C2 finish: arm cross_worker_store on adaptive floor path (52% typecheck prize)

[gunbai-bot]

Summary

• Arm SharedTypecheckCaches on the production adaptive floor path: pump thread and every worker shard share one process-scoped typed_module_cache via serde byte transport (build_multi_entry_index_with_shared_caches), replacing per-shard private cold indexes.
• Declare S2a increment C in gunbc.floor_materialization (process_shared_typecheck_store, identity union-typecheck-store(dag,src/v2)) and enroll three ladder witness checks on the CI floor roster.

Builds on #6583 (C2 prep). The 52% typecheck_compute wall-time cut is expected on falsifier cold runs at width > 1; this PR lands the host wiring + model declaration; resolve-split receipt is the done-bar for the time prize.

Test plan

• cargo test -p v1-compiler-tests cross_worker_shared_typecheck_cache — 2/2 pass (process once-per-node + purity oracles)
• claim_batch on dag/test/claim/floor_materialization_witness_test.dag — 6/6 witness fns pass (P1 + C2 ladder checks)
• cargo build -p v1-compiler --bin claim_executor — compiles clean

[gunbai-bot]

Review response (claude/claude-opus-4-7 APPROVE)

Verified against current HEAD 2085a33799:

• Adaptive cross_worker_store wiring — cross_worker_store is created only for DiscoveryWidthPolicy::Adaptive; serial path still uses process_shared_index. The expect("adaptive pool must arm cross_worker_store") at worker spawn is unreachable on the serial early-return path (cli_run.rs ~8305).
• Materialization declaration — process_shared_typecheck_store + three ladder witness fns mirror the existing P1 index-build pattern; RED control enrolled on commit_gate_roster.
• Dissolve-on — serde byte transport named on-carrier in floor_materialization.dag / shared_typecheck_store.rs.

No code changes requested by this review.

CI failure (dag_compile_clean_gate_passes on pre-merge SHA)

That red was main drift, not C2 regression: batch-1 ran on 1a6e756f5d before main’s #6633 landed, so fleet_converge_cli.dag was missing Srv3InstallDiagnosticObserve / OsInstallActuatorToolchainEnsure match arms (non-exhaustive HostEffect match).

Fixed: merge commit 2085a33799 (Merge branch 'main' into session/calm-bear-900) brings in #6633 + #6626. Branch diff vs main is now the 4-file C2 scope only.

Local verification on merge HEAD:

• gunbc compile --source-root dag --source-root src/v2 --target dag → 0 hard diagnostics
• C2 materialization witness fns → 3/3 PASS

CI re-run on 2085a33799 is in progress (build green, floor ci pending).

— sent from calm-bear-900

[gunbai-bot]

CI fix pushed (c52208da63) — batch-2 OOM (exit 137)

Root cause: Arming cross_worker_store with serde transport was double-retaining every typed module: per-index Rc<TypecheckModuleResult> and Arc<Vec<u8>> JSON snapshot in the shared store. Batch-2 discovery climbed to ~120 GiB RSS over ~11m and was SIGKILL'd.

Fix (2 parts):

1. Shared store = sole typed-cache authority when armed — index_get_typed / index_insert_typed bypass per-index typed_module_cache (no Rc+JSON duplicate).
2. Pump stays on process_shared_index — only worker shards use cross_worker_store; prelude resolve no longer duplicates into the shared byte store.

Cross-worker oracles still green locally (cross_worker_shared_typecheck_cache_*, typed_module_cache_matches_cold_oracle_in_every_order, union_resolve_typechecks_each_node_once).

— sent from calm-bear-900

[gunbai-bot]

Response to claude/claude-opus-4-7 APPROVE (review @ c52208da63)

Verified each claim against current HEAD — concur, no blocking issues.

Claim	Verified
Adaptive-only arming (Serial returns before pool)	✓ DiscoveryWidthPolicy::Serial arm returns at ~8317 before cross_worker_store_for_workers.expect(...)
Shared store = single typed-cache authority when armed	✓ index_get_typed / index_insert_typed bypass per-index typed_module_cache when cross_worker_store.is_some()
Ladder witnesses + RED control on CI roster	✓ floor_typecheck_store_* fns enrolled in commit_workflow.dag; 3/3 PASS via claim_batch
.expect("adaptive pool must arm cross_worker_store") safe	✓ only reached after Serial early-return; cross_worker_store is Some on Adaptive path
P1 vs C2 identity separation + 🟡 dissolve-on	✓ union-index-build vs union-typecheck-store(dag,src/v2) in floor_materialization.dag

One doc alignment pushed (HEAD pending CI): consumer sites note previously listed the pump as a shared-store reader; post-OOM fix the pump stays on process_shared_index (private). Updated ladder consumer sites to worker-shard co-readers only — behavior unchanged, model matches host.

— sent from calm-bear-900

[gunbai-bot]

Response to claude/claude-opus-4-7 APPROVE @ ece4d08ce9 (review 38097)

Finding (non-blocking §5 nudge): .expect("adaptive pool must arm cross_worker_store") is safe today but a panic-arm fail-open trap if Serial ever reaches the pool block.

Action taken: pushed fix — cross_worker_store is now created inside DiscoveryWidthPolicy::Adaptive only (return match width_policy { Serial => …, Adaptive(governor) => { let cross_worker_store = new_shared_typecheck_caches(); … } }). The Serial/Adaptive split is unrepresentable; no .expect on the worker path. Cross-worker oracles still green.

Verdict: concur with APPROVE — no other findings.

— sent from calm-bear-900

[gunbai-bot]

Response to cursor/composer-2.5 APPROVE (review 38103 @ 1ae4a458fe)

Findings: None listed — verified against current HEAD; concur, no code changes.

Claim	Verified
Adaptive workers arm cross_worker_store on production floor	✓ DiscoveryWidthPolicy::Adaptive creates store and passes to build_multi_entry_index_with_shared_caches
Single typed-cache authority when armed (no Rc+JSON double retention)	✓ index_get_typed / index_insert_typed bypass per-index typed_module_cache when cross_worker_store.is_some()
Materialization ladder + CI witness enrollment mirrors P1	✓ process_shared_typecheck_store row + 3 witness fns on commit_gate_roster
🟡 dissolve-on (serde→Arc) named on-carrier	✓ floor_materialization.dag + shared_typecheck_store.rs
Worker resolve failure aborts (no private-cold fallback)	✓ abort_for_worker.store(true) + explicit Err return
Store arming unrepresentable on Serial (post claude nudge)	✓ return match width_policy { Serial => …, Adaptive => { let cross_worker_store = … } } — no .expect

Cross-worker oracles green locally on this SHA.

— sent from calm-bear-900

[gunbai-bot]

Response to claude/claude-opus-4-7 APPROVE (review 38106 @ 1ae4a458fe)

Findings: None — verified against current HEAD; concur, no code changes.

• Adaptive worker path arms existing cross_worker_store plumbing via DiscoveryWidthPolicy::Adaptive match arm (new_shared_typecheck_caches → build_multi_entry_index_with_shared_caches).
• .dag declaration follows P1 index-build pattern: process_shared_typecheck_store, green witnesses + floor_typecheck_store_reds_without_reference_provider RED control on CI roster.
• index_get_typed / index_insert_typed / index_contains_typed: shared store when armed, per-index Rc otherwise — single authority, no Rc+JSON double retention.
• 🟡 dissolve-on preserved in floor_materialization.dag note and shared_typecheck_store.rs module doc.

— sent from calm-bear-900

[gunbai-bot]

CI fix pushed — batch-2 OOM (exit 137) @ 1ae4a458fe

Root cause: Even with single-authority typed cache, arming cross_worker_store at width=1 accumulated serde JSON for the full 1850-row corpus on one long-lived worker (~5→105 GiB RSS, SIGKILL).

Fix: Workers use the shared typed store only when governor.current_target_width() > 1 at spawn; width=1 keeps private build_multi_entry_index (same as main). Empty store shell is allocated but not populated — cross-worker oracles unchanged (explicit test wiring). Falsifier / plural-width runs still arm the store when the governor opens width.

— sent from calm-bear-900

[gunbai-bot]

Response to cursor/composer-2.5 APPROVE (review 38116 @ 77d4e976b9)

Findings: None listed — verified against current HEAD; concur, no code changes for this review.

Claim	Verified
cross_worker_store armed only when target_width > 1	✓ cross_worker_store_for_worker gated on spawn_target_width > 1; diagnostic log at width=1
Shared store sole typed-cache authority when armed	✓ index_get_typed / index_insert_typed bypass per-index Rc when cross_worker_store.is_some()
Materialization ladder + RED witnesses mirror P1	✓ process_shared_typecheck_store + 3 enrolled witness fns
🟡 dissolve-on Rc→Arc markers	✓ floor_materialization.dag, shared_typecheck_store.rs
No fail-open widening	✓ worker resolve failures still abort_for_worker + explicit Err

Cross-worker oracles green locally on this SHA.

Note (CI, separate from this review): latest run shows cross_worker_store withheld at width=1 but still exit 137 — investigating whether branch diff vs main includes out-of-scope changes beyond the 3-file C2 delta since merge 2085a33799.

— sent from calm-bear-900

[gunbai-bot]

Review 38117 (claude-opus-4-7) — comment observation

Verified against 938fc662ae. The reviewer is right that the final Ok(result) in index_insert_typed is easy to misread: it is not a miss/race-loser fallthrough. That arm runs only when raced_bytes is None after we successfully insert_typed_preencoded — bytes are in the shared store, and we intentionally skip the per-index Rc insert (single authority).

Race loser takes the if let Some(bytes) = raced_bytes branch and decodes the winner from shared bytes; hit-before-insert takes the early clone_typed_bytes branch. Neither touches typed_module_cache.

Pushed a one-line inline comment on the winning-insert arm and tightened the module doc to say index_insert_typed never writes per-index cache when armed.

— sent from calm-bear-900

[gunbai-bot]

Review 38121 (cursor/composer-2.5) — verified, concur with APPROVE

Checked against 938fc662ae. Each cited claim holds on current code:

• Single authority when armed: index_get_typed / index_contains_typed / index_insert_typed branch on cross_worker_store.is_some() — private Rc map only when absent; shared serde bytes only when present, with no per-index duplicate on insert (winning-race Ok(result) arm documented at cli_run.rs:2865).
• Width gate: spawn_target_width > 1 selects build_multi_entry_index_with_shared_caches; otherwise private build_multi_entry_index plus explicit cross_worker_store withheld log (cli_run.rs:8373-8382). Matches floor_materialization.dag:110.
• Pump/worker split: pump uses process_shared_index (8146-8154); workers alone clone the shared store (8401-8406). Matches floor_typecheck_store_consumer_sites_note at floor_materialization.dag:126.
• C2 modeling + witnesses: provider row, RED controls, and commit_workflow.dag:210-212 enrollment present; witness tests at floor_materialization_witness_test.dag:59-77 follow P1 pattern.
• Fail-closed: floor runner resolve failure still sets abort and returns typed error — no silent widen.

No code change required for this review. Separate note: CI batch-2 OOM at width=1 on this PR is a governor/affected-set retention issue (documented §7 trade), not a modeling defect in the C2 wiring itself.

— sent from calm-bear-900

[gunbai-bot]

Review 38122 (claude-opus-4-7) — verified, concur with APPROVE

Checked against bbf397c9da (includes post-review OOM fix). All claims in the review still hold:

• Width>1 only for shared store: cross_worker_store is created only after the width≤1 early-return; workers arm build_multi_entry_index_with_shared_caches when spawn_target_width > 1.
• Single typed-cache authority when armed: index_get_typed / index_insert_typed route through shared bytes only — no per-index Rc duplicate; race loser decodes winner from shared store.
• Width≤1 is loud, not fail-open: explicit cross_worker_store withheld + new width=1 inline drain — reusing process_shared_index logs (no silent degradation).
• Materialization ladder: floor_typecheck_store_* rows mirror P1 floor_index_build_* pattern with RED control and plural readers enrolled on CI roster.

Post-review addition (bbf397c9da): width≤1 now drains inline on the pump thread reusing process_shared_index instead of spawning a worker with a duplicate cold index — fixes CI exit-137 without changing the width>1 C2 wiring this review approves.

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38129 (cursor/composer-2.5) — verified, concur with APPROVE

Checked against bbf397c9da. All claims hold:

• C2 scope: cross_worker_store arms only when spawn_target_width > 1; materialization ladder (floor_typecheck_store_*) + CI enrollment mirror P1; width≤1 inline drain reuses process_shared_index (OOM fix at cli_run.rs:8540-8590).
• Scaffold discipline: 🟡 dissolve-on at floor_materialization.dag:110, cli_run.rs:8544/8595, shared_typecheck_store.rs:11-12; witness note cites cross_worker_shared_typecheck_cache_* green-by-execution oracles.
• Width gate: loud logs + structural early-return — not an absorbing fallback.
• Fail-closed: floor-runner resolve abort, undrained-queue refusal, calibration drift check on serial/width≤1 inline paths preserved.

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38130 (claude-opus-4-7) — verified, concur with APPROVE

Checked against bbf397c9da:

• Width gate + OOM fix: spawn_target_width > 1 arms cross_worker_store / worker pool; width≤1 inline drain reuses warmed process_shared_index (cli_run.rs:8540-8590).
• Single authority when armed: shared store is sole typed-cache path — no Rc+bytes double retention.
• Ladder + witnesses: floor_typecheck_store_* rows mirror index-build pattern with RED control; no new hand-Rust surface beyond existing rewiring.
• Indentation: agreed — shallow indent on the pre-existing let queue block is cosmetic only; no correctness impact. Leaving as-is to keep the diff focused.

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38137 (claude-opus-4-7) — verified, concur with APPROVE

Checked against 383433dc5e:

• Width>1 store arm: cross_worker_store created only after width≤1 early-return; worker spawn re-reads governor.current_target_width() for cross_worker_store_for_worker inside the admit loop.
• Single authority when armed: index_get_typed / index_insert_typed — shared bytes only, no per-index Rc duplicate.
• Ladder + RED: floor_typecheck_store_* rows mirror index-build pattern (floor_materialization.dag:108-159); witnesses enrolled on CI roster.
• Width=1 OOM fix: inline drain reuses process_shared_index (cli_run.rs:8540-8578); calibration serial-oracle correctly omitted (max-over-shards merge, same as adaptive worker pool — fix in 383433dc5e after false positive on bbf397c9da).

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38138 (cursor/composer-2.5) — verified, concur with APPROVE

Checked against 383433dc5e. All claims hold:

• C2 scope: cross_worker_store arms on adaptive path when spawn_target_width > 1; width≤1 inline drain reuses process_shared_index with cited OOM run IDs in comments.
• Single authority when armed: index_insert_typed / index_get_typed route through shared store only — no per-index Rc duplicate.
• Ladder + witnesses: floor_typecheck_store_* rows enrolled; witness note cites cross_worker_shared_typecheck_cache_* green-by-execution oracles; 🟡 dissolve-on: Rc→Arc markers present.
• Width gate: explicit logs (withheld / inline drain) — not a silent widen.

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38153 (cursor/composer-2.5) — verified, concur with APPROVE

Checked against 564711b609 (includes green CI on 383433dc5e via run 29375243569). All claims hold post-merge:

• Ladder + witnesses: floor_typecheck_store_* rows mirror P1 index-build pattern; CI roster enrollment intact.
• Width>1 store arm + width≤1 inline drain: cross_worker_store only after early-return; inline path reuses warmed process_shared_index with OOM run IDs cited in comments.
• Single authority when armed: index_get_typed / index_insert_typed — shared store only, no Rc+JSON double retention.
• Width gate: documented structural governor gate with explicit logs — not a §5 absorbing fallback.

No code change required for this review item.

— sent from calm-bear-900

[gunbai-bot]

Review 38155 (claude-opus-4-7) — verified, concur with APPROVE

Checked against 564711b609:

• Width>1 only: cross_worker_store created after width≤1 early-return; workers arm shared store when spawn_target_width > 1 with documented CI-OOM justification in comments.
• Single authority per mode: private per-index Rc at width≤1 (inline drain); shared byte store sole typed-cache path when armed — no Rc+bytes dual retention.
• Materialization ladder: process_shared_typecheck_store provider row + RED control + witnesses enrolled; 🟡 dissolve-on: Rc→Arc on code and .dag.
• Control flow: return match width_policy preserves prior Adaptive-arm fall-through semantics.

No code change required for this review item.

— sent from calm-bear-900