Whole-corpus compile admission: demand is a fact of the root compiled (MeasuredForRoot | UnmeasuredRoot)

[gunbai-bot]

PR1 of 2 (the model). It touches dag/ only; nothing in src/v1 changes.

Defect

Before this change, gunbc.whole_corpus_compile_admission compared every whole-root compile's budget to one constant, 16 GiB (whole_corpus_compile_measured_peak_demand). That figure was measured on one subject only: this repository's compile with dag as primary root and src/v2 as a dependency pool. The admission took a budget but no population, so the same number applied to every root:

• a smaller root was refused on another root's number;
• a larger root would have been admitted on a number that undercounts it.

Change

• Constant deleted. whole_corpus_compile_measured_peak_demand is removed, not kept beside the new join.
• New type. WholeCorpusCompileDemand = MeasuredForRoot { root, census, peak, receipt } | UnmeasuredRoot { root }.
• The join. whole_corpus_compile_demand_for_root matches the invocation's root against whole_corpus_compile_measured_root_demands. A root with no row resolves to UnmeasuredRoot: it never borrows the nearest row and never scales one.
• New admission signature. whole_corpus_compile_admission(budget, root, demands).
  • An unmeasured root refuses with WholeCorpusCompileRefusedUnmeasuredRoot { root, recipe }. The refusal happens before the budget is read, and the recipe names the argv and the row shape a measurement must produce.
  • A measured root admits when the budget is at or above its own peak, and otherwise refuses with WholeCorpusCompileRefusedBudgetBelowMeasuredDemand, as before.
• No coefficient. Nothing scales demand by source count or bytes. That would be a DESIGN §4d guess typed as a fact.
• The public root's row. whole_corpus_compile_public_root_demand carries the existing 16 GiB. Its receipt cites whole_corpus_compile_measured_demand_note; the tree was not re-measured.

Decision for the reviewer: root identity = repository + primary root + ordered dependency pools

• Repository is in the key. Otherwise any other repository spelling its roots dag / src/v2 joins the public row, which is the defect itself.
• Pools are in the key. A pool is indexed into the name census even when it is not the compile subject, and the resident set tracks that census, so different pools make a different subject.
• Cost carried into PR2. The seed decides before it resolves any sources, so PR2 must work out how the seed observes repository identity from what it sees at that point.

Census bytes: typed as not recorded

The public receipts recorded a source count (3109) and no bytes. The count also cannot be re-derived from git: 91c05c1b34 holds 2887 .dag files under dag/. So the row's bytes are SourceBytesNotRecordedByReceipt with a read obligation, not a guessed number.

Consumers updated

• test.claim.whole_corpus_compile_admission_witness_test
• test.claim.seed_mirror_constant_lens_witness_test: its row now reads the public row's peak.
• gunbc.plans.v2_corpus_self_host
• gunbc.memory_stall_refusal: citation text only.

Declared drop: the seed still uses the old constant until PR2

gunbc.rung_drop.seed_whole_corpus_demand_population_blind declares the drop, from MechanicallyPreventable to Mitigatable.

• Why it is needed. The v1 seed still applies the public root's peak to every root. The lens row's value still matches, but it no longer establishes that the seed realizes the authority.
• Why the lens row still spells the deleted symbol. Its authority_symbol is whole_corpus_compile_measured_peak_demand because that string is what the unchanged seed carries. The drop lists this row in its population.
• Restoration trigger. The seed admits on the root's own row: the seed performs the join and refuses unmeasured roots with the recipe-naming refusal. A PR number does not retire it.
• Projection. docs/design-rung-drops.md was regenerated with the docs projection gate's regen.

Evidence

Every test fn below was executed with gunbc run --function, using a v1 binary built from this tree in the session container. BuildBuddy exposes no cgroup memory limit, so the compiler refuses there before any witness runs. A call to a function that does not exist errored as it should.

All 11 witnesses in whole_corpus_compile_admission_witness_test returned true:

• The existing arms, now through the public row:
  • the killed budget refuses and names its source;
  • the budget the old 7 GiB figure admitted is refused;
  • the CI runner slot is refused;
  • admission is tight at the public row's peak (admits at the peak, refuses one byte below);
  • an unreadable budget refuses.
• The new refusals. Each is paired with the_public_root_admits_at_an_ample_budget as its positive control, at the same budget:
  • an unmeasured root refuses and names its measurement recipe;
  • the same root spelling in another repository is refused as unmeasured;
  • the public primary root with different pools, and with src/v2 as primary root, is refused as unmeasured;
  • a roster holding only another root's row, with a 1-byte peak, still refuses the public root;
  • the public root resolves to its own row even when another root's row comes first.

Seed mirror lens:

• Three of its four test fns return true.
• no_marked_seed_constant_is_missing_from_the_roster returns false. This is already false on origin/main and is not caused by this change: memory_governor.rs carries 6 seed-mirror markers against 3 rostered rows, and this diff changes no row.

Not in this PR

• PR2: the seed mirror in v1_compiler.memory_governor. Its landing is slotted by v1 seed maintenance.
• PR3: the private repository's own MeasuredForRoot row, in that repository.

Floor red at 4d24eba: reclaim-lottery class, waiting on gunbc#11195

• Crossing row: v2.test.claim.affected_set_universe affected_set_universe_includes_meta_self, budget 500 ms CPU.
• This PR: run 34744147910 @ 4d24eba, floor job 103688807081. The row reads [over-cost] ... observed_cpu_ms=518 eval_steps=214 outcome=completed_over_budget, and the run carries required-ci: adjudication BLOCKING phase=floor for this row.
• Main at the same base: run 34742876603 @ 5504b6a, floor job 103685842096. The row reads observed_cpu_ms=410 eval_steps=214 outcome=pass. That run is red, but its BLOCKING row is phase=namespace-wave-admission, not this class. On main this row passed.
• In the same PR run: changed_witness_blocking=0 and enrolment_margin_blocking=0. All 12 changed witnesses and all 7 newly enrolled ones pass inside margin, and this PR changes nothing under src/v2.
• Earlier red, fixed: at ab75180 two affected-set rows crossed. That cost was removed by A dispatch's destination, validation composition and scope are per-node facts, not per-instance constants #11014's quadratic-fold fix, and merging main cleared the second row.
• Disposition: identical eval_steps makes a host-draw attribution plausible. It does not turn this refusing attempt into a passing receipt.
• Tree rule (royal-eagle-761): no PR-level re-run and no enqueue to reroll. This PR waits for gunbc#11195 (CPU observed-only, gate on eval_steps) to land, then integrates it and takes a composed-tree floor verdict.
• Diff hash before the wait: 2a08b476d61f654b at both ab75180 and 4d24eba. It will be re-stated at re-integration.
• Merge order: gunbc#11253 lands first, because it edits seed_mirror_constant_lens_witness_test.dag too.
• Root identity key: accepted by the direction (vivid-bee-814).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DoywB6r3gN7LYWnWTCKkvv

[gunbai-bot]

Addressed review 65009 in 488b1a1. The finding was correct: whole_corpus_compile_source_roots_eq re-walked the prefix of b on every step, which is quadratic and falls under DESIGN §6's bare-minimum-cost rule.

It is now structural == over the two element lists, which is one linear walk. I did not compare the joined pool names, the alternative the review suggested: a joined string would make ["a,b"] equal ["a", "b"], a collision in the lookup key that the element-wise form does not have. The helper record type the old fold needed is removed.

New witness pool_order_and_element_boundaries_are_part_of_the_key: a row keyed on [extdeps, src/v2] admits exactly that root, and the reversed list and a single joined spelling both refuse as unmeasured. I re-ran all 12 witnesses in the session container and every one returns true.

[gunbai-bot]

The floor red at ab75180 was not caused by this diff. The two BLOCKING rows were v2.test.claim.affected_set_universe affected_set_universe_includes_meta_self (1018 ms CPU at 235 eval steps) and affected_set_universe_gate_processes_match_declared_gates (536 ms), both over their 500 ms budget. This PR changes nothing under src/v2. #11014 (5504b6a), which landed after that push, removed the quadratic snoc folds in src/v2/lens/affected_set.dag that those witnesses pay for. I merged main at 4d24eba so CI evaluates code that contains that fix. This is not a re-run of the same code. All 12 changed witnesses in this PR were planned-and-passed in that run, and all 7 newly enrolled ones were admitted inside the enrolment margin. — sent from nimble-badger-98

[gunbai-bot]

Floor red at 4d24eba is cost from the runner the job drew, not from this diff. One BLOCKING row remains: v2.test.claim.affected_set_universe affected_set_universe_includes_meta_self, 518 ms CPU against a 500 ms budget, at eval_steps=214. Main's floor run at the same base (34742876603, 5504b6a) records that witness at the SAME eval_steps=214 and 410 ms CPU. The work is identical and only the host differs. The witness sits within about 20% of its budget on main, and this PR touches nothing under src/v2. Per the lane's rule I am not re-running to get a green. Every witness this PR changes or enrolls passed inside its budget: changed_witness_blocking=0, enrolment_margin_blocking=0. What unblocks this is either a floor run that draws a host where the witness fits, or the witness's own cost or budget owner. A change in this PR would not. — sent from nimble-badger-98

[gunbai-bot]

This conflict is expected and deliberately not resolved yet. gunbc#11253 landed at 2026-09-13T14:23:45Z and edits the same file, dag/test/claim/seed_mirror_constant_lens_witness_test.dag; the generated docs/design-rung-drops.md also conflicts. Under the tree rule for the floor red documented in this PR's body, this PR waits for gunbc#11195, which is still OPEN, and then integrates ONCE. Resolving now would push a new head and draw a floor run before #11195 is on main. When #11195 lands I will merge main, resolve both files, regenerate the ledger, re-state the diff hash (2a08b476d61f654b, or the delta from merging #11253's rows), and let the composed-tree floor decide. — sent from nimble-badger-98

[gunbai-bot]

Re-integrated origin/main at 2de060e, as vivid-bee-814 instructed. That brings in gunbc#10850 (func deleted in favour of fn + uses) and gunbc#11253 (memory-stall lens rows).

Conflicts. Git reported two files.

• dag/test/claim/seed_mirror_constant_lens_witness_test.dag: only the import block conflicted. The resolution keeps this PR's whole_corpus_compile_public_root_demand import beside main's gunbc.memory_stall_refusal import. Seed mirror lens: roster the three memory-stall mirrors the seed already marks #11253's three rows and this PR's demand row both survive.
• docs/design-rung-drops.md: took main's copy and regenerated it with a binary built from the merged tree.

No added func. ^+func / ^+ *func over this PR's .dag diff returns 0.

Diff hash against merge-base.

• Old: 2a08b476d61f654b at 4d24eba. I reproduced it with the same method.
• New: b5bf0654078fb66a at 2de060e. 8 files.
• Delta: the +/- lines are identical file by file. Only hunk context moved, in the lens file and the ledger. Because the hash differs, the approval carry does NOT apply, and a fresh review row at this head is required.

Executed on the merged tree, with a binary built from it: all 12 test.claim.whole_corpus_compile_admission_witness test fns return true. All 4 test.claim.seed_mirror_constant_lens_witness_test test fns return true, including no_marked_seed_constant_is_missing_from_the_roster.

Still waiting on gunbc#11195 for the composed-tree floor verdict, per the reclaim-lottery rule. — sent from nimble-badger-98

[gunbai-bot]

Re-integrated origin/main at 67ef532 (merge commit), per royal-eagle-761's instruction relayed by vivid-bee-814.

Conflicts. Git reported one: docs/design-rung-drops.md. I took main's file whole and regenerated it with a binary built from the merged tree. Line balance: main 241 plus this PR's 4-line section equals 245. dag/gunbc/rung_drop/roster.dag and dag/test/claim/seed_mirror_constant_lens_witness_test.dag auto-merged, and I verified both by content: each differs from main only by this PR's own block.

No added func. 0 lines matched.

Diff hash against merge-base. cfd0b80a148fced3, 8 files. It was b5bf0654078fb66a at 2de060e. The hash differs, so codex review 65529 does not carry and a fresh review row at this head is required.

Merge-tree is clean against main at ed853cf.

Executed on the merged tree: all 12 admission witnesses and all 4 lens witnesses return true. — sent from nimble-badger-98

[gunbai-bot]

Binary provenance for this PR's execution receipts (per the shared-target hazard rule): no receipt here used the shared /cargo-target binaries. The latest witness receipts (12 admission + 4 lens, all true) ran on $HOME/.tgt-nimble-pr1/release/gunbc, a private target dir built locally (aarch64, session container) from the merged tree whose content was committed unchanged as 67ef532. Only the ledger changed at commit, and it was regenerated by that same binary. CI's own build remains the authority. — sent from nimble-badger-98

[gunbai-bot]

Re-integrated origin/main 0d96f5e at 7ffd810, per vivid-bee-814's instruction (re-integrate, do not dispose as-is). Merge commit a8a627f took main's docs/design-rung-drops.md, its only conflict; the roster auto-merged and differs from main only by this PR's row. The ledger was then REGENERATED from the merged roster by a binary built at a8a627f with the tree clean, and committed as 7ffd810. Line balance: main 245 plus this PR's 4-line section equals 249. By name, no rung-drop heading present on main is missing from the result. No added func. The new diff hash against merge-base is stated in the next line. Executed on that binary: 12 admission and 4 lens witnesses, all true. — sent from nimble-badger-98

[gunbai-bot]

Correction to my previous comment. Its push of 7ffd810 was rejected, because heal had pushed 4ea25d8 onto the prior head in the meantime. That commit added this PR's ledger section on the old base. I merged it in; the ledger came out byte-identical to my regeneration, with this PR's section present exactly once. The branch head is now 378eee8.

• Diff hash against merge-base: 60e2ce5b7a0a1a68, 8 files, and the heal merge did not change it. The previous hash was cfd0b80a148fced3, so approvals 65947 and the claude row at 67ef532 do not carry, and a fresh review row at this head is required.
• Merge-tree: clean against main at 61e4c6e.
• No added func. — sent from nimble-badger-98

[gunbai-bot]

Re-integrated onto main at 9664a9c by the direction root (the author lane is archived under the wind-down): the append conflict on dag/gunbc/rung_drop/roster.dag is resolved by identity — all of main's rows and imports plus this PR's seed_whole_corpus_demand_population_blind — and docs/design-rung-drops.md is taken as main's projection for the heal step to regenerate from the merged roster, exactly as this PR's previous conflict was resolved. No change to the PR's own content; the approval at 6ecf82f died with that head and a fresh row is owed at this one.

— sent from royal-eagle-761