Lever 1: floor compile-clean receipt through the shared index — one typecheck universe per run

[gunbai-bot]

What

Operator-signed lever 1 from the typecheck investigation (#6766, closed investigation record): the floor's whole-tree compile-clean receipt compile now rides the shared MultiEntryIndex cached path instead of the raw pipeline, and the executor's threading is lined up so the gate, the plan prelude, and batch-2's witness corpus share one content-keyed typecheck universe per run.

Why it matters (measured, srv3-class silicon): CI's ~55-min batch-1 = a ~7.5-min compile × ~2× srv3 per-core deficit × ~2× in-process double-pay. This PR deletes the double-pay factor and warms batch-2:

• gate compile: verdict-equivalent, no wall regression (377.7s via-index vs 381.4s raw, whole tree)
• planted-inject red: 4.3s (vs 361.6s raw — the failing stage refuses without typechecking the world)
• heavy witness entries after the gate: 1.0–1.4s (vs 10–90s cold) — batch-2's ~44 min of per-entry resolve collapses

How

• resolved_graph_from_sources_with_index — the sources-taking core extracted from resolve_entry_with_parse_cache (all memo tiers), with collect-then-refuse parse errors (all files, one run).
• floor_compile_clean_emit_ok_via_index — the receipt's compile: via-index resolve + --target dag emit over the already-typed graph. The raw floor_compile_clean_emit_ok remains the cache-independent oracle (cargo tests / enrolled witnesses) and the equivalence second opinion.
• Roots armed at enable_floor_compile_clean_lazy_install(&source_roots); a receipt demanded without them refuses (typed), never falls back to a second raw compile (§5).
• claim_executor: eager receipt install on the main thread (plan already resolved — same ordering the lazy path guaranteed; lazy consume stays as fail-closed fallback) and Discovery pumps on the main-thread lane — process_shared_index is thread-local (Rc, !Send), so this is what makes the gate-filled store the one the corpus reads. No wall loss: the main thread previously idled at the join while the lone Discovery unit ran spawned.

Receipts

• Whole-tree green/red agreement matrix + warm-entry walls: investigate typecheck #6766 (investigation record, prototype receipts).
• Enrolled: compile_clean_via_index_verdict_equivalence — green corpus agrees green; planted unresolved import agrees red; planted variant-mismatch typecheck red agrees red (3/3 green in release cargo test). The raw path shares no caches with via-index, so agreement is an independent second opinion.
• The ignored e2e broken-tree test now arms index roots, so it can no longer pass through a Refused receipt without compiling (masked-tooth fix).
• Predicate audit: typecheck refusals and the gate's hardness filter reduce to the same 00_core interpreter-blocking authority on every producible class (ComplexityUnknown, the sole divergence, is unproducible on both paths — complexity analysis off).
• This PR's own CI floor run is the whole-tree by-execution receipt for the new wiring.

Notes

• Memory: the shared index now retains the whole-tree typed store for the executor's lifetime (~1.2–1.8 GB measured) — the same union batch-2 already grows toward, reached earlier. The A-lane eviction (PR-β, cross-entry-typed-module-memo sketch §2) bounds it on constrained hosts; at width>1 the cross-worker serde store remains the (separate) sharing carrier — follow-up with the A-lane so the gate's store and the claim-workers' store stay one carrier (§3).
• Known pre-existing local reds (NOT this PR): emit_success_implies_resolve_success_on_live_witness_roots and primary_precedence_pool_fills_only_absent_modules fail identically on unmodified main in plain local cargo test ("source root does not exist: dag", cwd-dependent).
• Discharges the compile half of the CLAUDE.md open thread "floor shared-computation memoization — make the double-paid full-tree compile UNREPEATABLE by construction": the receipt is the one compile, and its results are the store every later resolve reads.

🤖 Generated with Claude Code

[gunbai-bot]

review 39118 (cursor, REQUEST_CHANGES) — finding valid, fixed in 34dcdb85ee. The roots-key split was real: the receipt armed the index with the executor's absolute CLI roots while batch-2 discovery keys on the plan's relative witness_layer_roots, and process_shared_index replaces its single per-thread slot on key mismatch — so on the CI path the gate-warmed universe was swapped for a cold one before the corpus read it, voiding the sharing claim. Fixed at the shared seam per the review's recommendation: canonical_shared_index_roots normalizes every root to its repo-relative form (order preserved for primary-precedence semantics; non-workspace roots keep their spelling) and process_shared_index uses the canonical form for both the key and the build, so no caller spelling can fork the universe. Enrolled discriminating control: shared_index_roots_key_canonicalizes_absolute_and_relative_spellings (absolute vs relative spellings must return the same Rc, pointer-equality, under the executor's workspace cwd) — 4/4 green with the equivalence matrix. — sent from clever-seal-476

[gunbai-bot]

CI receipt on head 34dcdb8 (run 29543941811, green): the shared-index reroute did what it was built to do — witness corpus collapsed from ~45–63 min (baseline runs on this runner class) to 5.7 min (batches 2–4: 01:29:42→01:35:25, discovery rows warm off the gate-warmed typed store; e.g. per-witness reconciles 1.3s/6.4s/22.9s vs 10–90s cold).

Full floor decomposition of the 104-min wall for the record:

• plan-artifact prelude ~8 min (separate claim_executor process, own cold index)
• whole-tree compile via shared index 47 min (the single cold pass — the per-module typecheck kernel × this runner's per-core speed; owned in the resolve-superlinearity lane, not this PR)
• batch-1 gate claim node 11.6 min — residue: claim units run on spawned worker threads whose thread-local process_shared_index starts empty, so the gate node rebuilds its entry closure cold. Discovery units already ride the main thread. Follow-up (new PR): at governor target_width=1 run claim units on the main thread too — removes this term without touching Rc→Arc.
• floor_skip selection control 9.7 min, regen 20.7 min (regen fires because this PR touches src/v1/**; absent on .dag-only PRs)

Net for a .dag-only PR: ~118 min baseline → ~73 min now → ~61 min with the width-1 follow-up. The remaining 47-min term decomposes per the #6766 attribution (per-module typecheck kernel; sharding + within-module work are the levers there).