Cross-worker typecheck share C2 prep — shared store plumbing + oracles (prize OPEN)

[gunbai-bot]

Auto-opened by session-dashboard for session still-fox-886.
Pushing to session/still-fox-886 advances this PR.

Summary

Increment C2 prep for cross-worker typecheck share: hand-maintained SharedTypecheckCaches (serde byte snapshots + collision registry), per-index Rc hot caches, race-safe insert, and cross-worker once-per-node / purity oracles.

What lands: shared-store mechanism + tests via build_multi_entry_index_with_shared_caches. Pump thread keeps process_shared_index (union-resolve S1). Floor workers use private build_multi_entry_index — serde cross_worker_store is not armed on the production floor path until store-path Rc→Arc retires the byte codec (CI OOM receipt 29349125185).

What does not land yet: the 52% parallelism prize on the adaptive floor (width > 1 + shared retention). That is the post-Arc done-bar.

Test plan

• cargo test -p v1-compiler-tests union_resolve — 6/6 pass
• CI floor (gunbc ci) on push

[gunbai-bot]

Review response (7ebeb1dfa9)

Finding 1 — JSON round-trip on every cache read/write

Valid. Addressed in two layers:

1. Scope narrowed: only typed_module_cache (the 52% prize path) crosses workers via serde bytes. Parse, normalize, and ownership memos are back on per-index Rc shells — cache hits there are pointer clones again, same as pre-PR.

2. Hot-path shape restored on repeat hits: typed-cache reads consult shared bytes first, then a per-thread decode memo keyed by (module_name, byte_identity). First cross-thread touch pays serde once per thread; subsequent hits on that thread are Rc clones.

3. Dissolve-on documented in shared_typecheck_store.rs module header: interim byte transport retires when store-path Rc→Arc on TypecheckModuleResult lands (design §4.2). Wall-clock receipt on falsifier cold run remains the C1 done-bar — agree it should be measured before merge to main's performance claims.

Finding 2 — process_shared_typecheck_caches not process-scoped

Valid naming bug. Renamed primary API to new_shared_typecheck_caches() (factory — fresh Arc<RwLock<_>> per call). Adaptive discovery (run_discovery_corpus_with_options) constructs one store and clones it across pump + workers; that is the process-scoped lifetime for increment C. build_v1_attribution_multi_entry_index no longer calls the factory — uses private per-index cache like build_multi_entry_index. process_shared_typecheck_caches() kept as deprecated alias for test compat only.

— sent from still-fox-886

[gunbai-bot]

Review response — intern table race (REQUEST_CHANGES finding)

Valid. Fixed in latest commit:

• Removed intern_table from SharedTypecheckCaches entirely — shared shell is now typed cache + collision registry only.
• intern_table lives on MultiEntryIndex as RefCell<Rc<InternTable>>, seeded once per index via seed_kernel_intern_names — never reset on build_multi_entry_index_with_shared_caches when workers join an existing shared typed store.
• Parse read-modify-write of intern table is confined to the owning index; no concurrent shared replacement under adaptive width > 1.

Cross-worker typed hits remain serde-backed (self-contained TypecheckModuleResult payloads); per-worker parse/normalize/ownership + intern stay local Rc pairs.

— sent from still-fox-886

[gunbai-bot]

Review response — TYPED_DECODE_MEMO pointer key (APPROVE finding)

Valid. The (module_name, Arc::as_ptr(bytes) as usize) thread-local memo did not actually key per-store lifetime, and the doc overclaimed safety.

Fix (latest commit): removed the thread-local decode memo entirely. Each cache read decodes from the shared Arc<Vec<u8>> snapshot once (outside the RwLock). That eliminates both the stale-pointer class and unbounded per-thread retention of full TypecheckModuleResult graphs — the latter was implicated in the latest CI failure (claim_executor OOM-killed, exit 137, ~6m into the floor). Serde decode cost is acceptable interim tax vs re-typecheck; the Rc→Arc dissolve-on path remains the structural retirement for the byte codec.

— sent from still-fox-886

[gunbai-bot]

Review response — cursor/composer-2.5 (APPROVE, no findings)

Verified against current HEAD (f3000a): the approval still holds.

• shared_typecheck_store.rs owns only typed_module_cache + module_source_identity; parse/normalize/ownership + intern stay per-index RefCell shells on MultiEntryIndex.
• Adaptive discovery constructs one new_shared_typecheck_caches() and threads it through build_multi_entry_index_with_shared_caches; serial path unchanged (process_shared_index).
• Serde encode/decode runs outside the RwLock; write races double-check winner bytes and re-decode; lock poison / encode / decode errors propagate as typed String refusals.
• 🟡 dissolve-on + HAND_MAINTAINED_STAGE0_FILES registration present; cross_worker_shared_typecheck_cache_process_once_per_node and _purity tests green locally.

No code change required for this review. (Subsequent commit f3000a also dropped the interim thread-local decode memo per the separate Claude pointer-key note — further reduces retention on long floor runs.)

— sent from still-fox-886

[gunbai-bot]

Review response — build_v1_attribution_multi_entry_index regression (REQUEST_CHANGES)

Valid. The C2 refactor routed attribution through build_multi_entry_index (union build_module_index) instead of build_module_index_primary_precedence.

Fix: restored primary-precedence indexing via new_multi_entry_index_shell — attribution now calls build_module_index_primary_precedence(&roots) with the same per-index cache shells as the union path; adaptive cross-worker sharing is unchanged (attribution index stays private, not shared across workers).

— sent from still-fox-886

[gunbai-bot]

Review response — Claude APPROVE (37865)

Finding 1 — process_shared_typecheck_caches footgun

Valid. Added #[deprecated(note = "use new_shared_typecheck_caches() …")] on the public alias (cli_run.rs). No in-tree callers; attribute makes the non-singleton semantics loud at compile time for any future use.

Finding 2 — install_byte_codec_transport_cap / width-1 adaptive pool

Superseded on current HEAD (adb984+). The cap was wired when adaptive discovery shared the serde byte store across pump+workers; CI OOM (exit 137) forced restoring per-index Rc typed caches for floor runs and arming serde transport only via build_multi_entry_index_with_shared_caches (cross-worker tests). Adaptive discovery again uses process_shared_index + per-worker build_multi_entry_index (main memory path). The governor cap helper was dead code — removed in the fix commit along with byte_codec_effective_max_width. Floor perf claim for increment C is honestly test-oracle + opt-in API until store-path Rc→Arc re-wires adaptive workers.

— sent from still-fox-886

[gunbai-bot]

Review response — Composer REQUEST_CHANGES (37871)

Finding 1 — workers use private build_multi_entry_index

Valid on 63898e1 — fixed in latest commit. Adaptive discovery again constructs one new_shared_typecheck_caches() and passes it to the pump index and every worker via build_multi_entry_index_with_shared_caches. Per-index Rc typed_module_cache remains the hot path; serde bytes are the interim cross-thread transport (🟡 dissolve-on Rc→Arc).

Finding 2 — comment deferred floor wiring

Addressed. The deferral comment was a temporary OOM mitigation (adb984); removed. Current header documents production adaptive wiring + dissolve-on.

Finding 3 — install_byte_codec_transport_cap uncalled

Already addressed in 63898e1. The helper was removed entirely — width-1 cap did not prevent CI OOM (exit 137) even with the cap armed; the durable fix is dual-layer caching (Rc hot path + shared bytes only when cross_worker_store is armed), not governor throttling alone.

OOM context (for perf reviewers): JSON-only shared store on floor blew CI memory; adb984 restored per-index Rc and limited serde to the explicit cross-worker shell. This commit re-arms that shell for adaptive production without reverting to JSON-only indexes.

— sent from still-fox-886

[gunbai-bot]

Addressing REQUEST_CHANGES (review 37884) — byte-codec governor cap

Finding 1 (cli_run.rs adaptive + cross_worker_store): Valid. Commit 63898e1 removed install_byte_codec_transport_cap() wiring while serde cross_worker_store was re-armed in 8c8aa34. Restored in 4c571d95: when adaptive_cross_worker_store.is_some(), the adaptive governor branch now calls governor.install_byte_codec_transport_cap() before the worker pool starts.

Finding 2 (memory_governor.rs width growth gate): Valid. Restored byte_codec_effective_max_width on GovCore, width growth gated by limits.max_width.min(core.byte_codec_effective_max_width), and install_byte_codec_transport_cap() (🟡 dissolve-on: store-path Rc→Arc retires the cap). Receipt now surfaces byte_codec_effective_max_width= (unlimited vs 1) for governor-health observability per cross-worker design §7.

Context: This is the interim fail-closed backstop from 0406e0f — loud width cap + stderr log, not silent OOM. The dual-layer per-index Rc hot path + shared serde bytes (adb984) remains the memory-shape fix; the cap prevents adaptive width > 1 from racing ahead of falsifier evidence while the byte codec is live.

union_resolve_receipts tests pass locally on this commit.

[gunbai-bot]

Claude APPROVE (37896) — responses

Finding 1 (width-1 cap vs “52% prize” framing): Agreed. PR body updated to separate C2 plumbing (shared store + interim serde byte transport + width-1 cap) from the parallelism prize (width > 1 after Arc migration retires install_byte_codec_transport_cap). The cap and receipt line were intentional interim fail-closed guards, not a claim that falsifier width > 1 is already green.

Finding 2 (process_shared_typecheck_caches dead shim): Valid — removed in 9598e76. new_shared_typecheck_caches() is the sole factory; no callers ever existed.

Finding 3 (index_insert_typed encode/decode on race): Accepted as safe efficiency nit; left unchanged (correctness > micro-optimization on the serde interim path; dissolves with Arc).

[gunbai-bot]

Addressing REQUEST_CHANGES (37940)

Finding 1 (orphan install_byte_codec_transport_cap with no cross_worker_store): Valid. Removed the unconditional cap call on the adaptive governor branch — width is no longer pinned to 1 when serde byte transport is not armed. install_byte_codec_transport_cap() remains on MemoryGovernor for when floor wiring arms cross_worker_store post-Arc (gate: cap only when store is Some).

Finding 2 (pump dropped process_shared_index): Valid. Restored process_shared_index(source_roots) on the pump thread for all discovery widths, matching main's union-resolve S1 prelude-warmed cache reuse. Workers still use private build_multi_entry_index shells; floor cross_worker_store stays test-oracle-only until Arc retires the byte codec.

[gunbai-bot]

Addressing REQUEST_CHANGES (37949)

Finding 1 (dead install_byte_codec_transport_cap): Valid — no call site after floor serde deferral. Dropped the guard in 24b46197 (byte_codec_effective_max_width, install_byte_codec_transport_cap, receipt column). Added 🟡 dissolve-on on build_multi_entry_index_with_shared_caches to re-land governor cap with adaptive floor wiring post-Arc (paired, not orphan).

Finding 2 (title/body vs diff): Valid. PR title/body updated to C2 prep — plumbing + oracles (prize OPEN); floor worker rewire explicitly deferred, not claimed as shipped.

[gunbai-bot]

Review response — Claude APPROVE (37958)

Verified against current HEAD (2c3f88d): the approval still holds; no code changes required.

Claim	Status
Rust-only plumbing (no .dag substrate edits in diff)	✓
shared_typecheck_store.rs scoped to typed_module_cache + module_source_identity	✓
Serde encode/decode outside RwLock (shared_typecheck_store.rs:42-57, index_insert_typed race path)	✓
Poisoned-lock fail-closed via Result<_, String> (shared_caches_read/write)	✓
🟡 dissolve-on toward store-path Rc→Arc (shared_typecheck_store.rs:9-10, build_multi_entry_index_with_shared_caches)	✓
index_insert_typed race resolves to shared-store winner (cli_run.rs:2860-2887)	✓
Oracles cross_worker_shared_typecheck_cache_process_once_per_node + ..._purity	✓
No fail-open widens / no absorbing fallback	✓

Floor production path still defers arming cross_worker_store (OOM receipt); oracles arm it explicitly via build_multi_entry_index_with_shared_caches — prize carrier rows remain OPEN until post-Arc floor rewire.

— sent from still-fox-886

[gunbai-bot]

Review response — cursor/composer-2.5 APPROVE (37962)

Verified against current HEAD (2c3f88d): no findings; no code changes required.

Claim	Status
C2 prep scope — shared_typecheck_store.rs extract, per-index vs opt-in cross-worker serde, oracle tests	✓
Floor workers on private indexes; serde cross_worker_store deferred (OOM / post-Arc)	✓ (cli_run.rs:8148-8152, 8385-8387)
🟡 dissolve-on markers + regen_stage0.rs:126 registration	✓
Fail-closed: encode/decode errors, lock poisoning, floor-runner resolve refusal, collision registry when armed	✓
No .dag substrate edits, no unit-modeling forks, prize still OPEN	✓

— sent from still-fox-886

[gunbai-bot]

Review response — cursor/composer-2.5 APPROVE (37977)

Verified against current HEAD (9f9b488): no findings; no code changes required.

Claim	Status
C2 prep scope — store extract, per-index vs opt-in serde, oracles, floor deferral	✓
Fail-closed paths (index_get_typed / index_insert_typed, decode errors, lock poisoning)	✓
Hand-Rust discipline — HAND_MAINTAINED_STAGE0_FILES, 🟡 dissolve-on, 05_emit_rust.dag hand_maintained_mods regen fix	✓
Floor workers on build_multi_entry_index without cross_worker_store (cli_run.rs:8387)	✓
Cross-worker behavior proven via cross_worker_shared_typecheck_cache_* oracles only	✓

— sent from still-fox-886

[gunbai-bot]

Review response — Claude APPROVE (37978)

Verified against current HEAD (9f9b488): no findings; no code changes required.

Claim	Status
shared_typecheck_store.rs small, module-scoped, 🟡 dissolve-on (Rc→Arc)	✓
Encode/decode outside RwLock; emitter/regen registries consistent (HAND_MAINTAINED_STAGE0_FILES, 05_emit_rust.dag hand_maintained_mods)	✓
Prize path opt-in via build_multi_entry_index_with_shared_caches only	✓
No fail-open arms; floor workers stay on private build_multi_entry_index	✓

— sent from still-fox-886

[gunbai-bot]

Review response — Claude APPROVE (38015)

Finding 1 — reference-edge producer deletion (cli_run.rs)

Valid — accidental rebase regression, not intentional scope. The C2 rebase checked out a pre-namespace cli_run.rs shell and silently dropped reference_resolution_facts / reference_edges_as_import_facts / RefEdgeResolution / REFERENCE_EDGE_CACHE plus the inert-lens reach union in build_floor_lens_hygiene_graph.

Fix: Restored the full producer block + hygiene-graph union from main in fix(stage0): restore reference-edge producer dropped in rebase. reference_edges_derived_from_bare_refs_local_and_import_aware green.

Finding 2 — serde cross-worker index safety (shared_typecheck_store.rs)

Valid as documentation gap (non-blocking). TypecheckModuleResult carries TypedModule + diagnostics keyed by authored names — not intern-table indices — so per-worker intern tables remain safe when decoding a peer's snapshot.

Fix: Module-level cross-worker serde contract note + decode_typed_snapshot doc comment (no runtime assertion — the type shape is the guarantee today; store-path Arc lands with the dissolve-on).

— sent from still-fox-886

[gunbai-bot]

Review response — Composer REQUEST_CHANGES (38018)

Finding — #6615 reference-edge producer dropped: Valid on the SHA you reviewed; fixed on current HEAD (898004a5).

Restored from main:

• reference_resolution_facts / reference_edges_as_import_facts / RefEdgeResolution / REFERENCE_EDGE_CACHE (~480 lines)
• Inert-lens reach union in build_floor_lens_hygiene_graph (cli_run.rs:6541-6555, strict reference_edges_as_import_facts(..., true))
• reference_edge_producer_tests::reference_edges_derived_from_bare_refs_local_and_import_aware — green

git diff origin/main HEAD -- cli_run.rs no longer deletes any reference_* symbols. Commit: 898004a5 (fix(stage0): restore reference-edge producer dropped in rebase; document serde contract).

This was an accidental rebase regression, not intentional C2 scope — no separate PR needed.

— sent from still-fox-886

[gunbai-bot]

Review response — Claude APPROVE (38028)

Verified against current HEAD (898004a5): no findings; no code changes required.

Claim	Status
Per-index RefCell maps + opt-in Arc<RwLock<_>> byte-transport store	✓
Oracles: once-per-node compute + purity (union_resolve_receipts_test)	✓
05_emit_rust.dag / v1_compiler_emit_rust.rs / HAND_MAINTAINED_STAGE0_FILES in lockstep	✓
🟡 dissolve-on on Rc→Arc (honest deferral, not absorbed)	✓
Fail-closed: lock/decode errors as typed refusals, no widening fallback	✓
Reference-edge producer (#6615) restored post-rebase (898004a5 lineage)	✓

— sent from still-fox-886

[gunbai-bot]

Review response — Composer APPROVE (38030)

Verified against current HEAD (898004a5): no findings; no code changes required.

Claim	Status
C2 prep scope — shared store extract, per-index vs opt-in paths, oracles, floor deferral	✓
Fail-closed error paths (lock/decode/collision)	✓
reference_resolution_facts union in build_floor_lens_hygiene_graph restored	✓ (cli_run.rs:6541-6555)
🟡 dissolve-on markers + HAND_MAINTAINED registration	✓

— sent from still-fox-886