# Planner ownership and executable fragment binding

Graph traversal, candidate catalogues/selection, Recipe, family construction/cache and persistent parameter-home selection now belong to planner. Pipeline configuration belongs to compile. Mid contains executable values, copies/compute/Repeat, validation, fragment substitution and rewrites. Module imports name their owners; mid no longer acts as an implicit export of planner/configuration/tensor definitions. Pure ownership/broadcast projection belongs to tensor, and shared operation-sequence costing belongs to estimate. OperatorFamily describes planner choices; the public MidOperator name is only a compatibility type re-export.

Fragment substitution checks complete input and output types before mutating the caller, preserves ownership groups and relative rotations, and remaps structured Repeat arguments, yields, sequences and operations. Returning an input through a distinct caller result produces an explicit identity copy. New semantic regressions exercise execution through rebound Repeat, group/alias preservation, returned inputs/multiple results, and atomic rejection of invalid IDs or incompatible contracts. The rewrite-only cast fixtures no longer construct planner state. Mid's executable validator has a ProgramError independent of planner errors. This stage prioritizes ownership and correctness, not source-size reduction; scoped Recipe owner maps and the remaining proposal requirements are unfinished.

Validation:

- Workspace release suite: 422 passed, 0 failed, 8 ignored. After relocating the ownership test beside the mid rewrite, its targeted rerun also passed.
- All-target workspace check: passed without warnings. Rust formatting and staged diff whitespace checks passed; final changes after the checks were comments and import ordering only.
- SDK-enabled saved_search_preserves_budget_aliases_and_order: passed using actual package construction. Four uninterrupted search steps match two plus two resumed steps across different worker counts; the same test covers attempt bounds, alias normalization, zero-step replay and infeasible baseline rejection.
- FP16 MLP Repeat 3: hardware PASS, maximum absolute error 0.000183. Package is byte-identical to compiler-driver/mlp-f16-repeat3.ipuexe.
- FP8 ViT with fused QKV and Repeat 3: hardware PASS, maximum absolute error 0.189453, minimum cosine 0.997459656. Package is byte-identical to compiler-driver/vit-fp8-repeat3.ipuexe.
- Real-weight SigLIP So400m, 27 layers, BS1, six real images: hardware PASS. Historical search checkpoint loads with zero optimization steps. Package and all six device outputs are byte-identical to compiler-driver/real-bs1. Minimum cosine against FP32 reference is 0.994567066. Build plus six-image verification took approximately 100 seconds.
- The identical packages retain the prior modeled total/exchange cycles: MLP 32613/18087; small ViT 331874/120708; full SigLIP 13301152/5422804. No device speedup is claimed.

Commands, logs, profiles and outputs are adjacent. Host check logs are /tmp/ipu-planner-workspace-tests.log, /tmp/ipu-planner-final-check.log, /tmp/ipu-planner-replay-test.log, /tmp/ipu-planner-owner-test.log and /tmp/ipu-planner-cli-build.log.