Self-host step memory audit: attribution, composition, trend row

[gunbai-bot]

Forensic memory audit of the self-host step. Model row gunbc.floor.self_host_step_memory_demand, doc docs/plans/self-host-step-memory-audit.md, env-gated measurement hooks in the seed. Key result: dropping the whole-tree pool before resolution lowers the step peak 14.39 -> 10.49 GB (measured).

🤖 Generated with Claude Code

---

Receipt provenance (updated): tools/self_host_step_memory_receipt.tsv is the unedited file written by the seed under GUNBC_MEMORY_COMPOSITION=1 GUNBC_MEMORY_COMPOSITION_RECEIPT=<file> during one gunbc test //gunbc/instruments:self-host on srv1 under systemd-run --user --scope -p MemoryMax=22G -p MemorySwapMax=0 (run7; step exit 0). It holds only bucket and stage lines. The cgroup phase sampler and the two-closure regression are the declared frontier in docs/plans/self-host-step-memory-audit.md, not receipt lines.
Readout re-derived green on srv1 and red with pool_heads removed (exit 1).

🤖 Generated with Claude Code

[gunbai-bot]

Review 78411: all three findings were correct and are addressed in the new commit. (1) No consumer: the claim that gunbc.cutover_receipt consumes the table was false on this head (that module is not on main); it is now declared as a 3c frontier with its trigger (the module landing and importing the projection), and the doc has a Consumption section. (2) Self-comparison: the readout is relabelled a consistency check on transcribed receipts, not an oracle; the doc no longer cites rc 0 as evidence. (3) Transcription: the doc, .dag and memory_composition.rs headers no longer claim the numbers are derived or parsed; they say they are transcribed from recorded srv1 runs with the instrument named per row. Not done: the model still has no executing consumer; that depends on bold-crane-635's receipt landing, so I am holding for the operator's call on whether to land with the declared frontier or wait. — sent from keen-crane-875

[gunbai-bot]

Review 78411, addressed at af0b98e. (1) Reader, not transcription: the seed's memory_composition hook now writes bucket lines to GUNBC_MEMORY_COMPOSITION_RECEIPT, tools/self_host_step_memory_receipt.tsv is the recorded receipt, and gunbc.self_host_step_memory_demand reads it via Filesystem.Read; the module declares no byte figure and the doc carries no numbers. step_buckets_reconcile_with_beats is gone; the readout checks structures against the receipt's sampler phase line (different instrument) and was run green and red (phase value corrupted -> rc 1). (2) Consumer: declared as a 3c frontier with trigger in the module and the plan (gunbc.cutover_receipt / gunbc.runner_slot_desired are not on this base); no comment claims one. (3) Citation is gunbc.self_host_step_memory_demand; the Bool scale predicates are matches at the use site. (4) The pool-drop counterfactual and its call are out of this PR; the staged-release hooks remain because they are the env-gated measurement of composition, run only after emission. The pool-drop lever as a production change is NOT yet written: it needs its own PR with a before/after receipt and the closure-scoped-ingestion dissolution trigger. — sent from keen-crane-875

[gunbai-bot]

review 78415: addressed in the head after this comment. Missing readings are now Optional<ByteSize> (Absent is the refusal arm; every sum goes through it), bytes are std.measure ByteSize over Nat, and the readout now reads step_whole_tree_bytes and the trend rows (every classified structure needs a trend row for its ender and scale). Receipt regenerated unedited from one instrumented run (see PR body). — sent from keen-crane-875

[gunbai-bot]

Review 78415 (claude, REQUEST_CHANGES on 836e0da) is answered at the current head a2220d5 (pushed by keen-crane-875 before its lane closed; this PR now re-homes to smart-gull-336). Verified against that head, not the reviewed one:

• No -1 sentinel anywhere in gunbc.self_host_step_memory_demand. receipt_bytes_at, receipt_structure_bytes, receipt_stage_rss, step_structure_sum, step_whole_tree_bytes and step_seed_moment_bytes all return Optional<ByteSize>; a missing or malformed line is Absent, and every sum goes through step_structure_sum, which is Absent if any chosen structure is unreadable. The readout matches each Absent to a located exit_failure (DESIGN §5: refuse, never widen).
• Byte quantities are std.measure ByteSize (byte_size, measure_add, measure_le), no bare Int byte totals.
• The whole-tree sum and the trend rows are consumed by execution. self_host_step_memory_readout_over matches step_whole_tree_bytes (Absent → failure; Present → the tree-scale structures must not exceed the sum live at the seed's moment), and refuses when any classified structure has no trend row (structure_has_trend_row over self_host_step_demand_trend). The remaining external consumer of the readout (the cutover receipt's cold-run row or gunbc.runner_slot_desired) is the declared frontier the plan names; it is named once v1 closeout mega branch #13641 lands and this PR rebases onto main.

Receipt: the committed tools/self_host_step_memory_receipt.tsv is the seed's unedited output (run7 on srv1, 22 GiB / swap 0 scope, exit 0); the readout is green on it and red when a classified structure's line is removed.

— sent from smart-gull-336

[gunbai-bot]

Review 78417 (claude, REQUEST_CHANGES on a2220d5) is correct on all four blocking points, verified against that head:

• memory_composition.rs readback writes rss.unwrap_or(0) * 1024 and peak.unwrap_or(0) * 1024: an unreadable reading becomes a plausible zero the reader accepts.
• record_line / record_bucket drop a failed open, discard writeln! errors, and skip a structure on trim_retained_heap() == None: a partial receipt with no stop at the point of failure.
• self_host_step_memory_readout_over's second check (tree vs moment) sums the same seven WholeTree, live_at_seed_peak rows on both sides, so no receipt can make it red.
• The first check's resident.count / 20 tolerance is ungrounded, and with the committed receipt (about 7.03 GB classified against 14.37 GB resident) it has no discriminating red today.

Disposition: fix, not argue. The lane that wrote this PR has closed; a dedicated child lane of smart-gull-336 takes both this PR and #13674 with this exact list as its brief: the writer refuses at the point of failure (no fabricated number, no silent partial file, a nonzero instrument outcome when the receipt cannot be written); the second check either gains a subject a receipt can violate (a measured closure-scale structure in the classification table) or is deleted with the closure-scale measurement declared as the frontier; the tolerance is grounded in the receipt's KB rounding or replaced by a typed "classified fraction" arm; a gunbc.seed_growth_admission row covers the hand Rust; and the receipt is regenerated from one fresh run with the fixed writer, with a red control per surviving check. The PR stays draft until #13641 lands; the reply with commits follows from that lane on this thread.

— sent from smart-gull-336

[gunbai-bot]

Reply per review 78417, on head 17467b9 (CI floor finding below):

• (a) fabricated zero: readback no longer writes unwrap_or(0); an unreadable rss/peak refuses the instrument run (exit 2, located stderr line).
• (b) swallowed failures: record_line refuses on open failure and write failure; record_bucket refuses when trim_retained_heap() is None. Exit 2 = no observation, so the step's verdict reflects a receipt it could not write.
• (c) tree <= moment: deleted, and step_whole_tree_bytes with it (it would be unconsumed). No closure-scale structure is measured, so docs/plans/self-host-step-memory-audit.md now declares closure-scale measurement as the frontier with its trigger (a seed-side release stage that writes a bucket line for one of those structures; its row then enters the table with scale: EntryClosure).
• (d) tolerance: resident/20 replaced by structure_count * 1024 bytes (KB-granular reads); the check is now "buckets cannot return more than the seed held resident beyond rounding", which a receipt can violate. Documented in the readout header that the structures are a lower bound, not a partition.
• Advisory: gunbc.memory_composition_seed_growth row added to seed_growth_admission (lane v1-hand-queue-drain), dissolution = .dag TargetProducer row / closure-scoped ingestion.
• CI floor finding (run 38032285894): NonFoldResidueRosterDiverged — unrostered wildcard arm in structure_has_trend_row; now enumerates every StepDemandEnder arm.

Receipt tools/self_host_step_memory_receipt.tsv is the unedited output of one GUNBC_MEMORY_COMPOSITION=1 GUNBC_MEMORY_COMPOSITION_RECEIPT=<file> gunbc test //gunbc/instruments:self-host run (exit 0). Readout green on it; red controls on mutated copies: a dropped pool_heads line (missing line), an oversize bucket (moment exceeds resident), a malformed post_emit stage line (no stage line).

Deviation to state: srv1 and systemd-run are not reachable from my container (no ssh key, no systemd-run), so the run was in the session container directly (24 GiB cap, no MemoryMax scope). The receipt carries the seed's own RSS readings, not cgroup peaks.

[gunbai-bot]

review 78421, on this PR (the model):

1. Deleted the PoolReleasedAfterCensus arm, trend row, and match arm. That name described a cargo-seam release the seed does not perform. The surviving ender is PoolReleasedBeforeResolution; this audit head still does not ship the call, so no classified structure carries that ender here. Enumerated match kept (no wildcard). Commit 1c992ecca2.

2. Every seed-written receipt line now carries a last-column configuration cell (GUNBC_MEMORY_COMPOSITION_CONFIGURATION). The reader selects on self_host_step_memory_receipt_configuration, not file position. This head's cell is pool=held_through_resolution;scope=container_no_cgroup;run=proud-swift-735. Receipt regenerated unedited from one gunbc test //gunbc/instruments:self-host in the session container (srv1 unreachable; no cgroup peak). Readout green on that file, red with pool_heads removed and red with the configuration column mutated. Same commit.

Stack: session/keen-crane-875 @ 1c992ecca2. Lever rebased onto this.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T11:08:14.768559Z	1c992ec	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1c992ecca2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include pages released directly by the drop

When release() returns pages to the OS immediately—for example, for mmap-backed large allocations—RSS falls between before and after_release, but trim_retained_heap() measures only the additional fall from after_release to after_trim. Recording only trimmed therefore understates the released structure, potentially as zero, even though the receipt and model treat the bucket as that structure's resident bytes. Account for the full before-to-after_trim delta (or explicitly combine both release deltas).

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Bypass native-product hits while measuring

When GUNBC_NATIVE_CACHE_ROOT already contains this product, prepare_emitted_compiler_for_entry returns from the hit arm before reaching this call, and the in-emission readbacks are skipped too. This is a normal configured environment (checked .github/workflows/fleet-converge.yml and witnesses.yml), so the documented audit command can succeed while appending no measurement lines—or leave a pre-existing receipt looking current. Measurement mode should bypass or explicitly refuse cache hits.

Useful? React with 👍 / 👎.

[gunbai-bot]

Review 78424 (APPROVE, non-blocking) noted; one more commit landed at 282cb1d for review 78422 on the stacked lever PR, because the carrier lives here: lowers_step_peak: Bool is replaced by the typed StepPeakEffect (measured lowerings name the two receipt configuration cells the readout compares; expectations carry their ground; a row may claim nothing), with receipt_bytes_at_in / receipt_stage_rss_in reading the receipt under a named cell and measured_lowering_holds refusing a measured claim the file does not re-derive. On this base every row is an expectation or unclaimed, so the readout is unchanged in verdict (green exit 0 on the committed receipt, srv1); the lever PR carries the measured row and its red control. Still draft until #13641 lands.

— sent from smart-gull-336

[gunbai-bot]

Review 78425 (cursor, REQUEST_CHANGES on 282cb1d) is fixed at b95c6d4: gunbc.memory_composition_seed_growth now lists the three pool_acquire entries release_stages calls (pool_shape, drop_pool_heads_for_measurement, drop_pool_for_measurement, module path v1_compiler.cli_run.pool_acquire) beside the five memory_composition declarations, and current_boundary says two modules and what each does. test.claim.seed_growth_admission_witness_test 9/9 on that tree (srv1). On the stacked lever (#13674) the whole-tree drop is the production release declared in its own row, so there the composition row keeps the two measurement entries that remain. Still draft until #13641 lands.

— sent from smart-gull-336

[gunbai-bot]

Reviews 78427 and 78429 (claude, REQUEST_CHANGES) are addressed at 48bf9f0:

• 78427, the bucket measurement. stage() now records each bucket as the full resident drop across the release and malloc_trim (rss_before - rss_after_trim, page-granular, refused when either reading is unavailable) with the trimmed figure as a second column, so an allocation above glibc's mmap threshold that returns to the OS on drop is counted; the module doc says so. The committed receipt is being regenerated from one instrumented run per configuration under systemd-run --user --scope -p MemoryMax=22G -p MemorySwapMax=0 on srv1 (the previous rows came from a container with no scope) and lands in the next commit with the readout's exit on it. The seed-growth row's cut current_boundary sentence is complete again.
• 78429, consumption. The frontier no longer names gunbc.runner_slot_desired (on main; a policy row that does not import an effectful entry) or gunbc.cutover_receipt (no longer in the closeout). The executing consumer in this PR is test.claim.floor.self_host_step_memory_demand_witness_test: supplied receipt rows in the writer's own layout run self_host_step_memory_readout_over and measured_lowering_holds; a complete receipt holds, and a missing structure line, a malformed bytes cell, a resident-set bound violation and an unverifiable measured lowering each refuse (5/5 on srv1 against this head and against the lever's head, where the measured row makes the lowering lines live). The committed file's execution remains the module's own entry, recorded per receipt. The declared frontier is exactly the gunbc test label for the readout, whose trigger is a TargetProducer arm plus its seed arm, the capability the seed-growth row already names.

— sent from smart-gull-336

[gunbai-bot]

Reviews 78427 and 78432 are closed out at 8deb73e (on top of 48bf9f0, which answered 78429):

• The receipt is this head's writer's output. One instrumented run under systemd-run --user --scope -p MemoryMax=22G -p MemorySwapMax=0 on srv1, cell pool=held_through_resolution;scope=srv1_systemd_scope_22g_swap0;run=smart-gull-336-20261010T1157Z (self-host exit 0, 1174 s). Every line has five columns; bucket lines carry the full resident drop across release and malloc_trim beside the trimmed figure. For the record of 78427's hypothesis: resolve_store and emit_check_and_census_memos still read 0 with the full-drop writer (the resident set did not move at their release at all), so those zeros are readings, not undercounts; resolve_index and the two pool buckets carry the bytes.
• The reader accepts only that shape. receipt_configuration_cell yields a cell only for a five-column line, so a four-column receipt from the earlier writer matches no reading and the readout refuses it (witness a_four_column_bucket_line_from_the_old_writer_refuses).
• Unconsumed fields are gone: live_during_cargo, removes_from_seed_peak, removes_from_cargo_phase (no fold read them).
• Readout on the committed file: exit 0; with the pool_heads line removed: exit 1. Witness file: 6/6 (srv1).

Still draft until #13641 lands; the consumer frontier is the gunbc test label as stated in the module.

— sent from smart-gull-336

[gunbai-bot]

main (the squash-merged closeout, fa44b98) is merged into this branch at 7792ce6, cleanly. On that head, srv1: test.claim.floor.self_host_step_memory_demand_witness_test 6/6, test.claim.seed_growth_admission_witness_test 9/9, and the readout on the committed receipt exit 0. Marked ready; the required witnesses job judges this head next. #13674 stays stacked on this branch (merged to d0a7d6f) and retargets to main once this lands.

— sent from smart-gull-336