CI floor endgame: every priced lever + the cost wall (D1–D6)

[briansrls]

CI floor endgame: every priced lever + the cost wall (D1–D6)

Baseline: carries #7123's docs (resolve-regression-journey.md, attribution doc §9–§9.2) as the fresher superset — #7123 closes as superseded after this merges (operator owns the close). Every number below has its receipt in those docs, the lever TSV, or run 30009199696.

Model (each deliverable extends ONE existing authority)

• D1 — per-batch pooling extends the transport discipline (tools.host_prelude → tools.cheap_gate_pool): batch-0's claim-backed gates shared source roots but each paid its own corpus-denominated MultiEntryIndex child (~88s + ~64s on run 30009199696). The pool = the DERIVED union of the two concern authorities (never a third roster; roster_registry ByDerivation), run as ONE claim_batch child, K sub-pools sized to the slot (cheap_gate_pool_max_claims_per_child, the §9.1 memory-cliff wall) — the pooled child stays a separate process from the executor (wall (a)); per-claim verdicts stay named by claim_batch's PASS/FAIL-per-function loop (wall (b)). A new CheapClaimPoolGate runs the pool; the layering/extdeps gates became non-vacuous enrollment walls asserting chunk-transform totality (the pool is their union by construction, so bare membership would be an inert tautology — the K-chunker between pool and children is the code that could drop a claim, and that drop reds both concern gates; the compile_clean_shard_totality pattern). Ingest's 4 children stay — the mktemp overlay root-sets are the genuine constraint, stated in-row (ingest_pool_separation_note): distinct root-sets are structurally distinct index processes, and merging them re-opens the module-path-collision class the mktemp isolation closes.
• D2 — teardown fast-exit extends the executor's terminal path only: floor_terminal_fast_exit after receipts flush skips the 2.5–3.1 min Drop walk of the ~16GB retained store (twice-confirmed: Pi swap-growth during Drop; run 30009199696's +3.1 min post-batch-7 tail). It is the common tail of run()'s walk path (every plan walk exits through it). Exit code preserved by construction (walk_exit_code, unit-pinned); receipts complete before the exit by construction (written inside run_walk; their write failures fold into any_failed), and the RED control unwritable_receipt_base_reds_not_vanishes proves a truncated/unwritable receipt reds rather than vanishing. fix governor #7119/Finish 7043 (floor budget refusal): ground witness rows on existing FloorOutcome + plan-roster fact #7072's governor arm (FloorBudgetBelowMinimumFootprint, commit 5cd0155149) touches ARM time — no overlap with this exit-path change; nothing forked (and its arm fired live during local validation on this memory-capped container).
• D3 — selection-control diagnosed within the §9 class: the 4m51s step (vs 80s local) was THREE cold whole-pool index builds inside one process — the two budget_roster_* cases called bare build_multi_entry_index, then the first corpus case built the thread-shared index (R4 log: first control line at t+2m07s). The warmup case now rides resolve_entry_graph_shared so the suite pays ONE shared build; budget_roster_resolves_cold keeps its bare build as the named cold control (the import-strip Class-B pool-coincidence witness — a resolution-correctness control, not un-finished pooling). The step stays per-PR (the widen-detector for the entry_file_touched class) and now has its redundancy-ledger row.
• D4 — discovery re-diagnosis, instrumentation first: lever-1 stays RETIRED as priced (Floor time: dissolve the #6848 once-per-entry fixpoint + reconcile-miss qualified-fill (~18min residual) #7030/floor: precompute both-closure edges to dissolve per-entry bare-ref fixpoint #7056 ancestors of the measured run, zero recovery). The pump's phases land as typed rows in the floor resolve receipt (discovery_pump_wall_ms, discovery_roster_walk_ms, discovery_diff_observe_ms, discovery_frontier_attribution_ms, discovery_shared_index_build_ms, discovery_preresolve_calibration_ms, discovery_runner_resolve_ms, plus discovery_corpus_resolve_ms/discovery_corpus_eval_ms serial sums) — not prints. The fresh per-phase profile from this PR's own runs names the next mechanism; if it names the identity authority or the retention lane, the receipt + frontier row is the deliverable (no downhill patching) — the lever-TSV 1-retired row records exactly that discipline.
• D5 — THE COST WALL extends gunbc.ci_spec (one carrier): gunbc_ci_floor_batch_wall_budget_seconds = [240, 60, 1320, 420, 120, 600, 420] (per-batch, receipt basis per row in the note; sum 53 min under the 55-min cap). claim_executor reads it fail-closed at arm time (the fast-lane-budget pattern; length must cover the schedule exactly — witness-pinned), records every batch's wall as typed receipt rows (target/floor-batch-wall-receipt.txt: wall/budget/verdict per batch), and reds an over-budget batch with the typed, located refusal FLOOR-BATCH-OVER-BUDGET batch=N wall_ms=… budget_ms=… (budget row: …) — never a rerun, never a widen, never a silent cap raise. Denominated per-batch, never per-run (§9.2: plumbing PRs legitimately run 46/55 wet rows; a per-run wall reds them spuriously). Ruling reconciliation stated and operator-SIGNED in the carrier note (briansrls, 2026-07-23): "no wall-clock term in any verdict" governs WITNESS verdicts; batch budgets are admission/scheduling facts at the walk grain — the 5-second-eval-law split — with the signed line as the declared human-signed exemption row the 2026-07-10 ruling requires. Raise discipline as signed: RAISING requires a new dated operator-signed line naming run id + enrollment; TIGHTENING by ordinary receipt note; the on-call remedy for FLOOR-BATCH-OVER-BUDGET is diagnose-or-signed-raise, never rerun. RED control both directions via GUNBC_FLOOR_BATCH_BUDGET_TIGHTEN_MS — a tighten-only injection (min), structurally unable to widen a budget. Named follow-up rows in the carrier: the prelude coverage hole (~5 min pre-batch-1 sits outside every budget), identity-keyed budgets, and the K=16 union-RSS receipt.
• D6 — short/quick wet discipline extends the bin_witness_wet_entries frontier (gunbc.ci_layer_roots): per-row wall budget bin_witness_wet_per_row_wall_budget_seconds = 60s. Run 30009199696's per-row table: the 54-row pool's 561s eval was 94% three rows — floor_skip_discovery_keystone_holds 289s (ALSO a per-PR duplicate of the selection-control step), cross_shard_seam_preservation_holds_on_live_tree 183s, dag_compile_clean_perturb_receipts_holds 53s (under budget, stays). The two over-budget rows re-home to a new falsifier wet lane (gunbc_falsifier_rehomed_bin_wet_batch, batch 5 — same mechanism as the other falsifier lanes) as typed frontier rows (falsifier_rehomed_bin_wet_rows: reason + dissolve_on each, enrolled in gunbc.roster_registry); the remaining 52 rows are the per-PR smoke subset (plumbing PRs keep a discriminating signal at ~1.6 min eval). The executable wall against silent regrowth is D5's batch-4 budget — a new heavy row blows it with a typed refusal even if review misses the per-row rule. The re-homed rows name their executing consumer through the new FalsifierRehomedBinWet cadence (std.witness_admission), wired through the exclusion-frontier classification, the v2 admission lens (consumer routing + manifest + backing check with its own unbacked-row RED control), and the Rust source-scan classifier (RehomedBinWetRow head, unit-pinned) — the integration: module-identity Phase 0(b)/1 + qualified_name de-fork + emitter Ord unlock (single merge point) #6866 admission invariant untouched.

Hard rules held

• No timeout raised: floor step stays 55 (gunbc_ci_floor_step_timeout_minutes); the cost-wall landing is APPENDED to the timeout note's bounce history; 55 → 40 is proposed as a data change AFTER post-merge receipts (operator signs; not in this PR).
• Falsifier cron/cadence untouched: falsifier.yml and the cold-control envs unchanged; the falsifier PLAN gains lane 5 (the D6 re-home destination — the brief's own instruction), enrolled through the same falsifier_batches_append_if_enrolled fold as lanes 2–4.
• No witness verdict changes: budgets never touch verdicts (admission split, operator-signed in the carrier note); the pool preserves per-claim run_claim semantics and the conjunction (no short-circuit — a v1 language fact, §9.2); the two re-homed rows run identically on the falsifier cadence; gate-grain attribution moves to the pool gate deliberately, with the failing CLAIM still naming itself (the finer grain).
• Non-goals untouched: ComputationIdentity authority, M2/W3 retention lanes, the 2,652-unlisted-import divergence (flagged, not ours), governor caps/width.

Test plan (proof by execution)

• cargo test -p v1-compiler --bin claim_executor — 18/18: walk-exit-code pin, unwritable-receipt RED (unwritable_receipt_base_reds_not_vanishes), batch-wall receipt verdicts both directions, existing lane-promotion battery
• Whole-tree --target dag compile: zero new error identities vs main — pristine main itself exits 1 with 2,647 unlisted-import errors (the flagged two-surface divergence, a named non-goal); the branch-vs-main error-set diff is line-number shifts plus files the merged main added. The two non-exhaustive match: missing variant(s) CheapClaimPoolGate hard diagnostics the first compile caught (floor_materialization, merge_admission) were fixed, and the post-cadence-variant round-3 compile shows zero hard diagnostics — the construction wall doing its job.
• main_wet regen: falsifier.yml/DESIGN byte-identical; ci.yml healed (converged byte-identical with main's own auto-heal of the stale fleet-converge line) and ROADMAP.md healed on the merge tree (main's committed copy carried a trailing blank line its generator does not emit — the first floor red, reproduced locally and regenerated).
• Batch-0 pool by execution: ONE claim_batch child evaluated all 4 batch-0 gate fns — cheap_claim_pool_gate_passes PASS (its ONE nested pooled child ran all 12 claims, per-claim PASS lines), both enrollment walls PASS, drift gate PASS after regen; chunk-totality witnesses 4/4 incl. the RED discriminator (cheap_pool_chunk_totality_red_control_holds).
• Budget-gate RED control BOTH directions by execution on budget_red_control_plan.dag: with GUNBC_FLOOR_BATCH_BUDGET_TIGHTEN_MS=0 → the witness itself PASSes (verdicts untouched — the admission split, live), ✗ FLOOR-BATCH-OVER-BUDGET batch=1 wall_ms=35419 budget_ms=0 (budget row: …) prints, exit 1, receipt row OverBudget counted; without the env → exit 0, WithinBudget. (Local runs needed GUNBC_MEMORY_BUDGET_BYTES above the 12 GiB arm-time floor — this container trips the Finish 7043 (floor budget refusal): ground witness rows on existing FloorOutcome + plan-roster fact #7072 FloorBudgetBelowMinimumFootprint arm otherwise, which is itself that refusal proven live.)
• Selection-control suite green end-to-end locally (18 controls; one shared index + the named cold control; the orphan-doc red it caught was real — the carried journey doc needed its inbound link — and the doc wall re-proved green)
• ci_floor_plan_witnesses + ci_floor_optin_roster_witnesses PASS (schedule lens, cheap-membership now 4, falsifier 5-lane structure, budget-coverage witnesses); witness-admission + exclusion-reconciliation witnesses 6/6 incl. the new unbacked-rehomed RED control
• Acceptance-1 per-batch residuals from this PR's green CI run (headline wall is plumbing-profile — §9.2): batch-0 ≤ ~2 min target (first run: batch-1 wall ~2m05s incl. the pooled child, under its 240s budget), teardown tail gone from the ci_job row, selection-control step wall, discovery phase receipt rows present

Prediction (acceptance 3)

First post-merge ordinary-diff main floor ≤ ~30 min. Basis: 49.5 min (run 30009199696 floor step) − ~3.1 teardown (D2) − ~1 batch-0 pooling (D1) − wet-lane re-homes (D6; plumbing profile −7.9, ordinary diffs less because their wet baseline was already ~1.3 min) − selection-suite share where it appears, against the ordinary-diff discovery/wet profile of §2/§9.2. The actual gets recorded in attribution doc §9.3 post-merge — a miss is a receipt, not a silent pass.

Counted residue (named, not silent)

• Ingest stays 4 children (~414s) — the mktemp constraint named in-row; dissolves on W3 only.
• One pool build per batch-0 child and per ingest leg — the in-process irreducible; dissolves on W3.
• Discovery's 643–1024s resolve wall — instrumented (D4), re-diagnosis gated on the fresh receipt; lever-1 retired as priced.
• The 1-qualified memory-cliff row — honored via the K-sub-pool cap; full pooling payoff waits on the retention lane (K=16 provisional until the pooled child's union-RSS receipt lands — follow-up row in the carrier note).
• The prelude coverage hole (~5 min before batch-1 arms) sits outside every batch budget — named follow-up row in the carrier note.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F2Rc3TWb8FFexdVQDNbb44

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[briansrls]

Review: Approve (qualitative — CI didn't complete on this head). Design-review verdict from the CI-audit session; run 30027001708's partial actuals are consistent with every prediction the PR makes.

The red on run 30027001708 is not this PR. Since this branch's merge-base, main took exactly one merge (#7110), which changed ROADMAP.md's authority — the merge-ref's textually-merged ROADMAP.md is not the regen fixed point of the merged authority, so generated_artifact_drift_gate correctly returned false. Remedy: merge origin/main, rerun main_wet, push. Note what the failure demonstrated: batch-1 red → the floor stopped before dependent batches and exited at 8m05s with a located ✗ FAIL — the fail-fast shape working, instead of a 40-minute doomed run.

What the partial run already proved by execution:

• The cost wall ran in CI for the first time: floor batch walls: 1 batch(es), 0 over budget — recording live, batch 1 ~2m05s against its 240s budget.
• D1 cheap pool: one claim_batch child, 98.5s wall, per-claim PASS lines, both enrollment walls green (was ~152s+ across two children plus per-gate index builds).
• Zero memory pressure through everything that ran (swap=0, high_events=0, psi=0.00; cgroup peak 10.5GB vs 16.1GB cap) — caveat: the heavy corpus batches never ran, so this narrows the pegging attribution rather than clearing it.
• Materialization receipt on this tree shows unkeyed≈0.6% (8,985 of 1.48M) vs the historic 47% figure — partial-run, not apples-to-apples, but flagged: if the clean rerun confirms it, the ComputationIdentity pricing in the journey doc needs a correction.

Two flags carried as residue (neither blocking):

1. Budgets are ordinal-keyed with an arm-time length pin (fails closed, loudly). The discriminating case is the first scoped/docs-only PR post-merge — if its schedule shape refuses spuriously, the fix is identity-keying (already specced in the review thread).
2. cheap_gate_pool_max_claims_per_child = 16 has thin provenance. A union-RSS ledger row per pooled child would make the cap priced rather than chosen.

Sequencing: this PR should merge before the executor-eviction keystone PR (branch claude/ci-executor-eviction-claims-wzwgbf) — they share cli_run/executor territory, and this one's D6 tames the wet profile the keystone's own branch will pay. Also: this PR and #7109 both append to roster_registry's tail; whichever merges second re-runs the standard both-append resolution.

Merge on the clean rerun's green, with the per-batch receipt (all 7 WithinBudget) recorded against the PR-body predictions.

---

Generated by Claude Code

[briansrls]

Blocker ack — landed in 7354a34: ("RehomedBinWetRow {", "") added to the recognized heads in witness_admission_entry_function_keys_from_source, head-coverage unit test extended (rehomed_bin_wet_rows_parse_as_explicit_consumer_keys pins the parse), rebuilt, and the admission/reconciliation witnesses re-proven green. The invariant itself is untouched — agreed it was #6866 working correctly on the two re-homed rows. One necessary addition beyond the scanner: the exclusion-frontier row for floor_skip_discovery_witness_test.dag was classified BinWitnessWet with its backing roster row gone, so witness_exclusion_explicit_roster_rows_consistent_holds would have redded next; the row now carries the new FalsifierRehomedBinWet cadence (std.witness_admission), with backing checked against falsifier_rehomed_bin_wet_entries() and its own unbacked-row RED control — strictly more enforcement, same invariant.

Signature applied verbatim (dated, in gunbc_ci_floor_batch_wall_budget_note) in 9461651, with the three follow-up rows (prelude coverage hole, identity-keyed budgets, K=16 union-RSS receipt), the D2 comment scope fix (common tail of run()), the §9.3 process lesson + on-call pre-positioning (batches 3/6 at 1.29×/1.45× headroom — first organic over-budget expected within days; diagnose-or-signed-raise), and the PR-body baseline flip (#7123 closes as superseded; you own the close).

Head is 9461651, CI running. Merge-on-green acknowledged — #7128 first in the queue.

---

Generated by Claude Code