Whole-corpus compile admission: demand is a fact of the root compiled (MeasuredForRoot | UnmeasuredRoot)

dag/gunbc/host/memory_stall_refusal.dag

@@ -20,7 +20,7 @@ data memory_stall_refusal_authority_disposition: Disposition = Terminal {
   reason: "Single authority for the STALL half of the memory governor: the decision that a resolve which is thrashing -- spending its wall time refaulting its own evicted pages rather than computing -- must stop the line with a typed refusal instead of holding indefinitely. The budget half (what bound to admit against) is gunbc.host_budget_source; the capacity half (how many typed modules the cache may hold) is gunbc.typed_module_cache_capacity; this module owns what happens when both of those were satisfied and the run still cannot make progress, which is the state neither of them can see: the budget was readable and admitted, the cap was derived and enforced, and the machine underneath cannot actually deliver the budget the operator declared."
 }
 
-data memory_stall_observed_receipt_note: String = "THE MEASURED STALL THIS MODULE REFUSES, so the thresholds below face a real specimen rather than a thought experiment. 2026-08-30, default BuildBuddy remote-execution VM (7276 MiB total, 6 CPUs, swap 0, no procfs PSI, no cgroup memory controller files at any depth), GUNBC_MEMORY_BUDGET_BYTES=7000000000: four whole-closure gunbc runs (invocations 0cf5e9cb-f09e-47b6-a953-9bb4528ea9ec, e11bc9bf-61a8-432f-b596-e1d74efc5b55, ecd54e06-8b02-48c6-9f63-95e912c9edff, 33d93219-793c-40fe-a2c1-84f64d0fb743, measured by session loyal-raven-297) ran 2 to 4.5 hours without completing and without printing a further line, while the same census completes in about 10 minutes on a 20 GB runner. The budget was READABLE (env override) and ADMITTED; the machine simply cannot hold the working set beside its own page cache, and with swap disabled the kernel's only recourse is evicting file-backed pages -- including the binary's own text -- which the process immediately refaults. Wall time is consumed by disk reads the process never asked for; memory.current never crosses a kill line; no signal any existing arm reads ever fires. The run is not slow, it is a treadmill.\n\nWHY NO EXISTING ARM COVERS IT. gunbc.host_budget_source refuses an UNREADABLE budget -- this budget was readable. gunbc.whole_corpus_compile_admission refuses a whole-root subject below measured demand -- these were Entry subjects, deliberately outside that arm (whole_corpus_compile_measured_peak_demand's annotation reserves the gap). gunbc.typed_module_cache_capacity bounds the typed cache -- the thrash is at PAGE grain underneath the allocator, invisible to entry counts. And the deleted AIMD controller's PSI arm could not run here even if it survived: the VM synthesizes no /proc/pressure files at all (measured, same day)."
+data memory_stall_observed_receipt_note: String = "THE MEASURED STALL THIS MODULE REFUSES, so the thresholds below face a real specimen rather than a thought experiment. 2026-08-30, default BuildBuddy remote-execution VM (7276 MiB total, 6 CPUs, swap 0, no procfs PSI, no cgroup memory controller files at any depth), GUNBC_MEMORY_BUDGET_BYTES=7000000000: four whole-closure gunbc runs (invocations 0cf5e9cb-f09e-47b6-a953-9bb4528ea9ec, e11bc9bf-61a8-432f-b596-e1d74efc5b55, ecd54e06-8b02-48c6-9f63-95e912c9edff, 33d93219-793c-40fe-a2c1-84f64d0fb743, measured by session loyal-raven-297) ran 2 to 4.5 hours without completing and without printing a further line, while the same census completes in about 10 minutes on a 20 GB runner. The budget was READABLE (env override) and ADMITTED; the machine simply cannot hold the working set beside its own page cache, and with swap disabled the kernel's only recourse is evicting file-backed pages -- including the binary's own text -- which the process immediately refaults. Wall time is consumed by disk reads the process never asked for; memory.current never crosses a kill line; no signal any existing arm reads ever fires. The run is not slow, it is a treadmill.\n\nWHY NO EXISTING ARM COVERS IT. gunbc.host_budget_source refuses an UNREADABLE budget -- this budget was readable. gunbc.whole_corpus_compile_admission refuses a whole-root subject below measured demand -- these were Entry subjects, deliberately outside that arm (the scoped-compile placement annotation in that module reserves the gap). gunbc.typed_module_cache_capacity bounds the typed cache -- the thrash is at PAGE grain underneath the allocator, invisible to entry counts. And the deleted AIMD controller's PSI arm could not run here even if it survived: the VM synthesizes no /proc/pressure files at all (measured, same day)."
 
 data memory_stall_declared_budget_kill_receipt_note: String = "THE SIBLING SPECIMEN OF THE ONE ABOVE, ON THE SAME RUNNER CLASS AND THE SAME RESERVED GAP, FAILING THE OTHER WAY. The treadmill receipt records a TRUTHFUL declaration (7000000000 on a 7276 MiB VM) producing four runs that never completed. This one records an OVERSTATED declaration on the same class of machine producing the opposite ending, and the pair is what shows there is no good value rather than merely a badly chosen one.\n\n2026-09-01, session vivid-deer-102, default BuildBuddy remote-execution runner (no cgroup memory.high or memory.max at any depth, so gunbc.host_budget_source answers Unreadable and the run refuses immediately and typed). The refusal was bypassed with GUNBC_MEMORY_BUDGET_BYTES=25000000000 -- roughly five times what that runner class holds -- which takes the DeclaredUnverified arm. Entry subject src/v2/compiler/00_compile.dag driven through tools.emission_entry_instrument measure, invocations b6fb4af7-1268-468f-ba0a-5ea9ec42314f and e7da3bd4-a99d-4b03-9c95-a1ff729366f2. The second reported exit 137 after about twenty minutes; the first stopped at the same step, gunbc.WitnessBin.Run. SIGKILL, no diagnostic, no measurement. The cache cap printed by the degraded_budget_source line was 4000, the clamp ceiling, because it is derived from the declared bytes and the declaration was false.\n\nWHY THE PAIR MATTERS MORE THAN EITHER READING. A reader holding only the treadmill receipt concludes the operator declared too little; a reader holding only this one concludes they declared too much. Together they bound the honest range from both sides on a machine of that size, and the range is empty for a whole-closure entry subject: a truthful budget thrashes and an admitting budget is killed. So the remedy is a runner that exposes a real cgroup limit -- at which point no declaration is involved, this module is not reached, and the host_budget_source refusal never fires -- and never a better number for the variable.\n\nWHAT THIS IS NOT. It is not a defect against the DeclaredUnverified arm, which is typed, graded degraded, and announced on stderr, and which the whole-root path maps to a refusal. It is the measured cost of the ENTRY-subject reservation that gunbc.whole_corpus_compile_admission holds deliberately and that the receipt above already names: on that path the declaration is never compared against an observable, because on a runner with no cgroup there is nothing to compare it against, and the only remaining behaviour when it is false is to be killed.\n\nAND THE AUTHORING LESSON, which is the part that cost two sessions rather than one: the arm that was bypassed names this exact exit code in its own refusal text, citing the BuildBuddy receipt of 2026-08-30. Declaring a budget to get past it is the workaround DESIGN section 5 names -- the line-stop signal is noticing you are routing around a refusal you do not understand -- and it converted an immediate typed answer into a twenty-minute SIGKILL carrying none."
 

dag/gunbc/plans/v2_corpus_self_host.dag

@@ -51,7 +51,7 @@ fn section_2() -> List<MarkdownBlock> {
 fn section_3() -> List<MarkdownBlock> {
   [
     h2(text: "3. Hosting — settled, and previously mis-stated"),
-    p(text: "The whole-corpus compile requires **13 GiB**, from `gunbc.whole_corpus_compile_admission` `whole_corpus_compile_measured_peak_demand` — a measured peak of 12.41 GiB rounded up to whole-gibibyte grain in the fail-closed direction."),
+    p(text: "A whole-corpus compile's demand is a fact of the ROOT compiled, not of the compiler: `gunbc.whole_corpus_compile_admission` `whole_corpus_compile_demand_for_root` joins the invocation's repository, primary root and ordered dependency pools to a measured row, and a root with no row is refused with its measurement recipe. The figure for this repository's dag-primary compile is the row `whole_corpus_compile_public_root_demand`, read there rather than restated here; the 12.41 GiB and 7 GiB readings below are history that row's receipt supersedes."),
     p(text: "**This section said ~7 GiB until 2026-08-28 and that figure was a live fail-open, not merely stale.** It was a PROXY taken on the floor route at an older tree, 43.6% below the real peak — 7 GiB against 12.41 GiB — so the admission arm admitted hosts the instrument would then be SIGKILLed on. The authority's own re-measure trigger — a dated uncensored whole-tree peak taken on the compile route itself — fired: whole-corpus `--target dag` peaked at 13008052 kB and `--target rust` at 13005964 kB, both EXIT=1 (completed and refused on diagnostics, not killed) on an unthrottled srv1, with the binary BUILT FROM the sha being compiled. A reader planning capacity against the old number would have provisioned a host that dies."),
     TableBlock {
       header: row(cells: [cell(text: "host"), cell(text: "admits?"), cell(text: "basis")]),

dag/gunbc/rung_drop/roster.dag

@@ -71,6 +71,7 @@ import gunbc.rung_drop.heal_healed_head_executed_verdict_without_human { heal_he
 import gunbc.rung_drop.runner_host_file_apply_route_hermetic { runner_host_file_apply_route_hermetic }
 import gunbc.rung_drop.floor_cost_cpu_regression_at_constant_eval_steps { floor_cost_cpu_regression_at_constant_eval_steps }
 import gunbc.rung_drop.accumulator_copy_positive_controls_off_every_lane { accumulator_copy_positive_controls_off_every_lane }
+import gunbc.rung_drop.seed_whole_corpus_demand_population_blind { seed_whole_corpus_demand_population_blind }
 
 data rung_drop_roster: List<RungDrop> = [
   floor_cut_heal,
@@ -125,6 +126,7 @@ data rung_drop_roster: List<RungDrop> = [
   runner_host_file_apply_route_hermetic,
   floor_cost_cpu_regression_at_constant_eval_steps,
   accumulator_copy_positive_controls_off_every_lane,
+  seed_whole_corpus_demand_population_blind,
 ]
 
 // THE DERIVATION THE PROJECTION USES, so "standing today" has one authority and not two. The

dag/gunbc/rung_drop/seed_whole_corpus_demand_population_blind.dag

@@ -0,0 +1,51 @@
+module gunbc.rung_drop.seed_whole_corpus_demand_population_blind
+
+import std.types { List, NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+
+// DECLARED 2026-09-13 (session nimble-badger-98, direction vivid-bee-814 / fierce-lark-661). The
+// .dag authority gunbc.whole_corpus_compile_admission now keys demand on the root compiled --
+// WholeCorpusCompileDemand = MeasuredForRoot | UnmeasuredRoot, joined on repository, primary root and
+// ordered dependency pools -- and an unmeasured root refuses with its measurement recipe. The v1
+// seed, which is the only route that executes the admission before a compile, still realizes the
+// deleted population-blind constant: v1_compiler.memory_governor
+// DECLARED_WHOLE_CORPUS_COMPILE_MEASURED_DEMAND_BYTES and whole_corpus_compile_admission compare
+// every whole-root compile's budget to the public root's peak.
+//
+// WHAT IS LOST ON THE SEED-MIRROR PATH. test.claim.seed_mirror_constant_lens_witness_test still
+// joins that constant's VALUE to the public root's row, and that equality still holds; what it no
+// longer establishes is that the seed realizes the authority, because the authority is now a join
+// the seed does not perform. So the seed ADMITS a root with no row (another repository, another
+// pool set) whose budget clears the public peak, and REFUSES a smaller root on the public root's
+// number -- both directions of the defect the model closed, still live at execution. The seed's
+// refusal stays typed and located, so the path sits at mitigation, not below the ladder.
+//
+// WHY A DROP AND NOT A SAME-PR FIX: the model and the seed mirror land separately because any
+// src/v1 landing stales every closure receipt taken before it, and the seed's landing is slotted by
+// v1 seed maintenance between receipt re-takes.
+
+data seed_whole_corpus_demand_population_blind_population: List<String> = [
+  "v1_compiler.memory_governor whole_corpus_compile_admission — every whole-root (PrimaryRoot) compile admitted or refused by v1_compiler.cli_run compile_emission",
+  "test.claim.seed_mirror_constant_lens_witness_test seed_mirror_constant_rows — the DECLARED_WHOLE_CORPUS_COMPILE_MEASURED_DEMAND_BYTES row, whose authority_symbol still spells the deleted whole_corpus_compile_measured_peak_demand",
+]
+
+data seed_whole_corpus_demand_population_blind: RungDrop = RungDrop {
+  identity: "seed_whole_corpus_demand_population_blind" as NonEmptyStr,
+
+  subject: "The v1 seed's whole-corpus compile admission as a realization of gunbc.whole_corpus_compile_admission's per-root demand join",
+
+  declared: "2026-09-13",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "the seed mirror of the per-root join in v1_compiler.memory_governor, with the lens row pinning the public root's MeasuredForRoot row rather than the retired bare constant",
+    },
+    population: seed_whole_corpus_demand_population_blind_population,
+    restoration_trigger: "THE SEED ADMITS ON THE ROOT'S OWN ROW: for every whole-root compile v1_compiler.cli_run compile_emission resolves the invocation's root identity (repository, primary root, ordered dependency pools) against the seed mirror of whole_corpus_compile_measured_root_demands, refuses a root with no MeasuredForRoot row with the recipe-naming UnmeasuredRoot refusal before indexing, and compares the budget only to that root's own peak -- executed by a discriminating red (an unmeasured root refused at a budget above the public peak) beside the positive control (the public root admitted at its peak and refused one byte below), and the seed-mirror lens joins the seed's row to whole_corpus_compile_public_root_demand by its current symbol. A seed change that renames the constant, or mirrors a row without performing the join, does not satisfy it",
+  }
+}