Run merge admission as ordered CI success stages

[briansrls]

Summary

Populate the live CI WalkPlan on-success roster with two ordered singleton stages: stamp the captured checkout subject, then fresh-fetch and gate the current merge target. The old cold stamp/gate shell-emitter web is deleted atomically, and the live schedule lens consumes the same roster authority so divergence is red from the first populated commit.

This is a topology/cost migration. It preserves GatingComputedDeferred: the PR makes the fresh observation and gate warm and ordered, but does not activate merge-freshness enforcement or describe that policy arc as complete.

Capture placement and authority

The original in-process ordinary capture falsified its Negligible declaration in production. Even after de-fusing the claim to a 54-module closure, run 30702499883 showed one spawned-worker arena surviving thread join: capture passed, discovery handed off at 7.4 GiB versus the 5.2–6.1 GiB controls, swap grew to about 32 GiB, and discovery remained at entry 0 until the 60-minute wrapper expired.

Per the Dispatch A→C ruling on 2026-08-01, capture is now a modeled TypedClaimSubprocess in WalkPlan.pre_walk_execution. claim_executor resolves the narrow transport entry and the transport launches the already-built claim_batch child through gunbc.WitnessBin.Run; no raw shell string and no ad-hoc Command is introduced. Child failure is a typed, located pre-walk refusal and blocks batch 1. The child address space dies before the ordinary floor, structurally reclaiming its evaluator arena.

WalkAttemptId, TestedSubject, and the exact capture path/wire helpers have one home in gunbc.merge_admission_subject. gunbc.merge_admission imports that carrier and retains classification/admission policy. Capture, stamp, and gate consume the same subject authority; the carrier never imports the domain. The tested-subject writer is unchanged, and the literal five-line byte-lock witness remains green.

The two success stages intentionally retain their disk-visible barrier. They use the same entry but do not claim cross-stage resolved-context memo reuse. Accounting therefore allows up to two stage resolves and records the actual count, wall, and memory in the attempt-scoped receipts.

The first production run to reach this population exposed a separate placement defect: non-heavy stage units were sent to a worker thread even though process_shared_index is thread-local and warmed only on the executor main thread. That rebuilt a cold index inside the supposedly warm stage path. Per the Dispatch A→C ruling on 2026-08-01, on-success units that would otherwise spawn now execute through the existing run_batch_unit on the main thread. They still acquire the same governor AdmittedSlot; ordinary placement is unchanged. WalkPlan already permits withdrawing sibling overlap, and the live roster consists of singleton stages, so the schedule lens remains unchanged and green.

The same run also showed that the postcondition watchdog could terminate during a silent resolve without leaving an observable stage mark. The modeled WalkPopulationBudgetRefusal now carries population, plan site, one-based stage/batch index, exact active unit, measured elapsed wall, and the budget that fired. The watchdog durably writes that receipt and flushes the located stderr line before exiting. A child-process discriminator proves both artifacts survive the forced exit.

Before receipts

• Current-main cold baseline: run 30671526012, job 91291716818 at ddbc5fd6aa; stamp 94.26s, gate 102.87s, combined 197.13s.
• Temporary first placement: the ordinary capture raised the measured floor resolve count 1 → 2 (resolves_total=2, resolve_ms_total=64486). Moving capture into the typed child returns the ordinary in-process declaration to 1; the child resolve remains visible in the pre-walk receipt rather than being counted as an ordinary resolve.
• Production false-profile RED: run 30702499883, job 91377903771 at 660436107; capture passed, discovery handoff was 7.4 GiB at entry 0/845, memory rose to 14.9 GiB plus swap, swap reached about 32 GiB, and the 60-minute wrapper expired with discovery still at entry 0.
• No-capture control: run 30691107295, job 91346262897; discovery reached entry 46/843 by minute 8 and entry 177 by minute 10 around 5.2–5.4 GiB with no swap, finishing green in 26m49s. The closure delta was only +4 nodes/+36 rows, while the retained memory delta matched the 2.1 GiB first-worker share.

Executed validation on the typed-child head

• ci_floor_plan_witnesses — pass, including the exact typed pre-walk row and the live success-stage roster lens.
• cargo check -p v1-compiler --bin claim_executor — pass.
• regen_stage0 --verify — regen_divergence_count=0.
• Production-shaped local control using the real floor plan and GUNBC_WALK_ATTEMPT_ID=quick-heron-typed-capture-control: typed capture child passed, wrote the unchanged five-line subject wire, and returned a located receipt with wall_ms=100088, memory_current_before=3241562112, memory_current_after=3177357312, swap_after=144097280; ordinary batch 1 began only afterward. This is placement/order evidence, not the required fleet performance receipt.
• Fleet run 30708195963 at 4607b2d71 proved the placement and resource side before an unrelated ordinary-floor witness import failed: capture wall_ms=102897, memory_current_before=3465207808, memory_current_after=3469225984, memory_peak_after=5825937408, swap_after=0, high_events_after=0. Discovery then advanced at a stable 6.4 GiB and zero swap from entry 54/847 at receipt-minute 12 to entry 524 at minute 19. The stale ci_spec_witness import failed batch 3, and construction correctly reported 0 of 2 on-success stages run with 0 stage resolves. The import now consumes gunbc.merge_admission_subject; its exact perturbation witness passes on the merged tree.
• Run 30710230296 at bf68ffb1d independently reproduced the resource result: capture wall_ms=97087, memory_current_before=3469467648, memory_current_after=3475148800, memory_peak_after=5828857856, swap_after=0, high_events_after=0; discovery advanced from entry 50/848 at receipt-minute 12 to 832 at minute 25, held 6.4 GiB/zero swap throughout, and drained all 848 groups with peak_rss=7157161984. The floor then hit exactly the two operator-declared known-main primitive-surface witness reds (the_surface_is_almost_entirely_derived, the_three_denominators_are_derived_and_distinct), owned and subsequently fixed by the separate repair lane. Green-only construction correctly recorded 0 of 2 stages and 0 stage resolves.
• Run 30712984494 at d682f83d integrated that main repair and completed the ordinary floor green: typed capture wall_ms=91065, current memory 3462320128 → 3463213056, peak 5817024512, zero swap/high events; discovery drained all 848 groups with peak_rss=7162372096. The first on-success window then emitted no stage receipt for 7m22s and raised the cgroup span peak to 9390518272 before failure. Local production-shape reproduction resolved tools.merge_admission_walk as a 176-module closure in 32.616s only after paying a fresh index load dominated by 51.3s in the bare-edge index. Code inspection established why: the stage worker received a fresh thread-local index instead of the main thread's warmed one. The local timings establish the cold-index mechanism; the remainder of the fleet multiplier is unattributed and is not claimed as index wall.
• The 102.897s capture wall is predominantly the narrow child paying cold compiler/index startup, not the semantic Git observations themselves. Per operator ruling, this PR does not add a capture-specific shortcut: dissolution belongs to the pre-index-materialization-lookup/native-realization program, where the child can consume a shared precomputed artifact.
• After integrating current main, the exact live-plan witness, declared resolve-count projection, and disjoint 55m/5m budget witness all pass; current-source regen_stage0 --verify reports regen_divergence_count=0.
• population_budget_watchdog_refuses_and_writes_located_receipt — pass: a forced watchdog exit leaves the flushed located line and durable receipt with exact index/unit/elapsed/budget.
• on_success_spawned_claims_move_to_warm_main_thread_only — pass in both directions: the same negligible claim remains Spawned for the ordinary population and becomes MainThread only for OnSuccessStage.
• gunbc_ci_walk_plan_schedule_lens_holds and its synthetic red controls — pass unmodified after the placement change.
• cargo fmt --all --check and git diff --check — pass.

Remaining draft bar

• Rerun final head 1432d825e0 through the now-main-thread success stages. Record both stage closure/profile receipts, actual resolves, memory, and wall; make the observed profile honest if it differs from the authored declaration.
• Compare total admission-related wall honestly: old 197.13s two-cold-process baseline versus new 102.897s capture subprocess + warm stamp stage + warm refresh/gate stage. No three-minute claim is made absent measured stage walls.
• Complete final-head CI and the normal review bar before undrafting.

[gunbai-bot]

Cross-PR semantic check for #7531: #7531 inserts the additive CheckCoverage carrier/fold before the receipt constructors. Its classify_check_coverage_admission path does not call legacy classify_merge_admission_verdict; it reuses only check_conclusion_admits_merge_admission_floor, which this PR leaves unchanged. The current 33-line replacement after the legacy classifier extracts WalkAttemptId / TestedSubject, so there is no hidden semantic dependency despite the shared file. Please re-run #7531’s check_coverage_admission_witness_test if this PR lands second.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

review 47523 examined the intermediate autocommit head (11396a1), which carried the ci_spec three-term wrapper (65m) with a not-yet-regenerated ci.yml — exactly the drift it describes. The current head a3c41e2 contains the main_wet regeneration: floor step timeout-minutes is 65 and the ci job backstop is 100. On the backstop magnitude: the review's own term list (10+5+65+5+5+5+5) sums to 100, not 105, and that is what the model emits; ci_workflow_witness_holds (backstop == exact step-sum + prelude, wrapper == three-term sum) is green by execution on this head, and the drift gate compares ci.yml byte-identically to the same authority that produced it. No further change should be needed for this finding. — sent from eager-boar-610

[gunbai-bot]

On review 47542's four non-blocking findings, dispositions rather than silence: (1) when write_capture_refusal_wire itself refuses, no channel to the parent remains (the claim result is a bare Bool), so child-crashed vs wire-write-refused are indistinguishable from the parent by construction — the parent's wire-absent wording will be widened to name both states in the next substantive commit rather than re-staling approvals over one diagnostic string. (2) The budget watchdog's hard exit tears concurrent writers the same way the outer workflow timeout always has; atomic temp+rename receipt writes are a real hardening item but separate work. (3) refresh_current_target_and_gate's bare-false arms are the documented staging window — the typed-refusal treatment lands with the merge_freshness_verdict_is_consumed_to_block flip, which is the same commit that makes those arms load-bearing. (4) gunbc_ci_walk_overhead_allowance_minutes is a declared envelope: the direction is receipted, and the magnitude gets its measurement from the pre-walk/finalization receipts the step itself emits once it runs on the fleet. — sent from eager-boar-610

[gunbai-bot]

Review 47596, finding by finding — findings 1–3 fixed in 0187240; finding 4 is deliberate, rationale below.

1 (wire relpaths hardcoded in Rust): the two seed read sites now go through MERGE_ADMISSION_CAPTURE_REFUSAL_WIRE / MERGE_ADMISSION_REFRESH_REFUSAL_WIRE consts whose doc-comment names the paired .dag authority, and both dag relpath data rows carry a _seed_pairing note pointing back at the const — the same paired-literal discipline as floor-population-budget-refusal.txt, under walk_plan_run_stage_claim_executor_seed_deferral. The seed cannot import a .dag datum, so the pairing note on BOTH ends is the strongest available wall short of the self-host frontier.

2 (minted bin path): merge_admission_capture_transport now routes through gunbc.cli_invoke release_bin_rel_path(bin_name: "claim_batch").

3 (ratchet-off widening arm): landed merge_admission_refresh_ratchet_off_widening_note + a co-located Disposition = Scaffold row bound to gunbc.ci_failure_class merge_freshness_verdict_is_consumed_to_block — the flip commit deletes the else arm (verdict match becomes unconditional) and the row together. The arm itself stays: the fleet-gating policy requires the shadow phase (verdict computed and receipted, never blocking unrelated PRs) before the mechanism may deny.

4 (detached watchdog process::exit(1)): deliberate, not fixed — the exit IS the enforcement of the declared population ceiling. The cooperative check at the batch boundary only fires between batches; a single wedged unit (hung fetch, interpreter loop inside one claim) never reaches the next boundary, so without the detached thread the ceiling is advisory exactly in the case it exists for. Ordering inside the watchdog is receipt-first: it writes the typed PopulationBudgetRefusal receipt and flushes stderr sequentially on the same thread before exit(1), so the post-mortem artifact for the overrun case is complete by construction. On the race with finalization writes: the watchdog can only fire while armed, i.e. while the population has genuinely overrun its declared budget — in that state the materialization receipt is already not going to be a within-budget receipt, and the designated artifact for the state is the budget refusal. The realistic alternative is not a graceful drain: it is the CI wrapper timeout, which is a SIGKILL that writes nothing. The watchdog converts that opaque kill into a typed, located, counted refusal.

— sent from eager-boar-610

[gunbai-bot]

Review 47629 addressed in 5c7ba15: parse_git_tree_object_id is deleted and both call sites (target tree observation and the v1 receipt wire parse) now route through extdeps.git.object_store git_object_id_from_untagged_hex. On the v1 wire's eligibility for the untagged decoder: git_object_id_wire_hex renders bare unprefixed hex, so width-based family inference is the factually correct read-back for that legacy wire (the family-prefixed <family>:<hex> form is the v2 wire only), and the producer witnesses prove the round-trip by execution — 11/11 PASS locally including wire_roundtrip_preserves_admission_fields.

— sent from eager-boar-610