One tree, one resolve: floor stages consume the compile-clean computation (levers 2/3/8 of #7106)

[briansrls]

One tree, one resolve: the floor's later stages consume the compile-clean computation (levers 2, 3, 8 of #7106)

Baseline: #7106's TSVs (docs/probes/ci_floor_{phase_attribution,redundancy_ledger_skeleton,lever_ranking}_2026-07-23.tsv) — merge #7106 first; this branch carries its docs-only baseline until then (a main-merge after #7106 lands collapses the overlap).

STEP 1 — Model (the code below is derived from this)

The consumable fact, associated — not minted. The compile-clean pass's output is modeled where the floor's duplicate-computation debt already lives: gunbc.ci_materialization's counted-resolve law (ci_floor_resolve_receipt_note, Receipt 5). FloorCompileCleanReceipt::Compiled means the main-thread process_shared_index — the typed resolved-graph store the compile-wall-endgame W3 lane names, and the duplicate-work/ComputationIdentity census already rows as PROCESS_RESOLVE_STORE — is warm for witness_layer_roots. Later floor stages consume that store. In ComputationIdentity vocabulary: the whole-tree resolve is ONE materialization; every later same-input resolve in the same process is Share at StructurallyIdentical grade (fixed snapshot, same roots — the purity assumption walk_memo and typed_module_cache already ship on); a stage that cannot be served is a counted necessary-first-touch, never a silent re-walk. The module-identity lane contributes the key language (path⇄module binding, content-hash SourceRef) — joined, never fused, per its own §6 alignment note.

Stage classification (the #7106 redundancy ledger's own vocabulary):

stage	was	now	how
compile-clean receipt (eager install)	necessary	necessary-first-touch (THE one whole-tree materialization)	unchanged
cheap gates batch 0 — entry resolve	duplicated (cold spawned-thread re-resolve of the same entry the memo path resolves)	consumes-receipt	FIX 1: memo-lane colocation
cheap gates batch 0 — gate-body claim rows (layering ×7, extdeps ×5 child processes)	duplicated (one cold pool build per claim row)	necessary-first-touch, pooled (one pool build per call)	FIX 2: pooled transport
compile gate consume (batch 1)	necessary (verify)	consumes-receipt (walk-memo hit, zero resolve)	FIX 1 side effect
emit-host	consumes-receipt (walk-memo hit)	unchanged	—
discovery corpus	duplicated per-entry (#6848 walk)	unchanged — out of mandate (lever 1, namespace §PR-5b)	—
source_root_ingest — bin scans + manifest supply	necessary kernel (host-read bytes: provenance coverage receipt, corpus content-hash, V2Tree/DagTree tagging, v2-modeled ingest activation over host-supplied bytes — facts the v1 compile receipt cannot carry by design)	unchanged	—
source_root_ingest — 12 per-claim child re-resolves	duplicated	necessary-first-touch, pooled (4 calls → 4 pool builds; overlay-manifest roots are genuinely composed input)	FIX 2
reads_real_bytes	duplicated heavy resolve (#7030 routes to shared index; entry resolve stays counted)	unchanged — its counted resolve is declared debt	—
compile-clean scope on src/v2-only deep diffs	duplicated (whole-tree where scoped admissible: roster ⊂ compiled tree)	scoped by construction (roster ≡ compiled tree)	FIX 3

Each fix is an extension of ONE existing authority:

• FIX 1 (lever 3) extends gunbc.ci_materialization's counted-resolve law: declared count 4 → 3 (Receipt 5, the note's own "the rewire PR declares the count's drop consciously" discipline). Realization: claim_executor batch_unit_lane clause (c) — any resolve-group sharing an (entry, execution_mode) that some batch resolves on the memo path is colocated there, so one entry resolves exactly once per walk, against the store the eager compile-clean install warmed. Derived from the plan's declared profiles only — no schedule fact added or reordered (CI fail-fast: cheap-gate early batch (SIMPLE declared membership + dissolution trigger) + event-scoped stop policy #7088's batch-0 ordering untouched; witness_cheap_gates_only_in_early_batch still pins it).
• FIX 2 (lever 2, and the child-process half of lever 3) extends the transport discipline (tools.host_prelude; the ingest gate's walk is the module-identity lane's named cost): run_gunbc_claims pools one child per call via claim_batch's pre-existing --entry/--function group grammar (argv authority tools.host_prelude.claim_batch_claims_argv, shape pinned by the typed_claim_batch_pooled_argv_shape_holds witness — no new claim grammar minted; see R1) instead of one child per claim row. Verdict-identical by construction: claim_batch's own loop runs every row (no short-circuit), each failure a named FAIL <function> line, exit nonzero iff any failed — the same conjunction the per-process fold computed. Residue named, counted, with dissolve-on: one pool build per call + one closure resolve per distinct entry (ledger rows), dissolving on the W3 cross-process content-keyed store.
• FIX 3 (lever 8) extends the partition authority (tools.dag_compile_clean_partition): the boundary derives from ALL witness_layer_roots — exactly the tree the whole-tree gate compiles — never .first(). This closes BOTH directions of the roster⊂compiled-tree asymmetry: src/v2-only .dag diffs no longer widen to whole-tree (the baseline run 29976989996's exact shape), and a dag/std touch now selects its affected src/v2 importers on scoped runs (previously covered only by the falsifier cold control). Every fail-closed arm unchanged: non-selectable paths, departed paths, affected-set refusals, and the no-shard-intersection residue all still widen to whole-tree loudly; the cold control still forces whole-tree.

Hard rules held

• Falsifier cadence untouched: no edits to falsifier.yml, gunbc_falsifier_batches, or the cold-control envs. The cold control (GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL=1) still forces whole-tree and remains the standing staleness detector for exactly the selection this PR widens.
• No cap/width changes (lever 5 out of mandate): governor untouched.
• No witness verdict changes: FIX 1 moves a resolve between threads of one process (resolve is a pure function of (source_roots, entry) — the BatchUnit doc's own construction argument); FIX 2 preserves the per-row run_claim semantics and the call-level conjunction; FIX 3 only widens/narrows which entries COMPILE, with all refusal arms intact. Acceptance oracle: verdict-identical floors.

Test plan

• cargo test -p v1-compiler --bin claim_executor — lane promotion + RED control (without the heavy same-entry declaration the group spawns, the pre-fix behavior) + mode-keying
• cargo test -p v1-compiler --lib — floor_fast_plan_scopes_src_v2_entries_both_directions (live tree: src/v2-only touch → Scoped incl. its own entry; dag/std touch → selects src/v2 importers); existing whole-tree guards (mixed .rs, departed, docs-only) unchanged
• Local pooled claim_batch execution: ONE child, 4 entries, 10/10 PASS (FIX-3 witnesses + pooled-argv shape witnesses); RED control: unknown function → named FAIL no_such_claim_zzz line, later rows still reported, exit 1
• gunbc ci regen (declared-count line) — drift gate stays green
• CI floor green (run 29995111208, pull_request): resolves_total 3 == declared 3; cheap 10.15→4.65, consume 27s→8ms, ingest 12.15→5.24
• Phase-attribution TSV row + ledger flips with evidence run id (5b9e08a)
• Falsifier condition replaced per R3 (see rework addendum): the standing red is capacity-class (exit 137 at the 16 GiB memory.max, 4 consecutive runs predating this branch), disjoint from selection staleness — hold released; re-arms if a future red is selection-class
• R4: fresh TSV row from the post-rework run 30009199696 (appended in 1b68104): floor step 49.5 min — fits the 55-min cap; ci job 99.2→61.1 min; batch-4 collapse delivered (wet 53.20→10.82); resolves_total 3 == declared 3; peak 15.0 GiB. Cheap 3.08 and ingest 6.90 MISS the ≤2-min targets — counted residue rows in the redundancy ledger, mechanism named (see R4 below), never silence

Rework addendum (R1–R4, 2026-07-23)

R1 — child-pool lever adopted (the §9 cold-child class). run_gunbc_claims' realization is now ONE pooled claim_batch child per call (claim_batch's own pre-existing --entry/--function group grammar — no new claim grammar; the interim gunbc run --claim flag, gunbc.Cli.RunClaims op, and the ENTRY::FUNCTION spec grammar this PR had introduced are deleted as a §3 duplicate of that pre-existing surface). The cheap-gate transports consolidate to one call per GATE: layering 7 rows → 1 child (was 7 children), extdeps 5 rows → 1 child (was 5); ingest keeps one child per overlay root-set (4 — composed inputs). Walls honored: (a) the pooled child stays a separate process — never in-executor evaluation (the executor is the 16 GiB-pinned process of the crawl; the child dies and frees); (b) per-claim verdicts survive pooling via claim_batch's own loop — every row runs (no short-circuit), each failure is a named FAIL <function> line, exit nonzero iff any failed. Pooling deliberately removes the old cross-call && short-circuit inside a gate (a clean-tree failure previously skipped the scanner receipts): strictly more reporting, stated in the transport notes rather than landed silently.

R2 — batch-4 anomaly: typed disposition, named at the witness grain. The 53.2 min wet wall's dominating row is interp_recorded_fixture_witness_test.dag::interp_recorded_fixture_keystone_holds (2556 s on run 29995111208). Mechanism at source grain: the witness drives ~13+ claim_batch children each invoked with --source-root <workspace root> — every child cold-indexes the entire repo, serially. That is a cold corpus-scan on the merge path (my earlier comment's attribution to "#7107's native-routing flip" is retracted — the PR-name was polluted squash-message history; the receipt now names the witness and its transport class, not a PR). Disposition per the enrollment discipline: too heavy for the falsifier wet lane's 600 s per-receipt budget as-is, so the per-PR enrollment reverts to OfflineLocalRecipe with a dissolve-on naming the re-enrollment precondition (fixture-scoped roots / pooled lifecycle children, measured under the destination lane's budget).

R3 — falsifier hold released, replaced with the class-named check. The red's class from the failed job log of run 29999281277 (main@63feea0): exit 137 — cgroup kill at floor_peak_post=17179869184, exactly the 16 GiB memory.max, during the predict-only cold corpus; 4th consecutive red (21:12/03:16/06:32/11:59), all on trees predating this branch. Disjointness from this diff: the class is memory-capacity on the falsifier's whole-corpus cold walk; this PR (a) removes a duplicate co-resident whole-tree index (memory-reductive), (b) reduces child-process count, (c) leaves the falsifier's compile-clean cold control forced-whole-tree (its env arm precedes selection). It is not a selection-staleness signal — the class the window exists to catch — so the hold is released; if a future falsifier red is selection-class (a counted divergence), the hold re-arms and merge-recommend waits on it.

R4 — re-measure (run 30009199696, all green). Floor step 49.5 min — under the 55-min cap; ci job 99.2 → 61.1 min; wet wall 53.20 → 10.82 (the interp de-enrollment, surviving pools 20+54 rows at 9.35 min eval); resolves_total 3 == declared 3; peak 15.0 GiB cgroup-post. The two R1 targets miss and land as counted residue (ledger rows updated in 1b68104):

• cheap gates 4.65 → 3.08 min (target ≤2, miss by 1.1): the two pooled children measured ~88 s (layering) + ~64 s (extdeps) + ~33 s node eval — each claim_batch child pays a corpus-denominated MultiEntryIndex build regardless of roster size (the full pool is load-bearing for bare-reference binding today, Import strip residual: 2 lens test files + FunctionCall homonym qualification (full src/v2 strip gated on loader repoint) #6985 Class B, so it cannot be narrowed per-roster).
• ingest 5.24 → 6.90 min (target ≤2, regression +1.66 vs the interim vehicle): 4 pooled children at ~102/118/82/111 s — the 4 overlay root-sets are genuinely composed inputs, so 4 processes are structural; the per-child delta vs the deleted gunbc run --claim vehicle (~78 s/child) is a claim_batch loader-parity gap (~25–30 s/process), named in the ledger row.

Dissolve-on for both: the W3 cross-process content-keyed store (or claim_batch loader parity with the gunbc-run entry path). Net-vs-baseline both levers remain wins (cheap 10.15→3.08, ingest 12.15→6.90).

🤖 Generated with Claude Code

https://claude.ai/code/session_01F2Rc3TWb8FFexdVQDNbb44

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[briansrls]

CI-trigger anomaly + dispatched run. GitHub created no pull_request workflow run for this PR — not at open (08:32Z), not on a synchronize push (0a24597, empty). Sibling claude/* PRs trigger within seconds (e.g. #7102's branch), so the plausible delta is that this PR modifies .github/workflows/ci.yml (the regenerated declared-count line — required, else the drift gate reds) and the branch is pushed through the session proxy's app credential; the push is accepted but the PR-event run never materializes.

Workaround in place: workflow_dispatch run 29992450742 on the branch head is in progress — it exercises the full floor (dispatch = FullLedger stop policy, unconditional regen, whole-tree compile-clean scope via the .rs-touch arm, resolve-receipt gate at declared 3) and will source the acceptance TSV row. Merge admission will still want the required PR-event checks; if the dispatch run is green, a maintainer re-run/close-reopen — or whatever grants the pushing app workflows scope — should let the PR-event run materialize.

---

Generated by Claude Code

[briansrls]

Acceptance receipts — run 29995111208 (pull_request, green, srv1-04) vs baseline 29976989996:

phase	baseline	this run	mandate
compile-clean (eager whole-tree)	3.58	2.89	necessary-first-touch, unchanged
cheap gates (batch 1)	10.15	4.65	lever 3 — consumes-receipt
compile-gate consume	0.45	0.00 (8 ms walk-memo hit)	lever 3
discovery	12.80	14.66	lever 1, out of mandate
source_root_ingest	12.15	5.24	lever 2 — pooled, residue counted
reads_real_bytes	3.30	3.13	declared debt, unchanged
resolves_total	4	3 == declared 3 (gate's own green line)	Receipt 5 closed on first measure

TSVs updated on the branch (5b9e08a): phase row appended, ledger rows flipped with this run id, lever ranking 2/3/8 marked landed. Lever 8's scoped-admissible proof is floor_fast_plan_scopes_src_v2_entries_both_directions (this run itself is .rs-touch → whole-tree by arm 3, correct).

One anomaly, not in any mandated stage: batch 4's 55-row exec corpus went 1.3 → 53.2 min, dominated by interp_recorded_fixture_keystone_holds at 2556 s (PASSED — slow, not red; floor_skip_discovery 265 s and cross_shard_seam 201 s next). Evidence on attribution: (a) the row ran in seconds on every green CI baseline whose tree ≤ #7094; (b) nothing in this PR touches its call graph (it replays recorded fixtures by driving claim_batch --record/--hermetic children — not the pooled transport, not the executor lane, not the roster); (c) the one substantive tree delta in between is #7107 — per its squash message actually the native-routing flip (NativeRouted family legs that cargo-build, toolchain-keyed cache roots that deliberately cold-rebuild) — whose main-side cold controls have never completed (its main push run was cancelled; the first falsifier carrying it, run 29999281277, has been in progress 3.5 h+); (d) a local A/B was attempted and discarded honestly — the row is ≥25 min in this container even at pre-#7107 c0e5732, so local walls are environment-dominated and cannot discriminate. The running falsifier on main@63feea0 is the real control: if its wet lane shows the same row slow, the regression is main-side (#7107-class), not this PR's.

Merge-readiness per the brief: floor green ✓, verdict-identical ✓ (all gates/witnesses PASS; the one prior red was the Phase-0(b) admission wall correctly catching two unrostered rows, fixed in 38d5075), TSV + ledger receipts ✓. The remaining acceptance condition — falsifier green through one full cadence window — is currently blocked by main-side state, not this PR: the falsifier was red on main for 3 consecutive runs before this branch existed (21:12/03:16/06:32, trees ≤ #7094), and the current run is the first to carry #7107. Will report when it completes; not merge-recommending until that window is readable.

---

Generated by Claude Code

[briansrls]

#7120 interaction (branch now carries it via 4eeb5f1): the floor step cap is now 55 min, sized off recent green main floors (~47-51 min) — runs that did not yet carry the batch-4 anomaly measured above (53.2 min alone; the first main-side control with #7107 aboard, falsifier run 29999281277, is still in progress after 4 h). If that anomaly is real on main, the arithmetic is: pre-#7122 floor ≈ 48 + 52 ≈ 100 min → timeout; with this PR's levers ≈ 34 + 52 ≈ 86 min → still over the 55 cap. So this PR's next synchronize run (and main's first affected deep run) may red on the floor-step timeout for a cost this PR reduces but does not own. Reporting here when the falsifier lands either way.

---

Generated by Claude Code

[briansrls]

Falsifier landed: red, main-side, OOM. Run 29999281277 (main@63feea0, the first carrying #7107) failed at 11:59Z with exit 137 — cgroup kill at floor_peak_post=17179869184, exactly the 16 GiB memory.max (a censored lower bound per the calibration label; killed on srv3-04 after ~93 min). That is the 4th consecutive falsifier red (21:12 / 03:16 / 06:32 / 11:59), all on trees predating this branch — a standing main-side capacity condition, not a divergence signal, and this PR's memory effect is reductive (the memo-lane colocation removes a duplicate whole-tree index that previously co-resided on a spawned thread).

Two consequences: (1) the batch-4 anomaly attribution stays open — the OOM kills the falsifier before its corpus can read the interp_recorded row, so the first completed main-side cold control is still outstanding; (2) the brief's acceptance condition "falsifier green through one full cadence window" is unsatisfiable by anything in this PR's mandate while main's falsifier OOMs. Everything else in the acceptance is green and receipted (floor green, verdict-identical, resolves 3==declared 3, TSV row + ledger flips with evidence run id). Holding merge-recommend per the brief; the falsifier window is the sole open condition and it is operator-territory (capacity/#7107-class, the falsifier-alert lane's jurisdiction).

---

Generated by Claude Code