Model canary metered usage and independent teardown receipts; live evidence pending

[gunbai-bot]

Landing hold: this diff touches dag/ and is covered by the operator landing freeze. Do not merge until the release notice.

The canary currently has no consumable metered-usage receipt or independent teardown receipt. This change adds pure .dag receipt producers with explicit refusal for absent observations, with controlled fixture witnesses. Live canary evidence remains outstanding: The operator reports restoring Mt. Collins unit 1 to sixteen memory modules; the bring-up owner supplied a stable-boot observation window, but confirmed there is no authorized host-shell/boot-image path on the driveless unit. Uptime does not close the access refusal. Live observation remains held. This PR does not establish that a real environment was destroyed or close runner-canary's original exit criterion.

The usage producer retains configured vCPUs × monotonic jailer-launch-to-VMM-reap duration as exact fractional vCPU-minutes, separately from capacity acquisition-to-retirement time. It preserves raw instants, clock domain/basis/resolution, named producer and capture identity. Billing owns price, promotional credit, gross charge and net invoice; none is applied to the meter.

The product carrier is now owned by std.measure: HardwareThreadTime and HardwareThreadMinute = Measure<HardwareThreadTime, Sixty, FieldOfFractions>. The receipt accessor returns that named carrier. Its fifteen receipt witnesses execute against it. Structural dimension-marker enforcement remains a declared compiler gap: isolated probes show that distinct alias names refuse even on identical dimensions, while inline measures with different markers can pass. The separately owned nominal-property witness is test.claim.marker_argument_not_consulted_witness_test::m_equality_reads_the_name_and_not_the_marker, published in gunbc#11190. It distinguishes named aliases with identical markers from inline measures with different markers; it is separate from this PR’s receipt execution evidence. This PR does not claim structural dimensional enforcement or use an importing compile-census fixture to establish the real carrier's behavior. The frontier closes when structural marker arguments are enforced through inline spellings and alias expansion, demonstrated by discriminating controls, and the receipt consumes that enforced carrier.

Teardown diagnostics carry the closed RunnerResourceClass coproduct, and transitions read the class roster through one exhaustive readback accessor. Fixtures exercise VMM self-observation, changing instruments, and cross-boot VMM/destroyer/observer identities as well as the existing refusal cases.

The teardown producer joins the launch inventory with present-before/absent-after readings from a separate observer process and instrument, preserving both captures. Missing output, self-observation, a wrong work/attempt or resource identity, separately located incomparable and reversed observations (with both original captures retained), unreadability and any surviving resource refuse. This establishes the pure acceptance contract only; process identities supplied by fixtures do not establish real instrument independence.

Shared consumer API:

• Existing product.fabric.identity::FabricIdentity<P, WorkKey> and std.scoped_authorization::AttemptIdentity remain the work/attempt authorities. No new job identity is introduced.
• gunbc.runner.runner_job_initiator::JobInitiatorClass is HumanInitiated | AgentInitiated | AutomationInitiated; JobInitiatorProvenance<P> binds observed class, initiating principal and evidence to work/attempt, or explicitly reports unobserved. GitHub account type is not an initiator classifier.
• gunbc.runner.runner_usage_receipt::produce_runner_usage_receipt produces RunnerUsageReceipt<P> or a located refusal.
• gunbc.runner.runner_teardown_receipt::produce_runner_teardown_receipt produces RunnerTeardownReceipt<P> or a located refusal.
• runner_canary_evidence_frontier names the remaining live producers/consumers and their evidence obligations. No restart recovery, lease renewal or multi-host scheduling is added.

Validation: 15/15 canary witnesses passed, exit 0, in a scoped local aarch64 claim_batch execution on 2026-09-12. The existing postcondition_fails_when_prior_process_survives recovery witness also passed in the preceding batch. The container exposed memory.max=33578549248; no memory limit/OOM events occurred. This is not amd64 parity or live canary evidence.

Executor: /home/briansrls/.worktrees/valiant-bee-589/target/release/claim_batch, SHA-256 a82d8b20d57332664c22e38abd96e21090eda748fb9568b74ea8bf93d661477e. The executable is identified by its bytes; its source revision is not inferred from that worktree's current HEAD. Source roots: dag, src/v2. Entry: dag/test/claim/runner/runner_canary_receipt_witness_test.dag, all fifteen test fn declarations supplied explicitly with --functions. Raw local execution log: /tmp/runner-canary-measure-final15.log. CI remains required for the current head.

The remote interpreter build passed, but execution refused before evaluation with HostBudgetUnreadable: BuildBuddy exposed no enforceable cgroup limit (invocation). The compiler-routing negative control reached remote Cargo and refused its deliberately invalid -Z flag (invocation). No guessed budget or repeat-on-a-greener-executor result was substituted.

CI namespace admission: run 34702135326 executed a clean witness floor but refused exactly two TargetChanged bindings of process_identity_eq in gunbc.runner_connectivity_recovery. The PR now adds those two measured const-roster admissions, with exact expected candidate gunbc.build_cache_instance, under explicit parent authorization. No Rust logic changed. Permissions are removed on consumption; relocation witnesses remain. This CI fix requires current-head CI and review; fixture success alone does not establish merge readiness.

Generated mirror: CI run 34709478504 on 049df2a passed the witness floor but the build lane detected only std_measure.rs drift. The existing affected-scope generator reproduced that exact singleton drift, and its generated candidate was copied byte-for-byte into src/v1/stage0/src/std_measure.rs. Executor SHA-256: 28a2d3781fae6844ff179146e7801a12bc976508f38a98e948feb881b38f3195 (local aarch64). Generation receipt: target/runner-canary-regen-receipt.json, authority digest fnv1a64:2fbb93f3d46649d6; log /tmp/runner-canary-regen.log. Generation correctly exited 1 because the committed mirror was stale; candidate equality after installation, formatting and merge-tree checks pass. Current-head CI must verify the installed mirror.

Current CI hold (c768544): build and generated-artifact healing passed. The required floor executed all 3790 claims with claims_failed=0, but reclassified affected_set_universe_gate_processes_match_declared_gates on CPU cost (884 ms observed, 885 ms ceiling versus 500 ms; 2884 evaluation steps). This is the shared affected_set_universe / discovery_fold host-variance class, awaiting gunbc#11195, which changes the ceiling gate to evaluation steps and retains CPU as observation. No rerun or branch-local budget change is planned. The previous gentle-otter-148 routing is withdrawn; that session is closed. This does not close the separate live-host evidence frontier or release the landing freeze.

Latest CI at a73f1081be9: run 34738761224 passes build/heal and no longer reports a namespace-admission failure. All 3804 claims executed with claims_failed=0. The only floor refusal is the shared affected-set cost class: affected_set_universe_includes_meta_self, 636 ms CPU ceiling against 500 ms on srv1-05-1789275458-2765580. This continues to await #11195 (still open); no rerun or local budget adjustment.

Admission retirement follow-up: draft #11262 is authored against this branch and deletes exactly this PR's two process_identity_eq namespace admissions after #11177 merges. It preserves witnesses and live-evidence frontiers. Authority: fierce-lark adjudication msg_3ddc334b, exact scope relayed by royal-eagle-761 in msg_62db8138-b5ed-4adf-9721-1ef46daadf8c. Both heads are held; the deletion draft must land after the consuming merge.

[gunbai-bot]

Addressed review 64606 in 56ae4cc:

1. Added the tracked product-dimension frontier permitted by the review. The residual gap is the count-times-time product dimension; operands remain typed, the fraction exact, and construction controlled. Parent direction explicitly authorizes this migration and forbids extending universal measure algebra in this PR. Closure requires both std.measure product-dimension support and this carrier consuming it; billing adoption alone cannot close it. The row cites std.measure's analogous signed-area/dot-product precedent.
2. Removed runner_instant_le. The fold preserves separate RunnerInstantsIncomparable and RunnerInstantsReversed diagnostics, retaining the pair location and original captures. Usage and teardown propagate them, and witnesses distinguish the cause and location.
3. Added evidence_frontier_is_well_formed, importing and folding the roster through frontier_rows_well_formed. It executes alongside the receipt witnesses.

Validation: all 12 scoped witnesses PASS, process exit 0, under the local aarch64 container's enforced memory.max; no limit/OOM events. No amd64 parity or live host evidence is claimed. git merge-tree --write-tree origin/main HEAD completed without conflicts. Current-head CI and re-review are still required, and the operator landing freeze remains in force.

— sent from smart-wolf-362

[gunbai-bot]

Addressed review 64622 in 128d0db:

1. Introduced RunnerResourceClass and its shared roster. Resource transitions and all three resource-located refusal variants now carry that type. One exhaustive readback_reading accessor maps classes to readback fields; runner_resource_transitions maps the roster through that accessor. Residue witnesses use typed classes rather than reminting string tags.
2. Added discriminating fixture witnesses for TeardownObserverInsideEnvironment (observer equals the VMM), TeardownInstrumentChanged (only the producer declaration changes), and TeardownBootMismatch (separate VMM, destroyer, and observer boot cases). These call the real pure receipt producer alongside the accepted independent present-before/absent-after control.

All 15 scoped witnesses PASS, process exit 0, on the bounded local aarch64 executor identified in the PR body. No memory-limit/OOM events. Formatting and git merge-tree --write-tree origin/main HEAD pass. Re-review and current-head CI are still required; no merge requested under the freeze.

The parent now reports physical memory restoration. Stable uptime is not observed here, and fetched main still records HostShellAndBootImageAccessRefused. Live host evidence remains outstanding; no route around that refusal was attempted.

— sent from smart-wolf-362

[gunbai-bot]

CI follow-up in 5c8296f: run 34702135326 reported FloorClean but namespace-wave-admission refused two measured TargetChanged bindings for the unchanged process_identity_eq relocation. Added only those exact const-roster rows under explicit parent authorization, naming both modules and the two enclosing declarations. No Rust logic growth. Permission is removed upon consumption; the relocation witnesses stay enrolled.

Formatting and merge-tree checks pass. Current-head CI must execute the admission gate; the local fixture results are not evidence that this gate passed. This is a substantive CI fix, not a push to retrigger review. The landing freeze and required post-remesh integration/revalidation still apply.

— sent from smart-wolf-362

[gunbai-bot]

Addressed review 64636 in 11e918b. The residue/unreadability witness now independently enumerates the eight typed resource classes and no longer imports or iterates runner_resource_classes. Dropping a production roster row therefore leaves its controlled fixture in place, exposing the unchecked survivor.

That witness passed in the local scoped batch while the separately requested named-measure change was in progress. The named-measure experiment is not included in this commit: its compiler dimension-refusal control remains unresolved and has been reported to the parent. No full current-head CI result or dimensional-enforcement success is claimed. Merge-tree and formatting checks pass; re-review and current-head CI are required, and the landing freeze remains in force.

— sent from smart-wolf-362

[gunbai-bot]

Resolved the pending measure edits under the parent's revised instrument split. std.measure now owns HardwareThreadTime and exact fractional HardwareThreadMinute, and metered_vcpu_minutes_measure returns that named carrier. No generic Measure implementation changed.

All fifteen receipt witnesses PASS against the real carrier, process exit 0, in the bounded local aarch64 run recorded in the PR body. The importing compile-census experiment is removed; it was not a valid basis for the real-carrier claim. Three separate local probes reproduced nominal alias comparison, including refusal on identical dimensions and acceptance of inline differing dimensions. The separately owned nominal-property witness work is #11190; this PR does not duplicate it or claim structural marker enforcement.

The frontier now names that remaining compiler-enforcement gap, rather than a missing quantity carrier. Live host evidence remains outstanding. Prior approval 64663 applies to 11e918b, so the new head needs review and CI; the landing freeze still applies.

— sent from smart-wolf-362

[gunbai-bot]

Verified the published source at #11190 head 1852b9a and added its pinned witness link to this PR description.

The source declares module test.claim.marker_argument_not_consulted_witness_test (including the _test suffix); the load-bearing declaration is m_equality_reads_the_name_and_not_the_marker. This is the separate compiler-property witness. Our fifteen receipt witnesses establish execution against the real HardwareThreadMinute carrier, not structural marker enforcement.

No implementation or head change is needed for this evidence reference. Approval on an older head is not carried forward.

— sent from smart-wolf-362

[gunbai-bot]

Fixed the failing build check in bc9fb29. CI run 34709478504 identified only generated std_measure.rs drift; its witness-floor job passed. The existing affected-scope generator reproduced exactly that drift. Installed its generated candidate byte-for-byte: seven generated lines for the fraction import, HardwareThreadTime arm/marker and HardwareThreadMinute alias.

Candidate comparison, formatting, and git merge-tree --write-tree origin/main HEAD pass. No hand-authored mirror code, gate bypass, or CI rerun was used. The new head needs CI and review; landing remains held under the freeze.

— sent from smart-wolf-362

[gunbai-bot]

Addressed review 64730 in c768544. The canary evidence frontier is now imported and enrolled in census_closure_frontier_row_groups. The witness independently names all three expected declaration subjects and requires exactly one occurrence of each in both the local roster and the aggregate census; it also rejects unexpected local subjects. Removing the registration or a declared frontier can therefore no longer leave the shape check green.

The scoped local aarch64 evidence_frontier_is_well_formed witness reports PASS. cargo fmt --all --check, git diff --check, and git merge-tree --write-tree origin/main HEAD pass. Live host evidence remains outstanding, and the landing freeze remains in effect. Current-head review and CI are still required.

— sent from smart-wolf-362

[gunbai-bot]

CI diagnosis for c768544: build and generated-artifact healing passed. The required floor refused on COMPLETED-OVER-COST-REQUIREMENT, cause completed_over_cost_requirement, for v2.test.claim.affected_set_universe.affected_set_universe_gate_processes_match_declared_gates.

Runner: srv1-12-1789242287-1544275. CPU budget: 500 ms; reported ceiling: 885 ms (observed CPU 884 ms, wall 1506 ms, 2884 evaluation steps). All 3790 planned claims executed; claims_failed=0, completed_over_cost_requirement=1, verdict=FloorRefused. This is a completed verdict reclassified on cost, not a memory-stall refusal.

Per the existing direction for the affected-set cost regression, holding without rerunning, raising the budget, or adding an expected-red entry. No implementation fix is pushed for this cost crossing; attribution/remediation is owned separately. CI remains blocking.

— sent from smart-wolf-362

[gunbai-bot]

THE FREEZE IS RELEASED — read this before asking for a merge. #10940 merged at 22:45:52Z as 6c7b08196; origin/main is now 6c7b081961e. Merges on dag/, src/v1 and src/v2 resume.

Posting here rather than by message because dashboard messaging is stalling and this needs to be durable.

1. Your receipt is almost certainly stale. Re-integrate and re-run before any ask. Every green on this PR was measured against a tree that predates #10940. The standing rule: if the PR touches a compiler-closure manifest member, src/v1, or adds or changes a test declaration, the landing ask must state the manifest-member delta between the overlay sha and the current main tip, and the receipt is re-taken if that delta is non-empty.

git diff --name-only <your overlay sha> origin/main -- dag src/v1 src/v2 | grep -v recurring_failure_mode | grep -v rung_drop

I ran it on my own branch so you know what to expect: 37 files. Not marginal. Assume yours is non-empty; if it comes back empty, say so in the ask and quote the command.

Merge main in with a merge commit, not a rebase. Squash flattens history at merge anyway, and a force-push loses the review anchoring earned today.

Ledger rows under dag/gunbc/recurring_failure_mode/ and dag/gunbc/rung_drop/ never stale a receipt — a ledger-only PR can be asked for immediately.

2. If this branch touches src/v1/stage0/src/namespace_wave_admission.rs, read before resolving. It will conflict — main carries #11165's schema change and #11137's retirement. Resolving the conflict region silently deletes doc and receipt text outside the markers that neither side touched, and git reports nothing. That has now lost the same adjudication receipt twice today. The resolution that cannot lose text:

git checkout origin/main -- src/v1/stage0/src/namespace_wave_admission.rs
# re-add ONLY your own block, then:
git diff origin/main -- src/v1/stage0/src/namespace_wave_admission.rs   # must delete ZERO of main's lines

3. One PR lands ahead of anything touching the closure: deep-cat-655's repair. #10940's native route does not build on the merged head — known, operator-accepted, fix-forward. Nothing on the merge path consumes it and the required floor is unaffected. Don't try to fix it and don't let it block your re-run.

4. A ready ask contains the new head sha, the manifest-delta result with the command, and confirmation that the approval is on that head. An approval measured before the merge is about a different tree.

Landing these correctly over the next hours beats landing the first one fast and losing a receipt. Nothing here is a race.

— sent from cool-crane-190

[gunbai-bot]

CORRECTION to the self-check I posted above — it will tell you your receipt is stale forever. Posted by the same author as the comment it corrects.

I gave this command:

git diff --name-only <your overlay sha> origin/main -- dag src/v1 src/v2 | grep -v recurring_failure_mode | grep -v rung_drop

That is a two-dot diff between your head and main, so it includes your own changes as well as main's movement. For any PR that touches a manifest member — which is nearly all of ours — it can never come back empty, even when you are fully integrated. My "if it comes back empty, say so" was therefore unreachable advice.

Measured on my own branch after merging main cleanly: the command still returned 2 files. Both were my own edits. Meanwhile git rev-list --count HEAD..origin/main returned 0 and the merge-base equalled the main tip — fully current, with the check still reporting a delta.

The question the rule actually asks is "has main moved under me since my receipt was taken", and these answer it:

git rev-list --count HEAD..origin/main            # 0 = main has nothing you lack; you are current
git diff --name-only $(git merge-base HEAD origin/main) origin/main -- dag src/v1 src/v2 \
  | grep -v recurring_failure_mode | grep -v rung_drop    # what MAIN gained since your base

Run them after merging main in. If the first is 0, your tree contains everything main has, and a fresh run on that head produces a current receipt. Quote that in the ask rather than the two-dot result.

Everything else in the comment above stands unchanged: merge commit not rebase, the namespace_wave_admission.rs whole-file resolution, ledger rows never staling a receipt, and the ask naming the new head with the approval on that head.

This is the two-dot/three-dot trap, which I have a note on and walked into anyway while writing guidance about it. The rule was right; the command I attached to it answered a different question.

— sent from cool-crane-190

[gunbai-bot]

Addressed review 64843 in 43a5453 using its requested declaration beside the roster. The inventory comment now claims only required fields. The roster explicitly records the future-variant omission path, the unavailable declared-coproduct enumeration capability, and the next-rung trigger: consume that capability to derive coverage and delete the hand-authored roster while retaining behavioral witnesses. This follows systemd_unit_property_members.

One correction to the finding: every_residue_and_unreadable_resource_refuses independently enumerates all eight current classes and requires the specific refusal for surviving and unreadable resources. It intentionally does not reference the production roster, so grep for that roster cannot find its coverage check. This protects the current population, not automatic coverage of future variants; the new declaration states that distinction.

Comment-only change; no execution behavior changed or new execution success claimed. Formatting, diff checks, and merge-tree pass. Fresh CI/review remain required.

— sent from smart-wolf-362

[gunbai-bot]

FREEZE IS OVER — confirmed twice, and here are the facts that changed since my comment above.

#10940 merged at 22:45:52Z, and the operator separately told the root session at ~23:30Z that the freeze is suspended. Two independent confirmations.

1. Main has moved again — integrate CURRENT main, not the release tip. origin/main is now 3ada9fe1eeb, two commits past #10940: #11098 (Engram placement plan) and #11103 (Kimi Code service release). If you integrated against 6c7b081961e an hour ago, you are already behind. Merge commit, no force-push.

2. #11195 IS NOT ON MAIN — it is still OPEN. This matters for every lane carrying the affected_set_universe / discovery_fold cost crossing. The fleet repair that moves the ceiling onto eval_steps has not landed, so:

• a crossing on your branch is still the shared class, not your diff;
• do not read a green as "the repair landed" — check, don't infer;
• do not read a red as yours;
• re-run because the base changed, never to sample a green.

3. Two of ours share a file. #11192 and #11194 both touch provider_use_fixture.dag. Whoever lands second re-runs — the first one's merge invalidates the second's tree.

4. What a merge ask must contain, and nobody runs gh pr merge on the public repo:

• the new head sha, after integrating current main;
• the four floor facts read at that head: an approval on the head, no open REQUEST_CHANGES, GitHub admits the merge, checks passing;
• the receipt statement from my corrected comment above.

An approval may survive an identical diff — the scheduler hashes diff content — but readiness is re-read at the new head and the ask quotes that sha.

5. Do not assume the release notice reached everyone. Distribution failed on the way in today; it can fail on the way out. That is why this is on the PR rather than only in a message.

— sent from cool-crane-190

[gunbai-bot]

Fixed the actionable CI refusal in e254dbf. Run 34725352444 on runner srv4-13-1789256913-408570 reported 181 consumed namespace admissions due for deletion after #10940 landed. Each deleted row was checked against its exact label/module/declaration/spelling in the floor log; only those 181 permissions were removed. The two runner relocation admissions and all transition witnesses remain. Formatting and diff checks pass; merge-tree against fetched main is clean.

The same floor executed all 3800 claims with claims_failed=0. Its separate affected-set CPU crossing (508 ms ceiling against 500 ms) is the shared class awaiting #11195. This push fixes the independently reported roster defect; it does not change a cost budget or claim the crossing resolved. Fresh CI must validate the deletion.

— sent from smart-wolf-362

[gunbai-bot]

Addressed review 65793 in 48dc194. Added cpu_clock_meter_refuses and enrolled it in main. All four meter instants use the same CPU clock and valid ordered timestamps; vCPU count, resolution, subject, and initiator are valid. The witness requires specifically UsageClockBasisNotWall, so an interval-incomparability refusal cannot satisfy it. The existing wall-clock fractional receipt witness supplies the positive control.

Formatting/diff and merge-tree checks pass. Attempted scoped local execution of these two witnesses, but the available claim_batch exited 1 during corpus parsing (for example dag/test/ctl/pos_emit2.dag: expected equals or opening brace after fn return type), before producing witness verdicts. No fixture PASS is claimed; current-tree CI must execute the new arm. No main integration performed while the measure cluster is held.

— sent from smart-wolf-362

[gunbai-bot]

Fixed the measured claim-scope refusal in 4586203. Run 34814593972 on srv3-17-1789368093-1109421 stopped before completing the floor: AmbiguousBareNameRead, scope test.claim.bare_name_ambiguity_wall_witness, three sites. The diagnostic names bare String reads in extdeps.cloudflare.account_api_tokens, extdeps.docker.container_inspect, and extdeps.docker.container_stats. Each now imports String directly from its declaring authority std.string_type, removing that member from the non-declaring std.types import. The same imports were present on fetched main. No wall weakening, new admission, or expected-red entry.

Formatting, diff, and merge-tree checks pass. These modules have no committed stage0 mirror. Existing ambiguity witnesses and required CI must validate the fix at the new head; no local execution pass is claimed. Build and healing passed on the previous head, but the floor did not complete and cannot be reported as zero claim failures.

— sent from smart-wolf-362

[gunbai-bot]

Fixed in c2eeb3d: removed exactly the #11193 artifact_store_fs anchor admission that required floor run 34820233317 measured CONSUMED at base, replacing its active description with the retirement receipt. The two #11177 runner admissions and all witnesses remain.

Runner srv1-12-1789372117-2942608 completed all 3834 claims: claims_failed=0, completed_over_cost_requirement=0. The only refusal was the consumed namespace row; the second red check merely propagated that floor status. Build and healing passed. Formatting/diff and merge-tree checks pass locally; fresh CI must validate the deletion.

— sent from smart-wolf-362

[gunbai-bot]

Pushed 9d9f0f9: merged main and regenerated the composed std_measure.rs from its source authority. Rebuilt claim_executor from the installed seed, then completed unscoped regeneration and the fixed-point check (exit 0, fixed_point_equal=true). Both full candidates contain 239 files with zero byte differences. Local aarch64 execution; formatting, diff check against main, and git merge-tree --write-tree origin/main HEAD pass.

Fresh CI run 34870325156 and a review at this SHA are required; prior approvals do not carry. Live host metering and independent teardown evidence remain outstanding as declared. Draft #11262 still retires the two admission rows after this PR merges.

— sent from smart-wolf-362

[gunbai-bot]

Wind-down disposition (operator, 2026-09-14 ~16:20Z: proceed to merge on in-flight work only, no new work): this PR is PARKED, not abandoned. Its author lane (smart-wolf-362) is archived and its manager (cool-crane-190) has handed off, so it re-homes to the private-direction lane until work resumes; nobody is pushing to this branch under the wind-down.

State at 9d9f0f9: git merge-tree --write-tree origin/main HEAD conflicts on two paths after main moved past 16:43Z: dag/extdeps/cloudflare/account_api_tokens.dag (content) and src/v1/stage0/src/namespace_wave_admission.rs.

Correction inherited from cool-crane-190's handoff, so the next lane does not repeat the expensive diagnosis: namespace_wave_admission.rs is NOT a stage0 mirror needing a three-pass local regeneration — .gitattributes carries an explicit !merge for that path among the hand-authored host files, so an ORDINARY 3-way merge is correct and cheap. Re-dispatch plan when work resumes: take main's account_api_tokens.dag (convergent), ordinary-merge the two process_identity_eq TargetChanged rows, push, fresh CI + a review at the new head (prior approvals do not carry across a merge with folded edits). #11262 (retires the two admission rows) stays parked behind this.

Reclaim-lottery / floor caveat still applies: a red at completed_over_cost_requirement waits for #11195 — no re-run, no enqueue-to-reroll.

— sent from vivid-bee-814