-                        ExtractPhase::Extract
-                    };
-                }
-                ExtractPhase::Extract => {
-                    ready!(C::poll_extract(
-                        &mut work.io,
-                        cx,
-                        &mut work.input,
-                        upper,
-                        frontier,
-                        &mut work.keep,
-                        &mut work.ship
-                    ));
-                    work.phase = ExtractPhase::Keep(false);
-                }
-                ExtractPhase::Keep(done) => {
-                    ready!(C::poll_settle(
-                        &mut work.io,
-                        cx,
-                        &mut work.keep,
-                        done,
-                        &mut work.kept
-                    ));
-                    work.phase = ExtractPhase::Ship(done);
-                }
-                ExtractPhase::Ship(done) => {
-                    ready!(C::poll_settle(
-                        &mut work.io,
-                        cx,
-                        &mut work.ship,
-                        done,
-                        &mut work.shipped
-                    ));
-                    if done {
-                        let work = self.extract.take().unwrap();
-                        ship.extend(work.shipped);
-                        kept.extend(work.kept);
-                        return Poll::Ready(());
-                    }
-                    work.phase = ExtractPhase::Choose;
-                }
-            }
-        }
-    }
-
-    fn len(chunk: &C) -> usize {
-        chunk.len()
-    }
-}
-
-enum BatchMergePhase {
-    Choose,
-    Merge,
-    Account,
-    Advance,
-    Settle,
-}
-
-/// The resumable [`SpineBatch::Merger`] for [`ChunkBatch`]: merges two updates and advances
-/// their times to the compaction frontier, a fuel-bounded step at a time.
-///
-/// Each step pipelines [`merge`](Chunk::merge) → [`advance`](Chunk::advance) →
-/// [`settle`](Chunk::settle) and settles its output, so a suspended merge holds only
-/// graded chunks. The sources are read by cloning (a cheap refcount bump) and must be
-/// supplied unchanged on every call.
-pub struct ChunkBatchMerger<C: Chunk> {
-    /// Compaction frontier supplied at construction.
-    frontier: Antichain<C::Time>,
-    /// Input deques, refilled from the sources (clones) head-of-list at a time.
-    in1: VecDeque<C>,
-    in2: VecDeque<C>,
-    /// Next source chunk to clone into `in1` / `in2`.
-    idx1: usize,
-    idx2: usize,
-    /// `advance`'s input: the merge output plus advance's withheld carry at the front.
-    merged: VecDeque<C>,
-    /// `advance`'s output and `settle`'s input: merged-and-advanced chunks, with
-    /// settle's withheld sub-`TARGET` carry at the front.
-    advanced: VecDeque<C>,
-    /// `settle`'s output: the committed, graded result, grown by `work`. Graded at
-    /// every yield, so a suspended merge holds well-formed (spillable) chunk state.
-    settled: VecDeque<C>,
-    /// Set once both sources are drained and advance's and settle's final flushes ran.
-    complete: bool,
-    io: C::Pending,
-    phase: BatchMergePhase,
-    work: usize,
-    produced: VecDeque<C>,
-}
-
-impl<C> super::spine::Merger<ChunkBatch<C>> for ChunkBatchMerger<C>
-where
-    C: Chunk + 'static,
-    C::Time: timely::progress::Timestamp + Lattice + Ord + 'static,
-{
-    fn new(
-        source1: &ChunkBatch<C>,
-        source2: &ChunkBatch<C>,
-        frontier: AntichainRef<C::Time>,
-    ) -> Self {
-        Self {
-            frontier: frontier.to_owned(),
-            in1: VecDeque::new(),
-            in2: VecDeque::new(),
-            idx1: 0,
-            idx2: 0,
-            merged: VecDeque::new(),
-            advanced: VecDeque::new(),
-            settled: VecDeque::new(),
-            complete: false,
-            io: C::pending_for(&source1.chunks, &source2.chunks),
-            phase: BatchMergePhase::Choose,
-            work: 0,
-            produced: VecDeque::new(),
-        }
-    }
-
-    fn work(&mut self, source1: &ChunkBatch<C>, source2: &ChunkBatch<C>, fuel: &mut isize) {
-        let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
-        assert!(
-            self.poll_work(source1, source2, &mut cx, fuel).is_ready(),
-            "pending chunk merger requires poll_work"
-        );
-    }
-
-    fn poll_work(
-        &mut self,
-        source1: &ChunkBatch<C>,
-        source2: &ChunkBatch<C>,
-        cx: &mut std::task::Context<'_>,
-        fuel: &mut isize,
-    ) -> std::task::Poll<super::spine::MergeStatus> {
-        use super::spine::MergeStatus;
-        use std::task::{Poll, ready};
-        loop {
-            match self.phase {
-                BatchMergePhase::Choose => {
-                    if self.complete {
-                        return Poll::Ready(MergeStatus::Complete);
-                    }
-                    if *fuel <= 0 {
-                        return Poll::Ready(MergeStatus::InProgress);
-                    }
-                    const BURST: usize = 8;
-                    while self.in1.len() < BURST && self.idx1 < source1.chunks.len() {
-                        self.in1.push_back(source1.chunks[self.idx1].clone());
-                        self.idx1 += 1;
-                    }
-                    while self.in2.len() < BURST && self.idx2 < source2.chunks.len() {
-                        self.in2.push_back(source2.chunks[self.idx2].clone());
-                        self.idx2 += 1;
-                    }
-                    if !self.in1.is_empty() && !self.in2.is_empty() {
-                        self.phase = BatchMergePhase::Merge;
-                    } else {
-                        if let Some(chunk) = self.in1.pop_front().or_else(|| self.in2.pop_front()) {
-                            self.produced.push_back(chunk);
-                        } else {
-                            self.complete = true;
-                        }
-                        self.phase = BatchMergePhase::Account;
-                    }
-                }
-                BatchMergePhase::Merge => {
-                    ready!(C::poll_merge(
-                        &mut self.io,
-                        cx,
-                        &mut self.in1,
-                        &mut self.in2,
-                        &mut self.produced
-                    ));
-                    self.phase = BatchMergePhase::Account;
-                }
-                BatchMergePhase::Account => {
-                    self.work = self.produced.iter().map(C::len).sum();
-                    self.merged.append(&mut self.produced);
-                    self.phase = BatchMergePhase::Advance;
-                }
-                BatchMergePhase::Advance => {
-                    ready!(C::poll_advance(
-                        &mut self.io,
-                        cx,
-                        &mut self.merged,
-                        self.frontier.borrow(),
-                        self.complete,
-                        &mut self.advanced
-                    ));
-                    self.phase = BatchMergePhase::Settle;
-                }
-                BatchMergePhase::Settle => {
-                    ready!(C::poll_settle(
-                        &mut self.io,
-                        cx,
-                        &mut self.advanced,
-                        self.complete,
-                        &mut self.settled
-                    ));
-                    *fuel -= self.work.cast_signed();
-                    self.phase = BatchMergePhase::Choose;
-                }
-            }
-        }
-    }
-
-    fn done(self) -> Option<ChunkBatch<C>> {
-        debug_assert!(self.merged.is_empty() && self.advanced.is_empty());
-        wrap(self.settled.into())
-    }
-}
-
-/// A builder that collects a chunk sequence into a [`ChunkBatch`].
-pub struct ChunkBatchBuilder<C: Chunk> {
-    /// Pushed chunks awaiting settling; holds settle's sub-`TARGET` carry at the front.
-    input: VecDeque<C>,
-    /// The graded chunks emitted so far.
-    output: VecDeque<C>,
-}
-
-impl<C: Chunk> Default for ChunkBatchBuilder<C> {
-    fn default() -> Self {
-        Self {
-            input: VecDeque::new(),
-            output: VecDeque::new(),
-        }
-    }
-}
-
-impl<C> ChunkBatchBuilder<C>
-where
-    C: Chunk + Default + 'static,
-    C::Time: timely::progress::Timestamp,
-{
-    pub fn push(&mut self, chunk: &mut C) {
-        let chunk = std::mem::take(chunk);
-        if chunk.len() > 0 {
-            self.input.push_back(chunk);
-            C::settle(&mut self.input, false, &mut self.output);
-        }
-    }
-
-    pub fn done(self) -> Option<ChunkBatch<C>> {
-        let ChunkBatchBuilder {
-            mut input,
-            mut output,
-        } = self;
-        C::settle(&mut input, true, &mut output);
-        let chunks: Vec<C> = output.into();
-        wrap(chunks)
-    }
-}
-
-impl<C> super::batcher::Sealer<C> for ChunkBatchBuilder<C>
-where
-    C: Chunk + Default + 'static,
-    C::Time: timely::progress::Timestamp,
-{
-    type Output = ChunkBatch<C>;
-
-    fn seal(chain: &mut Vec<C>) -> Option<Self::Output> {
-        // We settle the chain because we are not guaranteed to received pre-settled data.
-        // This should be efficient on pre-settled data.
-        wrap(settle_all(std::mem::take(chain)))
-    }
-}
-
-/// Wraps settled chunks as a batch, absent when there are no chunks.
-fn wrap<C: Chunk>(chunks: Vec<C>) -> Option<ChunkBatch<C>> {
-    (!chunks.is_empty()).then(|| ChunkBatch::new(chunks))
-}
-
-/// Whether `chunks` satisfy the [`Chunk::TARGET`] grading invariant: every chunk
-/// at most `TARGET`, and every adjacent pair summing to more than `TARGET` (so no
-/// two neighbours could be combined into one legal chunk — a *maximal packing*).
-///
-/// This is the post-[`settle`](Chunk::settle) shape; useful as a test/debug check.
-pub fn is_graded<C: Chunk>(chunks: &[C]) -> bool {
-    chunks.iter().all(|c| c.len() <= C::TARGET)
-        && chunks
-            .windows(2)
-            .all(|w| w[0].len() + w[1].len() > C::TARGET)
-}
-
-/// Settle `input` to completion into a fresh graded `Vec` (see [`Chunk::settle`]).
-///
-/// A convenience for the one-shot callers (batch sealing, the batcher's merge and
-/// extract) that have a whole sequence in hand and want it graded; the streaming
-/// callers drive [`Chunk::settle`] directly across ticks.
-pub fn settle_all<C: Chunk>(input: impl IntoIterator<Item = C>) -> Vec<C> {
-    let mut input: VecDeque<C> = input.into_iter().collect();
-    let mut out = VecDeque::new();
-    C::settle(&mut input, true, &mut out);
-    debug_assert!(input.is_empty());
-    out.into()
-}
-
-/// Merge two full chains of chunks into one, to completion, appending to `out`.
-///
-/// The plain whole-chain driver: ticks [`Chunk::merge`] until one deque empties, then
-/// appends the other's remainder (the verbatim tail). Output is near-graded, not
-/// settled. The batcher's `merge` runs the same loop but settles after each push (the
-/// bounded-footprint discipline) and so does not use this; it stays as the simplest way
-/// to drive [`Chunk::merge`] to completion.
-pub fn merge_chains<C: Chunk>(chain1: Vec<C>, chain2: Vec<C>, out: &mut VecDeque<C>) {
-    let mut in1: VecDeque<C> = chain1.into();
-    let mut in2: VecDeque<C> = chain2.into();
-    while !in1.is_empty() && !in2.is_empty() {
-        C::merge(&mut in1, &mut in2, out);
-    }
-    // One deque is empty; the other's remainder is all greater than everything merged.
-    out.extend(in1.drain(..));
-    out.extend(in2.drain(..));
-}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index 65daee2d33c7c..c699d40200e59 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -73,171 +73,17 @@
 //! have paid back any "debt" to higher layers by continuing to provide fuel as updates arrive.
 
 use std::collections::VecDeque;
-use std::rc::Rc;
 use std::task::{Context, Poll, Waker};
 
-use differential_dataflow::lattice::Lattice;
-use differential_dataflow::logging::Logger;
-use differential_dataflow::trace::{Description, ExertionLogic};
+use differential_dataflow_next::lattice::Lattice;
+use differential_dataflow_next::logging::Logger;
+use differential_dataflow_next::trace::asynchronous::{Batch as SpineBatch, MergeStatus, Merger};
+use differential_dataflow_next::trace::{Description, ExertionLogic, Span};
 use mz_ore::cast::CastFrom;
 
-use ::timely::dataflow::operators::generic::OperatorInfo;
-use ::timely::order::PartialOrder;
-use ::timely::progress::{Antichain, Timestamp, frontier::AntichainRef};
-
-/// An interval of a trace's history: a description of the times it covers, and the batch of
-/// updates within it, absent exactly when there are none.
-///
-/// The interval is never empty, but the batch may be missing; a span records that its times
-/// happened and brought no updates.
-#[derive(Clone, Debug)]
-pub struct Span<T, B> {
-    /// The lower and upper bounds of contained update times, and the compaction frontier.
-    pub desc: Description<T>,
-    /// The updates within the interval; absent exactly when there are none.
-    pub inner: Option<B>,
-}
-
-impl<T, B> Span<T, B> {
-    /// A span from a description and the batch within it, absent when there are no updates.
-    pub fn new(desc: Description<T>, inner: Option<B>) -> Self {
-        Self { desc, inner }
-    }
-    /// All times in the span are greater or equal to an element of `lower`.
-    pub fn lower(&self) -> &Antichain<T> {
-        self.desc.lower()
-    }
-    /// All times in the span are not greater or equal to any element of `upper`.
-    pub fn upper(&self) -> &Antichain<T> {
-        self.desc.upper()
-    }
-    /// True if the span carries a batch of updates.
-    ///
-    /// This is about the updates, not the interval, which is never empty.
-    pub fn has_updates(&self) -> bool {
-        self.inner.is_some()
-    }
-}
-
-impl<T: Timestamp, B> Span<T, B> {
-    /// A span over the indicated interval carrying no updates.
-    pub fn empty(lower: Antichain<T>, upper: Antichain<T>) -> Self {
-        Self {
-            desc: Description::new(lower, upper, Antichain::from_elem(T::minimum())),
-            inner: None,
-        }
-    }
-}
-
-/// The requirements this spine imposes on the batches its spans carry.
-///
-/// These are opinions of this spine, not properties of batches in general: a batch must
-/// support progressive (fuel-limited) merging through a [`Merger`], and must report its
-/// size, which drives the spine's geometric layering and its logging.
-pub trait SpineBatch: Sized {
-    /// The timestamp type of the batch's updates.
-    type Time: Timestamp + Lattice;
-
-    /// A type used to progressively merge batches.
-    type Merger: Merger<Self>;
-
-    /// The number of updates in the batch.
-    ///
-    /// A span with nothing in it is meant to carry no batch at all rather than an empty one,
-    /// so this should be positive. The spine does not rely on that: it asks this method
-    /// rather than asking whether a span carries a batch, so a producer that hands it an
-    /// empty batch costs an extra merge rather than behaving differently from the absent
-    /// case.
-    fn len(&self) -> usize;
-}
-
-/// Whether a polled merger finished or exhausted its work allowance.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum MergeStatus {
-    /// More CPU work is required.
-    InProgress,
-    /// All output is ready for extraction.
-    Complete,
-}
-
-/// A progressive merge of consecutive batches, optionally waiting for I/O.
-pub trait Merger<Output: SpineBatch> {
-    /// Creates a new merger to merge the supplied batches, optionally compacting
-    /// up to the supplied frontier.
-    fn new(
-        source1: &Output,
-        source2: &Output,
-        compaction_frontier: AntichainRef<Output::Time>,
-    ) -> Self;
-    /// Perform some amount of work, decrementing `fuel`.
-    ///
-    /// If `fuel` is non-zero after the call, the merging is complete and
-    /// one should call `done` to extract the merged results.
-    fn work(&mut self, _source1: &Output, _source2: &Output, _fuel: &mut isize) {
-        panic!("this merger requires poll_work")
-    }
-    /// Perform admitted work, registering `cx` before returning pending.
-    ///
-    /// A pending call retains all progress, including consumed fuel. Polling again
-    /// must not resubmit reads or require the inputs to change. Waiting consumes no
-    /// fuel. Implementations must be ready to observe read completion even at zero fuel.
-    fn poll_work(
-        &mut self,
-        source1: &Output,
-        source2: &Output,
-        cx: &mut Context<'_>,
-        fuel: &mut isize,
-    ) -> Poll<MergeStatus> {
-        let _ = cx;
-        self.work(source1, source2, fuel);
-        Poll::Ready(if *fuel > 0 {
-            MergeStatus::Complete
-        } else {
-            MergeStatus::InProgress
-        })
-    }
-    /// Extracts merged results, absent if the merge cancelled to nothing.
-    ///
-    /// Call only after `poll_work` reports `Complete`, or the synchronous
-    /// `work` adapter reports completion through its remaining fuel.
-    fn done(self) -> Option<Output>;
-}
-
-impl<B: SpineBatch> SpineBatch for Rc<B> {
-    type Time = B::Time;
-    type Merger = RcMerger<B>;
-    fn len(&self) -> usize {
-        (**self).len()
-    }
-}
-
-/// Wrapper type for merging reference counted batches.
-pub struct RcMerger<B: SpineBatch> {
-    merger: B::Merger,
-}
-
-impl<B: SpineBatch> Merger<Rc<B>> for RcMerger<B> {
-    fn new(source1: &Rc<B>, source2: &Rc<B>, compaction_frontier: AntichainRef<B::Time>) -> Self {
-        RcMerger {
-            merger: B::Merger::new(source1, source2, compaction_frontier),
-        }
-    }
-    fn work(&mut self, source1: &Rc<B>, source2: &Rc<B>, fuel: &mut isize) {
-        self.merger.work(source1, source2, fuel)
-    }
-    fn poll_work(
-        &mut self,
-        source1: &Rc<B>,
-        source2: &Rc<B>,
-        cx: &mut Context<'_>,
-        fuel: &mut isize,
-    ) -> Poll<MergeStatus> {
-        self.merger.poll_work(source1, source2, cx, fuel)
-    }
-    fn done(self) -> Option<Rc<B>> {
-        self.merger.done().map(Rc::new)
-    }
-}
+use ::timely_next::dataflow::operators::generic::OperatorInfo;
+use ::timely_next::order::PartialOrder;
+use ::timely_next::progress::{Antichain, frontier::AntichainRef};
 
 /// The number of updates in a span: its batch's length, or zero when it carries none.
 ///
@@ -287,7 +133,7 @@ pub struct Spine<B: SpineBatch> {
     pending: Vec<Span<B::Time, B>>,        // Spans at times in advance of `frontier`.
     upper: Antichain<B::Time>,
     effort: usize,
-    activator: Option<timely::scheduling::activate::Activator>,
+    activator: Option<timely_next::scheduling::activate::Activator>,
     /// Parameters to `exert_logic`, containing tuples of `(index, count, length)`.
     exert_logic_param: Vec<(usize, usize, usize)>,
     /// Logic to indicate whether and how many records we should introduce in the absence of actual updates.
@@ -302,7 +148,7 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         // If `upper` is the minimum frontier, we can return an empty cursor.
         // This can happen with operators that are written to expect the ability to acquire cursors
         // for their prior frontiers, and which start at `[T::minimum()]`, such as `Reduce`, sadly.
-        if upper.less_equal(&<B::Time as timely::progress::Timestamp>::minimum()) {
+        if upper.less_equal(&<B::Time as timely_next::progress::Timestamp>::minimum()) {
             return Some(Vec::new());
         }
 
@@ -435,9 +281,9 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
 impl<B: SpineBatch + Clone + 'static> Spine<B> {
     /// Construct an empty spine with the default effort multiplier.
     pub fn new(
-        info: ::timely::dataflow::operators::generic::OperatorInfo,
-        logging: Option<differential_dataflow::logging::Logger>,
-        activator: Option<timely::scheduling::activate::Activator>,
+        info: ::timely_next::dataflow::operators::generic::OperatorInfo,
+        logging: Option<differential_dataflow_next::logging::Logger>,
+        activator: Option<timely_next::scheduling::activate::Activator>,
     ) -> Self {
         Self::with_effort(1, info, logging, activator)
     }
@@ -489,7 +335,7 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
     pub fn insert(&mut self, span: Span<B::Time, B>) {
         // Log the introduction of a batch.
         self.logger.as_ref().map(|l| {
-            l.log(differential_dataflow::logging::BatchEvent {
+            l.log(differential_dataflow_next::logging::BatchEvent {
                 operator: self.operator.global_id,
                 length: span_len(&span),
             })
@@ -527,23 +373,23 @@ impl<B: SpineBatch> Spine<B> {
             for batch in self.merging.drain(..) {
                 match batch {
                     MergeState::Single(Some(batch)) => {
-                        logger.log(differential_dataflow::logging::DropEvent {
+                        logger.log(differential_dataflow_next::logging::DropEvent {
                             operator: self.operator.global_id,
                             length: span_len(&batch),
                         });
                     }
                     MergeState::Double(MergeVariant::InProgress(batch1, batch2, _, _)) => {
-                        logger.log(differential_dataflow::logging::DropEvent {
+                        logger.log(differential_dataflow_next::logging::DropEvent {
                             operator: self.operator.global_id,
                             length: span_len(&batch1),
                         });
-                        logger.log(differential_dataflow::logging::DropEvent {
+                        logger.log(differential_dataflow_next::logging::DropEvent {
                             operator: self.operator.global_id,
                             length: span_len(&batch2),
                         });
                     }
                     MergeState::Double(MergeVariant::Complete(Some((batch, _)))) => {
-                        logger.log(differential_dataflow::logging::DropEvent {
+                        logger.log(differential_dataflow_next::logging::DropEvent {
                             operator: self.operator.global_id,
                             length: span_len(&batch),
                         });
@@ -552,7 +398,7 @@ impl<B: SpineBatch> Spine<B> {
                 }
             }
             for batch in self.pending.drain(..) {
-                logger.log(differential_dataflow::logging::DropEvent {
+                logger.log(differential_dataflow_next::logging::DropEvent {
                     operator: self.operator.global_id,
                     length: span_len(&batch),
                 });
@@ -602,8 +448,8 @@ impl<B: SpineBatch> Spine<B> {
     pub fn with_effort(
         mut effort: usize,
         operator: OperatorInfo,
-        logger: Option<differential_dataflow::logging::Logger>,
-        activator: Option<timely::scheduling::activate::Activator>,
+        logger: Option<differential_dataflow_next::logging::Logger>,
+        activator: Option<timely_next::scheduling::activate::Activator>,
     ) -> Self {
         // Zero effort is .. not smart.
         if effort == 0 {
@@ -614,14 +460,14 @@ impl<B: SpineBatch> Spine<B> {
             operator,
             logger,
             logical_frontier: Antichain::from_elem(
-                <B::Time as timely::progress::Timestamp>::minimum(),
+                <B::Time as timely_next::progress::Timestamp>::minimum(),
             ),
             physical_frontier: Antichain::from_elem(
-                <B::Time as timely::progress::Timestamp>::minimum(),
+                <B::Time as timely_next::progress::Timestamp>::minimum(),
             ),
             merging: Vec::new(),
             pending: Vec::new(),
-            upper: Antichain::from_elem(<B::Time as timely::progress::Timestamp>::minimum()),
+            upper: Antichain::from_elem(<B::Time as timely_next::progress::Timestamp>::minimum()),
             effort,
             activator,
             exert_logic_param: Vec::default(),
@@ -814,7 +660,7 @@ impl<B: SpineBatch> Spine<B> {
             MergeState::Single(old) => {
                 // Log the initiation of a merge.
                 self.logger.as_ref().map(|l| {
-                    l.log(differential_dataflow::logging::MergeEvent {
+                    l.log(differential_dataflow_next::logging::MergeEvent {
                         operator: self.operator.global_id,
                         scale: index,
                         length1: old.as_ref().map(span_len).unwrap_or(0),
@@ -837,7 +683,7 @@ impl<B: SpineBatch> Spine<B> {
             if let Some((input1, input2)) = inputs {
                 // Log the completion of a merge from existing parts.
                 self.logger.as_ref().map(|l| {
-                    l.log(differential_dataflow::logging::MergeEvent {
+                    l.log(differential_dataflow_next::logging::MergeEvent {
                         operator: self.operator.global_id,
                         scale: index,
                         length1: span_len(&input1),
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests.rs
index 4a7053f123c7f..961700d34a4d4 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests.rs
@@ -2,5 +2,4 @@
 // SPDX-License-Identifier: MIT
 // See LICENSE.
 
-mod chunk;
 mod spine;
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs
deleted file mode 100644
index 8055d880abb94..0000000000000
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/chunk.rs
+++ /dev/null
@@ -1,211 +0,0 @@
-// Copyright (c) 2015 Frank McSherry
-// SPDX-License-Identifier: MIT
-// See ../LICENSE.
-
-use std::collections::VecDeque;
-use std::task::{Context, Poll, Waker};
-
-use super::super::batcher::Merger as ChainMerger;
-use super::super::chunk::{Chunk, ChunkBatch, ChunkBatchMerger, ChunkMerger};
-use super::super::spine::{MergeStatus, Merger};
-use differential_dataflow::trace::chunk::{Chunk as MzChunk, vec::VecChunk};
-use differential_dataflow::trace::{Cursor, Navigable};
-use timely::container::PushInto;
-use timely::progress::{Antichain, frontier::AntichainRef};
-
-type Inner = VecChunk<u64, (), u64, i64>;
-#[derive(Clone, Default)]
-struct Delayed(Inner);
-#[derive(Default)]
-struct Pending {
-    operation: Option<&'static str>,
-}
-impl Pending {
-    // Complete the primitive's mutation before suspending. Its input may now be
-    // empty, but the driver must still poll the same primitive to completion.
-    fn poll(&mut self, operation: &'static str, cx: &Context<'_>, work: impl FnOnce()) -> Poll<()> {
-        if let Some(saved) = self.operation.take() {
-            assert_eq!(saved, operation, "resumed a different primitive");
-            Poll::Ready(())
-        } else {
-            work();
-            self.operation = Some(operation);
-            cx.waker().wake_by_ref();
-            Poll::Pending
-        }
-    }
-}
-fn raw(queue: &mut VecDeque<Delayed>) -> VecDeque<Inner> {
-    queue.drain(..).map(|c| c.0).collect()
-}
-fn restore(queue: &mut VecDeque<Delayed>, chunks: VecDeque<Inner>) {
-    queue.extend(chunks.into_iter().map(Delayed));
-}
-impl Chunk for Delayed {
-    type Time = u64;
-    type Pending = Pending;
-    const TARGET: usize = Inner::TARGET;
-    fn len(&self) -> usize {
-        self.0.len()
-    }
-    fn merge(a: &mut VecDeque<Self>, b: &mut VecDeque<Self>, out: &mut VecDeque<Self>) {
-        let (mut aa, mut bb, mut result) = (raw(a), raw(b), VecDeque::new());
-        Inner::merge(&mut aa, &mut bb, &mut result);
-        restore(a, aa);
-        restore(b, bb);
-        restore(out, result);
-    }
-    fn advance(
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<u64>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    ) {
-        let (mut aa, mut result) = (raw(input), VecDeque::new());
-        Inner::advance(&mut aa, frontier, done, &mut result);
-        restore(input, aa);
-        restore(out, result);
-    }
-    fn extract(
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<u64>,
-        residual: &mut Antichain<u64>,
-        keep: &mut VecDeque<Self>,
-        ship: &mut VecDeque<Self>,
-    ) {
-        let (mut aa, mut kept, mut shipped) = (raw(input), VecDeque::new(), VecDeque::new());
-        Inner::extract(&mut aa, frontier, residual, &mut kept, &mut shipped);
-        restore(input, aa);
-        restore(keep, kept);
-        restore(ship, shipped);
-    }
-    fn settle(input: &mut VecDeque<Self>, done: bool, out: &mut VecDeque<Self>) {
-        let (mut aa, mut result) = (raw(input), VecDeque::new());
-        Inner::settle(&mut aa, done, &mut result);
-        restore(input, aa);
-        restore(out, result);
-    }
-    fn poll_merge(
-        state: &mut Pending,
-        cx: &mut Context<'_>,
-        a: &mut VecDeque<Self>,
-        b: &mut VecDeque<Self>,
-        out: &mut VecDeque<Self>,
-    ) -> Poll<()> {
-        state.poll("merge", cx, || Self::merge(a, b, out))
-    }
-    fn poll_advance(
-        state: &mut Pending,
-        cx: &mut Context<'_>,
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<u64>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    ) -> Poll<()> {
-        state.poll("advance", cx, || Self::advance(input, frontier, done, out))
-    }
-    fn poll_extract(
-        state: &mut Pending,
-        cx: &mut Context<'_>,
-        input: &mut VecDeque<Self>,
-        frontier: AntichainRef<u64>,
-        residual: &mut Antichain<u64>,
-        keep: &mut VecDeque<Self>,
-        ship: &mut VecDeque<Self>,
-    ) -> Poll<()> {
-        state.poll("extract", cx, || {
-            Self::extract(input, frontier, residual, keep, ship)
-        })
-    }
-    fn poll_settle(
-        state: &mut Pending,
-        cx: &mut Context<'_>,
-        input: &mut VecDeque<Self>,
-        done: bool,
-        out: &mut VecDeque<Self>,
-    ) -> Poll<()> {
-        state.poll("settle", cx, || Self::settle(input, done, out))
-    }
-}
-fn chunk(rows: &[(u64, u64, i64)]) -> Delayed {
-    let mut chunk = Inner::default();
-    for &(key, time, diff) in rows {
-        chunk.push_into(((key, ()), time, diff));
-    }
-    Delayed(chunk)
-}
-fn rows(chunks: &[Delayed]) -> Vec<((u64, ()), u64, i64)> {
-    let mut rows = Vec::new();
-    for Delayed(chunk) in chunks {
-        let mut cursor = chunk.cursor();
-        while cursor.key_valid(chunk) {
-            let key = *cursor.key(chunk);
-            cursor.map_times(chunk, |time, diff| rows.push(((key, ()), *time, *diff)));
-            cursor.step_key(chunk);
-        }
-    }
-    rows
-}
-
-fn finish(mut poll: impl FnMut(&mut Context<'_>) -> Poll<()>) {
-    let mut cx = Context::from_waker(Waker::noop());
-    for _ in 0..1000 {
-        if poll(&mut cx).is_ready() {
-            return;
-        }
-    }
-    panic!("chunk operation did not complete");
-}
-#[mz_ore::test]
-fn batch_merge_resumes_each_phase_after_consuming_input() {
-    let a = ChunkBatch {
-        chunks: vec![chunk(&[(0, 0, 1), (1, 0, 2)]), chunk(&[(2, 0, 1)])],
-    };
-    let b = ChunkBatch {
-        chunks: vec![chunk(&[(0, 1, -1), (1, 1, 3)]), chunk(&[(3, 1, 1)])],
-    };
-    let mut merge = ChunkBatchMerger::new(&a, &b, Antichain::from_elem(2).borrow());
-    let mut fuel = 1;
-    let mut yields = 0;
-    finish(|cx| match merge.poll_work(&a, &b, cx, &mut fuel) {
-        Poll::Pending => {
-            yields += 1;
-            Poll::Pending
-        }
-        Poll::Ready(MergeStatus::InProgress) => {
-            assert!(fuel <= 0);
-            fuel = 1;
-            Poll::Pending
-        }
-        Poll::Ready(MergeStatus::Complete) => Poll::Ready(()),
-    });
-    assert!(yields >= 3);
-    assert_eq!(
-        rows(&merge.done().unwrap().chunks),
-        vec![((1, ()), 2, 5), ((2, ()), 2, 1), ((3, ()), 2, 1)]
-    );
-}
-#[mz_ore::test]
-fn chain_merge_and_extraction_resume_before_reusing_state() {
-    let mut a = vec![chunk(&[(0, 0, 1), (1, 3, 1)])];
-    let mut b = vec![chunk(&[(0, 0, -1), (2, 1, 1)])];
-    let mut merger = ChunkMerger::<Delayed>::default();
-    let (mut merged, mut stash) = (Vec::new(), Vec::new());
-    finish(|cx| merger.poll_merge(&mut a, &mut b, &mut merged, &mut stash, cx));
-    assert_eq!(rows(&merged), vec![((1, ()), 3, 1), ((2, ()), 1, 1)]);
-    let (mut ship, mut kept, mut frontier) = (Vec::new(), Vec::new(), Antichain::new());
-    finish(|cx| {
-        merger.poll_extract(
-            &mut merged,
-            Antichain::from_elem(2).borrow(),
-            &mut frontier,
-            &mut ship,
-            &mut kept,
-            &mut stash,
-            cx,
-        )
-    });
-    assert_eq!(rows(&ship), vec![((2, ()), 1, 1)]);
-    assert_eq!(rows(&kept), vec![((1, ()), 3, 1)]);
-    assert_eq!(frontier, Antichain::from_elem(3));
-}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
index f1b22bda55e97..5cc427f28974c 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -2,13 +2,13 @@
 // SPDX-License-Identifier: MIT
 // See ../LICENSE.
 
-use super::super::spine::Span;
-use super::super::spine::{MergeStatus, Merger, Spine, SpineBatch};
-use differential_dataflow::trace::Description;
+use super::super::spine::Spine;
+use differential_dataflow_next::trace::asynchronous::{Batch as SpineBatch, MergeStatus, Merger};
+use differential_dataflow_next::trace::{Description, Span};
 use std::sync::{Arc, Mutex};
 use std::task::{Context, Poll, Wake, Waker};
-use timely::dataflow::operators::generic::OperatorInfo;
-use timely::progress::{Antichain, frontier::AntichainRef};
+use timely_next::dataflow::operators::generic::OperatorInfo;
+use timely_next::progress::{Antichain, frontier::AntichainRef};
 
 #[derive(Default)]
 struct Gate {
@@ -16,33 +16,41 @@ struct Gate {
     waker: Option<Waker>,
     polls: usize,
 }
+
 struct WakeCount(std::sync::atomic::AtomicUsize);
+
 impl Wake for WakeCount {
     fn wake(self: Arc<Self>) {
         self.wake_by_ref();
     }
+
     fn wake_by_ref(self: &Arc<Self>) {
         self.0.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
     }
 }
+
 #[derive(Clone)]
 struct Batch {
     rows: Vec<(u64, u64, i64)>,
     gate: Arc<Mutex<Gate>>,
 }
+
 impl SpineBatch for Batch {
     type Time = u64;
     type Merger = Merge;
+
     fn len(&self) -> usize {
         self.rows.len()
     }
 }
+
 struct Merge {
     rows: Vec<(u64, u64, i64)>,
     position: usize,
     since: u64,
     gate: Arc<Mutex<Gate>>,
 }
+
 impl Merger<Batch> for Merge {
     fn new(a: &Batch, b: &Batch, since: AntichainRef<u64>) -> Self {
         Self {
@@ -52,6 +60,7 @@ impl Merger<Batch> for Merge {
             gate: Arc::clone(&a.gate),
         }
     }
+
     fn poll_work(
         &mut self,
         _: &Batch,
@@ -77,19 +86,21 @@ impl Merger<Batch> for Merge {
             MergeStatus::InProgress
         })
     }
+
     fn done(mut self) -> Option<Batch> {
         assert_eq!(
             self.position,
             self.rows.len(),
             "extracted an incomplete merge"
         );
-        differential_dataflow::consolidation::consolidate_updates(&mut self.rows);
+        differential_dataflow_next::consolidation::consolidate_updates(&mut self.rows);
         (!self.rows.is_empty()).then_some(Batch {
             rows: self.rows,
             gate: self.gate,
         })
     }
 }
+
 fn contents(trace: &Spine<Batch>) -> Vec<(u64, u64, i64)> {
     let mut rows = Vec::new();
     trace.map_spans(|span| {
@@ -97,9 +108,10 @@ fn contents(trace: &Spine<Batch>) -> Vec<(u64, u64, i64)> {
             rows.extend_from_slice(&batch.rows);
         }
     });
-    differential_dataflow::consolidation::consolidate_updates(&mut rows);
+    differential_dataflow_next::consolidation::consolidate_updates(&mut rows);
     rows
 }
+
 fn drive(trace: &mut Spine<Batch>, gate: &Mutex<Gate>, expected: &[(u64, u64, i64)]) {
     for _ in 0..200_000 {
         assert_eq!(
@@ -122,6 +134,7 @@ fn drive(trace: &mut Spine<Batch>, gate: &Mutex<Gate>, expected: &[(u64, u64, i6
     }
     panic!("maintenance failed to resume");
 }
+
 #[mz_ore::test]
 fn pending_reads_preserve_rollup_and_every_published_update() {
     let gate = Arc::new(Mutex::new(Gate::default()));
@@ -133,7 +146,7 @@ fn pending_reads_preserve_rollup_and_every_published_update() {
         let count = [1, 1, 2, 1, 32, 3, 1, 128, 2, 7][usize::try_from(time % 10).unwrap()];
         let rows = (0..count).map(|key| (key, time, 1)).collect::<Vec<_>>();
         expected.extend_from_slice(&rows);
-        differential_dataflow::consolidation::consolidate_updates(&mut expected);
+        differential_dataflow_next::consolidation::consolidate_updates(&mut expected);
         trace.insert(Span::new(
             Description::new(
                 Antichain::from_elem(time),

From 2c880b740e0af460de5220ce067d053cac61d92b Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Thu, 10 Sep 2026 12:37:46 -0400
Subject: [PATCH 15/31] timely-util: preserve maintenance allowances across
 read wakeups

---
 src/timely-util/src/columnar/chunk/native.rs  |  21 ++-
 .../src/columnar/chunk/native/vendor/spine.rs |  10 ++
 .../chunk/native/vendor/tests/spine.rs        | 144 ++++++++++++++++++
 3 files changed, 163 insertions(+), 12 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index a7a37ff1d0a49..46959a25cc824 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -316,26 +316,23 @@ impl Wake for NotifyWake {
     }
 }
 
-/// Finish the outstanding native maintenance operation, yielding while it waits for I/O.
+/// Apply one exertion turn, yielding while its maintenance waits for I/O.
 ///
 /// This does not force all batches to compact. DD's exertion policy determines
 /// the work allowance. The caller must use the notification installed by
 /// `Spine::with_budget` and poll this future on the owning Timely worker.
-pub(super) async fn maintain<D, T, R>(state: &RefCell<NativeSpine<D, T, R>>, notify: &Notify)
+pub(super) async fn maintain<B>(state: &RefCell<vendor::spine::Spine<B>>, notify: &Notify)
 where
-    D: Columnar + 'static,
-    for<'a> columnar::Ref<'a, D>: Copy + Ord,
-    T: Columnar + Default + Timestamp + Lattice + Ord,
-    for<'a> columnar::Ref<'a, T>: Copy + Ord,
-    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>> + 'static,
+    B: differential_dataflow_next::trace::asynchronous::Batch + Clone + 'static,
 {
-    loop {
-        state.borrow_mut().exert();
-        if !state.borrow().maintenance_pending() {
-            return;
-        }
+    state.borrow_mut().exert();
+    while state.borrow().maintenance_pending() {
         // No trace borrow may cross this await. Reader compaction can change the
         // same spine while a read is pending, and its wakeup uses this notification.
         notify.notified().await;
+        // A read completion resumes the existing allowance. Calling `exert` here
+        // would grant more fuel and could keep the arranger from accepting input
+        // until an entire merge finishes.
+        state.borrow_mut().resume_maintenance();
     }
 }
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index c699d40200e59..1ec36bc79d562 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -314,6 +314,16 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         }
     }
 
+    /// Resume queued maintenance without requesting another exertion allowance.
+    ///
+    /// Completion wakes the owner so it can accept input before starting further
+    /// maintenance. Incomplete work retains its fuel and waits for the read waker.
+    pub fn resume_maintenance(&mut self) {
+        if self.drive_maintenance() {
+            self.activate();
+        }
+    }
+
     /// Install the owning operator's wakeup before any maintenance can return pending.
     pub fn set_waker(&mut self, waker: Waker) {
         self.waker = Some(waker);
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
index 5cc427f28974c..df75aa2d78c1e 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -15,6 +15,7 @@ struct Gate {
     permits: usize,
     waker: Option<Waker>,
     polls: usize,
+    worked: usize,
 }
 
 struct WakeCount(std::sync::atomic::AtomicUsize);
@@ -76,6 +77,7 @@ impl Merger<Batch> for Merge {
                 return Poll::Pending;
             }
             gate.permits -= 1;
+            gate.worked += 1;
             self.rows[self.position].1 = self.rows[self.position].1.max(self.since);
             self.position += 1;
             *fuel -= 1;
@@ -168,3 +170,145 @@ fn pending_reads_preserve_rollup_and_every_published_update() {
     drive(&mut trace, &gate, &expected);
     assert!(wake.0.load(std::sync::atomic::Ordering::Relaxed) > 0);
 }
+
+struct MaintenanceSample {
+    worked: usize,
+    completions: usize,
+    elapsed: std::time::Duration,
+}
+
+// Two equal batches start a merge without doing any merge work during setup.
+// Each permit represents one row made available by a completed read. The same
+// maintenance future used by the arranger decides when input can resume.
+fn maintenance_sample(rows: u64, fuel: usize, read_rows: Option<usize>) -> MaintenanceSample {
+    use std::cell::RefCell;
+    use std::future::Future;
+    use std::pin::pin;
+    use std::time::Instant;
+
+    use crate::columnar::chunk::native::{NotifyWake, maintain};
+    use tokio::sync::Notify;
+
+    let gate = Arc::new(Mutex::new(Gate::default()));
+    let notify = Arc::new(Notify::new());
+    let mut trace = Spine::new(OperatorInfo::new(0, 0, [].into()), None, None);
+    trace.set_waker(Arc::new(NotifyWake(Arc::clone(&notify))).into());
+    for time in 0..2 {
+        trace.insert(Span::new(
+            Description::new(
+                Antichain::from_elem(time),
+                Antichain::from_elem(time + 1),
+                Antichain::from_elem(0),
+            ),
+            Some(Batch {
+                rows: (0..rows).map(|key| (key, time, 1)).collect(),
+                gate: Arc::clone(&gate),
+            }),
+        ));
+    }
+    trace.set_physical_compaction(Antichain::from_elem(2).borrow());
+    assert!(!trace.maintenance_pending());
+    assert_eq!(gate.lock().unwrap().worked, 0);
+    trace.set_exert_logic(Arc::new(move |levels| {
+        levels
+            .iter()
+            .any(|(_, count, _)| *count > 1)
+            .then_some(fuel)
+    }));
+    if read_rows.is_none() {
+        gate.lock().unwrap().permits = usize::MAX / 2;
+    }
+    let expected = contents(&trace);
+    let state = RefCell::new(trace);
+    let mut completions = 0;
+    let start = Instant::now();
+    {
+        let mut future = pin!(maintain(&state, &notify));
+        let wake_count = Arc::new(WakeCount(std::sync::atomic::AtomicUsize::new(0)));
+        let waker = Waker::from(Arc::clone(&wake_count));
+        let mut cx = Context::from_waker(&waker);
+        while future.as_mut().poll(&mut cx).is_pending() {
+            assert!(completions < 4 * rows);
+            let wake = {
+                let mut gate = gate.lock().unwrap();
+                gate.permits += read_rows.expect("resident maintenance must not suspend");
+                gate.waker
+                    .take()
+                    .expect("pending read must install a waker")
+            };
+            let before = wake_count.0.load(std::sync::atomic::Ordering::Relaxed);
+            wake.wake();
+            assert!(wake_count.0.load(std::sync::atomic::Ordering::Relaxed) > before);
+            completions += 1;
+        }
+    }
+    let elapsed = start.elapsed();
+    let worked = gate.lock().unwrap().worked;
+    assert_eq!(contents(&state.borrow()), expected);
+    assert!(!state.borrow().maintenance_pending());
+
+    // Returning to input must leave a wakeup for remaining background work.
+    if worked < usize::try_from(2 * rows).unwrap() {
+        let mut notified = std::pin::pin!(notify.notified());
+        assert!(
+            notified
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_ready()
+        );
+    }
+    gate.lock().unwrap().permits = usize::MAX / 2;
+    for _ in 0..=2 * rows {
+        state.borrow_mut().exert();
+        if gate.lock().unwrap().worked == usize::try_from(2 * rows).unwrap() {
+            assert_eq!(contents(&state.borrow()), expected);
+            return MaintenanceSample {
+                worked,
+                completions: usize::try_from(completions).unwrap(),
+                elapsed,
+            };
+        }
+    }
+    panic!("remaining merge work did not finish");
+}
+
+#[mz_ore::test]
+fn maintenance_readiness_preserves_work_allowance() {
+    for fuel in [1, 1000] {
+        let ready = maintenance_sample(4096, fuel, None);
+        assert_eq!(ready.worked, fuel);
+        for read_rows in [1, 64, 1024] {
+            let pending = maintenance_sample(4096, fuel, Some(read_rows));
+            assert_eq!(
+                pending.worked, ready.worked,
+                "fuel={fuel}, read_rows={read_rows}"
+            );
+        }
+    }
+}
+
+/// Run with `cargo test -p mz-timely-util maintenance_microbench -- --ignored --nocapture`.
+/// Reports work and read completions before the arranger can next accept input.
+/// Reads complete immediately when requested: timings measure scheduling and mock
+/// merge work, excluding setup and verification, and do not model device latency.
+#[mz_ore::test]
+#[ignore = "local scheduling microbenchmark"]
+fn maintenance_microbench() {
+    println!("rows_per_batch,fuel,read_rows,sample,worked,read_completions,elapsed_us");
+    for rows in [64, 4096, 65536] {
+        for fuel in [1, 1000] {
+            for read_rows in [None, Some(1), Some(64), Some(1024)] {
+                for sample in 0..5 {
+                    let result = maintenance_sample(rows, fuel, read_rows);
+                    println!(
+                        "{rows},{fuel},{},{sample},{},{},{}",
+                        read_rows.map_or_else(|| "ready".to_owned(), |n| n.to_string()),
+                        result.worked,
+                        result.completions,
+                        result.elapsed.as_micros()
+                    );
+                }
+            }
+        }
+    }
+}

From 485b0149612e8280da814458cfbc1d7b05817708 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Thu, 10 Sep 2026 15:31:38 -0400
Subject: [PATCH 16/31] timely-util: drain queued input before async trace
 maintenance

---
 .../src/columnar/chunk/asynchronous.rs        |  70 ++--
 .../chunk/asynchronous/operator_tests.rs      | 367 ++++++++++++++++++
 2 files changed, 409 insertions(+), 28 deletions(-)
 create mode 100644 src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs

diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index 2d256ee7afa8c..a578b49f5589f 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -71,14 +71,21 @@ where
         let mut batcher = Batcher::new(budget.clone());
         let mut chunker = ChunkChunker::<D, T, R>::default();
         let mut upper = Antichain::from_elem(T::minimum());
+        const INPUT_EVENTS_PER_TURN: usize = 32;
         loop {
-            let event = tokio::select! {
+            let mut event = tokio::select! {
+                biased;
                 _ = input.ready(), if !upper.is_empty() => input.next_sync(),
                 _ = notify.notified() => None,
             };
-            if let Some(event) = event {
-                match event {
-                    Event::Data(time, mut data) => {
+            let mut next_upper = None;
+            // Extra exertion can introduce virtual batches and change subsequent
+            // merge work. Amortize it over queued input, with a finite scheduling
+            // quantum so other operators still get a turn. The latest observed
+            // frontier suffices for sealing, including data read after it.
+            for index in 0..INPUT_EVENTS_PER_TURN {
+                match event.take() {
+                    Some(Event::Data(time, mut data)) => {
                         if cap.as_ref().is_none_or(|old| time.time() < old.time()) {
                             cap = Some(time);
                         }
@@ -87,31 +94,35 @@ where
                             batcher.push(std::mem::take(chunk)).await;
                         }
                     }
-                    Event::Progress(next) => {
-                        while let Some(chunk) = chunker.finish() {
-                            batcher.push(std::mem::take(chunk)).await;
-                        }
-                        if next != upper {
-                            let (chunks, description) = batcher.seal(next.clone()).await;
-                            let batch = Rc::new(ChunkBatch {
-                                chunks,
-                                description,
-                            });
-                            writer
-                                .insert(Rc::clone(&batch), cap.as_ref().map(|c| c.time().clone()));
-                            if let Some(time) = &cap {
-                                output.give(time, batch);
-                            }
-                            if let Some(t) = batcher.frontier().first() {
-                                cap.as_mut()
-                                    .expect("buffered data has a capability")
-                                    .downgrade(t);
-                            } else {
-                                cap = None;
-                            }
-                            upper = next;
-                        }
+                    Some(Event::Progress(next)) => next_upper = Some(next),
+                    None => break,
+                }
+                if index + 1 < INPUT_EVENTS_PER_TURN {
+                    event = input.next_sync();
+                }
+            }
+            if let Some(next) = next_upper {
+                while let Some(chunk) = chunker.finish() {
+                    batcher.push(std::mem::take(chunk)).await;
+                }
+                if next != upper {
+                    let (chunks, description) = batcher.seal(next.clone()).await;
+                    let batch = Rc::new(ChunkBatch {
+                        chunks,
+                        description,
+                    });
+                    writer.insert(Rc::clone(&batch), cap.as_ref().map(|c| c.time().clone()));
+                    if let Some(time) = &cap {
+                        output.give(time, batch);
+                    }
+                    if let Some(t) = batcher.frontier().first() {
+                        cap.as_mut()
+                            .expect("buffered data has a capability")
+                            .downgrade(t);
+                    } else {
+                        cap = None;
                     }
+                    upper = next;
                 }
             }
             maintain(&state, &notify).await;
@@ -127,6 +138,9 @@ where
     )
 }
 
+#[cfg(test)]
+mod operator_tests;
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
new file mode 100644
index 0000000000000..b973e6912216a
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -0,0 +1,367 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Live-operator checks and an opt-in comparison against the synchronous arranger.
+//!
+//! The benchmark uses deterministic 1,900-byte values with a repeated 475-byte
+//! pattern, overlapping key ranges, and independently advancing sources. All
+//! sources share one worker, pool, and decoded-input budget. It reports output
+//! frontier latency separately from the subsequent maintenance drain. The latter
+//! ends after admission is released and pool counters stay quiet for 20 ms.
+//! This exercises pool eviction and compression, not forced device contention.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use columnar::{Columnar, Index, Len};
+use differential_dataflow::operators::arrange::arrangement::arrange_core;
+use differential_dataflow::operators::arrange::{Arranged, TraceAgent};
+use differential_dataflow::trace::chunk::{ChunkBatch, ChunkBatcher, ChunkBuilder, ChunkSpine};
+use differential_dataflow::trace::{BatchReader, ExertionLogic, TraceReader};
+use itertools::Itertools;
+use mz_ore::pool::{Pool, PoolStats};
+use timely::container::{CapacityContainerBuilder, PushInto};
+use timely::dataflow::channels::pact::Pipeline;
+use timely::dataflow::operators::{Input, Inspect, Probe};
+use timely::dataflow::{InputHandle, Scope};
+
+use super::super::merge::ReadBudget;
+use super::super::{ChunkChunker, Column, ColumnChunk, with_spill_override};
+
+type Update = ((u64, Vec<u8>), u64, i64);
+type TestChunk = ColumnChunk<(u64, Vec<u8>), u64, i64>;
+type TestBatch = Rc<ChunkBatch<TestChunk>>;
+type InputPort = InputHandle<u64, CapacityContainerBuilder<Column<Update>>>;
+type ProbeHandle = timely::dataflow::operators::probe::Handle<u64>;
+
+#[derive(Default)]
+struct Observed {
+    batches: Vec<usize>,
+    rows: Option<Vec<Update>>,
+}
+
+fn observe<'scope, Tr>(
+    arranged: Arranged<'scope, TraceAgent<Tr>>,
+    observed: Rc<RefCell<Observed>>,
+    probe: &ProbeHandle,
+) where
+    Tr: TraceReader<Time = u64, Batch = TestBatch> + 'static,
+{
+    let mut trace = arranged.trace;
+    arranged
+        .stream
+        .inspect_batch(move |_, batches| {
+            for batch in batches {
+                let mut observed = observed.borrow_mut();
+                observed.batches.push(batch.len());
+                if let Some(rows) = &mut observed.rows {
+                    for chunk in &batch.chunks {
+                        let column = chunk.clone().into_column();
+                        let view = column.borrow();
+                        rows.extend((0..view.len()).map(|i| Update::into_owned(view.get(i))));
+                    }
+                }
+                trace.set_logical_compaction(batch.upper().borrow());
+                trace.set_physical_compaction(batch.upper().borrow());
+            }
+        })
+        .probe_with(probe);
+}
+
+fn install(
+    scope: Scope<'_, u64>,
+    asynchronous: bool,
+    budget: ReadBudget,
+    observed: Rc<RefCell<Observed>>,
+    probe: &ProbeHandle,
+) -> (InputPort, Option<super::PressOnDropButton>) {
+    let (input, stream) = scope.new_input::<Column<Update>>();
+    let token = if asynchronous {
+        let (arranged, token) = super::arrange(stream, budget, "Async");
+        observe(arranged, observed, probe);
+        Some(token)
+    } else {
+        #[allow(clippy::disallowed_methods)]
+        let arranged = arrange_core::<
+            _,
+            _,
+            ChunkChunker<(u64, Vec<u8>), u64, i64>,
+            ChunkBatcher<TestChunk>,
+            ChunkBuilder<TestChunk>,
+            ChunkSpine<TestChunk>,
+        >(stream, Pipeline, "Sync");
+        observe(arranged, observed, probe);
+        None
+    };
+    (input, token)
+}
+
+fn columns(rounds: u64, rows: u64) -> Vec<Column<Update>> {
+    (0..rounds)
+        .map(|round| {
+            let mut column = Column::default();
+            for row in 0..rows {
+                let mut key = (round * rows + row).wrapping_add(0x9e3779b97f4a7c15);
+                key = (key ^ (key >> 30)).wrapping_mul(0xbf58476d1ce4e5b9);
+                key = (key ^ (key >> 27)).wrapping_mul(0x94d049bb133111eb);
+                key ^= key >> 31;
+                let mut random = key;
+                let pattern: Vec<u8> = (0..475)
+                    .map(|_| {
+                        random ^= random << 13;
+                        random ^= random >> 7;
+                        random ^= random << 17;
+                        random.to_le_bytes()[0]
+                    })
+                    .collect();
+                column.push_into(((key, pattern.repeat(4)), round, 1i64));
+            }
+            column
+        })
+        .collect()
+}
+
+#[derive(Clone, Copy)]
+struct Config {
+    rounds: u64,
+    rows: u64,
+    sources: usize,
+    pool_bytes: usize,
+    burst: usize,
+    asynchronous: bool,
+    direct_output: bool,
+}
+
+struct Measurement {
+    hydrated: Duration,
+    elapsed: Duration,
+    batches: usize,
+    stats: PoolStats,
+}
+
+fn run(config: Config) -> Measurement {
+    let mut timely_config = timely::Config::thread();
+    let logic: ExertionLogic = Arc::new(|levels| {
+        let mut proportionality = 16;
+        let mut first = true;
+        for (_, count, len) in levels
+            .iter()
+            .copied()
+            .skip_while(|(_, count, _)| *count == 0)
+        {
+            if count > 1 || (!first && proportionality > 0 && len > 0) {
+                return Some(1000);
+            }
+            first = false;
+            proportionality /= 2;
+        }
+        None
+    });
+    timely_config
+        .worker
+        .set("differential/default_exert_logic".into(), logic);
+    timely::execute(timely_config, move |worker| {
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(2)
+            .enable_all()
+            .build()
+            .unwrap();
+        let _entered = runtime.enter();
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(config.pool_bytes);
+        super::super::set_direct_compressed_output_override(Some(config.direct_output));
+        with_spill_override(pool.clone(), || {
+            let probe = ProbeHandle::new();
+            let observed = Rc::new(RefCell::new(Observed::default()));
+            let budget = ReadBudget::new(32 << 20);
+            let mut inputs = Vec::new();
+            let mut tokens = Vec::new();
+            for _ in 0..config.sources {
+                let (input, token) = worker.dataflow(|scope| {
+                    install(
+                        scope,
+                        config.asynchronous,
+                        budget.clone(),
+                        Rc::clone(&observed),
+                        &probe,
+                    )
+                });
+                inputs.push(input);
+                tokens.push(token);
+            }
+            let mut fixtures: Vec<_> = (0..config.sources)
+                .map(|_| columns(config.rounds, config.rows).into_iter())
+                .collect();
+            let start = Instant::now();
+            for round in 0..config.rounds {
+                for (input, fixture) in inputs.iter_mut().zip_eq(&mut fixtures) {
+                    input.send_batch(&mut fixture.next().unwrap());
+                    input.advance_to(round + 1);
+                }
+                worker.step();
+                if usize::try_from(round + 1).unwrap() % config.burst == 0 {
+                    while probe.less_than(&(round + 1)) {
+                        worker.step();
+                        std::thread::yield_now();
+                        assert!(start.elapsed().as_secs() < 120);
+                    }
+                }
+            }
+            while probe.less_than(&config.rounds) {
+                worker.step();
+                std::thread::yield_now();
+                assert!(start.elapsed().as_secs() < 120);
+            }
+            let hydrated = start.elapsed();
+            let mut previous = pool.stats();
+            let mut stable_since = Instant::now();
+            loop {
+                worker.step();
+                std::thread::yield_now();
+                let current = pool.stats();
+                if current.inserts != previous.inserts
+                    || current.async_reads != previous.async_reads
+                    || current.async_reads_in_flight != 0
+                {
+                    stable_since = Instant::now();
+                }
+                previous = current;
+                if budget.reserved_bytes() == 0 && stable_since.elapsed().as_millis() >= 20 {
+                    break;
+                }
+                assert!(start.elapsed().as_secs() < 120);
+            }
+            let elapsed = start.elapsed();
+            let observed = observed.borrow();
+            assert_eq!(
+                observed.batches.iter().sum::<usize>(),
+                usize::try_from(config.rounds * config.rows).unwrap() * config.sources
+            );
+            let result = Measurement {
+                hydrated,
+                elapsed,
+                batches: observed.batches.len(),
+                stats: pool.stats(),
+            };
+            drop(tokens);
+            result
+        })
+    })
+    .unwrap()
+    .join()
+    .pop()
+    .unwrap()
+    .unwrap()
+}
+
+fn parameter(name: &str, default: usize) -> usize {
+    std::env::var(name).map_or(default, |s| s.parse().unwrap())
+}
+
+#[mz_ore::test]
+#[ignore = "local operator performance comparison"]
+fn operator_microbench() {
+    let bursts = std::env::var("MZ_BENCH_BURST")
+        .map_or_else(|_| vec![1, 8, 32], |s| vec![s.parse().unwrap()]);
+    for sample in 0..parameter("MZ_BENCH_SAMPLES", 1) {
+        for &burst in &bursts {
+            for asynchronous in if sample % 2 == 0 {
+                [false, true]
+            } else {
+                [true, false]
+            } {
+                let config = Config {
+                    rounds: u64::try_from(parameter("MZ_BENCH_ROUNDS", 32)).unwrap(),
+                    rows: u64::try_from(parameter("MZ_BENCH_ROWS", 512)).unwrap(),
+                    sources: parameter("MZ_BENCH_SOURCES", 1),
+                    pool_bytes: parameter("MZ_BENCH_POOL_BYTES", 0),
+                    burst,
+                    asynchronous,
+                    direct_output: parameter("MZ_BENCH_DIRECT", 0) != 0,
+                };
+                let m = run(config);
+                eprintln!(
+                    "OPERATOR sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
+                    config.sources,
+                    config.rounds * config.rows,
+                    config.pool_bytes,
+                    config.direct_output,
+                    m.elapsed.as_millis(),
+                    m.hydrated.as_millis(),
+                    m.batches,
+                    m.stats.inserts,
+                    m.stats.extent_bytes_written,
+                    m.stats.async_reads
+                );
+            }
+        }
+    }
+}
+
+#[mz_ore::test]
+fn queued_input_preserves_updates_and_completes_progress() {
+    let runtime = tokio::runtime::Runtime::new().unwrap();
+    let _entered = runtime.enter();
+    for burst in [1, 80] {
+        timely::execute_directly(move |worker| {
+            let pool = Pool::new().unwrap();
+            pool.set_spill_threads(0);
+            pool.set_budget(0);
+            with_spill_override(pool, || {
+                let observed = Rc::new(RefCell::new(Observed {
+                    rows: Some(Vec::new()),
+                    ..Observed::default()
+                }));
+                let probe = ProbeHandle::new();
+                let (mut input, token) = worker.dataflow(|scope| {
+                    install(
+                        scope,
+                        true,
+                        ReadBudget::new(1 << 20),
+                        Rc::clone(&observed),
+                        &probe,
+                    )
+                });
+                let mut expected = Vec::new();
+                let start = Instant::now();
+                // Exceed the drain limit, with future updates and cancellation.
+                for round in 0..80 {
+                    let rows = [
+                        ((round % 7, vec![42; 128]), round + 2, 1),
+                        ((round % 7, vec![42; 128]), round + 2, -1),
+                        ((round, vec![17; 128]), round + 3, 1),
+                    ];
+                    let mut column = Column::default();
+                    for row in &rows {
+                        column.push_into(row);
+                    }
+                    expected.extend(rows);
+                    input.send_batch(&mut column);
+                    input.advance_to(round + 1);
+                    if (round + 1) % burst == 0 {
+                        while probe.less_than(input.time()) {
+                            worker.step();
+                            std::thread::yield_now();
+                            assert!(start.elapsed().as_secs() < 10);
+                        }
+                    }
+                }
+                drop(input);
+                while !probe.done() {
+                    worker.step();
+                    std::thread::yield_now();
+                    assert!(start.elapsed().as_secs() < 10);
+                }
+                let mut actual = observed.borrow_mut().rows.take().unwrap();
+                differential_dataflow::consolidation::consolidate_updates(&mut actual);
+                differential_dataflow::consolidation::consolidate_updates(&mut expected);
+                assert_eq!(actual, expected);
+                drop(token);
+            });
+        });
+    }
+}

From e004975db1bce6ceb2980dcf19e1187dd8bf908a Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 10:21:29 -0400
Subject: [PATCH 17/31] timely-util: instrument columnar merge work

---
 .../src/upsert_continual_feedback_v2.rs       |  10 +-
 src/timely-util/src/columnar/chunk.rs         |  16 +++
 .../src/columnar/chunk/asynchronous.rs        |   5 +
 src/timely-util/src/columnar/chunk/metrics.rs | 129 ++++++++++++++++++
 src/timely-util/src/columnar/chunk/native.rs  |   5 +
 .../src/columnar/chunk/native/pool_chunk.rs   |   3 +
 .../src/columnar/chunk/native/vendor/spine.rs |  17 +++
 src/timely-util/src/pool_config/metrics.rs    |   1 +
 8 files changed, 184 insertions(+), 2 deletions(-)
 create mode 100644 src/timely-util/src/columnar/chunk/metrics.rs

diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index 1ac4e37fef0a6..8a23baf21c983 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -104,7 +104,7 @@ use differential_dataflow::logging::Logger;
 use differential_dataflow::operators::arrange::agent::TraceAgent;
 use differential_dataflow::operators::arrange::arrangement::{Arranged, arrange_core};
 use differential_dataflow::trace::chunk::{ChunkBatcher, ChunkBuilder, ChunkSpine};
-use differential_dataflow::trace::{Batcher, Cursor, Description, TraceReader};
+use differential_dataflow::trace::{BatchReader, Batcher, Cursor, Description, TraceReader};
 use differential_dataflow::{AsCollection, VecCollection};
 use mz_dyncfg::ConfigSet;
 use mz_repr::{Datum, Diff, GlobalId, Row};
@@ -739,7 +739,13 @@ where
             tokio::select! {
                 _ = input.ready() => {}
                 _ = persist_wakeup.ready() => {
-                    while persist_wakeup.next_sync().is_some() {}
+                    while let Some(event) = persist_wakeup.next_sync() {
+                        if let AsyncEvent::Data(_, batches) = event {
+                            for batch in batches {
+                                mz_timely_util::columnar::chunk::metrics::record_batch(batch.len());
+                            }
+                        }
+                    }
                 }
             }
 
diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 8085a9d4d1bd6..b25bb202ba11d 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -255,6 +255,7 @@ const COMMIT_BYTES: usize = 2 << 20;
 
 pub mod asynchronous;
 pub mod merge;
+pub mod metrics;
 mod native;
 
 /// Bodies smaller than this stay resident: the pool's smallest size class is
@@ -474,6 +475,11 @@ impl<D: Columnar, T: Columnar, R: Columnar> ColumnChunk<D, T, R> {
     where
         T: Timestamp,
     {
+        metrics::record(
+            metrics::Stage::Commit,
+            column.borrow().len(),
+            column.length_in_bytes(),
+        );
         mz_ore::soft_assert_no_log!(!column.is_empty(), "chunks must be non-empty");
         if let Some(pool) = spill_pool() {
             if column.length_in_bytes() >= SPILL_MIN_BYTES {
@@ -733,6 +739,11 @@ where
     /// Fronts whose data ranges are disjoint never load at all: the resident
     /// fence entries decide, and the lower front moves to the output whole.
     fn merge(in1: &mut VecDeque<Self>, in2: &mut VecDeque<Self>, out: &mut VecDeque<Self>) {
+        metrics::record(
+            metrics::Stage::Merge,
+            in1.front().map_or(0, Self::records) + in2.front().map_or(0, Self::records),
+            0,
+        );
         // Disjoint fast path: when one front lies strictly below the other's
         // first data item (equal boundary data could still interleave on
         // time), the merged prefix through the shared horizon is exactly that
@@ -886,6 +897,11 @@ where
         done: bool,
         out: &mut VecDeque<Self>,
     ) {
+        metrics::record(
+            metrics::Stage::Advance,
+            input.iter().map(Self::records).sum(),
+            0,
+        );
         let Some(front) = input.pop_front() else {
             return;
         };
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index a578b49f5589f..2dbe8a369e42f 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -86,6 +86,11 @@ where
             for index in 0..INPUT_EVENTS_PER_TURN {
                 match event.take() {
                     Some(Event::Data(time, mut data)) => {
+                        super::metrics::record(
+                            super::metrics::Stage::AsyncInput,
+                            columnar::Len::len(&data.borrow()),
+                            0,
+                        );
                         if cap.as_ref().is_none_or(|old| time.time() < old.time()) {
                             cap = Some(time);
                         }
diff --git a/src/timely-util/src/columnar/chunk/metrics.rs b/src/timely-util/src/columnar/chunk/metrics.rs
new file mode 100644
index 0000000000000..ffc9807c1f639
--- /dev/null
+++ b/src/timely-util/src/columnar/chunk/metrics.rs
@@ -0,0 +1,129 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//! Process-wide work counters for columnar batching and trace maintenance.
+//!
+//! Counts describe work attempted, including repeated processing of the same
+//! updates. Bytes are serialized uncompressed sizes, not extent or device writes.
+//! For optional exertion and virtual introductions, rows count fuel units and
+//! virtual updates respectively. Zero byte counts indicate an uninstrumented size.
+//! Row-size buckets are disjoint, indexed by ceil(log2(rows)), with zero and one
+//! sharing bucket zero. Counters at different stages must not be added together.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use mz_ore::cast::CastFrom;
+use mz_ore::metric;
+use mz_ore::metrics::{ComputedUIntGauge, MetricsRegistry};
+
+#[derive(Clone, Copy)]
+pub(super) enum Stage {
+    Merge,
+    Advance,
+    Commit,
+    Batch,
+    InitialSettle,
+    AsyncInput,
+    OptionalExert,
+    VirtualIntroduction,
+    TraceMerge,
+}
+
+impl Stage {
+    #[allow(clippy::as_conversions)]
+    fn counters(self) -> &'static Counters {
+        &COUNTERS[self as usize]
+    }
+
+    const ALL: [(Self, &'static str); 9] = [
+        (Self::Merge, "merge"),
+        (Self::Advance, "advance"),
+        (Self::Commit, "commit"),
+        (Self::Batch, "batch"),
+        (Self::InitialSettle, "initial_settle"),
+        (Self::AsyncInput, "async_input"),
+        (Self::OptionalExert, "optional_exert"),
+        (Self::VirtualIntroduction, "virtual_introduction"),
+        (Self::TraceMerge, "trace_merge"),
+    ];
+}
+
+struct Counters {
+    calls: AtomicU64,
+    rows: AtomicU64,
+    bytes: AtomicU64,
+    buckets: [AtomicU64; 32],
+}
+
+static COUNTERS: [Counters; 9] = [const {
+    Counters {
+        calls: AtomicU64::new(0),
+        rows: AtomicU64::new(0),
+        bytes: AtomicU64::new(0),
+        buckets: [const { AtomicU64::new(0) }; 32],
+    }
+}; 9];
+
+pub(super) fn record(stage: Stage, rows: usize, bytes: usize) {
+    let counters = stage.counters();
+    counters.calls.fetch_add(1, Ordering::Relaxed);
+    counters
+        .rows
+        .fetch_add(u64::cast_from(rows), Ordering::Relaxed);
+    counters
+        .bytes
+        .fetch_add(u64::cast_from(bytes), Ordering::Relaxed);
+    let bucket = (usize::BITS - rows.saturating_sub(1).leading_zeros()).min(31);
+    counters.buckets[usize::cast_from(bucket)].fetch_add(1, Ordering::Relaxed);
+}
+
+/// Record one published batch when its consumer receives it, including empty batches.
+pub fn record_batch(rows: usize) {
+    record(Stage::Batch, rows, 0);
+}
+
+pub(crate) fn register(registry: &MetricsRegistry) {
+    for (stage, name) in Stage::ALL {
+        let counters = stage.counters();
+        let _: ComputedUIntGauge = registry.register_computed_gauge(
+            metric!(name: "mz_column_chunk_work_calls_total", help: "Columnar work operations, by stage.", const_labels: {"stage" => name}),
+            move || counters.calls.load(Ordering::Relaxed),
+        );
+        let _: ComputedUIntGauge = registry.register_computed_gauge(
+            metric!(name: "mz_column_chunk_work_rows_total", help: "Rows processed by columnar work, including repeated visits.", const_labels: {"stage" => name}),
+            move || counters.rows.load(Ordering::Relaxed),
+        );
+        let _: ComputedUIntGauge = registry.register_computed_gauge(
+            metric!(name: "mz_column_chunk_work_bytes_total", help: "Uncompressed serialized bytes processed at instrumented columnar stages.", const_labels: {"stage" => name}),
+            move || counters.bytes.load(Ordering::Relaxed),
+        );
+        for (bucket, count) in counters.buckets.iter().enumerate() {
+            let _: ComputedUIntGauge = registry.register_computed_gauge(
+                metric!(name: "mz_column_chunk_work_size_total", help: "Disjoint columnar operation row-size buckets, indexed by ceil(log2(rows)).", const_labels: {"stage" => name, "log2_rows" => bucket.to_string()}),
+                move || count.load(Ordering::Relaxed),
+            );
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[mz_ore::test]
+    fn all_stages_register_and_scrape() {
+        let registry = MetricsRegistry::new();
+        register(&registry);
+        record_batch(3);
+        let families = registry.gather();
+        assert_eq!(families.len(), 4);
+        assert_eq!(
+            families
+                .iter()
+                .map(|family| family.get_metric().len())
+                .sum::<usize>(),
+            9 * 35
+        );
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index 46959a25cc824..db0b513726897 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -93,6 +93,11 @@ where
             chunk,
             budget: self.budget.clone(),
         }]);
+        super::metrics::record(
+            super::metrics::Stage::InitialSettle,
+            input.iter().map(|c| c.chunk.records()).sum(),
+            0,
+        );
         let mut settled = VecDeque::new();
         PoolChunk::settle(&mut input, true, &mut settled);
         let mut chunks: Vec<_> = settled.into();
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index ff476b7b975d4..cc5099b3b8abe 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -299,6 +299,8 @@ where
         right: &mut VecDeque<Self>,
         output: &mut VecDeque<Self>,
     ) -> Poll<()> {
+        let input_rows =
+            left.front().unwrap().chunk.records() + right.front().unwrap().chunk.records();
         let (left_first, left_last) = left.front().unwrap().chunk.data_span();
         let (right_first, right_last) = right.front().unwrap().chunk.data_span();
         let disjoint = if super::super::rr::<D>(left_last) < super::super::rr::<D>(right_first) {
@@ -309,6 +311,7 @@ where
             None
         };
         if let Some(disjoint) = disjoint {
+            super::super::metrics::record(super::super::metrics::Stage::Merge, input_rows, 0);
             // The synchronous survivor path may migrate codecs by reading the body.
             // Keep this metadata-only path cold, while retaining merge-depth accounting.
             let mut chunk = disjoint.pop_front().unwrap();
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index 1ec36bc79d562..95b0e048ed4ed 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -302,6 +302,11 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         }
         self.tidy_layers();
         if let Some(effort) = self.exert_effort() {
+            crate::columnar::chunk::metrics::record(
+                crate::columnar::chunk::metrics::Stage::OptionalExert,
+                effort,
+                0,
+            );
             if self.merging.iter().any(|b| b.is_double()) {
                 self.queue_fuel(effort.cast_signed());
             } else {
@@ -539,6 +544,13 @@ impl<B: SpineBatch> Spine<B> {
     }
 
     fn queue_introduction(&mut self, level: usize, pending: bool) {
+        if !pending {
+            crate::columnar::chunk::metrics::record(
+                crate::columnar::chunk::metrics::Stage::VirtualIntroduction,
+                1usize << level,
+                0,
+            );
+        }
         assert!(self.maintenance.is_empty());
         // Preserve the fueled spine's virtual update accounting, independent of
         // cancellation and of how many times a read wakes its continuation.
@@ -914,6 +926,11 @@ impl<B: SpineBatch> MergeState<B> {
                     Description::new(batch1.lower().clone(), batch2.upper().clone(), since);
                 match (&batch1.inner, &batch2.inner) {
                     (Some(source1), Some(source2)) => {
+                        crate::columnar::chunk::metrics::record(
+                            crate::columnar::chunk::metrics::Stage::TraceMerge,
+                            source1.len() + source2.len(),
+                            0,
+                        );
                         let merger = B::Merger::new(source1, source2, description.since().borrow());
                         MergeVariant::InProgress(batch1, batch2, description, merger)
                     }
diff --git a/src/timely-util/src/pool_config/metrics.rs b/src/timely-util/src/pool_config/metrics.rs
index 4f2d6c291f196..7338aae1b0dc5 100644
--- a/src/timely-util/src/pool_config/metrics.rs
+++ b/src/timely-util/src/pool_config/metrics.rs
@@ -30,6 +30,7 @@ use mz_ore::metrics::{ComputedUIntGauge, MakeCollectorOpts, MetricsRegistry};
 pub fn register(registry: &MetricsRegistry) {
     static REGISTERED: OnceLock<()> = OnceLock::new();
     REGISTERED.get_or_init(|| {
+        crate::columnar::chunk::metrics::register(registry);
         // Every name and help string is a literal at the `metric!` call so the
         // metrics-catalog scanner (`bin/gen-metrics-catalog`), which reads the
         // source rather than the expanded macro, can index them.

From e6871b8af15bd5de3121c48499b1a12ba9cdd419 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 10:30:18 -0400
Subject: [PATCH 18/31] timely-util: measure operator work through equal final
 compaction

---
 .../chunk/asynchronous/operator_tests.rs      | 400 +++++++++++++-----
 1 file changed, 287 insertions(+), 113 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
index b973e6912216a..6a4295ffe1b0b 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -5,15 +5,19 @@
 //! Live-operator checks and an opt-in comparison against the synchronous arranger.
 //!
 //! The benchmark uses deterministic 1,900-byte values with a repeated 475-byte
-//! pattern, overlapping key ranges, and independently advancing sources. All
-//! sources share one worker, pool, and decoded-input budget. It reports output
-//! frontier latency separately from the subsequent maintenance drain. The latter
-//! ends after admission is released and pool counters stay quiet for 20 ms.
+//! pattern, overlapping key ranges, and independently advancing sources.
+//! Sources share a pool and decoded-input budget across the configured workers.
+//! Input generation is incremental and included in the reported times. The fixture
+//! does not retain the entire input history. It reports output frontier latency
+//! separately from final compaction. After ingestion, the benchmark policy requests
+//! one non-empty batch per source. The drain waits for that shape, released read
+//! admission, and pool counters that remain quiet for 20 ms.
 //! This exercises pool eviction and compression, not forced device contention.
 
 use std::cell::RefCell;
 use std::rc::Rc;
 use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::time::{Duration, Instant};
 
 use columnar::{Columnar, Index, Len};
@@ -41,6 +45,8 @@ type ProbeHandle = timely::dataflow::operators::probe::Handle<u64>;
 struct Observed {
     batches: Vec<usize>,
     rows: Option<Vec<Update>>,
+    traces: Vec<Box<dyn Fn() -> (usize, usize)>>,
+    wake_traces: Vec<Box<dyn Fn()>>,
 }
 
 fn observe<'scope, Tr>(
@@ -50,13 +56,25 @@ fn observe<'scope, Tr>(
 ) where
     Tr: TraceReader<Time = u64, Batch = TestBatch> + 'static,
 {
-    let mut trace = arranged.trace;
+    // Share this reader so sampling does not introduce another compaction hold.
+    let trace = Rc::new(RefCell::new(arranged.trace));
+    let inspected = Rc::clone(&trace);
+    observed.borrow_mut().traces.push(Box::new(move || {
+        let mut batches = 0;
+        let mut rows = 0;
+        inspected.borrow().map_batches(|batch| {
+            batches += usize::from(!batch.is_empty());
+            rows += batch.len();
+        });
+        (batches, rows)
+    }));
     arranged
         .stream
         .inspect_batch(move |_, batches| {
             for batch in batches {
                 let mut observed = observed.borrow_mut();
                 observed.batches.push(batch.len());
+                super::super::metrics::record_batch(batch.len());
                 if let Some(rows) = &mut observed.rows {
                     for chunk in &batch.chunks {
                         let column = chunk.clone().into_column();
@@ -64,6 +82,7 @@ fn observe<'scope, Tr>(
                         rows.extend((0..view.len()).map(|i| Update::into_owned(view.get(i))));
                     }
                 }
+                let mut trace = trace.borrow_mut();
                 trace.set_logical_compaction(batch.upper().borrow());
                 trace.set_physical_compaction(batch.upper().borrow());
             }
@@ -81,6 +100,11 @@ fn install(
     let (input, stream) = scope.new_input::<Column<Update>>();
     let token = if asynchronous {
         let (arranged, token) = super::arrange(stream, budget, "Async");
+        let notify = Arc::clone(&arranged.trace.trace_box_unstable().borrow().trace().notify);
+        observed
+            .borrow_mut()
+            .wake_traces
+            .push(Box::new(move || notify.notify_one()));
         observe(arranged, observed, probe);
         Some(token)
     } else {
@@ -93,35 +117,36 @@ fn install(
             ChunkBuilder<TestChunk>,
             ChunkSpine<TestChunk>,
         >(stream, Pipeline, "Sync");
+        let activator = scope.activator_for(Rc::clone(&arranged.trace.operator().address));
+        observed
+            .borrow_mut()
+            .wake_traces
+            .push(Box::new(move || activator.activate()));
         observe(arranged, observed, probe);
         None
     };
     (input, token)
 }
 
-fn columns(rounds: u64, rows: u64) -> Vec<Column<Update>> {
-    (0..rounds)
-        .map(|round| {
-            let mut column = Column::default();
-            for row in 0..rows {
-                let mut key = (round * rows + row).wrapping_add(0x9e3779b97f4a7c15);
-                key = (key ^ (key >> 30)).wrapping_mul(0xbf58476d1ce4e5b9);
-                key = (key ^ (key >> 27)).wrapping_mul(0x94d049bb133111eb);
-                key ^= key >> 31;
-                let mut random = key;
-                let pattern: Vec<u8> = (0..475)
-                    .map(|_| {
-                        random ^= random << 13;
-                        random ^= random >> 7;
-                        random ^= random << 17;
-                        random.to_le_bytes()[0]
-                    })
-                    .collect();
-                column.push_into(((key, pattern.repeat(4)), round, 1i64));
-            }
-            column
-        })
-        .collect()
+fn column(round: u64, rows: u64) -> Column<Update> {
+    let mut column = Column::default();
+    for row in 0..rows {
+        let mut key = (round * rows + row).wrapping_add(0x9e3779b97f4a7c15);
+        key = (key ^ (key >> 30)).wrapping_mul(0xbf58476d1ce4e5b9);
+        key = (key ^ (key >> 27)).wrapping_mul(0x94d049bb133111eb);
+        key ^= key >> 31;
+        let mut random = key;
+        let pattern: Vec<u8> = (0..475)
+            .map(|_| {
+                random ^= random << 13;
+                random ^= random >> 7;
+                random ^= random << 17;
+                random.to_le_bytes()[0]
+            })
+            .collect();
+        column.push_into(((key, pattern.repeat(4)), round, 1i64));
+    }
+    column
 }
 
 #[derive(Clone, Copy)]
@@ -139,13 +164,35 @@ struct Measurement {
     hydrated: Duration,
     elapsed: Duration,
     batches: usize,
+    trace_batches: usize,
     stats: PoolStats,
 }
 
 fn run(config: Config) -> Measurement {
-    let mut timely_config = timely::Config::thread();
-    let logic: ExertionLogic = Arc::new(|levels| {
-        let mut proportionality = 16;
+    let timeout =
+        Duration::from_secs(u64::try_from(parameter("MZ_BENCH_TIMEOUT_S", 1200)).unwrap());
+    let workers = parameter("MZ_BENCH_WORKERS", 1);
+    assert!(workers > 0 && config.sources > 0 && config.burst > 0);
+    assert!(config.rounds > 0 && config.rows > 0);
+    let mut timely_config = timely::Config::process(workers);
+    let draining = Arc::new(AtomicBool::new(false));
+    let hydrated_workers = Arc::new(AtomicUsize::new(0));
+    let policy_draining = Arc::clone(&draining);
+    // Match the storage TimelyConfig in mz_controller::clusters.
+    let exert_proportionality = parameter("MZ_BENCH_EXERT_PROPORTIONALITY", 1337);
+    let logic: ExertionLogic = Arc::new(move |levels| {
+        if policy_draining.load(Ordering::Relaxed) {
+            let batches = levels
+                .iter()
+                .filter(|(_, _, rows)| *rows > 0)
+                .map(|(_, count, _)| count)
+                .sum::<usize>();
+            return (batches > 1).then_some(1000);
+        }
+        if exert_proportionality == 0 {
+            return None;
+        }
+        let mut proportionality = exert_proportionality;
         let mut first = true;
         for (_, count, len) in levels
             .iter()
@@ -163,99 +210,200 @@ fn run(config: Config) -> Measurement {
     timely_config
         .worker
         .set("differential/default_exert_logic".into(), logic);
-    timely::execute(timely_config, move |worker| {
-        let runtime = tokio::runtime::Builder::new_multi_thread()
-            .worker_threads(2)
+    let runtime = Arc::new(
+        tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(workers.clamp(2, 4))
             .enable_all()
             .build()
-            .unwrap();
-        let _entered = runtime.enter();
-        let pool = Pool::new().unwrap();
-        pool.set_spill_threads(0);
-        pool.set_budget(config.pool_bytes);
+            .unwrap(),
+    );
+    let pool = Pool::new().unwrap();
+    pool.set_spill_threads(parameter("MZ_BENCH_SPILL_THREADS", 0));
+    pool.set_budget(config.pool_bytes);
+    let worker_pool = pool.clone();
+    let budget =
+        ReadBudget::new(u32::try_from(parameter("MZ_BENCH_READ_BYTES", 256 << 20)).unwrap());
+    let barrier = Arc::new(std::sync::Barrier::new(workers));
+    let worker_runtime = Arc::clone(&runtime);
+    let worker_budget = budget.clone();
+    let results = timely::execute(timely_config, move |worker| {
+        let _entered = worker_runtime.enter();
+        let budget = worker_budget.clone();
+        let pool = worker_pool.clone();
         super::super::set_direct_compressed_output_override(Some(config.direct_output));
-        with_spill_override(pool.clone(), || {
-            let probe = ProbeHandle::new();
-            let observed = Rc::new(RefCell::new(Observed::default()));
-            let budget = ReadBudget::new(32 << 20);
-            let mut inputs = Vec::new();
-            let mut tokens = Vec::new();
-            for _ in 0..config.sources {
-                let (input, token) = worker.dataflow(|scope| {
-                    install(
-                        scope,
-                        config.asynchronous,
-                        budget.clone(),
-                        Rc::clone(&observed),
-                        &probe,
-                    )
-                });
-                inputs.push(input);
-                tokens.push(token);
-            }
-            let mut fixtures: Vec<_> = (0..config.sources)
-                .map(|_| columns(config.rounds, config.rows).into_iter())
-                .collect();
-            let start = Instant::now();
-            for round in 0..config.rounds {
-                for (input, fixture) in inputs.iter_mut().zip_eq(&mut fixtures) {
-                    input.send_batch(&mut fixture.next().unwrap());
-                    input.advance_to(round + 1);
+        let mut dataflows = Vec::new();
+        let measure = || {
+            with_spill_override(pool.clone(), || {
+                let mut probes = Vec::new();
+                let observed = Rc::new(RefCell::new(Observed::default()));
+                let mut inputs = Vec::new();
+                let mut tokens = Vec::new();
+                for _ in 0..config.sources {
+                    let probe = ProbeHandle::new();
+                    dataflows.push(worker.next_dataflow_index());
+                    let (input, token) = worker.dataflow(|scope| {
+                        install(
+                            scope,
+                            config.asynchronous,
+                            budget.clone(),
+                            Rc::clone(&observed),
+                            &probe,
+                        )
+                    });
+                    inputs.push(input);
+                    tokens.push(token);
+                    probes.push(probe);
                 }
-                worker.step();
-                if usize::try_from(round + 1).unwrap() % config.burst == 0 {
-                    while probe.less_than(&(round + 1)) {
+                barrier.wait();
+                let start = Instant::now();
+                if parameter("MZ_BENCH_INDEPENDENT", 0) != 0 {
+                    let mut rounds = vec![0; config.sources];
+                    while rounds.iter().any(|round| *round < config.rounds) {
+                        for ((input, probe), round) in
+                            inputs.iter_mut().zip_eq(&probes).zip_eq(&mut rounds)
+                        {
+                            while *round < config.rounds {
+                                let required =
+                                    round.saturating_sub(u64::try_from(config.burst - 1).unwrap());
+                                if probe.less_than(&required) {
+                                    break;
+                                }
+                                input.send_batch(&mut column(*round, config.rows));
+                                *round += 1;
+                                input.advance_to(*round);
+                            }
+                        }
                         worker.step();
                         std::thread::yield_now();
-                        assert!(start.elapsed().as_secs() < 120);
+                        check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
+                    }
+                } else {
+                    for round in 0..config.rounds {
+                        for input in &mut inputs {
+                            input.send_batch(&mut column(round, config.rows));
+                            input.advance_to(round + 1);
+                        }
+                        if usize::try_from(round + 1).unwrap() % config.burst == 0 {
+                            worker.step();
+                            while probes.iter().any(|probe| probe.less_than(&(round + 1))) {
+                                worker.step();
+                                std::thread::yield_now();
+                                check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
+                            }
+                        }
                     }
                 }
-            }
-            while probe.less_than(&config.rounds) {
-                worker.step();
-                std::thread::yield_now();
-                assert!(start.elapsed().as_secs() < 120);
-            }
-            let hydrated = start.elapsed();
-            let mut previous = pool.stats();
-            let mut stable_since = Instant::now();
-            loop {
-                worker.step();
-                std::thread::yield_now();
-                let current = pool.stats();
-                if current.inserts != previous.inserts
-                    || current.async_reads != previous.async_reads
-                    || current.async_reads_in_flight != 0
-                {
-                    stable_since = Instant::now();
+                while probes.iter().any(|probe| probe.less_than(&config.rounds)) {
+                    worker.step();
+                    std::thread::yield_now();
+                    check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
                 }
-                previous = current;
-                if budget.reserved_bytes() == 0 && stable_since.elapsed().as_millis() >= 20 {
-                    break;
+                let hydrated = start.elapsed();
+                // Normalize the terminal trace shape without changing the ingestion policy.
+                if hydrated_workers.fetch_add(1, Ordering::Relaxed) + 1 == workers {
+                    draining.store(true, Ordering::Relaxed);
                 }
-                assert!(start.elapsed().as_secs() < 120);
-            }
-            let elapsed = start.elapsed();
-            let observed = observed.borrow();
-            assert_eq!(
-                observed.batches.iter().sum::<usize>(),
-                usize::try_from(config.rounds * config.rows).unwrap() * config.sources
-            );
-            let result = Measurement {
-                hydrated,
-                elapsed,
-                batches: observed.batches.len(),
-                stats: pool.stats(),
-            };
-            drop(tokens);
-            result
-        })
+                let mut woke_drain = false;
+                let mut previous = pool.stats();
+                let mut stable_since = Instant::now();
+                loop {
+                    if !woke_drain && draining.load(Ordering::Relaxed) {
+                        for wake in &observed.borrow().wake_traces {
+                            wake();
+                        }
+                        woke_drain = true;
+                    }
+                    worker.step();
+                    std::thread::yield_now();
+                    let current = pool.stats();
+                    if current.inserts != previous.inserts
+                        || current.async_reads != previous.async_reads
+                        || current.async_reads_in_flight != 0
+                    {
+                        stable_since = Instant::now();
+                    }
+                    previous = current;
+                    if woke_drain
+                        && budget.reserved_bytes() == 0
+                        && stable_since.elapsed().as_millis() >= 20
+                        && observed.borrow().traces.iter().all(|trace| trace().0 == 1)
+                    {
+                        break;
+                    }
+                    check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
+                }
+                let elapsed = start.elapsed();
+                let observed = observed.borrow();
+                assert_eq!(
+                    observed.batches.iter().sum::<usize>(),
+                    usize::try_from(config.rounds * config.rows).unwrap() * config.sources
+                );
+                let mut trace_batches = 0;
+                for trace in &observed.traces {
+                    let (batches, rows) = trace();
+                    trace_batches += batches;
+                    assert_eq!(rows, usize::try_from(config.rounds * config.rows).unwrap());
+                }
+                let result = Measurement {
+                    hydrated,
+                    elapsed,
+                    batches: observed.batches.len(),
+                    trace_batches,
+                    stats: pool.stats(),
+                };
+                drop(tokens);
+                result
+            })
+        };
+        let result = mz_ore::panic::catch_unwind(std::panic::AssertUnwindSafe(measure));
+        // A failed assertion must also destroy dataflows while Tokio is entered.
+        for index in dataflows {
+            worker.drop_dataflow(index);
+        }
+        result.unwrap_or_else(|panic| std::panic::resume_unwind(panic))
     })
     .unwrap()
-    .join()
-    .pop()
-    .unwrap()
-    .unwrap()
+    .join();
+    // Cancelled operator reads retain admission until their owned tasks finish.
+    // Keep Tokio alive for those tasks before propagating a worker panic.
+    runtime.block_on(async {
+        tokio::time::timeout(Duration::from_secs(10), async {
+            while budget.reserved_bytes() > 0 {
+                tokio::time::sleep(Duration::from_millis(1)).await;
+            }
+        })
+        .await
+        .expect("cancelled reads release admission");
+    });
+    let mut results = results.into_iter().map(Result::unwrap);
+    let mut result = results.next().unwrap();
+    for next in results {
+        result.elapsed = result.elapsed.max(next.elapsed);
+        result.hydrated = result.hydrated.max(next.hydrated);
+        result.batches += next.batches;
+        result.trace_batches += next.trace_batches;
+    }
+    result.stats = pool.stats();
+    result
+}
+
+fn check_timeout(
+    start: Instant,
+    timeout: Duration,
+    budget: &ReadBudget,
+    observed: &Observed,
+    pool: &Pool,
+) {
+    if start.elapsed() >= timeout {
+        let stats = pool.stats();
+        panic!(
+            "operator benchmark timed out: reserved={} published={} reads={} in_flight={}",
+            budget.reserved_bytes(),
+            observed.batches.iter().sum::<usize>(),
+            stats.async_reads,
+            stats.async_reads_in_flight,
+        );
+    }
 }
 
 fn parameter(name: &str, default: usize) -> usize {
@@ -265,6 +413,9 @@ fn parameter(name: &str, default: usize) -> usize {
 #[mz_ore::test]
 #[ignore = "local operator performance comparison"]
 fn operator_microbench() {
+    let selected = std::env::var("MZ_BENCH_ASYNC")
+        .ok()
+        .map(|value| value.parse::<bool>().unwrap());
     let bursts = std::env::var("MZ_BENCH_BURST")
         .map_or_else(|_| vec![1, 8, 32], |s| vec![s.parse().unwrap()]);
     for sample in 0..parameter("MZ_BENCH_SAMPLES", 1) {
@@ -274,6 +425,9 @@ fn operator_microbench() {
             } else {
                 [true, false]
             } {
+                if selected.is_some_and(|value| value != asynchronous) {
+                    continue;
+                }
                 let config = Config {
                     rounds: u64::try_from(parameter("MZ_BENCH_ROUNDS", 32)).unwrap(),
                     rows: u64::try_from(parameter("MZ_BENCH_ROWS", 512)).unwrap(),
@@ -283,9 +437,29 @@ fn operator_microbench() {
                     asynchronous,
                     direct_output: parameter("MZ_BENCH_DIRECT", 0) != 0,
                 };
+                let registry = mz_ore::metrics::MetricsRegistry::new();
+                super::super::metrics::register(&registry);
+                let before = registry.gather();
                 let m = run(config);
+                let after = registry.gather();
+                for (before, after) in before.iter().zip_eq(&after) {
+                    let family = after.name();
+                    if after.name().ends_with("size_total") {
+                        continue;
+                    }
+                    for (before, after) in before.get_metric().iter().zip_eq(after.get_metric()) {
+                        eprintln!(
+                            "WORK async={asynchronous} family={family} stage={} value={}",
+                            after.get_label()[0].value(),
+                            after.get_gauge().as_ref().unwrap().value()
+                                - before.get_gauge().as_ref().unwrap().value(),
+                        );
+                    }
+                }
                 eprintln!(
-                    "OPERATOR sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
+                    "OPERATOR trace_batches={} workers={} sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
+                    m.trace_batches,
+                    parameter("MZ_BENCH_WORKERS", 1),
                     config.sources,
                     config.rounds * config.rows,
                     config.pool_bytes,

From 5d1cf9566b97afaca0e3e034f3680e342cb2bf93 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 11:23:03 -0400
Subject: [PATCH 19/31] timely-util: avoid read-admission cycles in native
 merges

---
 src/timely-util/src/columnar/chunk.rs         |  73 ++++--
 src/timely-util/src/columnar/chunk/native.rs  |   6 +-
 .../src/columnar/chunk/native/pool_chunk.rs   | 212 ++++++++++++++----
 .../src/columnar/chunk/native/vendor/spine.rs |   4 +-
 4 files changed, 233 insertions(+), 62 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index b25bb202ba11d..34bf27a9c7538 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -711,7 +711,7 @@ fn to_typed<C: Columnar>(column: Column<C>) -> Column<C> {
     }
 }
 
-impl<D, T, R> Chunk for ColumnChunk<D, T, R>
+impl<D, T, R> ColumnChunk<D, T, R>
 where
     D: Columnar,
     for<'a> columnar::Ref<'a, D>: Copy + Ord,
@@ -719,26 +719,17 @@ where
     for<'a> columnar::Ref<'a, T>: Copy + Ord,
     R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>>,
 {
-    type Time = T;
-
-    /// A nominal record count for the harness's fuel and ladder accounting,
-    /// not a bound. Actual chunk sizing is by serialized bytes: `merge` and
-    /// `extract` cut output at the [`Column`] ship threshold, and `settle`
-    /// grades by `at_commit_size`, so a chunk of narrow records can hold more
-    /// records than this and nothing here consults it.
-    const TARGET: usize = 65536;
-
-    fn len(&self) -> usize {
-        self.records()
-    }
-
-    /// [`Column::merge_from`] does the work: gallop bulk-copies for disjoint
-    /// runs, semigroup consolidation on equal `(data, time)`, output cut at
-    /// the ship threshold.
+    /// Merge the front pair, optionally using decoded copies of those exact inputs.
     ///
-    /// Fronts whose data ranges are disjoint never load at all: the resident
-    /// fence entries decide, and the lower front moves to the output whole.
-    fn merge(in1: &mut VecDeque<Self>, in2: &mut VecDeque<Self>, out: &mut VecDeque<Self>) {
+    /// Pool handles in the input queues stay available for untouched survivors.
+    /// Decoded input buffers are consumed here. Rewritten output and residuals
+    /// own typed storage, so read admission can be released when this returns.
+    pub(super) fn merge_with_loaded(
+        in1: &mut VecDeque<Self>,
+        in2: &mut VecDeque<Self>,
+        out: &mut VecDeque<Self>,
+        loaded: Option<[Self; 2]>,
+    ) {
         metrics::record(
             metrics::Stage::Merge,
             in1.front().map_or(0, Self::records) + in2.front().map_or(0, Self::records),
@@ -783,7 +774,15 @@ where
             ColumnChunk::Spilled(body, _) => Some(Rc::clone(body)),
             ColumnChunk::Resident(_, _) => None,
         };
-        let mut cols = [a.into_column(), b.into_column()];
+        let mut cols = match loaded {
+            Some([left, right]) => {
+                // Resident inputs can share their columns with the supplied copies.
+                // Release the originals before taking ownership to avoid copying them.
+                drop((a, b));
+                [left.into_column(), right.into_column()]
+            }
+            None => [a.into_column(), b.into_column()],
+        };
         let mut positions = [0usize, 0usize];
         loop {
             let mut result: Column<(D, T, R)> = Column::default();
@@ -820,6 +819,38 @@ where
             }
         }
     }
+}
+
+impl<D, T, R> Chunk for ColumnChunk<D, T, R>
+where
+    D: Columnar,
+    for<'a> columnar::Ref<'a, D>: Copy + Ord,
+    T: Columnar + Default + Timestamp + Lattice + Ord,
+    for<'a> columnar::Ref<'a, T>: Copy + Ord,
+    R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>>,
+{
+    type Time = T;
+
+    /// A nominal record count for the harness's fuel and ladder accounting,
+    /// not a bound. Actual chunk sizing is by serialized bytes: `merge` and
+    /// `extract` cut output at the [`Column`] ship threshold, and `settle`
+    /// grades by `at_commit_size`, so a chunk of narrow records can hold more
+    /// records than this and nothing here consults it.
+    const TARGET: usize = 65536;
+
+    fn len(&self) -> usize {
+        self.records()
+    }
+
+    /// [`Column::merge_from`] does the work: gallop bulk-copies for disjoint
+    /// runs, semigroup consolidation on equal `(data, time)`, output cut at
+    /// the ship threshold.
+    ///
+    /// Fronts whose data ranges are disjoint never load at all: the resident
+    /// fence entries decide, and the lower front moves to the output whole.
+    fn merge(in1: &mut VecDeque<Self>, in2: &mut VecDeque<Self>, out: &mut VecDeque<Self>) {
+        Self::merge_with_loaded(in1, in2, out, None);
+    }
 
     /// Partition one front chunk by `frontier`, folding kept times into
     /// `residual`. One chunk per call, so the harness settles both sides
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index db0b513726897..a8eb8bb529b93 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -13,6 +13,10 @@
 //! [`super::asynchronous::arrange`] owns the Timely operator and calls [`maintain`]
 //! when compaction or read completion makes work available. Batch conversion clones
 //! chunk handles, preserving shared ownership of their bodies.
+//!
+//! Trace callbacks queue maintenance. Only the owning driver polls storage, so a
+//! reader cannot acquire admission for work that the owner must finish while it
+//! is already waiting for admission in its batcher.
 
 use std::cell::RefCell;
 use std::collections::VecDeque;
@@ -291,7 +295,7 @@ where
     }
 
     fn exert(&mut self) {
-        self.state.borrow_mut().exert();
+        self.notify.notify_one();
     }
 
     fn set_exert_logic(&mut self, logic: ExertionLogic) {
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index cc5099b3b8abe..89563d12d2625 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -72,16 +72,15 @@ impl<D: Columnar, T: Columnar, R: Columnar> Default for PoolChunk<D, T, R> {
     }
 }
 
-/// Read state retained for one native merge or extraction, across all its chunk operations.
+/// Pending reads for a native merge or extraction.
 ///
-/// The reservation lasts until this state is dropped. It covers the largest input
-/// pair in the original runs, so progressing to another pair never requires more
-/// admission while retaining an earlier reservation. Output and compaction carry
-/// are outside this input budget.
+/// Admission covers one chunk operation's decoded inputs and is released after
+/// its kernel consumes them. Keeping admission across fuel turns can deadlock:
+/// a paused merger can hold the bytes needed by the next merger in the spine.
+/// Typed output and compaction carry are outside this input budget.
 pub struct ReadState<D: Columnar, T: Columnar, R: Columnar> {
     budget: Option<ReadBudget>,
     required_bytes: usize,
-    reservation: Option<Arc<OwnedSemaphorePermit>>,
     pending: Option<LocalBoxFuture<'static, LoadedInputs<D, T, R>>>,
 }
 
@@ -90,15 +89,15 @@ impl<D: Columnar, T: Columnar, R: Columnar> Default for ReadState<D, T, R> {
         Self {
             budget: None,
             required_bytes: 0,
-            reservation: None,
             pending: None,
         }
     }
 }
 
+// Field order releases abandoned buffers before their admission.
 struct LoadedInputs<D: Columnar, T: Columnar, R: Columnar> {
     chunks: Vec<ColumnChunk<D, T, R>>,
-    reservation: Arc<OwnedSemaphorePermit>,
+    _reservation: Arc<OwnedSemaphorePermit>,
 }
 
 impl<D, T, R> ReadState<D, T, R>
@@ -114,42 +113,30 @@ where
         &mut self,
         chunks: Vec<ColumnChunk<D, T, R>>,
         cx: &mut Context<'_>,
-    ) -> Poll<Vec<ColumnChunk<D, T, R>>> {
+    ) -> Poll<LoadedInputs<D, T, R>> {
         if self.pending.is_none() {
             let budget = self.budget.clone().expect("operation has input admission");
-            self.pending = Some(
-                Self::load_inputs(
-                    chunks,
-                    budget,
-                    self.required_bytes,
-                    self.reservation.clone(),
-                )
-                .boxed_local(),
-            );
+            self.pending =
+                Some(Self::load_inputs(chunks, budget, self.required_bytes).boxed_local());
         }
         let loaded = ready!(self.pending.as_mut().unwrap().as_mut().poll(cx));
         self.pending = None;
-        self.reservation = Some(loaded.reservation);
-        Poll::Ready(loaded.chunks)
+        Poll::Ready(loaded)
     }
 
     async fn load_inputs(
         chunks: Vec<ColumnChunk<D, T, R>>,
         budget: ReadBudget,
         required_bytes: usize,
-        reservation: Option<Arc<OwnedSemaphorePermit>>,
     ) -> LoadedInputs<D, T, R> {
-        let reservation = match reservation {
-            Some(reservation) => reservation,
-            None => budget.reserve(required_bytes).await,
-        };
+        let reservation = budget.reserve(required_bytes).await;
         let reads = chunks
             .into_iter()
             .map(|chunk| Self::load_chunk(chunk, Arc::clone(&reservation)));
         let chunks = futures_util::future::join_all(reads).await;
         LoadedInputs {
             chunks,
-            reservation,
+            _reservation: reservation,
         }
     }
 
@@ -323,17 +310,30 @@ where
             output.push_back(chunk);
             return Poll::Ready(());
         }
-        let loaded = ready!(io.poll_load(
+        let mut loaded = ready!(io.poll_load(
             vec![
                 left.front().unwrap().chunk.clone(),
                 right.front().unwrap().chunk.clone()
             ],
             cx
         ));
-        let mut loaded = loaded.into_iter();
-        left.front_mut().unwrap().chunk = loaded.next().unwrap();
-        right.front_mut().unwrap().chunk = loaded.next().unwrap();
-        Self::merge(left, right, output);
+        let mut chunks = loaded.chunks.drain(..);
+        let decoded = [chunks.next().unwrap(), chunks.next().unwrap()];
+        drop(chunks);
+        let budget = left.front().unwrap().budget.clone();
+        let mut left_columns = Self::take_columns(left);
+        let mut right_columns = Self::take_columns(right);
+        let mut merged = VecDeque::new();
+        ColumnChunk::merge_with_loaded(
+            &mut left_columns,
+            &mut right_columns,
+            &mut merged,
+            Some(decoded),
+        );
+        Self::extend_columns(left, left_columns, &budget);
+        Self::extend_columns(right, right_columns, &budget);
+        Self::extend_columns(output, merged, &budget);
+        drop(loaded);
         Poll::Ready(())
     }
 
@@ -345,17 +345,22 @@ where
         done: bool,
         out: &mut VecDeque<Self>,
     ) -> Poll<()> {
-        if input
+        let read = if input
             .iter()
             .any(|c| matches!(c.chunk, ColumnChunk::Spilled(..)))
         {
-            let loaded = ready!(io.poll_load(input.iter().map(|c| c.chunk.clone()).collect(), cx));
-            assert_eq!(input.len(), loaded.len());
-            for (index, chunk) in loaded.into_iter().enumerate() {
+            let mut loaded =
+                ready!(io.poll_load(input.iter().map(|c| c.chunk.clone()).collect(), cx));
+            assert_eq!(input.len(), loaded.chunks.len());
+            for (index, chunk) in loaded.chunks.drain(..).enumerate() {
                 input[index].chunk = chunk;
             }
-        }
+            Some(loaded)
+        } else {
+            None
+        };
         Self::advance(input, frontier, done, out);
+        drop(read);
         Poll::Ready(())
     }
 
@@ -368,6 +373,7 @@ where
         keep: &mut VecDeque<Self>,
         ship: &mut VecDeque<Self>,
     ) -> Poll<()> {
+        let mut read = None;
         if let Some(chunk) = input.front() {
             let (low, high) = chunk.chunk.chunk_time_bounds();
             let upper = to_mz(frontier);
@@ -375,11 +381,13 @@ where
             let entirely_after = low.iter().all(|time| upper.less_equal(time));
             let straddles_frontier = !entirely_before && !entirely_after;
             if straddles_frontier && matches!(chunk.chunk, ColumnChunk::Spilled(..)) {
-                let loaded = ready!(io.poll_load(vec![chunk.chunk.clone()], cx));
-                input.front_mut().unwrap().chunk = loaded.into_iter().next().unwrap();
+                let mut loaded = ready!(io.poll_load(vec![chunk.chunk.clone()], cx));
+                input.front_mut().unwrap().chunk = loaded.chunks.pop().unwrap();
+                read = Some(loaded);
             }
         }
         Self::extract(input, frontier, residual, keep, ship);
+        drop(read);
         Poll::Ready(())
     }
 }
@@ -421,3 +429,131 @@ impl<D: Columnar, T: Columnar, R: Columnar>
         self.queued.extend(input.drain(..));
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use differential_dataflow_next::trace::asynchronous::{MergeStatus, Merger};
+    use differential_dataflow_next::trace::chunk::ChunkBatch;
+    use differential_dataflow_next::trace::chunk::asynchronous::ChunkBatchMerger;
+    use mz_ore::pool::Pool;
+    use timely::container::PushInto;
+
+    type Update = ((u64, Vec<u8>), u64, i64);
+    type TestChunk = PoolChunk<(u64, Vec<u8>), u64, i64>;
+
+    fn chunk(updates: &[Update], pool: &Pool, budget: &ReadBudget) -> TestChunk {
+        let mut column = Column::default();
+        for update in updates {
+            column.push_into(update);
+        }
+        TestChunk {
+            chunk: ColumnChunk::spill_body(column, pool, 1),
+            budget: budget.clone(),
+        }
+    }
+
+    #[mz_ore::test]
+    fn a_fuel_yield_does_not_hold_read_admission() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        tokio::runtime::Runtime::new().unwrap().block_on(async {
+            let budget = ReadBudget::new(1 << 20);
+            let batch = |offset: u64| {
+                ChunkBatch::new(
+                    (0..4)
+                        .map(|part| {
+                            let rows: Vec<_> = (0..8)
+                                .map(|row| ((part * 16 + row * 2 + offset, vec![7; 128]), 0, 1))
+                                .collect();
+                            chunk(&rows, &pool, &budget)
+                        })
+                        .collect(),
+                )
+            };
+            let left = batch(0);
+            let right = batch(1);
+            let frontier = timely_next::progress::Antichain::from_elem(Time(0));
+            let mut merger = ChunkBatchMerger::new(&left, &right, frontier.borrow());
+            let mut fuel = 1;
+            let status =
+                futures_util::future::poll_fn(|cx| merger.poll_work(&left, &right, cx, &mut fuel))
+                    .await;
+            assert!(matches!(status, MergeStatus::InProgress));
+            assert!(pool.stats().async_reads > 0);
+            assert_eq!(
+                budget.reserved_bytes(),
+                0,
+                "another merger must be able to acquire admission before this one resumes"
+            );
+        });
+    }
+
+    #[mz_ore::test]
+    fn loaded_merge_restores_an_untouched_pool_body() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        tokio::runtime::Runtime::new().unwrap().block_on(async {
+            let budget = ReadBudget::new(1 << 20);
+            // Equal data spans require inspecting times. Only the left input is
+            // consumed, so the right input must retain its original pool handle.
+            let mut left = VecDeque::from([chunk(&[((1, vec![7; 128]), 0, 1)], &pool, &budget)]);
+            let mut right = VecDeque::from([chunk(&[((1, vec![7; 128]), 1, 1)], &pool, &budget)]);
+            let ColumnChunk::Spilled(original, _) = right[0].chunk.clone() else {
+                unreachable!();
+            };
+            let mut io = TestChunk::pending_for(left.make_contiguous(), right.make_contiguous());
+            let mut output = VecDeque::new();
+            futures_util::future::poll_fn(|cx| {
+                TestChunk::poll_merge(&mut io, cx, &mut left, &mut right, &mut output)
+            })
+            .await;
+            assert!(left.is_empty());
+            assert_eq!(output.iter().map(NativeChunk::len).sum::<usize>(), 1);
+            let ColumnChunk::Spilled(survivor, depth) = &right[0].chunk else {
+                panic!("untouched input must not retain a decoded read buffer");
+            };
+            assert!(Rc::ptr_eq(&original, survivor));
+            assert_eq!(*depth, 2);
+            assert_eq!(budget.reserved_bytes(), 0);
+        });
+    }
+
+    #[mz_ore::test]
+    fn trace_callbacks_leave_reads_to_the_owning_driver() {
+        use differential_dataflow::trace::{Description, Trace, TraceReader};
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        tokio::runtime::Runtime::new().unwrap().block_on(async {
+            let budget = ReadBudget::new(1 << 20);
+            let info = timely::dataflow::operators::generic::OperatorInfo::new(0, 0, Rc::from([0]));
+            let mut trace = super::super::Spine::with_budget(info, budget.clone());
+            for time in 0..3 {
+                trace.insert(Rc::new(differential_dataflow::trace::chunk::ChunkBatch {
+                    chunks: vec![chunk(&[((1, vec![7; 128]), time, 1)], &pool, &budget).chunk],
+                    description: Description::new(
+                        timely::progress::Antichain::from_elem(time),
+                        timely::progress::Antichain::from_elem(time + 1),
+                        timely::progress::Antichain::from_elem(0),
+                    ),
+                }));
+            }
+            let frontier = timely::progress::Antichain::from_elem(3);
+            trace.set_logical_compaction(frontier.borrow());
+            trace.set_physical_compaction(frontier.borrow());
+            trace.exert();
+            assert_eq!(pool.stats().async_reads, 0);
+            assert_eq!(
+                budget.reserved_bytes(),
+                0,
+                "callbacks must not acquire admission while the arranger can be awaiting its batcher"
+            );
+            super::super::maintain(&trace.state, &trace.notify).await;
+            assert!(pool.stats().async_reads > 0);
+            assert_eq!(budget.reserved_bytes(), 0);
+        });
+    }
+}
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index 95b0e048ed4ed..c83d23219001d 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -251,7 +251,7 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         );
         self.physical_frontier.clear();
         self.physical_frontier.extend(frontier.iter().cloned());
-        self.consider_merges();
+        self.activate();
     }
     #[inline]
     /// Return the current physical compaction frontier.
@@ -363,7 +363,7 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
 
         // TODO: Consolidate or discard spans with no updates.
         self.pending.push(span);
-        self.consider_merges();
+        self.activate();
     }
 
     /// Completes the trace with a final empty batch.

From 61344007ec08bf5b4340f378ed211b031b8e2811 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 11:42:07 -0400
Subject: [PATCH 20/31] controller: expose storage arrangement maintenance
 policy

---
 src/controller-types/src/dyncfgs.rs             |  8 ++++++++
 src/controller/src/clusters.rs                  | 13 +++++++------
 test/launchdarkly-flag-consistency/mzcompose.py |  1 +
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/controller-types/src/dyncfgs.rs b/src/controller-types/src/dyncfgs.rs
index 7a37b862df65f..8ceb83aa46b21 100644
--- a/src/controller-types/src/dyncfgs.rs
+++ b/src/controller-types/src/dyncfgs.rs
@@ -76,6 +76,13 @@ pub const ARRANGEMENT_EXERT_PROPORTIONALITY: Config<u32> = Config::new(
     ParameterScope::Replica,
 );
 
+pub const STORAGE_ARRANGEMENT_EXERT_PROPORTIONALITY: Config<u32> = Config::new(
+    "storage_arrangement_exert_proportionality",
+    1337,
+    "Storage arrangement maintenance proportionality. Zero disables optional maintenance. Applies when a replica is provisioned.",
+    ParameterScope::Replica,
+);
+
 pub const ENABLE_PAUSED_CLUSTER_READHOLD_DOWNGRADE: Config<bool> = Config::new(
     "enable_paused_cluster_readhold_downgrade",
     true,
@@ -94,5 +101,6 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&ENABLE_TIMELY_ZERO_COPY_LGALLOC)
         .add(&TIMELY_ZERO_COPY_LIMIT)
         .add(&ARRANGEMENT_EXERT_PROPORTIONALITY)
+        .add(&STORAGE_ARRANGEMENT_EXERT_PROPORTIONALITY)
         .add(&ENABLE_PAUSED_CLUSTER_READHOLD_DOWNGRADE)
 }
diff --git a/src/controller/src/clusters.rs b/src/controller/src/clusters.rs
index 3af30e43670f6..6482f7e2bb70d 100644
--- a/src/controller/src/clusters.rs
+++ b/src/controller/src/clusters.rs
@@ -26,7 +26,8 @@ use mz_compute_client::logging::LogVariant;
 use mz_compute_types::config::{ComputeReplicaConfig, ComputeReplicaLogging};
 use mz_controller_types::dyncfgs::{
     ARRANGEMENT_EXERT_PROPORTIONALITY, CONTROLLER_PAST_GENERATION_REPLICA_CLEANUP_RETRY_INTERVAL,
-    ENABLE_TIMELY_ZERO_COPY, ENABLE_TIMELY_ZERO_COPY_LGALLOC, TIMELY_ZERO_COPY_LIMIT,
+    ENABLE_TIMELY_ZERO_COPY, ENABLE_TIMELY_ZERO_COPY_LGALLOC,
+    STORAGE_ARRANGEMENT_EXERT_PROPORTIONALITY, TIMELY_ZERO_COPY_LIMIT,
 };
 use mz_controller_types::{ClusterId, ReplicaId};
 use mz_orchestrator::NamespacedOrchestrator;
@@ -704,11 +705,6 @@ impl Controller {
         let persist_pubsub_url = self.persist_pubsub_url.clone();
         let secrets_args = self.secrets_args.to_flags();
 
-        // TODO(teskje): use the same values as for compute?
-        let storage_proto_timely_config = TimelyConfig {
-            arrangement_exert_proportionality: 1337,
-            ..Default::default()
-        };
         // These configure the replica's process rather than environmentd's, so
         // they are `ParameterScope::Replica` and must be read through this
         // replica's scoped overrides. They are baked into the process
@@ -716,6 +712,11 @@ impl Controller {
         // environment-wide value or the override reaches the replica only when
         // it is next provisioned.
         let overrides = self.replica_dyncfg_overrides.get(&replica_id);
+        let storage_proto_timely_config = TimelyConfig {
+            arrangement_exert_proportionality: STORAGE_ARRANGEMENT_EXERT_PROPORTIONALITY
+                .get_with_overrides(&self.dyncfg, overrides),
+            ..Default::default()
+        };
         let compute_proto_timely_config = TimelyConfig {
             arrangement_exert_proportionality: ARRANGEMENT_EXERT_PROPORTIONALITY
                 .get_with_overrides(&self.dyncfg, overrides),
diff --git a/test/launchdarkly-flag-consistency/mzcompose.py b/test/launchdarkly-flag-consistency/mzcompose.py
index 551510cdb4481..94af040c6b768 100644
--- a/test/launchdarkly-flag-consistency/mzcompose.py
+++ b/test/launchdarkly-flag-consistency/mzcompose.py
@@ -413,6 +413,7 @@
     ssh_connect_timeout
     ssh_keepalives_idle
     statement_logging_use_reproducible_rng
+    storage_arrangement_exert_proportionality
     storage_cluster_shutdown_grace_period
     storage_downgrade_since_during_finalization
     storage_record_source_sink_namespaced_errors

From 5975b874ed73be7ecb5f9ed712749b052b2731cc Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 11:53:03 -0400
Subject: [PATCH 21/31] timely-util: exercise maintenance between input bursts

---
 .../columnar/chunk/asynchronous/operator_tests.rs   | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
index 6a4295ffe1b0b..e2df94844a389 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -12,6 +12,8 @@
 //! separately from final compaction. After ingestion, the benchmark policy requests
 //! one non-empty batch per source. The drain waits for that shape, released read
 //! admission, and pool counters that remain quiet for 20 ms.
+//! `MZ_BENCH_IDLE_MS` gives maintenance time between completed input bursts while
+//! continuing to schedule the worker. It applies to the coordinated-input mode.
 //! This exercises pool eviction and compression, not forced device contention.
 
 use std::cell::RefCell;
@@ -172,6 +174,8 @@ fn run(config: Config) -> Measurement {
     let timeout =
         Duration::from_secs(u64::try_from(parameter("MZ_BENCH_TIMEOUT_S", 1200)).unwrap());
     let workers = parameter("MZ_BENCH_WORKERS", 1);
+    let idle = Duration::from_millis(u64::try_from(parameter("MZ_BENCH_IDLE_MS", 0)).unwrap());
+    assert!(idle.is_zero() || parameter("MZ_BENCH_INDEPENDENT", 0) == 0);
     assert!(workers > 0 && config.sources > 0 && config.burst > 0);
     assert!(config.rounds > 0 && config.rows > 0);
     let mut timely_config = timely::Config::process(workers);
@@ -290,6 +294,12 @@ fn run(config: Config) -> Measurement {
                                 std::thread::yield_now();
                                 check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
                             }
+                            let idle_start = Instant::now();
+                            while idle_start.elapsed() < idle {
+                                worker.step();
+                                std::thread::yield_now();
+                                check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
+                            }
                         }
                     }
                 }
@@ -457,9 +467,10 @@ fn operator_microbench() {
                     }
                 }
                 eprintln!(
-                    "OPERATOR trace_batches={} workers={} sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
+                    "OPERATOR trace_batches={} workers={} idle_ms={} sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
                     m.trace_batches,
                     parameter("MZ_BENCH_WORKERS", 1),
+                    parameter("MZ_BENCH_IDLE_MS", 0),
                     config.sources,
                     config.rounds * config.rows,
                     config.pool_bytes,

From 34309484787e6d2c2f24be7c62704eddc1aae8ea Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 13:14:25 -0400
Subject: [PATCH 22/31] ore: avoid executor hops for resident pool reads

---
 src/ore/src/pool.rs                           | 95 ++++++++++++++++++-
 .../src/columnar/chunk/native/pool_chunk.rs   | 33 ++++++-
 2 files changed, 121 insertions(+), 7 deletions(-)

diff --git a/src/ore/src/pool.rs b/src/ore/src/pool.rs
index f0ab4ca01339d..d52d4937b1c51 100644
--- a/src/ore/src/pool.rs
+++ b/src/ore/src/pool.rs
@@ -2019,13 +2019,17 @@ impl ChunkHandle {
         self.read_impl(0..self.meta.len, dst, false);
     }
 
-    /// Copy this chunk on the blocking executor without admitting it to the pool.
+    /// Copy this chunk without admitting it to the pool, offloading nonresident reads.
     ///
-    /// Requires a Tokio runtime. A submitted read retains its handle and
+    /// Resident slots are copied inline if their state lock is available. Other
+    /// reads require a Tokio runtime. A submitted read retains its handle and
     /// concurrency permit until it finishes, even if the caller cancels.
     /// The returned buffer belongs to the caller.
     #[cfg(feature = "async")]
     pub async fn read_async(self: &Arc<Self>) -> Vec<u64> {
+        if let Some(words) = self.try_read_resident() {
+            return words;
+        }
         let permit = Arc::clone(&self.meta.pool.read_slots)
             .acquire_owned()
             .await
@@ -2050,6 +2054,29 @@ impl ChunkHandle {
         .await
     }
 
+    #[cfg(feature = "async")]
+    fn try_read_resident(&self) -> Option<Vec<u64>> {
+        if self.meta.len == 0 {
+            return Some(Vec::new());
+        }
+        let mut state = match self.meta.state.try_lock() {
+            Ok(state) => state,
+            Err(std::sync::TryLockError::WouldBlock) => return None,
+            Err(std::sync::TryLockError::Poisoned(_)) => panic!("chunk state poisoned"),
+        };
+        match state.residency {
+            Residency::UnbackedResident | Residency::BackedResident | Residency::WriteInFlight => {
+                state.touched = true;
+                let slot = state.slot.expect("resident non-empty chunk has a slot");
+                // SAFETY: the state lock prevents eviction from releasing this slot.
+                let words = unsafe { self.meta.pool.slot_data(&self.meta, slot) };
+                Some(words.to_vec())
+            }
+            // Oversize heap copies have no slot-size bound, so keep them off-worker.
+            Residency::Oversize | Residency::Evicted => None,
+        }
+    }
+
     /// As [`ChunkHandle::read_into`], restricted to the word range `range`
     /// of the chunk's contents, which must lie within them. `dst` receives
     /// exactly the range.
@@ -2308,8 +2335,12 @@ impl Drop for ChunkHandle {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(feature = "async")]
+    use std::future::Future;
     #[cfg(feature = "async")]
     use std::sync::atomic::{AtomicBool, AtomicUsize};
+    #[cfg(feature = "async")]
+    use std::task::{Context, Poll, Waker};
 
     use super::*;
     use crate::pool::extent::TEST_CODEC;
@@ -2386,11 +2417,69 @@ mod tests {
             let resident = pool.stats().resident_bytes;
             assert_eq!(handle.read_async().await, expected);
             assert_eq!(pool.stats().resident_bytes, resident);
-            assert_eq!(pool.stats().async_reads, 1);
+            assert_eq!(pool.stats().async_reads, u64::from(budget == 0));
             assert_eq!(pool.stats().async_reads_in_flight, 0);
         }
     }
 
+    #[cfg(feature = "async")]
+    #[mz_ore::test]
+    fn resident_async_reads_complete_without_a_runtime() {
+        let pool = test_pool(usize::MAX);
+        let expected = payload(8192, 42);
+        let handle = Arc::new(insert(&pool, &mut expected.clone()));
+        let mut read = Box::pin(handle.read_async());
+        assert_eq!(
+            read.as_mut().poll(&mut Context::from_waker(Waker::noop())),
+            Poll::Ready(expected)
+        );
+        assert_eq!(pool.stats().async_reads, 0);
+        pool.evict(&handle);
+        assert!(handle.try_read_resident().is_none());
+    }
+
+    #[cfg(feature = "async")]
+    #[mz_ore::test(tokio::test)]
+    #[cfg_attr(miri, ignore)]
+    async fn contended_resident_reads_yield() {
+        let pool = test_pool(usize::MAX);
+        let expected = payload(8192, 42);
+        let handle = Arc::new(insert(&pool, &mut expected.clone()));
+        let mut read = Box::pin(handle.read_async());
+        {
+            let _state = handle.meta.state();
+            assert!(
+                read.as_mut()
+                    .poll(&mut Context::from_waker(Waker::noop()))
+                    .is_pending()
+            );
+        }
+        assert_eq!(read.await, expected);
+        assert_eq!(pool.stats().async_reads, 1);
+    }
+
+    #[cfg(feature = "async")]
+    #[mz_ore::test(tokio::test)]
+    #[ignore = "local resident-read dispatch comparison"]
+    async fn resident_read_microbench() {
+        for words in [8 << 10, 256 << 10] {
+            let pool = test_pool(usize::MAX);
+            let expected = payload(words, 42);
+            let handle = Arc::new(insert(&pool, &mut expected.clone()));
+            assert_eq!(handle.read_async().await, expected);
+            let start = std::time::Instant::now();
+            for _ in 0..1024 {
+                std::hint::black_box(handle.read_async().await);
+            }
+            eprintln!(
+                "RESIDENT_READ bytes={} iterations=1024 us={} offloaded={}",
+                words * 8,
+                start.elapsed().as_micros(),
+                pool.stats().async_reads,
+            );
+        }
+    }
+
     #[cfg(feature = "async")]
     #[mz_ore::test(tokio::test)]
     #[cfg_attr(miri, ignore)]
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index 89563d12d2625..463592f08a1c4 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -147,13 +147,18 @@ where
         match chunk {
             ColumnChunk::Spilled(body, depth) => {
                 let handle = Arc::clone(&body.handle);
-                // NOTE: Dropping the operator cannot cancel a submitted blocking
-                // read. This owned task keeps input admission until that read ends.
-                let task = mz_ore::task::spawn(|| "native_merge_read", async move {
+                let mut read = Box::pin(async move {
                     let words = handle.read_async().await;
                     (words, reservation)
                 });
-                let (words, _reservation) = task.await;
+                let (words, _reservation) = match futures_util::poll!(read.as_mut()) {
+                    Poll::Ready(loaded) => loaded,
+                    Poll::Pending => {
+                        // NOTE: A submitted blocking read outlives cancellation.
+                        // This task retains its input admission until the read ends.
+                        mz_ore::task::spawn(|| "native_merge_read", read).await
+                    }
+                };
                 ColumnChunk::Resident(Rc::new(Column::Align(words)), depth)
             }
             chunk @ ColumnChunk::Resident(..) => chunk,
@@ -453,6 +458,26 @@ mod tests {
         }
     }
 
+    #[mz_ore::test]
+    fn resident_inputs_do_not_spawn_read_tasks() {
+        let pool = Pool::new().unwrap();
+        pool.set_budget(usize::MAX);
+        let budget = ReadBudget::new(1 << 20);
+        let input = chunk(&[((1, vec![7; 128]), 0, 1)], &pool, &budget);
+        let mut io = TestChunk::pending_for(std::slice::from_ref(&input), &[]);
+        let Poll::Ready(loaded) = io.poll_load(
+            vec![input.chunk.clone()],
+            &mut Context::from_waker(std::task::Waker::noop()),
+        ) else {
+            panic!("resident input should load in one poll");
+        };
+        assert_eq!(loaded.chunks[0].records(), 1);
+        assert!(budget.reserved_bytes() > 0);
+        drop(loaded);
+        assert_eq!(budget.reserved_bytes(), 0);
+        assert_eq!(pool.stats().async_reads, 0);
+    }
+
     #[mz_ore::test]
     fn a_fuel_yield_does_not_hold_read_admission() {
         let pool = Pool::new().unwrap();

From c7697f7fb3dccf1e1f3efb3c9bd7a8365fa78213 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 13:53:07 -0400
Subject: [PATCH 23/31] timely-util: defer optional consolidation while input
 is queued

---
 src/timely-util/src/builder_async.rs          |  5 ++
 .../src/columnar/chunk/asynchronous.rs        |  8 +-
 src/timely-util/src/columnar/chunk/native.rs  | 15 +++-
 .../src/columnar/chunk/native/pool_chunk.rs   |  2 +-
 .../src/columnar/chunk/native/vendor/spine.rs | 18 ++++-
 .../chunk/native/vendor/tests/spine.rs        | 73 ++++++++++++++++---
 6 files changed, 101 insertions(+), 20 deletions(-)

diff --git a/src/timely-util/src/builder_async.rs b/src/timely-util/src/builder_async.rs
index 51eb84b39d8b1..d73d47b362bd7 100644
--- a/src/timely-util/src/builder_async.rs
+++ b/src/timely-util/src/builder_async.rs
@@ -158,6 +158,11 @@ pub struct AsyncInputHandle<T: Timestamp, D: Container, C: InputConnection<T>> {
 }
 
 impl<T: Timestamp, D: Container, C: InputConnection<T>> AsyncInputHandle<T, D, C> {
+    /// Whether the input currently has no queued data or frontier changes.
+    pub fn is_empty(&self) -> bool {
+        self.queue.borrow().is_empty()
+    }
+
     pub fn next_sync(&mut self) -> Option<Event<T, C::Capability, D>> {
         let mut queue = self.queue.borrow_mut();
         match queue.pop_front()? {
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index 2dbe8a369e42f..f940442c100e8 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -130,7 +130,9 @@ where
                     upper = next;
                 }
             }
-            maintain(&state, &notify).await;
+            // Queued input will fund introductions itself. Continue active merges,
+            // but wait for input to drain before forcing separate batches together.
+            maintain(&state, &notify, input.is_empty()).await;
             tokio::task::yield_now().await;
         }
     });
@@ -258,7 +260,7 @@ mod tests {
             reader.set_logical_compaction(frontier.borrow());
             reader.set_physical_compaction(frontier.borrow());
 
-            maintain(&state, &notify).await;
+            maintain(&state, &notify, true).await;
             assert_eq!(
                 reader
                     .batches_through(Antichain::new().borrow())
@@ -269,7 +271,7 @@ mod tests {
             );
             hold.set_logical_compaction(frontier.borrow());
             hold.set_physical_compaction(frontier.borrow());
-            let mut maintenance = Box::pin(maintain(&state, &notify));
+            let mut maintenance = Box::pin(maintain(&state, &notify, true));
             assert!(futures_util::poll!(&mut maintenance).is_pending());
             assert_eq!(
                 reader
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index a8eb8bb529b93..068f212cc71e3 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -330,11 +330,20 @@ impl Wake for NotifyWake {
 /// This does not force all batches to compact. DD's exertion policy determines
 /// the work allowance. The caller must use the notification installed by
 /// `Spine::with_budget` and poll this future on the owning Timely worker.
-pub(super) async fn maintain<B>(state: &RefCell<vendor::spine::Spine<B>>, notify: &Notify)
-where
+/// Set `allow_consolidation` when input drains so policy can also initiate merges
+/// between separate batches. Otherwise only active merges receive optional fuel.
+pub(super) async fn maintain<B>(
+    state: &RefCell<vendor::spine::Spine<B>>,
+    notify: &Notify,
+    allow_consolidation: bool,
+) where
     B: differential_dataflow_next::trace::asynchronous::Batch + Clone + 'static,
 {
-    state.borrow_mut().exert();
+    if allow_consolidation {
+        state.borrow_mut().exert();
+    } else {
+        state.borrow_mut().exert_merges();
+    }
     while state.borrow().maintenance_pending() {
         // No trace borrow may cross this await. Reader compaction can change the
         // same spine while a read is pending, and its wakeup uses this notification.
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index 463592f08a1c4..8274bce721a13 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -576,7 +576,7 @@ mod tests {
                 0,
                 "callbacks must not acquire admission while the arranger can be awaiting its batcher"
             );
-            super::super::maintain(&trace.state, &trace.notify).await;
+            super::super::maintain(&trace.state, &trace.notify, true).await;
             assert!(pool.stats().async_reads > 0);
             assert_eq!(budget.reserved_bytes(), 0);
         });
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index c83d23219001d..10d5c9b72932e 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -292,6 +292,18 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
     ///
     /// Whether and how much effort to apply is determined by `self.exert_logic`, a closure the user can set.
     pub fn exert(&mut self) {
+        self.exert_inner(true);
+    }
+
+    /// Apply policy-funded effort to active merges without forcing separate batches together.
+    ///
+    /// Pending introductions retain their insertion-funded work. Call `exert` when
+    /// input drains to satisfy the configured optional consolidation policy.
+    pub fn exert_merges(&mut self) {
+        self.exert_inner(false);
+    }
+
+    fn exert_inner(&mut self, allow_consolidation: bool) {
         // Finish the old grant before asking policy for another one.
         if !self.drive_maintenance() {
             return;
@@ -302,12 +314,16 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         }
         self.tidy_layers();
         if let Some(effort) = self.exert_effort() {
+            let active_merge = self.merging.iter().any(|b| b.is_double());
+            if !active_merge && !allow_consolidation {
+                return;
+            }
             crate::columnar::chunk::metrics::record(
                 crate::columnar::chunk::metrics::Stage::OptionalExert,
                 effort,
                 0,
             );
-            if self.merging.iter().any(|b| b.is_double()) {
+            if active_merge {
                 self.queue_fuel(effort.cast_signed());
             } else {
                 let level = usize::cast_from(effort.next_power_of_two().trailing_zeros());
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
index df75aa2d78c1e..93f5673f7d8a3 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -180,7 +180,12 @@ struct MaintenanceSample {
 // Two equal batches start a merge without doing any merge work during setup.
 // Each permit represents one row made available by a completed read. The same
 // maintenance future used by the arranger decides when input can resume.
-fn maintenance_sample(rows: u64, fuel: usize, read_rows: Option<usize>) -> MaintenanceSample {
+fn maintenance_sample(
+    rows: u64,
+    fuel: usize,
+    read_rows: Option<usize>,
+    allow_consolidation: bool,
+) -> MaintenanceSample {
     use std::cell::RefCell;
     use std::future::Future;
     use std::pin::pin;
@@ -223,7 +228,7 @@ fn maintenance_sample(rows: u64, fuel: usize, read_rows: Option<usize>) -> Maint
     let mut completions = 0;
     let start = Instant::now();
     {
-        let mut future = pin!(maintain(&state, &notify));
+        let mut future = pin!(maintain(&state, &notify, allow_consolidation));
         let wake_count = Arc::new(WakeCount(std::sync::atomic::AtomicUsize::new(0)));
         let waker = Waker::from(Arc::clone(&wake_count));
         let mut cx = Context::from_waker(&waker);
@@ -274,19 +279,63 @@ fn maintenance_sample(rows: u64, fuel: usize, read_rows: Option<usize>) -> Maint
 
 #[mz_ore::test]
 fn maintenance_readiness_preserves_work_allowance() {
-    for fuel in [1, 1000] {
-        let ready = maintenance_sample(4096, fuel, None);
-        assert_eq!(ready.worked, fuel);
-        for read_rows in [1, 64, 1024] {
-            let pending = maintenance_sample(4096, fuel, Some(read_rows));
-            assert_eq!(
-                pending.worked, ready.worked,
-                "fuel={fuel}, read_rows={read_rows}"
-            );
+    for allow_consolidation in [false, true] {
+        for fuel in [1, 1000] {
+            let ready = maintenance_sample(4096, fuel, None, allow_consolidation);
+            assert_eq!(ready.worked, fuel);
+            for read_rows in [1, 64, 1024] {
+                let pending = maintenance_sample(4096, fuel, Some(read_rows), allow_consolidation);
+                assert_eq!(
+                    pending.worked, ready.worked,
+                    "fuel={fuel}, read_rows={read_rows}, allow_consolidation={allow_consolidation}"
+                );
+            }
         }
     }
 }
 
+#[mz_ore::test]
+fn merge_only_maintenance_defers_consolidation_until_idle() {
+    let gate = Arc::new(Mutex::new(Gate {
+        permits: usize::MAX,
+        ..Gate::default()
+    }));
+    let mut trace = Spine::new(OperatorInfo::new(0, 0, [].into()), None, None);
+    // Descending sizes place the batches in separate layers without starting a merge.
+    for (time, count) in [(0, 32), (1, 1)] {
+        trace.insert(Span::new(
+            Description::new(
+                Antichain::from_elem(time),
+                Antichain::from_elem(time + 1),
+                Antichain::from_elem(0),
+            ),
+            Some(Batch {
+                rows: (0..count).map(|key| (key, time, 1)).collect(),
+                gate: Arc::clone(&gate),
+            }),
+        ));
+    }
+    trace.set_physical_compaction(Antichain::from_elem(2).borrow());
+    let expected = contents(&trace);
+    trace.set_exert_logic(Arc::new(|levels| {
+        let batches: usize = levels.iter().map(|(_, count, _)| count).sum();
+        (batches > 1).then_some(1000)
+    }));
+    for _ in 0..100 {
+        trace.exert_merges();
+        assert_eq!(gate.lock().unwrap().worked, 0);
+        assert_eq!(contents(&trace), expected);
+    }
+    for _ in 0..100 {
+        trace.exert();
+    }
+    assert_eq!(gate.lock().unwrap().worked, 33);
+    let mut batches = 0;
+    trace.map_spans(|span| batches += usize::from(span.inner.is_some()));
+    assert_eq!(batches, 1, "idle maintenance must complete consolidation");
+    assert_eq!(contents(&trace), expected);
+}
+
 /// Run with `cargo test -p mz-timely-util maintenance_microbench -- --ignored --nocapture`.
 /// Reports work and read completions before the arranger can next accept input.
 /// Reads complete immediately when requested: timings measure scheduling and mock
@@ -299,7 +348,7 @@ fn maintenance_microbench() {
         for fuel in [1, 1000] {
             for read_rows in [None, Some(1), Some(64), Some(1024)] {
                 for sample in 0..5 {
-                    let result = maintenance_sample(rows, fuel, read_rows);
+                    let result = maintenance_sample(rows, fuel, read_rows, true);
                     println!(
                         "{rows},{fuel},{},{sample},{},{},{}",
                         read_rows.map_or_else(|| "ready".to_owned(), |n| n.to_string()),

From 2d1a9ed4597f6cc7e1bb5faa7d2b48f3e7472fe7 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Fri, 11 Sep 2026 13:57:09 -0400
Subject: [PATCH 24/31] timely-util: preserve spilled chunks across unchanged
 timestamp advancement

---
 src/timely-util/src/columnar/chunk.rs         | 107 ++++++++++++++++++
 .../src/columnar/chunk/native/pool_chunk.rs   |  87 ++++++++++++++
 2 files changed, 194 insertions(+)

diff --git a/src/timely-util/src/columnar/chunk.rs b/src/timely-util/src/columnar/chunk.rs
index 34bf27a9c7538..f6ac09309c3a2 100644
--- a/src/timely-util/src/columnar/chunk.rs
+++ b/src/timely-util/src/columnar/chunk.rs
@@ -719,6 +719,29 @@ where
     for<'a> columnar::Ref<'a, T>: Copy + Ord,
     R: Columnar + Default + Semigroup + for<'a> Semigroup<columnar::Ref<'a, R>>,
 {
+    /// Whether stored metadata proves this chunk can pass through advancement unchanged.
+    ///
+    /// The following chunk must start a later data group, or this must be the
+    /// final input at `done`. Otherwise the trailing group still needs consolidation.
+    fn advances_unchanged(
+        &self,
+        frontier: AntichainRef<T>,
+        next: Option<&Self>,
+        done: bool,
+    ) -> bool {
+        let Self::Spilled(body, _) = self else {
+            return false;
+        };
+        body.time_lower.iter().all(|time| frontier.less_equal(time))
+            && match next {
+                Some(next) if next.records() > 0 => {
+                    rr::<D>(self.data_span().1) < rr::<D>(next.data_span().0)
+                }
+                Some(_) => false,
+                None => done,
+            }
+    }
+
     /// Merge the front pair, optionally using decoded copies of those exact inputs.
     ///
     /// Pool handles in the input queues stay available for untouched survivors.
@@ -928,6 +951,12 @@ where
         done: bool,
         out: &mut VecDeque<Self>,
     ) {
+        while input
+            .front()
+            .is_some_and(|chunk| chunk.advances_unchanged(frontier, input.get(1), done))
+        {
+            out.push_back(input.pop_front().expect("front observed above"));
+        }
         metrics::record(
             metrics::Stage::Advance,
             input.iter().map(Self::records).sum(),
@@ -1977,6 +2006,84 @@ mod tests {
         assert_eq!(collect_chunks(out), consolidate(advanced));
     }
 
+    #[mz_ore::test]
+    fn unchanged_advance_preserves_complete_spilled_groups() {
+        let pool = test_pool();
+        let first: Vec<Tuple> = (0..8).map(|key| ((key, 0), 10, 1)).collect();
+        let second: Vec<Tuple> = (8..16).map(|key| ((key, 0), 10, 1)).collect();
+        let original = TestChunk::spill_body(build_column(&first), &pool, 2);
+        let mut input = VecDeque::from([
+            original.clone(),
+            TestChunk::spill_body(build_column(&second), &pool, 2),
+        ]);
+        let mut output = VecDeque::new();
+        TestChunk::advance(
+            &mut input,
+            Antichain::from_elem(5).borrow(),
+            false,
+            &mut output,
+        );
+        let (ColumnChunk::Spilled(before, depth), ColumnChunk::Spilled(after, after_depth)) =
+            (&original, &output[0])
+        else {
+            panic!("the complete prefix must retain its spilled representation");
+        };
+        assert!(Rc::ptr_eq(before, after));
+        assert_eq!(depth, after_depth);
+        assert!(
+            !input.is_empty(),
+            "the unobserved trailing group must remain buffered"
+        );
+        assert_eq!(
+            collect_chunks(output.into_iter().chain(input)),
+            first.into_iter().chain(second).collect::<Vec<_>>()
+        );
+    }
+
+    #[mz_ore::test]
+    fn unchanged_advance_consolidates_shared_boundary_groups() {
+        let pool = test_pool();
+        let first = [((0, 0), 10, 1), ((0, 0), 11, 1)];
+        let second = [((0, 0), 11, -1)];
+        let mut input = VecDeque::from([TestChunk::spill_body(build_column(&first), &pool, 1)]);
+        let mut output = VecDeque::new();
+        let frontier = Antichain::from_elem(5);
+        TestChunk::advance(&mut input, frontier.borrow(), false, &mut output);
+        assert!(
+            output.is_empty(),
+            "a following chunk may continue the same group"
+        );
+        input.push_back(TestChunk::spill_body(build_column(&second), &pool, 1));
+        TestChunk::advance(&mut input, frontier.borrow(), true, &mut output);
+        assert!(input.is_empty());
+        assert_eq!(collect_chunks(output), vec![((0, 0), 10, 1)]);
+
+        // Both boundary chunks can still be spilled when presented in one call.
+        let mut input = VecDeque::from([
+            TestChunk::spill_body(build_column(&first), &pool, 1),
+            TestChunk::spill_body(build_column(&second), &pool, 1),
+        ]);
+        let mut output = VecDeque::new();
+        TestChunk::advance(&mut input, frontier.borrow(), true, &mut output);
+        assert_eq!(collect_chunks(output), vec![((0, 0), 10, 1)]);
+    }
+
+    #[mz_ore::test]
+    fn spilled_advance_rewrites_changed_timestamps() {
+        let pool = test_pool();
+        let rows = [((0, 0), 3, 1), ((0, 0), 4, 1)];
+        let mut input = VecDeque::from([TestChunk::spill_body(build_column(&rows), &pool, 1)]);
+        let mut output = VecDeque::new();
+        TestChunk::advance(
+            &mut input,
+            Antichain::from_elem(5).borrow(),
+            true,
+            &mut output,
+        );
+        assert!(input.is_empty());
+        assert_eq!(collect_chunks(output), vec![((0, 0), 5, 2)]);
+    }
+
     /// Chunks the extract frontier does not split pass through whole from
     /// their resident time bounds: spilled bodies land on their side still
     /// spilled, with no load or re-commit, and a kept chunk's minimal times
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index 8274bce721a13..169b1652576dd 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -350,6 +350,16 @@ where
         done: bool,
         out: &mut VecDeque<Self>,
     ) -> Poll<()> {
+        let mz_frontier = to_mz(frontier);
+        while input.front().is_some_and(|chunk| {
+            chunk.chunk.advances_unchanged(
+                mz_frontier.borrow(),
+                input.get(1).map(|next| &next.chunk),
+                done,
+            )
+        }) {
+            out.push_back(input.pop_front().expect("front observed above"));
+        }
         let read = if input
             .iter()
             .any(|c| matches!(c.chunk, ColumnChunk::Spilled(..)))
@@ -458,6 +468,83 @@ mod tests {
         }
     }
 
+    #[mz_ore::test]
+    fn unchanged_advance_does_not_read_cold_chunks() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        let budget = ReadBudget::new(1 << 20);
+        let first = chunk(&[((1, vec![7; 128]), 10, 1)], &pool, &budget);
+        let second = chunk(&[((2, vec![7; 128]), 10, 1)], &pool, &budget);
+        let handle = match &first.chunk {
+            ColumnChunk::Spilled(body, _) => Arc::clone(&body.handle),
+            ColumnChunk::Resident(..) => panic!("expected spilled input"),
+        };
+        let mut io = TestChunk::pending_for(std::slice::from_ref(&first), &[]);
+        let mut input = VecDeque::from([first, second]);
+        let mut output = VecDeque::new();
+        let frontier = timely_next::progress::Antichain::from_elem(Time(5));
+        let mut cx = Context::from_waker(std::task::Waker::noop());
+        assert!(
+            TestChunk::poll_advance(
+                &mut io,
+                &mut cx,
+                &mut input,
+                frontier.borrow(),
+                true,
+                &mut output,
+            )
+            .is_ready()
+        );
+        assert!(input.is_empty());
+        assert_eq!(output.len(), 2);
+        let ColumnChunk::Spilled(body, _) = &output[0].chunk else {
+            panic!("unchanged body must retain its pool handle");
+        };
+        assert!(Arc::ptr_eq(&body.handle, &handle));
+        assert_eq!(pool.stats().async_reads, 0);
+        assert_eq!(budget.reserved_bytes(), 0);
+    }
+
+    #[mz_ore::test]
+    #[ignore = "local unchanged-advancement performance comparison"]
+    fn unchanged_advance_microbench() {
+        let pool = Pool::new().unwrap();
+        pool.set_spill_threads(0);
+        pool.set_budget(0);
+        let budget = ReadBudget::new(8 << 20);
+        let updates: Vec<_> = (0..4096).map(|key| ((key, vec![7; 512]), 10, 1)).collect();
+        let original = chunk(&updates, &pool, &budget);
+        let runtime = tokio::runtime::Runtime::new().unwrap();
+        let start = std::time::Instant::now();
+        for _ in 0..256 {
+            let mut io = TestChunk::pending_for(std::slice::from_ref(&original), &[]);
+            let mut input = VecDeque::from([original.clone()]);
+            let mut output = VecDeque::new();
+            let frontier = timely_next::progress::Antichain::from_elem(Time(5));
+            runtime.block_on(futures_util::future::poll_fn(|cx| {
+                TestChunk::poll_advance(
+                    &mut io,
+                    cx,
+                    &mut input,
+                    frontier.borrow(),
+                    true,
+                    &mut output,
+                )
+            }));
+            assert_eq!(
+                output.iter().map(|c| c.chunk.records()).sum::<usize>(),
+                4096
+            );
+            assert_eq!(budget.reserved_bytes(), 0);
+        }
+        eprintln!(
+            "UNCHANGED_ADVANCE iterations=256 rows=4096 elapsed_us={} offloaded_reads={}",
+            start.elapsed().as_micros(),
+            pool.stats().async_reads,
+        );
+    }
+
     #[mz_ore::test]
     fn resident_inputs_do_not_spawn_read_tasks() {
         let pool = Pool::new().unwrap();

From 033f0df04ee112694d70b55769420deeb58437c5 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Mon, 14 Sep 2026 10:23:21 -0400
Subject: [PATCH 25/31] timely-util: count exertion grants and split fixture
 input into messages

The operator fixture counts optional exertion grants for both spines through
the shared policy closure, can run a fixed number of Timely steps after each
input tick, and can deliver a tick's input as small messages. Steps per tick
control scheduling turns per unit of input independently of wall-clock speed,
which is the variable that separates the AWS async and sync observations.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../chunk/asynchronous/operator_tests.rs      | 44 ++++++++++++++++++-
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
index e2df94844a389..292c53f2378d0 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -151,6 +151,27 @@ fn column(round: u64, rows: u64) -> Column<Update> {
     column
 }
 
+/// Send one round, as a single message or split into `message_rows`-row messages.
+fn send_round(input: &mut InputPort, round: u64, rows: u64, message_rows: usize) {
+    let mut column = column(round, rows);
+    if message_rows == 0 || message_rows >= usize::try_from(rows).unwrap() {
+        input.send_batch(&mut column);
+        return;
+    }
+    let view = column.borrow();
+    let len = view.len();
+    let mut start = 0;
+    while start < len {
+        let end = (start + message_rows).min(len);
+        let mut part: Column<Update> = Column::default();
+        for i in start..end {
+            part.push_into(&Update::into_owned(view.get(i)));
+        }
+        input.send_batch(&mut part);
+        start = end;
+    }
+}
+
 #[derive(Clone, Copy)]
 struct Config {
     rounds: u64,
@@ -167,6 +188,7 @@ struct Measurement {
     elapsed: Duration,
     batches: usize,
     trace_batches: usize,
+    grants: usize,
     stats: PoolStats,
 }
 
@@ -182,6 +204,9 @@ fn run(config: Config) -> Measurement {
     let draining = Arc::new(AtomicBool::new(false));
     let hydrated_workers = Arc::new(AtomicUsize::new(0));
     let policy_draining = Arc::clone(&draining);
+    // Optional grants during ingestion, counted identically for both spines.
+    let grants = Arc::new(AtomicUsize::new(0));
+    let policy_grants = Arc::clone(&grants);
     // Match the storage TimelyConfig in mz_controller::clusters.
     let exert_proportionality = parameter("MZ_BENCH_EXERT_PROPORTIONALITY", 1337);
     let logic: ExertionLogic = Arc::new(move |levels| {
@@ -204,6 +229,7 @@ fn run(config: Config) -> Measurement {
             .skip_while(|(_, count, _)| *count == 0)
         {
             if count > 1 || (!first && proportionality > 0 && len > 0) {
+                policy_grants.fetch_add(1, Ordering::Relaxed);
                 return Some(1000);
             }
             first = false;
@@ -282,11 +308,19 @@ fn run(config: Config) -> Measurement {
                         check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
                     }
                 } else {
+                    let message_rows = parameter("MZ_BENCH_MESSAGE_ROWS", 0);
+                    let tick_steps = parameter("MZ_BENCH_TICK_STEPS", 0);
                     for round in 0..config.rounds {
                         for input in &mut inputs {
-                            input.send_batch(&mut column(round, config.rows));
+                            send_round(input, round, config.rows, message_rows);
                             input.advance_to(round + 1);
                         }
+                        // Activations per input tick, independent of wall-clock
+                        // speed. Both spines receive one exertion turn per step.
+                        for _ in 0..tick_steps {
+                            worker.step();
+                            check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
+                        }
                         if usize::try_from(round + 1).unwrap() % config.burst == 0 {
                             worker.step();
                             while probes.iter().any(|probe| probe.less_than(&(round + 1))) {
@@ -309,6 +343,7 @@ fn run(config: Config) -> Measurement {
                     check_timeout(start, timeout, &budget, &observed.borrow(), &pool);
                 }
                 let hydrated = start.elapsed();
+                let ingestion_grants = grants.load(Ordering::Relaxed);
                 // Normalize the terminal trace shape without changing the ingestion policy.
                 if hydrated_workers.fetch_add(1, Ordering::Relaxed) + 1 == workers {
                     draining.store(true, Ordering::Relaxed);
@@ -359,6 +394,7 @@ fn run(config: Config) -> Measurement {
                     elapsed,
                     batches: observed.batches.len(),
                     trace_batches,
+                    grants: ingestion_grants,
                     stats: pool.stats(),
                 };
                 drop(tokens);
@@ -392,6 +428,7 @@ fn run(config: Config) -> Measurement {
         result.hydrated = result.hydrated.max(next.hydrated);
         result.batches += next.batches;
         result.trace_batches += next.trace_batches;
+        result.grants = result.grants.max(next.grants);
     }
     result.stats = pool.stats();
     result
@@ -467,10 +504,13 @@ fn operator_microbench() {
                     }
                 }
                 eprintln!(
-                    "OPERATOR trace_batches={} workers={} idle_ms={} sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
+                    "OPERATOR trace_batches={} workers={} idle_ms={} tick_steps={} message_rows={} grants={} sample={sample} async={asynchronous} burst={burst} sources={} rows={} pool={} direct={} ms={} hydrated_ms={} batches={} inserts={} bytes={} reads={}",
                     m.trace_batches,
                     parameter("MZ_BENCH_WORKERS", 1),
                     parameter("MZ_BENCH_IDLE_MS", 0),
+                    parameter("MZ_BENCH_TICK_STEPS", 0),
+                    parameter("MZ_BENCH_MESSAGE_ROWS", 0),
+                    m.grants,
                     config.sources,
                     config.rounds * config.rows,
                     config.pool_bytes,

From 5d8dd4e603b48b5c414d7906d4fe3fe603ef3442 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Mon, 14 Sep 2026 10:28:55 -0400
Subject: [PATCH 26/31] timely-util: fund optional consolidation from inserted
 updates

The exertion policy is consulted once per scheduling turn and grants a fixed
allowance each time, so optional consolidation scales with how often the
arranger is woken rather than with its input. Under storage's proportionality
of 1337, enough turns between published batches climb each batch into the
largest one through virtual introductions, rewriting the largest batch once
per published batch. The async arranger is woken by small input messages,
read completions, and maintenance steps, and reached 400 to 500 grants per
published batch on AWS.

Spine::exert now takes an Exertion mode. Merges funds active merges only.
Funded grants policy effort from credit that inserted updates accrue at the
same multiple introduce_batch already funds, bounding optional effort while
input flows. Idle keeps the unbounded drain. exert reports deferred policy
work, and the arranger arms an idle timer so deferred consolidation runs as
soon as the input is quiet. The spine no longer wakes its owner just because
policy would like more effort.

A regression test runs one large batch and many small ones with far more
turns than updates, and checks that funded turns spend at most the credit,
merge-only turns force nothing, and idle turns still reduce to one batch.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../src/columnar/chunk/asynchronous.rs        |  36 +++++-
 src/timely-util/src/columnar/chunk/native.rs  |  21 ++--
 .../src/columnar/chunk/native/pool_chunk.rs   |   2 +-
 .../src/columnar/chunk/native/vendor/spine.rs | 103 +++++++++++-------
 .../chunk/native/vendor/tests/spine.rs        |  94 ++++++++++++++--
 5 files changed, 188 insertions(+), 68 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index f940442c100e8..1e4d9a253a154 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -9,8 +9,8 @@
 //! operator, which resumes maintenance on its Timely worker.
 
 use super::merge::ReadBudget;
-use super::native::maintain;
 pub use super::native::{Batcher, Spine};
+use super::native::{Exertion, maintain};
 use super::{ChunkChunker, Column, ColumnChunk};
 use crate::builder_async::{Event, OperatorBuilder, PressOnDropButton};
 use columnar::Columnar;
@@ -28,6 +28,16 @@ use timely::order::TotalOrder;
 use timely::progress::{Timestamp, frontier::Antichain};
 type BatchRef<D, T, R> = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
 
+/// Quiet time on the input before unfunded consolidation may start.
+///
+/// The exertion policy grants effort per scheduling turn, and turns are not
+/// proportional to input: an operator that is woken often while ingesting can
+/// otherwise fund enough virtual introductions to merge each published batch into
+/// its largest batch. Inserted updates fund consolidation while input flows, and
+/// this quiet interval, well below a source tick and well above a turn, marks a
+/// genuinely idle input where the configured policy may run without limit.
+const IDLE_CONSOLIDATION_AFTER: std::time::Duration = std::time::Duration::from_millis(100);
+
 /// Arrange a local stream using asynchronous batch and trace merges.
 ///
 /// The caller owns the shutdown token. The input must already have the desired
@@ -71,13 +81,20 @@ where
         let mut batcher = Batcher::new(budget.clone());
         let mut chunker = ChunkChunker::<D, T, R>::default();
         let mut upper = Antichain::from_elem(T::minimum());
+        let mut last_input = tokio::time::Instant::now();
+        let mut deferred = false;
         const INPUT_EVENTS_PER_TURN: usize = 32;
         loop {
+            let idle_at = last_input + IDLE_CONSOLIDATION_AFTER;
             let mut event = tokio::select! {
                 biased;
                 _ = input.ready(), if !upper.is_empty() => input.next_sync(),
                 _ = notify.notified() => None,
+                _ = tokio::time::sleep_until(idle_at), if deferred => None,
             };
+            if event.is_some() {
+                last_input = tokio::time::Instant::now();
+            }
             let mut next_upper = None;
             // Extra exertion can introduce virtual batches and change subsequent
             // merge work. Amortize it over queued input, with a finite scheduling
@@ -130,9 +147,16 @@ where
                     upper = next;
                 }
             }
-            // Queued input will fund introductions itself. Continue active merges,
-            // but wait for input to drain before forcing separate batches together.
-            maintain(&state, &notify, input.is_empty()).await;
+            // Queued input funds its own introductions. Inserted updates fund
+            // consolidation while input flows, and only a quiet input lifts that bound.
+            let exertion = if !input.is_empty() {
+                Exertion::Merges
+            } else if upper.is_empty() || last_input.elapsed() >= IDLE_CONSOLIDATION_AFTER {
+                Exertion::Idle
+            } else {
+                Exertion::Funded
+            };
+            deferred = maintain(&state, &notify, exertion).await;
             tokio::task::yield_now().await;
         }
     });
@@ -260,7 +284,7 @@ mod tests {
             reader.set_logical_compaction(frontier.borrow());
             reader.set_physical_compaction(frontier.borrow());
 
-            maintain(&state, &notify, true).await;
+            maintain(&state, &notify, Exertion::Idle).await;
             assert_eq!(
                 reader
                     .batches_through(Antichain::new().borrow())
@@ -271,7 +295,7 @@ mod tests {
             );
             hold.set_logical_compaction(frontier.borrow());
             hold.set_physical_compaction(frontier.borrow());
-            let mut maintenance = Box::pin(maintain(&state, &notify, true));
+            let mut maintenance = Box::pin(maintain(&state, &notify, Exertion::Idle));
             assert!(futures_util::poll!(&mut maintenance).is_pending());
             assert_eq!(
                 reader
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index 068f212cc71e3..504f50bf76763 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -41,6 +41,7 @@ use super::ColumnChunk;
 use super::merge::ReadBudget;
 use pool_chunk::{PoolChunk, PreparedChunker};
 use timestamp::{Time, to_mz, to_native};
+pub use vendor::spine::Exertion;
 
 mod pool_chunk;
 mod timestamp;
@@ -328,22 +329,19 @@ impl Wake for NotifyWake {
 /// Apply one exertion turn, yielding while its maintenance waits for I/O.
 ///
 /// This does not force all batches to compact. DD's exertion policy determines
-/// the work allowance. The caller must use the notification installed by
-/// `Spine::with_budget` and poll this future on the owning Timely worker.
-/// Set `allow_consolidation` when input drains so policy can also initiate merges
-/// between separate batches. Otherwise only active merges receive optional fuel.
+/// the work allowance and `exertion` bounds what it may start. The caller must use
+/// the notification installed by `Spine::with_budget` and poll this future on the
+/// owning Timely worker. Returns true when policy requested consolidation that this
+/// turn did not fund, so the caller should return once it is idle.
 pub(super) async fn maintain<B>(
     state: &RefCell<vendor::spine::Spine<B>>,
     notify: &Notify,
-    allow_consolidation: bool,
-) where
+    exertion: Exertion,
+) -> bool
+where
     B: differential_dataflow_next::trace::asynchronous::Batch + Clone + 'static,
 {
-    if allow_consolidation {
-        state.borrow_mut().exert();
-    } else {
-        state.borrow_mut().exert_merges();
-    }
+    let deferred = state.borrow_mut().exert(exertion);
     while state.borrow().maintenance_pending() {
         // No trace borrow may cross this await. Reader compaction can change the
         // same spine while a read is pending, and its wakeup uses this notification.
@@ -353,4 +351,5 @@ pub(super) async fn maintain<B>(
         // until an entire merge finishes.
         state.borrow_mut().resume_maintenance();
     }
+    deferred
 }
diff --git a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
index 169b1652576dd..f83c34dd985be 100644
--- a/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
+++ b/src/timely-util/src/columnar/chunk/native/pool_chunk.rs
@@ -663,7 +663,7 @@ mod tests {
                 0,
                 "callbacks must not acquire admission while the arranger can be awaiting its batcher"
             );
-            super::super::maintain(&trace.state, &trace.notify, true).await;
+            super::super::maintain(&trace.state, &trace.notify, super::super::Exertion::Idle).await;
             assert!(pool.stats().async_reads > 0);
             assert_eq!(budget.reserved_bytes(), 0);
         });
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index 10d5c9b72932e..763f4c59834ae 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -95,6 +95,26 @@ fn span_len<B: SpineBatch>(span: &Span<B::Time, B>) -> usize {
     span.inner.as_ref().map(|b| b.len()).unwrap_or(0)
 }
 
+/// Policy-requested effort that each inserted update funds, in fuel units.
+///
+/// Introducing a batch already funds `8 << level` fuel for active merges. The same
+/// multiple bounds policy-requested effort while input flows, so it stays
+/// proportional to inserted updates however often the owner is scheduled. Per
+/// scheduling turn the policy would otherwise lift each published batch into the
+/// largest one. Unfunded requests wait for idle exertion.
+const CONSOLIDATION_CREDIT_PER_UPDATE: usize = 8;
+
+/// How much policy-requested maintenance an exertion turn may start.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Exertion {
+    /// Continue active merges only. Queued input funds its own introductions.
+    Merges,
+    /// Grant only what credit accrued by inserted updates can pay for.
+    Funded,
+    /// Also force separate batches together without limit: the owner has no input to accept.
+    Idle,
+}
+
 // A continuation of the existing introduction algorithm. No action owns a
 // published span: results move directly between levels before a poll can yield.
 enum Maintenance {
@@ -140,6 +160,8 @@ pub struct Spine<B: SpineBatch> {
     exert_logic: Option<ExertionLogic>,
     maintenance: VecDeque<Maintenance>,
     waker: Option<Waker>,
+    /// Fuel units of policy-requested consolidation that inserted updates have paid for.
+    consolidation_credit: usize,
 }
 
 impl<B: SpineBatch + Clone + 'static> Spine<B> {
@@ -288,51 +310,53 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         Self::with_effort(1, info, logging, activator)
     }
 
-    /// Apply some amount of effort to trace maintenance.
+    /// Apply one exertion allowance to trace maintenance.
     ///
-    /// Whether and how much effort to apply is determined by `self.exert_logic`, a closure the user can set.
-    pub fn exert(&mut self) {
-        self.exert_inner(true);
-    }
-
-    /// Apply policy-funded effort to active merges without forcing separate batches together.
-    ///
-    /// Pending introductions retain their insertion-funded work. Call `exert` when
-    /// input drains to satisfy the configured optional consolidation policy.
-    pub fn exert_merges(&mut self) {
-        self.exert_inner(false);
-    }
-
-    fn exert_inner(&mut self, allow_consolidation: bool) {
+    /// Whether and how much effort policy requests is determined by `self.exert_logic`.
+    /// `Merges` funds only active merges. `Funded` spends credit that inserted updates
+    /// accrued, so optional effort during ingestion is bounded by
+    /// `CONSOLIDATION_CREDIT_PER_UPDATE` per update. `Idle` grants without limit.
+    /// Returns true when policy requested work that this turn did not grant, so the
+    /// owner knows to return once its input is idle.
+    pub fn exert(&mut self, exertion: Exertion) -> bool {
         // Finish the old grant before asking policy for another one.
         if !self.drive_maintenance() {
-            return;
+            return false;
         }
         self.consider_merges();
         if !self.maintenance.is_empty() {
-            return;
+            return false;
         }
         self.tidy_layers();
-        if let Some(effort) = self.exert_effort() {
-            let active_merge = self.merging.iter().any(|b| b.is_double());
-            if !active_merge && !allow_consolidation {
-                return;
-            }
-            crate::columnar::chunk::metrics::record(
-                crate::columnar::chunk::metrics::Stage::OptionalExert,
-                effort,
-                0,
-            );
-            if active_merge {
-                self.queue_fuel(effort.cast_signed());
-            } else {
-                let level = usize::cast_from(effort.next_power_of_two().trailing_zeros());
-                self.queue_introduction(level, false);
-            }
-            if self.drive_maintenance() {
-                self.activate();
+        let Some(effort) = self.exert_effort() else {
+            return false;
+        };
+        let active_merge = self.merging.iter().any(|b| b.is_double());
+        match exertion {
+            Exertion::Merges if !active_merge => return true,
+            Exertion::Funded => {
+                if self.consolidation_credit < effort {
+                    return true;
+                }
+                self.consolidation_credit -= effort;
             }
+            Exertion::Merges | Exertion::Idle => {}
+        }
+        crate::columnar::chunk::metrics::record(
+            crate::columnar::chunk::metrics::Stage::OptionalExert,
+            effort,
+            0,
+        );
+        if active_merge {
+            self.queue_fuel(effort.cast_signed());
+        } else {
+            let level = usize::cast_from(effort.next_power_of_two().trailing_zeros());
+            self.queue_introduction(level, false);
+        }
+        if self.drive_maintenance() {
+            self.activate();
         }
+        false
     }
 
     /// Resume queued maintenance without requesting another exertion allowance.
@@ -376,6 +400,11 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         assert_eq!(span.lower(), &self.upper);
 
         self.upper.clone_from(span.upper());
+        self.consolidation_credit = self.consolidation_credit.saturating_add(
+            span_len(&span)
+                .saturating_mul(CONSOLIDATION_CREDIT_PER_UPDATE)
+                .saturating_mul(self.effort),
+        );
 
         // TODO: Consolidate or discard spans with no updates.
         self.pending.push(span);
@@ -505,6 +534,7 @@ impl<B: SpineBatch> Spine<B> {
             exert_logic: None,
             maintenance: VecDeque::new(),
             waker: None,
+            consolidation_credit: 0,
         }
     }
 
@@ -546,9 +576,6 @@ impl<B: SpineBatch> Spine<B> {
                 return;
             }
         }
-        if self.exert_effort().is_some() {
-            self.activate();
-        }
     }
 
     fn queue_fuel(&mut self, grant: isize) {
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
index 93f5673f7d8a3..8288cebe30a1d 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 // See ../LICENSE.
 
-use super::super::spine::Spine;
+use super::super::spine::{Exertion, Spine};
 use differential_dataflow_next::trace::asynchronous::{Batch as SpineBatch, MergeStatus, Merger};
 use differential_dataflow_next::trace::{Description, Span};
 use std::sync::{Arc, Mutex};
@@ -132,7 +132,7 @@ fn drive(trace: &mut Spine<Batch>, gate: &Mutex<Gate>, expected: &[(u64, u64, i6
         if let Some(wake) = wake {
             wake.wake();
         }
-        trace.exert();
+        trace.exert(Exertion::Idle);
     }
     panic!("maintenance failed to resume");
 }
@@ -184,7 +184,7 @@ fn maintenance_sample(
     rows: u64,
     fuel: usize,
     read_rows: Option<usize>,
-    allow_consolidation: bool,
+    exertion: Exertion,
 ) -> MaintenanceSample {
     use std::cell::RefCell;
     use std::future::Future;
@@ -228,7 +228,7 @@ fn maintenance_sample(
     let mut completions = 0;
     let start = Instant::now();
     {
-        let mut future = pin!(maintain(&state, &notify, allow_consolidation));
+        let mut future = pin!(maintain(&state, &notify, exertion));
         let wake_count = Arc::new(WakeCount(std::sync::atomic::AtomicUsize::new(0)));
         let waker = Waker::from(Arc::clone(&wake_count));
         let mut cx = Context::from_waker(&waker);
@@ -264,7 +264,7 @@ fn maintenance_sample(
     }
     gate.lock().unwrap().permits = usize::MAX / 2;
     for _ in 0..=2 * rows {
-        state.borrow_mut().exert();
+        state.borrow_mut().exert(Exertion::Idle);
         if gate.lock().unwrap().worked == usize::try_from(2 * rows).unwrap() {
             assert_eq!(contents(&state.borrow()), expected);
             return MaintenanceSample {
@@ -279,15 +279,15 @@ fn maintenance_sample(
 
 #[mz_ore::test]
 fn maintenance_readiness_preserves_work_allowance() {
-    for allow_consolidation in [false, true] {
+    for exertion in [Exertion::Merges, Exertion::Funded, Exertion::Idle] {
         for fuel in [1, 1000] {
-            let ready = maintenance_sample(4096, fuel, None, allow_consolidation);
+            let ready = maintenance_sample(4096, fuel, None, exertion);
             assert_eq!(ready.worked, fuel);
             for read_rows in [1, 64, 1024] {
-                let pending = maintenance_sample(4096, fuel, Some(read_rows), allow_consolidation);
+                let pending = maintenance_sample(4096, fuel, Some(read_rows), exertion);
                 assert_eq!(
                     pending.worked, ready.worked,
-                    "fuel={fuel}, read_rows={read_rows}, allow_consolidation={allow_consolidation}"
+                    "fuel={fuel}, read_rows={read_rows}, exertion={exertion:?}"
                 );
             }
         }
@@ -322,12 +322,12 @@ fn merge_only_maintenance_defers_consolidation_until_idle() {
         (batches > 1).then_some(1000)
     }));
     for _ in 0..100 {
-        trace.exert_merges();
+        assert!(trace.exert(Exertion::Merges), "policy work is deferred");
         assert_eq!(gate.lock().unwrap().worked, 0);
         assert_eq!(contents(&trace), expected);
     }
     for _ in 0..100 {
-        trace.exert();
+        trace.exert(Exertion::Idle);
     }
     assert_eq!(gate.lock().unwrap().worked, 33);
     let mut batches = 0;
@@ -336,6 +336,76 @@ fn merge_only_maintenance_defers_consolidation_until_idle() {
     assert_eq!(contents(&trace), expected);
 }
 
+// One large batch followed by small batches, each of which is followed by far more
+// exertion turns than inserted updates. Returns merge rows worked and the number of
+// non-empty batches left.
+fn many_turns_per_insert(exertion: Exertion) -> (usize, usize) {
+    let gate = Arc::new(Mutex::new(Gate {
+        permits: usize::MAX,
+        ..Gate::default()
+    }));
+    let mut trace = Spine::new(OperatorInfo::new(0, 0, [].into()), None, None);
+    // Active merges and any second non-empty layer request effort, as the storage
+    // policy does for layers near the largest one.
+    trace.set_exert_logic(Arc::new(|levels| {
+        let active = levels.iter().any(|(_, count, _)| *count > 1);
+        let separate = levels.iter().filter(|(_, _, len)| *len > 0).count() > 1;
+        (active || separate).then_some(1000)
+    }));
+    let mut expected = Vec::new();
+    for time in 0..=16u64 {
+        let count = if time == 0 { 4096 } else { 16 };
+        let rows: Vec<_> = (0..count)
+            .map(|key| (key + 100_000 * time, time, 1))
+            .collect();
+        expected.extend_from_slice(&rows);
+        trace.insert(Span::new(
+            Description::new(
+                Antichain::from_elem(time),
+                Antichain::from_elem(time + 1),
+                Antichain::from_elem(0),
+            ),
+            Some(Batch {
+                rows,
+                gate: Arc::clone(&gate),
+            }),
+        ));
+        trace.set_physical_compaction(Antichain::from_elem(time + 1).borrow());
+        for _ in 0..10_000 {
+            trace.exert(exertion);
+        }
+        assert!(!trace.maintenance_pending());
+    }
+    differential_dataflow_next::consolidation::consolidate_updates(&mut expected);
+    assert_eq!(contents(&trace), expected);
+    let mut batches = 0;
+    trace.map_spans(|span| batches += usize::from(span.inner.is_some()));
+    (gate.lock().unwrap().worked, batches)
+}
+
+#[mz_ore::test]
+fn funded_consolidation_is_bounded_by_inserted_updates() {
+    let inserted = 4096 + 16 * 16;
+    let (idle_worked, idle_batches) = many_turns_per_insert(Exertion::Idle);
+    assert_eq!(idle_batches, 1);
+    assert!(
+        idle_worked > 12 * 4096,
+        "idle turns should lift most small batches into the large one: {idle_worked}"
+    );
+    let (funded_worked, _) = many_turns_per_insert(Exertion::Funded);
+    // Insertion-funded merges of the small batches plus at most the credit's worth
+    // of policy-requested effort.
+    assert!(
+        funded_worked <= 8 * inserted + 16 * 16 * 4,
+        "funded exertion exceeded its credit: {funded_worked} of {idle_worked}"
+    );
+    let (merges_worked, _) = many_turns_per_insert(Exertion::Merges);
+    assert!(
+        merges_worked <= 16 * 16 * 4,
+        "merge-only turns forced consolidation: {merges_worked}"
+    );
+}
+
 /// Run with `cargo test -p mz-timely-util maintenance_microbench -- --ignored --nocapture`.
 /// Reports work and read completions before the arranger can next accept input.
 /// Reads complete immediately when requested: timings measure scheduling and mock
@@ -348,7 +418,7 @@ fn maintenance_microbench() {
         for fuel in [1, 1000] {
             for read_rows in [None, Some(1), Some(64), Some(1024)] {
                 for sample in 0..5 {
-                    let result = maintenance_sample(rows, fuel, read_rows, true);
+                    let result = maintenance_sample(rows, fuel, read_rows, Exertion::Idle);
                     println!(
                         "{rows},{fuel},{},{sample},{},{},{}",
                         read_rows.map_or_else(|| "ready".to_owned(), |n| n.to_string()),

From 9b225736aa857769bbcba2b7439d46fe9a30be40 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Mon, 14 Sep 2026 10:36:37 -0400
Subject: [PATCH 27/31] cluster: count exertion policy decisions

Process-wide gauges count how often the shared arrangement exertion policy
was consulted and how often it granted effort for an active merge or for
consolidation. The closure runs for every trace implementation, so the
counts compare scheduling cadence between the synchronous and asynchronous
spines, which the trace-local counters could not.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/cluster/src/client.rs | 29 +++++++++++++++++++++++++++++
 src/compute/src/server.rs |  1 +
 2 files changed, 30 insertions(+)

diff --git a/src/cluster/src/client.rs b/src/cluster/src/client.rs
index 0008e72b0d7fe..b335f62c15229 100644
--- a/src/cluster/src/client.rs
+++ b/src/cluster/src/client.rs
@@ -10,6 +10,7 @@
 //! An interactive cluster server.
 
 use std::fmt;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex};
 use std::thread::Thread;
 
@@ -18,6 +19,8 @@ use async_trait::async_trait;
 use differential_dataflow::trace::ExertionLogic;
 use futures::future;
 use mz_cluster_client::client::{TimelyConfig, TryIntoProtocolNonce};
+use mz_ore::metric;
+use mz_ore::metrics::{ComputedUIntGauge, MetricsRegistry};
 use mz_service::client::{GenericClient, Partitionable, Partitioned};
 use mz_service::local::LocalClient;
 use timely::WorkerConfig;
@@ -225,6 +228,7 @@ pub trait ClusterSpec: Clone + Send + Sync + 'static {
             // largest to the smallest layer.
 
             let arc: ExertionLogic = Arc::new(move |layers| {
+                EXERT_POLICY_CALLS.fetch_add(1, Ordering::Relaxed);
                 let mut prop = config.arrangement_exert_proportionality;
 
                 // Layers are ordered from largest to smallest.
@@ -238,12 +242,14 @@ pub trait ClusterSpec: Clone + Send + Sync + 'static {
                 for (_idx, count, len) in layers {
                     if count > 1 {
                         // Found an in-progress merge that we should continue.
+                        EXERT_POLICY_MERGE_GRANTS.fetch_add(1, Ordering::Relaxed);
                         return merge_effort;
                     }
 
                     if !first && prop > 0 && len > 0 {
                         // Found a non-empty batch within `arrangement_exert_proportionality` of
                         // the largest one.
+                        EXERT_POLICY_CONSOLIDATION_GRANTS.fetch_add(1, Ordering::Relaxed);
                         return merge_effort;
                     }
 
@@ -284,6 +290,29 @@ pub trait ClusterSpec: Clone + Send + Sync + 'static {
     }
 }
 
+// The exertion policy runs on every arrangement's scheduling turn, so these
+// process-wide counts describe how often traces of every implementation were
+// offered optional effort, and for which reason.
+static EXERT_POLICY_CALLS: AtomicU64 = AtomicU64::new(0);
+static EXERT_POLICY_MERGE_GRANTS: AtomicU64 = AtomicU64::new(0);
+static EXERT_POLICY_CONSOLIDATION_GRANTS: AtomicU64 = AtomicU64::new(0);
+
+/// Register gauges for the arrangement exertion policy's decisions.
+pub fn register_exert_policy_metrics(registry: &MetricsRegistry) {
+    let _: ComputedUIntGauge = registry.register_computed_gauge(
+        metric!(name: "mz_arrangement_exert_policy_calls_total", help: "Arrangement maintenance turns that consulted the exertion policy."),
+        || EXERT_POLICY_CALLS.load(Ordering::Relaxed),
+    );
+    let _: ComputedUIntGauge = registry.register_computed_gauge(
+        metric!(name: "mz_arrangement_exert_policy_grants_total", help: "Exertion policy grants, by reason.", const_labels: {"reason" => "active_merge"}),
+        || EXERT_POLICY_MERGE_GRANTS.load(Ordering::Relaxed),
+    );
+    let _: ComputedUIntGauge = registry.register_computed_gauge(
+        metric!(name: "mz_arrangement_exert_policy_grants_total", help: "Exertion policy grants, by reason.", const_labels: {"reason" => "consolidation"}),
+        || EXERT_POLICY_CONSOLIDATION_GRANTS.load(Ordering::Relaxed),
+    );
+}
+
 mod alloc {
     /// A Timely communication refill function that uses lgalloc.
     ///
diff --git a/src/compute/src/server.rs b/src/compute/src/server.rs
index b062f58da1adc..ced444311f74c 100644
--- a/src/compute/src/server.rs
+++ b/src/compute/src/server.rs
@@ -175,6 +175,7 @@ pub async fn serve(
         mz_timely_util::column_pager::tiered_policy(),
     );
     mz_timely_util::pool_config::metrics::register(metrics_registry);
+    mz_cluster::client::register_exert_policy_metrics(metrics_registry);
 
     let config = Config {
         persist_clients,

From 75639582da834bf75ddfbc629d309eed87fb7d7c Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Mon, 14 Sep 2026 12:28:28 -0400
Subject: [PATCH 28/31] timely-util: gate idle consolidation on a configurable
 quiet interval

The arranger let the exertion policy run without an input-funded bound once
its input had been quiet for 100 ms. A ticking source delivers input in one
burst per timestamp tick, so every gap between bursts opened the unbounded
drain and each published batch was still merged into the largest batch.

Make the quiet interval a parameter of arrange. Storage supplies it from the
new upsert_idle_consolidation_delay dyncfg, defaulting to five seconds, several
ticks rather than a fraction of one. The operator fixture reads
MZ_BENCH_IDLE_CONSOLIDATION_MS.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/storage-types/src/dyncfgs.rs              | 13 ++++++++++
 .../src/upsert_continual_feedback_v2.rs       | 23 +++++++++++++----
 .../src/columnar/chunk/asynchronous.rs        | 25 ++++++++++---------
 .../chunk/asynchronous/operator_tests.rs      |  5 +++-
 4 files changed, 48 insertions(+), 18 deletions(-)

diff --git a/src/storage-types/src/dyncfgs.rs b/src/storage-types/src/dyncfgs.rs
index 960bc2a89d669..345b3154fbf8f 100644
--- a/src/storage-types/src/dyncfgs.rs
+++ b/src/storage-types/src/dyncfgs.rs
@@ -462,6 +462,18 @@ pub const ENABLE_UPSERT_ASYNC_MERGES: Config<bool> = Config::new(
     ParameterScope::Replica,
 );
 
+/// Quiet time on a resumable feedback arrangement's input before its exertion
+/// policy may consolidate without limit. Source input arrives in bursts once per
+/// timestamp tick, so this must span several ticks. Shorter values let idle-time
+/// compaction run between bursts and can merge every published batch into the
+/// largest one. Read once per dataflow.
+pub const UPSERT_IDLE_CONSOLIDATION_DELAY: Config<Duration> = Config::new(
+    "upsert_idle_consolidation_delay",
+    Duration::from_secs(5),
+    "Quiet input time before a resumable upsert-v2 feedback arrangement compacts without an input-funded bound. Takes effect on new dataflows.",
+    ParameterScope::Replica,
+);
+
 /// Separate upsert-v2 payload blocks from columnar merge metadata.
 /// Read once per dataflow. Uses the process pool and asynchronous payload reads.
 pub const ENABLE_UPSERT_PAYLOAD_STASH: Config<bool> = Config::new(
@@ -597,6 +609,7 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&ENABLE_UPSERT_CHUNKED_STASH)
         .add(&ENABLE_UPSERT_ASYNC_READS)
         .add(&ENABLE_UPSERT_ASYNC_MERGES)
+        .add(&UPSERT_IDLE_CONSOLIDATION_DELAY)
         .add(&ENABLE_UPSERT_PAYLOAD_STASH)
         .add(&WALLCLOCK_GLOBAL_LAG_HISTOGRAM_RETENTION_INTERVAL)
         .add(&WALLCLOCK_LAG_HISTORY_RETENTION_INTERVAL)
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index 8a23baf21c983..b4c2f69417f45 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -96,6 +96,7 @@
 mod payload;
 
 use std::fmt::Debug;
+use std::time::Duration;
 
 use differential_dataflow::difference::{IsZero, Semigroup};
 use differential_dataflow::hashable::Hashable;
@@ -114,7 +115,7 @@ use mz_row_spine::DatumSeq;
 use mz_row_spine::{ValRowColPagedBuilder, ValRowSpine};
 use mz_storage_types::dyncfgs::{
     ENABLE_UPSERT_ASYNC_MERGES, ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH,
-    ENABLE_UPSERT_PAYLOAD_STASH,
+    ENABLE_UPSERT_PAYLOAD_STASH, UPSERT_IDLE_CONSOLIDATION_DELAY,
 };
 use mz_storage_types::errors::{DataflowError, EnvelopeError, UpsertError};
 use mz_timely_util::builder_async::{
@@ -161,8 +162,12 @@ pub enum UpsertStashFlavor {
     /// Chunk merge batcher stash, chunk-spine feedback arrangement,
     /// bulk-probe drain. Spills through the process buffer pool.
     Chunked { async_reads: bool },
-    /// Async source batching and feedback trace compaction.
-    Resumable { async_reads: bool },
+    /// Async source batching and feedback trace compaction. `idle_after` is
+    /// the quiet input time before unfunded feedback consolidation may run.
+    Resumable {
+        async_reads: bool,
+        idle_after: Duration,
+    },
 }
 
 impl UpsertStashFlavor {
@@ -176,6 +181,7 @@ impl UpsertStashFlavor {
         {
             Self::Resumable {
                 async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
+                idle_after: UPSERT_IDLE_CONSOLIDATION_DELAY.get(config),
             }
         } else if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
             Self::Chunked {
@@ -494,10 +500,14 @@ where
             )
         }
 
-        UpsertStashFlavor::Resumable { async_reads } => {
+        UpsertStashFlavor::Resumable {
+            async_reads,
+            idle_after,
+        } => {
             let (persist_arranged, token) = mz_timely_util::columnar::chunk::asynchronous::arrange(
                 encoded,
                 merge_read_budget(),
+                idle_after,
                 "Persist resumable feedback",
             );
             let mut persist_token = persist_token.unwrap_or_default();
@@ -2341,7 +2351,10 @@ mod test {
                 assert_eq!(
                     baseline,
                     run_payload_feedback_scenario(
-                        UpsertStashFlavor::Resumable { async_reads: false },
+                        UpsertStashFlavor::Resumable {
+                            async_reads: false,
+                            idle_after: Duration::from_secs(5),
+                        },
                         width
                     )
                 );
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index 1e4d9a253a154..8d2084f41c44f 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -28,23 +28,24 @@ use timely::order::TotalOrder;
 use timely::progress::{Timestamp, frontier::Antichain};
 type BatchRef<D, T, R> = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
 
-/// Quiet time on the input before unfunded consolidation may start.
-///
-/// The exertion policy grants effort per scheduling turn, and turns are not
-/// proportional to input: an operator that is woken often while ingesting can
-/// otherwise fund enough virtual introductions to merge each published batch into
-/// its largest batch. Inserted updates fund consolidation while input flows, and
-/// this quiet interval, well below a source tick and well above a turn, marks a
-/// genuinely idle input where the configured policy may run without limit.
-const IDLE_CONSOLIDATION_AFTER: std::time::Duration = std::time::Duration::from_millis(100);
-
 /// Arrange a local stream using asynchronous batch and trace merges.
 ///
 /// The caller owns the shutdown token. The input must already have the desired
 /// worker partitioning. All clones of `budget` share decoded-input admission.
+///
+/// `idle_after` is the quiet time on the input, with no data and no frontier
+/// progress, before the exertion policy may consolidate without limit. While
+/// input flows, optional consolidation is funded by inserted updates. The
+/// exertion policy grants effort per scheduling turn, and turns are not
+/// proportional to input, so an operator woken often while ingesting could
+/// otherwise merge each published batch into its largest batch. Input from a
+/// ticking source arrives in bursts, so this interval must exceed several
+/// ticks, not merely a turn, or every gap between bursts opens the unbounded
+/// drain.
 pub fn arrange<'scope, D, T, R>(
     stream: Stream<'scope, T, Column<(D, T, R)>>,
     budget: ReadBudget,
+    idle_after: std::time::Duration,
     name: &str,
 ) -> (
     Arranged<'scope, TraceAgent<Spine<D, T, R>>>,
@@ -85,7 +86,7 @@ where
         let mut deferred = false;
         const INPUT_EVENTS_PER_TURN: usize = 32;
         loop {
-            let idle_at = last_input + IDLE_CONSOLIDATION_AFTER;
+            let idle_at = last_input + idle_after;
             let mut event = tokio::select! {
                 biased;
                 _ = input.ready(), if !upper.is_empty() => input.next_sync(),
@@ -151,7 +152,7 @@ where
             // consolidation while input flows, and only a quiet input lifts that bound.
             let exertion = if !input.is_empty() {
                 Exertion::Merges
-            } else if upper.is_empty() || last_input.elapsed() >= IDLE_CONSOLIDATION_AFTER {
+            } else if upper.is_empty() || last_input.elapsed() >= idle_after {
                 Exertion::Idle
             } else {
                 Exertion::Funded
diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
index 292c53f2378d0..1d212b6eaa9d0 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -101,7 +101,10 @@ fn install(
 ) -> (InputPort, Option<super::PressOnDropButton>) {
     let (input, stream) = scope.new_input::<Column<Update>>();
     let token = if asynchronous {
-        let (arranged, token) = super::arrange(stream, budget, "Async");
+        let idle_after = Duration::from_millis(
+            u64::try_from(parameter("MZ_BENCH_IDLE_CONSOLIDATION_MS", 5000)).unwrap(),
+        );
+        let (arranged, token) = super::arrange(stream, budget, idle_after, "Async");
         let notify = Arc::clone(&arranged.trace.trace_box_unstable().borrow().trace().notify);
         observed
             .borrow_mut()

From 1ffd83d37dcecab53866ce933864024538d49749 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Mon, 14 Sep 2026 12:35:23 -0400
Subject: [PATCH 29/31] timely-util: fund idle consolidation from frontier
 progress

Replace the wall-clock idle gate. The interval it needs is the upstream's tick
spacing as seen by one spine, which depends on load: on the skewed hydration
workload each async spine published every 11 seconds, so a 5 second gate still
opened the unbounded drain on most gaps and the spine kept receiving about a
thousand allowances per published batch.

Optional consolidation on an open input is now paid for only by inserted
updates and by input frontier advances. Each advance banks eight policy
allowances, capped at 64 banked, so a quiet input still converges at a rate set
by upstream progress rather than by scheduling turns, and a long quiet spell
cannot store a burst. Only a closed input lifts the bound. The arrange
signature loses its idle interval and the storage dyncfg is removed.

The operator fixture closes its inputs before the final drain so the closed
input path drives normalization.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/storage-types/src/dyncfgs.rs              | 13 -----
 .../src/upsert_continual_feedback_v2.rs       | 23 ++------
 .../src/columnar/chunk/asynchronous.rs        | 30 +++-------
 .../chunk/asynchronous/operator_tests.rs      | 11 ++--
 .../src/columnar/chunk/native/vendor/spine.rs | 47 +++++++++++++---
 .../chunk/native/vendor/tests/spine.rs        | 56 +++++++++++++++++++
 6 files changed, 115 insertions(+), 65 deletions(-)

diff --git a/src/storage-types/src/dyncfgs.rs b/src/storage-types/src/dyncfgs.rs
index 345b3154fbf8f..960bc2a89d669 100644
--- a/src/storage-types/src/dyncfgs.rs
+++ b/src/storage-types/src/dyncfgs.rs
@@ -462,18 +462,6 @@ pub const ENABLE_UPSERT_ASYNC_MERGES: Config<bool> = Config::new(
     ParameterScope::Replica,
 );
 
-/// Quiet time on a resumable feedback arrangement's input before its exertion
-/// policy may consolidate without limit. Source input arrives in bursts once per
-/// timestamp tick, so this must span several ticks. Shorter values let idle-time
-/// compaction run between bursts and can merge every published batch into the
-/// largest one. Read once per dataflow.
-pub const UPSERT_IDLE_CONSOLIDATION_DELAY: Config<Duration> = Config::new(
-    "upsert_idle_consolidation_delay",
-    Duration::from_secs(5),
-    "Quiet input time before a resumable upsert-v2 feedback arrangement compacts without an input-funded bound. Takes effect on new dataflows.",
-    ParameterScope::Replica,
-);
-
 /// Separate upsert-v2 payload blocks from columnar merge metadata.
 /// Read once per dataflow. Uses the process pool and asynchronous payload reads.
 pub const ENABLE_UPSERT_PAYLOAD_STASH: Config<bool> = Config::new(
@@ -609,7 +597,6 @@ pub fn all_dyncfgs(configs: ConfigSet) -> ConfigSet {
         .add(&ENABLE_UPSERT_CHUNKED_STASH)
         .add(&ENABLE_UPSERT_ASYNC_READS)
         .add(&ENABLE_UPSERT_ASYNC_MERGES)
-        .add(&UPSERT_IDLE_CONSOLIDATION_DELAY)
         .add(&ENABLE_UPSERT_PAYLOAD_STASH)
         .add(&WALLCLOCK_GLOBAL_LAG_HISTOGRAM_RETENTION_INTERVAL)
         .add(&WALLCLOCK_LAG_HISTORY_RETENTION_INTERVAL)
diff --git a/src/storage/src/upsert_continual_feedback_v2.rs b/src/storage/src/upsert_continual_feedback_v2.rs
index b4c2f69417f45..8a23baf21c983 100644
--- a/src/storage/src/upsert_continual_feedback_v2.rs
+++ b/src/storage/src/upsert_continual_feedback_v2.rs
@@ -96,7 +96,6 @@
 mod payload;
 
 use std::fmt::Debug;
-use std::time::Duration;
 
 use differential_dataflow::difference::{IsZero, Semigroup};
 use differential_dataflow::hashable::Hashable;
@@ -115,7 +114,7 @@ use mz_row_spine::DatumSeq;
 use mz_row_spine::{ValRowColPagedBuilder, ValRowSpine};
 use mz_storage_types::dyncfgs::{
     ENABLE_UPSERT_ASYNC_MERGES, ENABLE_UPSERT_ASYNC_READS, ENABLE_UPSERT_CHUNKED_STASH,
-    ENABLE_UPSERT_PAYLOAD_STASH, UPSERT_IDLE_CONSOLIDATION_DELAY,
+    ENABLE_UPSERT_PAYLOAD_STASH,
 };
 use mz_storage_types::errors::{DataflowError, EnvelopeError, UpsertError};
 use mz_timely_util::builder_async::{
@@ -162,12 +161,8 @@ pub enum UpsertStashFlavor {
     /// Chunk merge batcher stash, chunk-spine feedback arrangement,
     /// bulk-probe drain. Spills through the process buffer pool.
     Chunked { async_reads: bool },
-    /// Async source batching and feedback trace compaction. `idle_after` is
-    /// the quiet input time before unfunded feedback consolidation may run.
-    Resumable {
-        async_reads: bool,
-        idle_after: Duration,
-    },
+    /// Async source batching and feedback trace compaction.
+    Resumable { async_reads: bool },
 }
 
 impl UpsertStashFlavor {
@@ -181,7 +176,6 @@ impl UpsertStashFlavor {
         {
             Self::Resumable {
                 async_reads: ENABLE_UPSERT_ASYNC_READS.get(config),
-                idle_after: UPSERT_IDLE_CONSOLIDATION_DELAY.get(config),
             }
         } else if ENABLE_UPSERT_CHUNKED_STASH.get(config) {
             Self::Chunked {
@@ -500,14 +494,10 @@ where
             )
         }
 
-        UpsertStashFlavor::Resumable {
-            async_reads,
-            idle_after,
-        } => {
+        UpsertStashFlavor::Resumable { async_reads } => {
             let (persist_arranged, token) = mz_timely_util::columnar::chunk::asynchronous::arrange(
                 encoded,
                 merge_read_budget(),
-                idle_after,
                 "Persist resumable feedback",
             );
             let mut persist_token = persist_token.unwrap_or_default();
@@ -2351,10 +2341,7 @@ mod test {
                 assert_eq!(
                     baseline,
                     run_payload_feedback_scenario(
-                        UpsertStashFlavor::Resumable {
-                            async_reads: false,
-                            idle_after: Duration::from_secs(5),
-                        },
+                        UpsertStashFlavor::Resumable { async_reads: false },
                         width
                     )
                 );
diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index 8d2084f41c44f..f0205245cf407 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -33,19 +33,14 @@ type BatchRef<D, T, R> = Rc<ChunkBatch<ColumnChunk<D, T, R>>>;
 /// The caller owns the shutdown token. The input must already have the desired
 /// worker partitioning. All clones of `budget` share decoded-input admission.
 ///
-/// `idle_after` is the quiet time on the input, with no data and no frontier
-/// progress, before the exertion policy may consolidate without limit. While
-/// input flows, optional consolidation is funded by inserted updates. The
-/// exertion policy grants effort per scheduling turn, and turns are not
-/// proportional to input, so an operator woken often while ingesting could
-/// otherwise merge each published batch into its largest batch. Input from a
-/// ticking source arrives in bursts, so this interval must exceed several
-/// ticks, not merely a turn, or every gap between bursts opens the unbounded
-/// drain.
+/// Optional consolidation on an open input is funded by inserted updates and by
+/// input frontier advances, never by scheduling turns: the exertion policy grants
+/// effort per turn, and an operator woken often while ingesting could otherwise
+/// merge each published batch into its largest batch. Only a closed input lifts
+/// that bound.
 pub fn arrange<'scope, D, T, R>(
     stream: Stream<'scope, T, Column<(D, T, R)>>,
     budget: ReadBudget,
-    idle_after: std::time::Duration,
     name: &str,
 ) -> (
     Arranged<'scope, TraceAgent<Spine<D, T, R>>>,
@@ -82,20 +77,13 @@ where
         let mut batcher = Batcher::new(budget.clone());
         let mut chunker = ChunkChunker::<D, T, R>::default();
         let mut upper = Antichain::from_elem(T::minimum());
-        let mut last_input = tokio::time::Instant::now();
-        let mut deferred = false;
         const INPUT_EVENTS_PER_TURN: usize = 32;
         loop {
-            let idle_at = last_input + idle_after;
             let mut event = tokio::select! {
                 biased;
                 _ = input.ready(), if !upper.is_empty() => input.next_sync(),
                 _ = notify.notified() => None,
-                _ = tokio::time::sleep_until(idle_at), if deferred => None,
             };
-            if event.is_some() {
-                last_input = tokio::time::Instant::now();
-            }
             let mut next_upper = None;
             // Extra exertion can introduce virtual batches and change subsequent
             // merge work. Amortize it over queued input, with a finite scheduling
@@ -135,6 +123,7 @@ where
                         description,
                     });
                     writer.insert(Rc::clone(&batch), cap.as_ref().map(|c| c.time().clone()));
+                    state.borrow_mut().fund_progress();
                     if let Some(time) = &cap {
                         output.give(time, batch);
                     }
@@ -148,16 +137,15 @@ where
                     upper = next;
                 }
             }
-            // Queued input funds its own introductions. Inserted updates fund
-            // consolidation while input flows, and only a quiet input lifts that bound.
+            // Queued input funds its own introductions.
             let exertion = if !input.is_empty() {
                 Exertion::Merges
-            } else if upper.is_empty() || last_input.elapsed() >= idle_after {
+            } else if upper.is_empty() {
                 Exertion::Idle
             } else {
                 Exertion::Funded
             };
-            deferred = maintain(&state, &notify, exertion).await;
+            maintain(&state, &notify, exertion).await;
             tokio::task::yield_now().await;
         }
     });
diff --git a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
index 1d212b6eaa9d0..402e2e81a89a8 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous/operator_tests.rs
@@ -101,10 +101,7 @@ fn install(
 ) -> (InputPort, Option<super::PressOnDropButton>) {
     let (input, stream) = scope.new_input::<Column<Update>>();
     let token = if asynchronous {
-        let idle_after = Duration::from_millis(
-            u64::try_from(parameter("MZ_BENCH_IDLE_CONSOLIDATION_MS", 5000)).unwrap(),
-        );
-        let (arranged, token) = super::arrange(stream, budget, idle_after, "Async");
+        let (arranged, token) = super::arrange(stream, budget, "Async");
         let notify = Arc::clone(&arranged.trace.trace_box_unstable().borrow().trace().notify);
         observed
             .borrow_mut()
@@ -347,6 +344,12 @@ fn run(config: Config) -> Measurement {
                 }
                 let hydrated = start.elapsed();
                 let ingestion_grants = grants.load(Ordering::Relaxed);
+                // A closed input lifts the async operator's input-funded bound on
+                // consolidation for the final drain. The synchronous operator is
+                // torn down when its input closes and drains by self-activation.
+                if config.asynchronous {
+                    drop(inputs);
+                }
                 // Normalize the terminal trace shape without changing the ingestion policy.
                 if hydrated_workers.fetch_add(1, Ordering::Relaxed) + 1 == workers {
                     draining.store(true, Ordering::Relaxed);
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
index 763f4c59834ae..11662b79e68d1 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/spine.rs
@@ -101,17 +101,30 @@ fn span_len<B: SpineBatch>(span: &Span<B::Time, B>) -> usize {
 /// multiple bounds policy-requested effort while input flows, so it stays
 /// proportional to inserted updates however often the owner is scheduled. Per
 /// scheduling turn the policy would otherwise lift each published batch into the
-/// largest one. Unfunded requests wait for idle exertion.
+/// largest one. Unfunded requests wait for more credit or a closed input.
 const CONSOLIDATION_CREDIT_PER_UPDATE: usize = 8;
 
+/// Policy allowances one input frontier advance funds when no updates arrive.
+///
+/// A quiet input still converges to the policy's reduced form, at a rate set by
+/// the upstream's own progress rather than by how often the owner is woken. A
+/// synchronous storage arrangement was measured healthy at roughly thirty
+/// allowances per published batch; this leaves that margin while a stray batch
+/// still climbs ten levels within a few hundred frontier advances.
+const CONSOLIDATION_GRANTS_PER_PROGRESS: usize = 8;
+
+/// Most progress-funded allowances held back for later, so a long quiet spell
+/// does not bank a burst of forced consolidation for the moment input returns.
+const MAX_BANKED_PROGRESS_GRANTS: usize = 8 * CONSOLIDATION_GRANTS_PER_PROGRESS;
+
 /// How much policy-requested maintenance an exertion turn may start.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Exertion {
     /// Continue active merges only. Queued input funds its own introductions.
     Merges,
-    /// Grant only what credit accrued by inserted updates can pay for.
+    /// Grant only what credit accrued by inserted updates and frontier progress can pay for.
     Funded,
-    /// Also force separate batches together without limit: the owner has no input to accept.
+    /// Also force separate batches together without limit: the input is closed.
     Idle,
 }
 
@@ -162,6 +175,8 @@ pub struct Spine<B: SpineBatch> {
     waker: Option<Waker>,
     /// Fuel units of policy-requested consolidation that inserted updates have paid for.
     consolidation_credit: usize,
+    /// Policy allowances funded by input frontier advances and not yet spent.
+    progress_grants: usize,
 }
 
 impl<B: SpineBatch + Clone + 'static> Spine<B> {
@@ -314,10 +329,10 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
     ///
     /// Whether and how much effort policy requests is determined by `self.exert_logic`.
     /// `Merges` funds only active merges. `Funded` spends credit that inserted updates
-    /// accrued, so optional effort during ingestion is bounded by
-    /// `CONSOLIDATION_CREDIT_PER_UPDATE` per update. `Idle` grants without limit.
-    /// Returns true when policy requested work that this turn did not grant, so the
-    /// owner knows to return once its input is idle.
+    /// and frontier advances accrued, so optional effort on an open input is bounded
+    /// by `CONSOLIDATION_CREDIT_PER_UPDATE` per update plus
+    /// `CONSOLIDATION_GRANTS_PER_PROGRESS` per advance. `Idle` grants without limit.
+    /// Returns true when policy requested work that this turn did not grant.
     pub fn exert(&mut self, exertion: Exertion) -> bool {
         // Finish the old grant before asking policy for another one.
         if !self.drive_maintenance() {
@@ -335,10 +350,13 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         match exertion {
             Exertion::Merges if !active_merge => return true,
             Exertion::Funded => {
-                if self.consolidation_credit < effort {
+                if self.consolidation_credit >= effort {
+                    self.consolidation_credit -= effort;
+                } else if self.progress_grants > 0 {
+                    self.progress_grants -= 1;
+                } else {
                     return true;
                 }
-                self.consolidation_credit -= effort;
             }
             Exertion::Merges | Exertion::Idle => {}
         }
@@ -378,6 +396,16 @@ impl<B: SpineBatch + Clone + 'static> Spine<B> {
         !self.maintenance.is_empty()
     }
 
+    /// Credit the optional consolidation one input frontier advance funds.
+    ///
+    /// Allowances are counted in policy grants rather than fuel, since the batch
+    /// the advance seals may not have reached the layers yet. Banked allowances
+    /// are capped by `MAX_BANKED_PROGRESS_GRANTS`.
+    pub fn fund_progress(&mut self) {
+        self.progress_grants = (self.progress_grants + CONSOLIDATION_GRANTS_PER_PROGRESS)
+            .min(MAX_BANKED_PROGRESS_GRANTS);
+    }
+
     /// Set the policy that grants maintenance fuel in the absence of new updates.
     pub fn set_exert_logic(&mut self, logic: ExertionLogic) {
         self.exert_logic = Some(logic);
@@ -535,6 +563,7 @@ impl<B: SpineBatch> Spine<B> {
             maintenance: VecDeque::new(),
             waker: None,
             consolidation_credit: 0,
+            progress_grants: 0,
         }
     }
 
diff --git a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
index 8288cebe30a1d..1fda591b69cb9 100644
--- a/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
+++ b/src/timely-util/src/columnar/chunk/native/vendor/tests/spine.rs
@@ -406,6 +406,62 @@ fn funded_consolidation_is_bounded_by_inserted_updates() {
     );
 }
 
+// One large batch and one small batch in separate layers, then only frontier
+// progress and funded exertion turns. The policy asks for more effort per grant
+// than the insertions credit, so only progress can pay for consolidation. Returns
+// merge rows worked and the number of non-empty batches left.
+fn progress_without_updates(advances: usize) -> (usize, usize) {
+    let gate = Arc::new(Mutex::new(Gate {
+        permits: usize::MAX,
+        ..Gate::default()
+    }));
+    let mut trace = Spine::new(OperatorInfo::new(0, 0, [].into()), None, None);
+    trace.set_exert_logic(Arc::new(|levels| {
+        let active = levels.iter().any(|(_, count, _)| *count > 1);
+        let separate = levels.iter().filter(|(_, _, len)| *len > 0).count() > 1;
+        (active || separate).then_some(1_000_000)
+    }));
+    for (time, count) in [(0u64, 4096u64), (1, 16)] {
+        trace.insert(Span::new(
+            Description::new(
+                Antichain::from_elem(time),
+                Antichain::from_elem(time + 1),
+                Antichain::from_elem(0),
+            ),
+            Some(Batch {
+                rows: (0..count)
+                    .map(|key| (key + 100_000 * time, time, 1))
+                    .collect(),
+                gate: Arc::clone(&gate),
+            }),
+        ));
+    }
+    trace.set_physical_compaction(Antichain::from_elem(2).borrow());
+    for _ in 0..advances {
+        trace.fund_progress();
+    }
+    for _ in 0..10_000 {
+        trace.exert(Exertion::Funded);
+    }
+    assert!(!trace.maintenance_pending());
+    let mut batches = 0;
+    trace.map_spans(|span| batches += usize::from(span.inner.is_some()));
+    (gate.lock().unwrap().worked, batches)
+}
+
+#[mz_ore::test]
+fn frontier_progress_funds_bounded_consolidation() {
+    let (worked, batches) = progress_without_updates(0);
+    assert_eq!(worked, 0, "turns alone must not fund consolidation");
+    assert_eq!(batches, 2);
+    let (worked, batches) = progress_without_updates(1);
+    assert_eq!(batches, 1, "one advance funds the pending consolidation");
+    assert_eq!(worked, 4096 + 16);
+    let (worked, batches) = progress_without_updates(1_000);
+    assert_eq!(batches, 1);
+    assert_eq!(worked, 4096 + 16, "banked allowances must not redo work");
+}
+
 /// Run with `cargo test -p mz-timely-util maintenance_microbench -- --ignored --nocapture`.
 /// Reports work and read completions before the arranger can next accept input.
 /// Reads complete immediately when requested: timings measure scheduling and mock

From fcce95ef4d275312b3f9aea5873ca05a8935a8b6 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 15 Sep 2026 11:36:40 -0400
Subject: [PATCH 30/31] controller: default storage arrangement maintenance
 policy to 16

Storage arrangements ran the exertion policy at proportionality 1337, which
reaches ten layers below the largest batch and lets idle scheduling turns lift
every small published batch into it. Compute has used 16, a reach of four
layers, throughout. On the skewed hydration benchmark the unfixed async spine
took 509 seconds for a matched interval at 1337 and 242 at 16.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/controller-types/src/dyncfgs.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/controller-types/src/dyncfgs.rs b/src/controller-types/src/dyncfgs.rs
index 8ceb83aa46b21..774273d716770 100644
--- a/src/controller-types/src/dyncfgs.rs
+++ b/src/controller-types/src/dyncfgs.rs
@@ -76,9 +76,13 @@ pub const ARRANGEMENT_EXERT_PROPORTIONALITY: Config<u32> = Config::new(
     ParameterScope::Replica,
 );
 
+/// The proportionality halves per layer below the largest, so 16 lets the
+/// policy request consolidation of layers within four levels of the largest
+/// batch, the same reach compute uses. Larger values let every small published
+/// batch be lifted into the largest batch on idle turns.
 pub const STORAGE_ARRANGEMENT_EXERT_PROPORTIONALITY: Config<u32> = Config::new(
     "storage_arrangement_exert_proportionality",
-    1337,
+    16,
     "Storage arrangement maintenance proportionality. Zero disables optional maintenance. Applies when a replica is provisioned.",
     ParameterScope::Replica,
 );

From 6a6609bc6d1d54312574466f91ebe5a6c2bf2844 Mon Sep 17 00:00:00 2001
From: Dov Alperin <dov.alperin@materialize.com>
Date: Tue, 15 Sep 2026 11:47:19 -0400
Subject: [PATCH 31/31] timely-util: keep accepting input while trace
 maintenance waits on reads

The arranger awaited each maintenance turn to completion, including every cold
read it suspended on, and took at most 32 input events and one seal per turn.
Input and frontier advances queued behind merge reads, so a spine could be woken
a hundred times a second while publishing every ten. Drain all queued input and
seal every frontier advance each turn, then advance maintenance by one poll;
reads suspend maintenance, never input. The spine already holds sealed batches
as pending until its current maintenance completes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../src/columnar/chunk/asynchronous.rs        | 50 ++++++++++---------
 src/timely-util/src/columnar/chunk/native.rs  |  1 +
 2 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/src/timely-util/src/columnar/chunk/asynchronous.rs b/src/timely-util/src/columnar/chunk/asynchronous.rs
index f0205245cf407..4ddb1c7e47a7b 100644
--- a/src/timely-util/src/columnar/chunk/asynchronous.rs
+++ b/src/timely-util/src/columnar/chunk/asynchronous.rs
@@ -9,8 +9,8 @@
 //! operator, which resumes maintenance on its Timely worker.
 
 use super::merge::ReadBudget;
+use super::native::Exertion;
 pub use super::native::{Batcher, Spine};
-use super::native::{Exertion, maintain};
 use super::{ChunkChunker, Column, ColumnChunk};
 use crate::builder_async::{Event, OperatorBuilder, PressOnDropButton};
 use columnar::Columnar;
@@ -77,21 +77,21 @@ where
         let mut batcher = Batcher::new(budget.clone());
         let mut chunker = ChunkChunker::<D, T, R>::default();
         let mut upper = Antichain::from_elem(T::minimum());
-        const INPUT_EVENTS_PER_TURN: usize = 32;
+        // Maintenance runs alongside input. A turn drains every queued input
+        // event and seals each frontier advance before it advances maintenance
+        // by one poll, so a merge waiting on a read never stalls input or delays
+        // publication. The spine holds sealed batches as pending until its
+        // current maintenance completes.
         loop {
-            let mut event = tokio::select! {
+            tokio::select! {
                 biased;
-                _ = input.ready(), if !upper.is_empty() => input.next_sync(),
-                _ = notify.notified() => None,
-            };
+                _ = input.ready(), if !upper.is_empty() => {},
+                _ = notify.notified() => {},
+            }
             let mut next_upper = None;
-            // Extra exertion can introduce virtual batches and change subsequent
-            // merge work. Amortize it over queued input, with a finite scheduling
-            // quantum so other operators still get a turn. The latest observed
-            // frontier suffices for sealing, including data read after it.
-            for index in 0..INPUT_EVENTS_PER_TURN {
-                match event.take() {
-                    Some(Event::Data(time, mut data)) => {
+            while let Some(event) = input.next_sync() {
+                match event {
+                    Event::Data(time, mut data) => {
                         super::metrics::record(
                             super::metrics::Stage::AsyncInput,
                             columnar::Len::len(&data.borrow()),
@@ -105,11 +105,7 @@ where
                             batcher.push(std::mem::take(chunk)).await;
                         }
                     }
-                    Some(Event::Progress(next)) => next_upper = Some(next),
-                    None => break,
-                }
-                if index + 1 < INPUT_EVENTS_PER_TURN {
-                    event = input.next_sync();
+                    Event::Progress(next) => next_upper = Some(next),
                 }
             }
             if let Some(next) = next_upper {
@@ -137,15 +133,22 @@ where
                     upper = next;
                 }
             }
-            // Queued input funds its own introductions.
-            let exertion = if !input.is_empty() {
-                Exertion::Merges
-            } else if upper.is_empty() {
+            // A read completion resumes the existing allowance; only a spine with
+            // no maintenance in flight asks policy for another. No trace borrow
+            // may cross an await: reader compaction can change the same spine.
+            let exertion = if upper.is_empty() {
                 Exertion::Idle
             } else {
                 Exertion::Funded
             };
-            maintain(&state, &notify, exertion).await;
+            {
+                let mut spine = state.borrow_mut();
+                if spine.maintenance_pending() {
+                    spine.resume_maintenance();
+                } else {
+                    spine.exert(exertion);
+                }
+            }
             tokio::task::yield_now().await;
         }
     });
@@ -163,6 +166,7 @@ mod operator_tests;
 
 #[cfg(test)]
 mod tests {
+    use super::super::native::maintain;
     use super::*;
     use columnar::{Index, Len};
     use differential_dataflow::trace::Batcher as SyncBatcher;
diff --git a/src/timely-util/src/columnar/chunk/native.rs b/src/timely-util/src/columnar/chunk/native.rs
index 504f50bf76763..c30cdbce5a5fb 100644
--- a/src/timely-util/src/columnar/chunk/native.rs
+++ b/src/timely-util/src/columnar/chunk/native.rs
@@ -326,6 +326,7 @@ impl Wake for NotifyWake {
     }
 }
 
+#[cfg(test)]
 /// Apply one exertion turn, yielding while its maintenance waits for I/O.
 ///
 /// This does not force all batches to compact. DD's exertion policy determines