Assess prospective DIMM populations before build fulfillment

[gunbai-bot]

A part-level compatibility answer cannot detect the Mt. Collins configuration that firmware rejected: ADS package byte 0x91 mixed with retained Hynix byte 0x00 in socket 0. This change assesses the concrete positioned population before fulfillment and reports the modules, positions, bytes, firmware scope and observing source that explain the rejection.

Change

• Replace NodeRecipe.memory_module + PopulationOption with an initial/proposed configuration and action plan. Derive memory procurement quantities from acquisition positions while retaining installed modules in the assessment.
• Evaluate fixed minimum obligations and caller additions through std.goal_assessment: satisfied, violated with a counterexample, or unresolved with named missing evidence/model capability. Coverage, package acceptance, firmware applicability, class support, specific-part qualification, training, boot and the failure screen remain separate.
• Join Micron catalog/package facts, the pinned EDK2 SPD layout, and the bounded observing-layer finding. The witnessed rule covers firmware 210525, its platform/settings, socket 0 and the 00/91 pair. It establishes neither an ADS defect nor successful uniform ADS boot.
• Construct Mt. Collins positions from resolved population roles and the existing GSG connector-label/slot authority. Preserve both population-role refusal causes as located unknowns; replay cannot construct a configuration when the authority refuses.
• Evaluate allowed delivery variants and every initialization snapshot, including a mixed intermediate population. Collector validation consumes process/session evidence, stimulus, interval and inventory coverage. Repeated capture hashes contribute suspicion alongside independent collector failures, never proof by themselves.
• Run assessment and admission once in resolve_build before supply or inclusions. BuildResolution carries the bound assessment, purchase purpose, lines and ceiling; max_constructible projects its ceiling. Selection retains qualification gaps on unread/missing lines and cannot turn a bounded experiment into production readiness.

Consumption and limits

The assigning parent revised the original order-actuator and physical-memory-convergence completion requirements after confirming those consumers do not exist in the corpus. Existing fulfillment and selection execute this assessment. memory_change_consumer_frontiers declares the absent order/readback consumers and their required behavior; planned readback is never represented as observed readback. The residual PopulationOption power path is frozen with retirement bound to its existing carrier.

Catalog (#11124), compatibility-evidence (#11140), and captured-artifact (#11141) authorities are integrated from main. PartEvidenceUnresolved remains unresolved through fulfillment. The artifact is joined, not copied; replay checks SHA-256 e5044f71cde73fe9b2ea1e76c9b894c1ab2f007577b9cbb7e8d50650c2b78a4c.

Validation

• Coverage admission joins identities in both directions, rejects duplicate required identities and unrelated results, and retains the independently mandatory roster. The exact duplicate-required/unrelated-result control fails with the old predicate and passes with the repair; count-preserving identity-loss and valid-bijection controls also pass.

• Capture verification hashes the same captured content returned to recognition through sha256sum stdin. Its known-answer, changed-content and added-newline controls execute in local_repo_wet_schedule, with the read-only local SHA-256 effect separately admitted. Measured hermetic DigestStdin / NoMockResponse is recorded as a route gap requiring that real terminal, never a successful mock.

• All 74 controls pass across the assessment, fulfillment, selection and real-process capture witness modules, using the full source/import closures with explicit entry/function selection. Controls include both upstream population-role refusals and a synthetic even-numbered primary connector.

• Read-only replay verifies the committed capture and exits 1 with the expected production-admission refusal: J9 / MCU4, package bytes 145/0, firmware 210525 and the capture source. Other-socket scope and independent qualification/boot requirements remain unresolved. No hardware action occurs.

• Required CI must pass on the pushed head; local controls do not replace it. A capacity refusal before claim execution is UNEVALUATED. No closure trimming or Rust implementation additions.

Implementation account and replay command. Work item: node://adhoc-55f81638-bae.

Main through e7e86ec551e is integrated. Its #10850 migration removed func; the four replay/verifier declarations now use canonical fn in f740bae3b05. The earlier 74-control run and replay predate this integration. CI at ed87bb27199 refused module indexing on the retired spelling before claims ran; fresh CI must validate the corrected composition.

Review 65550: MemoryCollectorReceipt now carries std.process::ProcessExit and preserves failure code/reason. resolve_build assesses and screens once, constructing both lines and ceiling in BuildResolution; max_constructible and selection project that same result. The collector-failure and production-admission controls exercise the changed consumers. The observed EXP[91] remains independent of catalog values; see the review response. The current-compiler scoped remote attempt built but refused before claims (HostBudgetUnreadable: no enforcing cgroup limit). The existing older local bootstrap also refused before claims because it cannot parse current fn … uses declarations. Neither attempt supplies a verdict. Required CI run 34773710388 is pending; earlier control results do not certify this change.

At unchanged 7d1f2054eef, the isolated current-compiler local run now passes all 74 scoped controls. The mechanically harvested roster joins exactly to the PASS identities, with zero missing, extra, duplicate or failed entries. Validation receipt and scope. Required CI remains pending for floor enrollment and route-gap discovery.

[gunbai-bot]

Addressed review 64336 in b03d5b432da.

The finding was correct: the new SPD module declared extdeps_model_scope but was absent from the coverage roster. Added dag/extdeps/firmware/tianocore_edk2/sdram_spd_ddr4.dag to scope_carrier_paths beside the existing Tianocore subject entry.

Validation: the existing production placement gate completed successfully (exit 0), including its live Git observations and legacy-manifest read:

ctrl-build --local -- /cargo-target/release/gunbc run \
  --source-root dag --source-root src/v2 \
  --entry dag/gunbc/instruments/extdeps_scope_placement_gate.dag \
  --function run_extdeps_scope_placement_gate

This commit changes only that roster entry; the evaluator implementation is unchanged.

— sent from deep-raven-79

[gunbai-bot]

Addressed review 64358 in a5a3a2fbbce:

1. The reported production bypass does not occur: evaluate_memory_configuration makes PartSampleQualificationRequired an unresolved mandatory MemoryTrainingFailureScreen, and admission refuses before supply resolution. The new exact-case regression checks that refusal even with all other axes established and a market row marked CompatibilityEstablished. Nevertheless, the later fold obscured this contract. It now explicitly narrows unresolved findings for production, preserves existing refutations, and permits the qualification exception only with the named completion obligation. The regression also directly checks the narrowed supply verdict and verifies that an allowed qualification purchase remains a selection gap. PartNotImplicated remains a negative-screen result; independent class/part/training/boot assessment supplies the positive evidence.
2. Replaced the geometry reference with gunbc.machine_intake_mtcollins1_access_observation::mtcollins1_identity.baseboard, the existing observed board identity. Corrected the corresponding fulfillment fixtures and the mismatched-board control too. This does not invent a vendor catalog row with unestablished fields.
3. Removed the literal population count from coverage. Generic coverage checks the given positions; the specifically bounded Mt. Collins finding derives its expected population count from the documented channel-pair rosters and names that scope when refusing a different capture shape.
4. Removed part-number dispatch from the observing fold. Collector receipts now carry captured printed-token bindings keyed by catalog declaration identity; missing or ambiguous bindings explicitly refuse. The same coverage check now guards positive qualification receipts; a partial-inventory control cannot establish class/training/boot even when its standings claim success. These bindings stay in the observing layer, as required by the task. Moving them into the EDK2 authority would be incorrect: that source defines SPD layout and provides no evidence about this firmware's inventory output. No general ADS-prefix rule is asserted.
5. Declared the surviving aggregate PopulationOption host/power surface frozen beside its producer and consumer, with no new host rows or callers. The returned assessment frontier names the missing per-connector power model and the trigger for deleting the aggregate power input. Homogeneous candidate enumeration remains upstream of selection; its power envelope does not assess this concrete configuration.
6. Corrected “its dimm says” to “its module says.”

Validation: 63/63 scoped claims PASS, including the exact sample-required scenario and partial qualification capture; full source/import closures retained. The real-artifact replay verified the capture and exited 1 with the expected located 00/91 production refusal.

Also fixed the e42e088 required-CI failure: the floor reported a structural parser error for an annotation inside memory_capture_covers_population. That special case is gone, and all new annotations are at declaration grain. The scoped ARM runner did not enforce this newer parser rule, so passing scoped claims are not presented as a substitute for CI. Floor diagnostic. New-head CI and rereview are still required.

[gunbai-bot]

Addressed review 64383 in eb9e531.

• MemoryCollectorReceipt now carries its four stimulus-relative offsets as std.types::Seconds; the declaration specifies seconds.
• MemoryMixtureFinding.expected_byte / actual_byte and MemoryComparisonUnestablished.left / right now use std.integer::UInt8, matching the SPD data carrier and counterexample values.
• Removed memory_platform_same and memory_configuration_same. Every caller now uses structural equality directly, preserving exact firmware/platform and proposal binding.

Validation: all 24 evaluator controls pass after the fixture correction (final dispatch exit 0), including incomplete/failed collectors, scope changes, intermediate initialization, and decisive production fulfillment. The 27 fulfillment and 12 selection controls also pass with the production changes. git diff --check passes. The remote compiler-route negative control refused as expected.

The fixture needed a typed Seconds data constant: a branch with a plain integer fails type resolution, and Int as Seconds passes typechecking but the existing interpreter cast path rejects that target. I inspected the cast implementation and used the existing typed-data construction already consumed by gunbc.auth.access_request; no cast fallback or compiler change was added. The unsuccessful runs are not counted as passes.

Required CI and rereview on this head remain separate from these scoped results. No merge requested.

[gunbai-bot]

Addressed review 64419 in bb69e4d.

The grain finding is correct. resolve_build now returns one BuildResolution containing the assessment/purpose and its line results. BuildCandidate holds that result. The context is removed from LineResolved and all per-line resolvers; candidate_missing_inputs emits the qualification gap once before folding line gaps. Unread compatibility and missing supply therefore retain both their own located cause and the build-level qualification cause without repeating it per line. Cash and inventory projections were migrated to the same build carrier.

The reporting finding is also fixed: explain_memory_change projects the final assessment plus every initialization snapshot, labeled by action ordinal. An intermediate mixed boot now shows its positioned byte-6 counterexample even when the final configuration clears the mixing check.

Validation: 65 scoped controls passed in one exit-0 dispatch (26 evaluator/consumer, 27 fulfillment, 12 selection), with full import closures. The new unread/missing-supply control checks exactly two qualification-axis gaps across multiple lines while retaining every line-specific gap. The new workflow explanation control checks a homogeneous final population with an intermediate initialization and the located J9 / 145 / 0 / firmware 210525 / source explanation. Existing purchase, inclusion, production refusal, binding, and selection controls remain enrolled and pass. git diff --check passed.

Required CI and review on this head remain separate and pending; no merge request.

[gunbai-bot]

Addressed review 64437 in 1d71056.

The repetition predicate was unconsumed outside its witness. memory_collector_refusal now calls it and preserves the repeated-digest signal alongside an independently established collector failure. That located cause flows through the existing mixture and qualification refusal/unknown paths. The witness now checks this production consumer, including both the repetition context and the interval-coverage cause, and keeps the positive control where a valid repeated capture still establishes the finding.

I did not make repetition alone an unresolved obligation: that would withhold production solely on identical hashes despite valid coverage and payload, contrary to the operator's explicit correction that identical captures are suspicion, not proof. The implemented result combines the comparison with independent process, interval, stimulus and payload checks; the digest does not become a standalone veto.

QualificationMemoryPurchase.maximum_units, MemoryInitializationAssessment.action_ordinal, and MemoryWorkflowState.ordinal now use std.nat::Nat. The explicit zero-bound policy remains; negative counts are no longer the declared carrier.

Validation: all 65 scoped controls pass in one exit-0 dispatch, retaining the full import closures (26 evaluator/consumer, 27 fulfillment, 12 selection). git diff --check passes. Required CI and rereview on the new head remain separate; no merge request.

[gunbai-bot]

Investigated the two failing checks on 1d71056. There is one underlying failure: namespace-wave admission rejected a stale #11137 transition row; the witnesses aggregate reflected that refusal. Build and generated-artifact checks passed.

The floor job completed measurement: planned=3810 executed=3810 not_attempted=0, claims_failed=0. Its admission phase found 13 deltas, all adjudicated, and one stale admission: gunbc#11137 extdeps.tools.sha256sum names Filesystem instead of reaching it. This is a structural admission failure after evaluation, not a capacity refusal or UNEVALUATED result.

Integrated current main and removed that exact row from NAMESPACE_TRANSITION_ADMISSIONS. Its documented trigger was #11137 merging; commit 34d2a8d already puts the named import on both sides of this run. The deletion receipt records the actual STALE classification rather than claiming the stronger CONSUMED singleton-binding proof. No gate logic or evaluator behavior changed, and no admission was added or widened.

rustfmt --check and git diff --check pass. Required CI must verify the corrected head; the earlier result is not presented as a green floor.

[gunbai-bot]

Addressed review 64518 in 7d9ed91.

The frozen power frontier now uses retires_dissolution bound to the existing product.node_power_envelope::PopulationModuleRead. This constructs BoundDissolution { trigger: DeclarationRetires }; bound_dissolution itself is the appearance helper, so it would have the opposite polarity.

The full migration requirement remains on the frontier's reason: consume the positioned population for channel coverage and per-module power, preserve unsupported-density and missing-evidence refusals, and retire the aggregate input atomically. The bound trigger observes the old carrier's removal; it does not independently prove replacement behavior. The absent order and physical-convergence consumers remain unbound.

The new control consumes the frontier returned by evaluate_memory_change through the shared dissolution_status fold: present retirement subject gives DissolutionPending, absent subject gives DissolutionFired.

Validation: all 27 evaluator/consumer controls passed in one exit-0 scoped dispatch with full import closure, including the new trigger control. git diff --check passed. Required CI and rereview on this head remain pending; no merge request.

[gunbai-bot]

Addressed review 64531 in 07b5d78.

The hardcoded recognizer moved to gunbc.mtcollins_memory_change::mtcollins_training_mixture_finding, beside the captured platform, artifact identity and catalog bindings it observes. That producer now owns the roster-count check, firmware and mismatch tokens, comparison socket, expected/actual bytes and mismatch coordinate. The generic gunbc.memory_observation module no longer imports the Mt. Collins roster or contains its transcript literals. The recognizer retains all its bounded refusal conditions; this is not a new universal firmware rule or an upstream guarantee.

I also removed the implicit coordinate-print convention from the generic inventory join. MemoryCollectorReceipt now receives an explicit expected payload token and MemoryPrintedPositionBinding rows, alongside its existing part-token bindings. The Mt. Collins producer supplies its SK / MC / S format; the generic validator joins position and part identities and checks their tokens on the same captured line. Missing or ambiguous position bindings refuse coverage.

The new control executes generic validation against a different explicit payload/coordinate format, checks that missing position bindings fail coverage, and verifies that the host-specific recognizer still refuses that alternate transcript. Existing collector and production-consumer controls remain enrolled.

Validation: all 67 scoped controls passed in one exit-0 dispatch (28 evaluator/consumer, 27 fulfillment, 12 selection), with full import closures. The actual committed-artifact replay verified the SHA-256 and exited 1 with the expected refusal, including J9 / MCU4, byte values 145/0, firmware 210525 and the capture source. git diff --check passed. Required CI and rereview remain pending; no merge request.

[gunbai-bot]

Addressed review 64539 in 4fa6b60. The configuration-wide qualification receipt filter now executes once before the population fold, rather than repeating its deep structural equality for every DIMM. Matching and refusal behavior are unchanged.

All four targeted controls pass in one exit-0 dispatch with the full import closure: decisive production fulfillment with the other obligations established; failed collector; partial inventory; and unresolved sample-required screen. git diff --check passes. Required CI and rereview on this head remain pending; no merge request.

[gunbai-bot]

Addressed review 64585 in 361e42c1745.

The three parity-based constructions are gone. gunbc.mtcollins_memory_placement::mtcollins_memory_position consumes a resolved population role and projects the existing GSG connector prefix and slot legend. Placement evaluation consumes the complete mt_collins_channel_population_roles standing, preserving both upstream refusal causes in MemoryPopulationRoleUnresolved. The replay refuses before constructing any configuration when that authority refuses. Fulfillment fixtures construct Mt. Collins positions through the same projection; their ASRock supply-only labels explicitly make no Mt. Collins mapping claim. Test fixture setup now requires the resolved roster instead of silently manufacturing positions.

All 69 assessment/fulfillment/selection controls pass with full source/import closures. New controls exercise BothMembersAtOneDpc, NeitherMemberAtOneDpc, and a synthetic even-numbered primary connector. The hash-verified committed-capture replay still exits 1 with the expected J9/MCU4, byte145/0, firmware210525 counterexample and source. git diff --check and the push formatting hook pass.

Current main is integrated. Required CI and review must be evaluated on this new head; the previous head's green CI does not cover it. Landing remains held by the operator's #10940 freeze, and no merge is requested.

[gunbai-bot]

Integrated main 2a5baa914f7938b7571a2710680421f05c73332d after #11216 merged. The refreshed composition includes upstream compiler and test-declaration changes; evaluator changes add no src/v1 or src/v2 delta against that main.

Fresh remote validation built the integrated compiler successfully, then refused before executing witnesses: HostBudgetUnreadable, because no enforceable cgroup memory limit bound the process. This is UNEVALUATED, not a memory-evaluator assertion failure or a pass. No unchanged retry or budget bypass was attempted.

Required CI is pending: base PR run, stacked follow-up pinned run. The follow-up requires explicit dispatch because its base branch does not match the workflow's automatic main-PR trigger. No merge request yet.

[gunbai-bot]

Scoped regression refresh completed on 2bac1ec598cf9a45c9c0513b95ecac5c9eb51e4c: every test fn dispatched through claim_batch passed in memory_multiple_findings_witness_test, memory_change_evaluation_witness_test, build_fulfillment_witness_test, and build_selection_witness_test (18 + 30 + 27 + 12 witnesses; process exit 0). Both source roots (dag, src/v2) and full import closures were retained.

This was the existing local /cargo-target/release/claim_batch, SHA-256 2594b0e431db93e1e8410cb313da041f823f2e4dd7bc5b1486bbe9f5ed0fa192, not the newly built remote compiler. Its passing assertions do not replace required CI or erase the remote pre-evaluation HostBudgetUnreadable refusal. The instrument separately refused its cost attribution accounting; no cost-share claim is made from that output.

Required CI remains queued. No merge request.

[gunbai-bot]

Investigated the failing floor job. The floor executed all 3,857 planned witnesses with claims_failed=0; all changed memory, fulfillment and selection witnesses passed. Build/clippy and generated-artifact checks passed.

The sole blocker is v2.test.claim.affected_set_universe.affected_set_universe_gate_processes_match_declared_gates: completed with eval_steps=2884, observed CPU 575 ms, rounded ceiling 576 ms against 500 ms. This is measurement_completed / completed_over_cost_requirement, not an assertion failure and not UNEVALUATED.

Immediately before it, the runner reported cgroup charge 14.9 GiB, 7,584 high events and 169,409 major faults/min. That supports the already documented gunbc.recurring_failure_mode.admitted_reclaim_charged_by_first_touch diagnosis for this exact subject and step count, though it does not independently measure reclaim's contribution in this run. That authority explicitly rejects narrowed scans, prewarming and exempting the scan from its budget as repairs.

Reported to the parent coordinating the floor-capacity work. No evaluator change, budget increase or blind retry; merge remains blocked.

— sent from deep-raven-79

[gunbai-bot]

Review 65550: accepting the process carrier and shared-evaluation findings. MemoryCollectorReceipt.process_exit now takes std.process::ProcessExit; matching its failure arm preserves code and reason in the refusal. resolve_build computes the assessment, admission decision, BOM and screened supply once, and constructs both line resolutions and ceiling in BuildResolution. max_constructible projects that ceiling; BuildCandidate and the selection folds consume the same resolution, with no independent ceiling field. The existing production control now exercises both outputs.

I am declining the requested projection of EXP[91] from extdeps.memory.micron. EXP is an observation of this attempt, not a catalog guarantee. The independent captured bytes say EXP[91] in artifacts/bmc/mtcollins1-sol-dram-training-2026-09-12.txt; the separate captured attempt in #11198 says EXP[b2] in artifacts/bmc/mtcollins1-sol-3ds-mixture-refusal-2026-09-12.txt. A catalog correction must leave those observations intact so evaluation can detect disagreement. Replacing the observed value with the catalog's answer would erase that independent referent (DESIGN §§3 and 5) and could assert a byte the recognized transcript did not print. SLOT0[00] does now project mtcollins_observed_hynix_package, whose authority is this same captured observation. The recognizer remains bounded to its literal captured syndrome and firmware/configuration scope.

Validation is in progress; this is not a merge-readiness claim.

— sent from deep-raven-79

[gunbai-bot]

The current-compiler scoped run built successfully, then refused before evaluating claims: HostBudgetUnreadable because the BuildBuddy executor exposed no enforcing memory.high/memory.max bound. Execution receipt. This is UNEVALUATED, not a failed or passing control suite. I am not retrying with a guessed budget.

The source repairs are pushed at 7d1f2054eef; required CI run 34773710388 is running on that head. #11198 carries them at 65043da0dd5 and remains gated on retargeting after this PR lands. Neither PR is being presented as merge-ready.

— sent from deep-raven-79

[gunbai-bot]

Current-compiler local validation completed at unchanged head 7d1f2054eef. Built claim_batch from this checkout with an isolated target directory after detecting a stale dependency from another worktree in the shared target directory.

One scoped invocation used explicit --entry and mechanically harvested --functions for the four assessment, fulfillment, selection and real-process digest witness modules (--source-root dag --source-root src/v2 --wet). All 74 expected identities returned PASS exactly once; the roster join found no missing, extra, duplicate or failed identities. This includes the shared line/ceiling production-admission control, the qualification-gap control, collector failure-reason preservation and the real SHA-256 stdin control. Peak RSS was reported as 6.8 GiB.

This establishes scoped behavior with the current compiler. It does not establish floor enrollment or route-gap discovery; CI34773710388 remains running and authoritative for those. The pushed head stays fixed.

— sent from deep-raven-79

[gunbai-bot]

Fixed the DESIGN §4c annotation placement defect in c4f57af9fc6: the EXP[91] rationale now leads mtcollins_training_mixture_finding, rather than appearing inside its record literal. The rationale and semantic code are preserved.

The DAG diff contains no added indented annotations or unattached EOF annotations. A repeated-arm-head scan within lexical scopes found no candidates. The earlier 74 local passes establish scoped behavior, not source-annotation grammar admission. Required CI run 34775031062 now targets this head; cancellation was requested for superseded run 34773710388, with no verdict claimed for it.

— sent from deep-raven-79

[gunbai-bot]

Addressed both findings in review 65591 with e8626c3:

• Deleted max_constructible; its witness consumers now read BuildResolution.ceiling, as production selection already does. The probe documentation names that carried field directly.
• Removed the transcribed scoped-control count from the probe documentation.

Also removed the unused imports identified by the review. No finding is being refused.

Validation: git diff --check and the pre-push formatting check passed. Scoped execution of this correction remains UNEVALUATED: the shared binary rejected current source syntax, and an isolated current-compiler build could not spawn rustc (Resource temporarily unavailable). No behavioral pass is claimed from those attempts. The prior head c4f57af completed required CI successfully in run 34775031062; that result belongs to that head. The pushed correction needs its own CI and review. No run was cancelled.

— sent from deep-raven-79