M1.c L5a: per-user store policy (XDG cache home, 2 GiB ceiling, UserCacheRoot, one ceiling-typed store construction)

[briansrls]

M1.c compiled acquisition bridge, unit L5a: the store policy the local per-user compiler store needs, declared ahead of its consumers.

• Spec: M1.c compiled acquisition bridge: exact seed closure, emitter repairs, scoped exception (pre-merge-review spec, rev 3) #12581 (revision 3, published before merge review as the operator's 2026-09-28 ruling requires).
• Operator rulings of 2026-09-29 (M1.c compiled acquisition bridge: exact seed closure, emitter repairs, scoped exception (pre-merge-review spec, rev 3) #12581 comment): the 2 GiB initial per-user policy is accepted. No persistent compiler hit is served before U3-B, and this unit serves nothing.
• Independence: L5a touches no file Integrate the demand engine into the production native driver #12401 edits (gh pr diff 12401 --name-only against this diff: 0 shared files).

What lands

• extdeps.freedesktop.xdg_base_directory (new) is the cited authority for the per-user cache home. It follows the XDG Base Directory Specification 0.8:
  • An absolute XDG_CACHE_HOME wins.
  • A relative or empty one is ignored, and the result names that.
  • The fallback is $HOME/.cache.
  • An unset, empty or relative HOME refuses with its own cause. There is no substitute directory.
  • XdgCacheHome is sole_constructor.
• gunbc.materialization_store_capacity (new) is the one home of the store byte ceiling. UserCacheRoot gets 2 GiB, measured in apparent file bytes (manifest plus blobs). DurableHostVolumeRoot answers StoreCeilingUndeclared, because no size has been decided for the unattached fleet volume and borrowing 2 GiB would be fabricated policy.
• std.materialization_store_grant:
  • adds UserCacheRoot { cache_home: XdgCacheHome }, rooted at <cache home>/gunbc/materialization-store;
  • gives WitnessScratchRoot a fixture ceiling;
  • rewrites the module's durability invariant. The §3b divergence (the durability of a root derived from the environment) is stated and executed by durability_is_the_arm_s_not_the_path_s, and rests on object-level preimage verification.
• std.artifact_store:
  • artifact_store_for_ceiling(StoreCeiling) is the one construction of a store from a ceiling. It never takes a raw ByteSize.
  • store_over_provider_resolved is the provider door: every existing provider check, then that same construction.
  • artifact_store_with_occupancy seeds held rows in recency order, with no per-row replay.
  • The commit order L5b will use: the opened root's ceiling, then artifact_store_for_ceiling, then artifact_store_with_occupancy, then one store_put.

Declared frontier (DESIGN §3c)

Every new declaration has a witness consumer now. Its production consumers land later, and each declaration's leading comment names its trigger:

• artifact_store_for_ceiling, artifact_store_with_occupancy and materialization_store_byte_ceiling: L5b, which is local_store_commit, the catalog retention and first-use initialization.
• xdg_cache_home and UserCacheRoot: L8, where the route root opens the store.

The catalog-row witness the_store_catalog_row_admits_exactly_the_ceiling_store lands with the catalog's retention in L5b. Declaring that retention now would claim a ceiling and eviction that nothing applies yet (§4d).

Controls

All runs used claim_batch --hermetic built at this head. Results are recorded on the merged head below.

control	result
xdg_base_directory_witness	7/7
materialization_store_capacity_witness	3/3
materialization_store_grant_witness	4/4
artifact_store_witness, in full	31/31
materialization_store_witness	28/29. The one FAIL, a_tampered_part_size_is_an_integrity_refusal, fails identically on clean main
wet materialization_store_local_wet_witness (--wet)	8/8, with no /tmp residue
mutation reds: 25 rounds in total, each with its predicted red set written down before the run	every round red on exactly the predicted witnesses and nothing else. Covered: XDG rules; the ceiling value and unit; durability; forking the construction (the door minting its own store); the door skipping each check (release policy, LRU-only, authority, unit); constant sizing; seeding (ordinals, dropped rows, re-sizing, reversal, per-row replay)
entry-route unimported-bare-provider judgment on every touched module and each file whose roster row was retired	0 refusals. Red control: a planted bare filter refuses UnimportedBareProvider Unrostered ...xdg_base_directory.dag#filter

Known limit. A second construction that is identical in value cannot be detected by a value-level witness. Any fork that diverges goes red on the_resolved_door_answers_the_one_ceiling_construction.

Roster retirements

19 rows in src/v2/workflow/floor_unimported_bare_provider_debt_roster.dag move from ActiveDebt to Retired { cause: ImportsFixed }.

• Cause: the new import std.artifact_store → gunbc.materialization_store_capacity (for StoreCeiling) brings v2.std.algebra into those files' closures through std.effect_grant.
• Evidence: each retirement is what the entry-route judgment printed.
• Consequence: a later change that removes that edge must add explicit imports in those 11 files. That includes L1, which drops std.effect_grant's v2.std.algebra import, and L4's std.artifact_store_provider carve. The floor refuses loudly if that is missed.

Receipts

These are carried here rather than in the upstream module (DESIGN §3, External upstream decomposition; §4c):

• XDG page, read 2026-09-29. https://specifications.freedesktop.org/basedir/0.8/ answered HTTP 200, and the older spelling basedir-spec/0.8/ answers 301 to it. Rules read from it:

  • $XDG_CACHE_HOME and the $HOME/.cache default, under "3 Environment variables";
  • the absolute-path rule, under "2 Basics";
  • the 0700 rule, under "4 Referencing this specification".

  Version 0.8, published 08 May 2021.

• No prior XDG authority. Before this change, git grep XDG_CACHE_HOME -- '*.dag' matched only prose.

• Source of the 2 GiB policy. The per-compiler executable size behind it is M1.c compiled acquisition bridge: exact seed closure, emitter repairs, scoped exception (pre-merge-review spec, rev 3) #12581's U0 measurement. Its re-deriving instrument is the census line each L5b commit prints (entries, bytes, ceiling, evicted).

Stated departures from the spec text

• materialization_store_byte_ceiling returns StoreCeilingResolution, with StoreCeilingUndeclared for DurableHostVolumeRoot, as above.
• The unit is carried in the field name StoreCeiling.apparent_file_bytes rather than as a separate unit type, because the v1 seed reads a single-variant coproduct as a type alias.
• XDG's 0700 creation rule lands with its only consumer, L5b's first-use initialization.
• The version is held once, as the anchor's literal locator. A locator computed from a version row would project refused on the corpus anchor wall.
• The spec's artifact_store_from_occupancy(ceiling) became the commit order above. M1.c compiled acquisition bridge: exact seed closure, emitter repairs, scoped exception (pre-merge-review spec, rev 3) #12581 §7.2 and §8 will be updated to match.

Pre-existing reds in this closure, none caused by this change

• materialization_store_witness a_tampered_part_size_is_an_integrity_refusal.
• external_model_scope_witness carriers_declare_scope_on_disk and frontier_rosters_are_disjoint, and the scope placement gate's freeze arm. All three come from dag/extdeps/bmc/ipmi_boot_selection.dag being both a scope carrier and a frozen-manifest row.
• corpus_live_clean_tree_wall_holds, which is already expected-red.

Obligations recorded for later units

• L5b: a UserCacheRoot with XDG_CACHE_HOME=/var/lib has the same store path as the fleet root, so one directory would carry two ceilings. The fix is either to put the root arm in the store marker, or to refuse a user root that equals or nests the fleet root.
• After L3: consolidate the four directory-child joins into one, in extdeps.filesystem.
• L8: confirm that the frozen v1 emitter renders these modules once they are stage0 mirrors.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T05:25:52.777950Z	968b4db	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.