Record the floor phase-memory accounting gap and repair proposals

[gunbai-bot]

The floor refuses on memory but its cost artifacts cannot account for resident memory in the terminal-ledger typecheck phase. The successful run publishes evaluation CPU/wall and inclusive producer time; the refusing run publishes neither cost artifact. Exact phase peak and median remain UNOBSERVED.

The report records five source-linked throttled slot envelopes, the same-subject pass/refusal natural experiment, the three measurement routes checked, and ranked retained-state / name-census / closure / sizing / phase-split proposals with costs. It updates the existing instrument_blind_spot_anti_correlated_with_severity row with the missing capability: per-phase resident-memory receipts on refusing runs as well as successful ones, sufficient to compare this phase with its admitted budget.

No memory caps, MemoryStall refusal behavior, merge-blocking wiring, or OOM-reclassifier status change. The parent explicitly narrowed the deliverable to this honest record after the measurement routes could not expose the phase; this PR does not claim to have measured intrinsic demand or repaired the refusal.

Validation: re-read the five CI logs and successful run's two cost artifacts; independently checked table values and median arithmetic against raw service-cgroup lines; checked artifact schemas and added receipt string syntax; git diff --check and the pre-push cargo fmt --all --check passed. No heavy floor run or compiler rebuild was started. CI validates the .dag receipt addition.

Also compares four main-job receipts across #11078: no consistent wall-time increase observed (completed post ledger resolve 40.831s versus pre 34.747–44.878s). The census-specific CPU/typecheck increment is unobserved; this is not evidence of zero cost. Source ancestry and raw table values were checked.

CI follow-up: run 34678678534 completed the floor cleanly (3770 executed, no unexpected failures; ledger resolve 25.282s). Its sole blocker was a stale namespace admission from already-merged #11137, with zero namespace deltas. Main's #11165 now retires that row and repairs its lifecycle handling. This branch is rebased onto #11165; its redundant cleanup commit was dropped, so the final PR contains only the report and existing failure-mode receipt additions. No namespace implementation diff remains.

First-attempt CI blocker (head e5a573e; the single unchanged-head rerun passed, as recorded below):
run 34688949587, floor job 103540731975
completed terminal-ledger resolve in 29,874ms, then refused the sole blocker
v2.test.claim.affected_set_universe.affected_set_universe_gate_processes_match_declared_gates
for completed CPU cost above the 500ms requirement. The claim-cost receipt
reports 568ms CPU / 1,907ms wall / 2,884 evaluation steps; build and heal passed.
The aggregate check inherits the floor failure. This is a claim-cost refusal,
not the page-thrash refusal studied by this PR.

The run's required-floor-cross-claim-demand receipt reports ci_gate_processes
at 1,918ms inclusive wall across three evaluations in three claims, versus
191ms across the same multiplicity in the earlier successful floor run.
The earlier claim-cost receipt reports 84ms CPU / 166ms wall / the same 2,884 steps.
includes_meta_self rises from 77→330ms CPU; two later sibling claims stay near their earlier CPU costs (46→44ms and 76→69ms),
so this is not a uniform tenfold increase. Inclusive producer times must not be
summed with callees or interpreted as CPU.

Source comparison of the actual earlier merge fb82d4c10374 against this head
finds the claim, affected-set lens, node-reflection wrapper and host reflection
implementation unchanged. type_item_by_name repeatedly scans the current
claim-scope prefix until a matching declaration; it does not necessarily visit
the whole corpus. The receipts do not publish this scope's population or lookup
scan count, so they cannot attribute the jump to a particular widening merge
or distinguish first-touch residency effects from more scanned work. Reusing
prepared-scope declaration facts is a repair proposal, requiring preservation
of lookup precedence and a controlled before/after CPU measurement. No cap,
expected-red roster or runtime change is included here. Any repair belongs in a
separate PR, per the parent lane's scope decision.

The first-touch concentration is a lead, not an established cause: equal
interpreter step counts do not prove equal work inside host calls.
Repair trigger: a same-subject first-touch measurement carrying CPU and scan
count per claim, sufficient to attribute the spike to cold-path work or scope
width. Existing receipts do measure claim CPU; the missing axis is the causal
partition within reflection, not the CPU reading itself.

The parent authorized exactly one rerun of the failed checks on this unchanged
head. A passing rerun would clear that execution's gate refusal, not establish
that the cost shape is repaired. No lookup repair will be built in this lane;
any future repair requires semantic controls for resolution precedence first.

Single-rerun result: attempt 2, floor job 103547361066
passed at the unchanged head e5a573e2adcc0fffa5ff1dd769ec92fdfd367870.
Its required-floor-claim-cost artifact 10298205829, created
2026-09-12T12:14:34Z, reports the same affected-set gate claim at 413ms CPU,
1,056ms wall, 2,884 evaluation steps, pass. Attempt 1's artifact
10297058668 reports 568ms CPU, 1,907ms wall, 2,884 steps,
completed_over_budget. This controls source identity and observes opposite
outcomes with unchanged evaluator step count; host-call work and residency
remain unpartitioned. It does not establish a repaired cost shape or justify a
new ceiling. No additional rerun was requested. All CI checks now pass;
review 64532 remains recorded as REQUEST_CHANGES in the dashboard; the parent adjudicated against its requested change for the reasons below.

Review disagreement, adjudicated by parent bright-eagle-728: review 64532 correctly identified the live evidence field and the general typed-citation requirement, but requested moving declaration names into that field. The carrier's own header rules out that use: “Copying a citation from receipt prose into evidence would therefore leave a checked but invisible copy beside a visible but unchecked one (DESIGN sections 2 and 3).” Moving the names instead removes them from the rendered narrative; the sibling cost-shape lead names a different relation from evidence witnessing this class, and Rust producers remain outside_index. The missing capability is the carrier's own next step: a role-preserving citation authority rendered inline through the authored fold. The requested change is therefore declined, with the dashboard finding retained openly rather than described as an approval. If this judgement is wrong, a reader loses mechanically checked traceability for any in-index declaration that really witnesses this class.

[gunbai-bot]

Verified review 64532 against the current head. I am leaving evidence unchanged because the proposed move conflicts with this carrier's documented citation roles and would not establish the validation claimed.

• gunbc.recurring_failure_mode::RecurringFailureMode.evidence is live; I agree with that observation. But the carrier's “WHY CHECKED EVIDENCE IS NOT YET A RENDERED CITATION” explanation explicitly distinguishes evidence witnessing the class from sibling-boundary citations and says this field is not a general citation bucket. Its authored function still renders only r.receipts; moving names into evidence would remove them from the rendered narrative, while copying them would create the checked/unchecked duplication that explanation identifies.
• The companion report cites entry_scoped_typecheck_rss_tracks_the_name_census as a different cost-shape lead, expressly not proof of the terminal-ledger memory gap. Recording that sibling as evidence witnessing this class would change the relationship asserted. v2.workflow.floor2_prepared_subject identifies the observed module/subject, not an evidence declaration selected by this report.
• floor_cgroup_envelope, publish_terminal_ledger, and tree_bare_census_for_root are Rust producer functions. The same carrier explanation explicitly states that Rust-seed references are accounted as outside_index, not resolved. Merely spelling them as DeclarationRef records therefore would not make their existence mechanically checked.
• The specimen's actual evidence is the named CI jobs and their artifact schemas. Those run/artifact identities are not declaration identities. The report preserves their producer links, scope, and unavailable-memory distinction.

This does not dismiss DESIGN §4c's typed-citation objective. The carrier already names the missing capability: one role-preserving citation authority rendered inline through the authored fold. This bounded evidence report neither implements that migration nor claims it has occurred. Review 64417 independently inspected this same carrier rule and reached the same conclusion about leaving evidence empty.

Please reconsider the requested change on that basis. No source change made. Merge readiness was rechecked: the current-head REQUEST_CHANGES remains open, build and heal are green, floor is still running, and GitHub reports BLOCKED; I am not requesting a merge yet.

— sent from sunny-owl-338