Frontier survey did not complete: interrupted-run receipt (0 receipts) + roster provenance rung-inflation finding

[gunbai-bot]

What this is, and what it is not

The authoritative exact-head 27/27 frontier survey did not run. This PR lands the executed receipt of an interrupted run plus one substantive finding. It contains no frontier measurement and no blocker-class counts, and it edits no roster row.

It also contains no probe memory requirement — see the corrections below.

The runs (6 probe invocations, 0 receipts)

Every probe invocation was SIGKILLed before emitting a receipt for any module: a one-shot over all 27 (died during module 1), 03_normalize, 03_resolve and 01_tokenize individually at src/v2+dag, 03_normalize at src/v2 alone, and a later retry of 01_tokenize under low host load. All die at the same place — after the per-module probe begins, inside the interpreted evaluation, with the ingest closure already fully read.

Corrections: four hypotheses raised and refuted by execution

This PR's value is mostly in what got killed by controls rather than reported.

Hypothesis	Verdict
The 10 never-measured modules are the memory-bound ones	Refuted — 01_tokenize, one of the measured 17, fails too
The widened src/v2+dag root set is the cause	Refuted — 03_normalize fails with src/v2 alone
The probe requires >31 GiB	Refuted — memory.peak is 8.5 GiB
This host cannot cold-build v1-compiler	Refuted — independent same-cap control builds it at 3.26 GiB

The counter misread, named so it does not recur

memory.max     33578549248   31.3 GiB
memory.peak     9136902144    8.5 GiB   high-water across EVERY run
memory.events   max 0   oom 0   oom_kill 10

max 0 means allocation never reached memory.max. oom 0 means the cgroup OOM killer was never invoked. In cgroup v2 oom_kill also counts tasks reaped by a killer above this cgroup. The cgroup never exceeded 27% of its cap.

oom_kill incrementing in lockstep with the kills is a sound control for "was this a kill" and a worthless one for "what hit the limit". An earlier revision built a three-tier capacity narrative on exactly that inference. memory.events max/oom and memory.peak answer the second question and were available the whole time.

Not a leak either: memory.current was 391 MB before the jobs=1 build with no cargo/rustc running, and memory.peak never moved. A retry under low host load survived to 3.5 min at ~2.0 GB — past every earlier run — then was killed anyway without raising memory.peak. A 2 GB process SIGKILLed with 80 GB free on the host, in a cgroup at 27% of cap, is not explicable by this cgroup, host exhaustion, or a session leak. /proc/self/cgroup is namespaced to 0::/, so the actual limiter is not observable from inside. Reported as an operator finding rather than guessed at.

Consequently the lane is INTERRUPTED AND RETRYABLE, not blocked, and probe memory cost is UNMEASURED, not high. The receipt and carrier note were renamed off memory_refusal — that name asserted the conclusion the evidence killed.

Withdrawn claims are marked withdrawn in place rather than deleted, so the next reader sees the correction and the reasoning that produced it.

Finding: rung inflation in the roster carrier

Independent of everything above — a static fact about call sites and signatures, unaffected by any memory observation.

v2.compiler.self_host.frontier declares knowledge_attributed_blocker_class_seed_retained_row — the constructor that honestly marks a row knowledge-attributed — and it has zero call sites repo-wide; the only occurrence is its own definition.

Meanwhile all 10 roster modules never execution-measured at any head are authored through execution_measured_seed_retained_row, whose name asserts execution measurement (8 directly; 03_normalize and 03_body_producer via quarantine_seed_retained_row_from_oracle, which delegates to it). The 10 are derived by joining compiler_frontier_sweep_order against the interim TSV's module column, not counted by hand.

The mechanism matters more than the count: that constructor takes measured_blocker, located_stage and located_reason as ordinary parameters, so it cannot distinguish measured from attributed — the name asserts a provenance the type does not carry, and no discipline at the call site can make the claim checkable. This is DESIGN §4b rung inflation, and it is why a carrier reading execution_measured is not evidence of measurement.

The §5 construction fix is a provenance field making an attributed row unrepresentable as measured. No roster row is edited here — frontier.dag is load-bearing, so this is flagged for routing, not landed.

Recipe defects: one confirmed, two predicted and refuted

Confirmed: ctrl-build defaults to remote and BuildBuddy refuses a detached worktree (unexpected branch state * (no branch)). The recipe mandates a detached worktree, so the mandated procedure and the default build path are mutually exclusive; ctrl-build --local is required. Corrected in the recipe note.

Refuted — no module collision: a duplicate manifest module in a third source root does not refuse, tested both inside and outside target/.

Refuted — target/ roots are indexed: an invalid .dag placed in a third root under target/ fails the compile loudly (parse error naming the file, exit 101), so the recipe's emitted manifest will be read.

Recorded separately because it is real and independent: compiler_frontier_wave2_blocker_partition_totality_holds passes on an empty manifest, so it can never be read as evidence that a survey ran.

Verification

All three edited .dag modules compile with zero own-file diagnostics.

Incidental and unrelated to this branch: every compile at this head exits 1 on 4 hard diagnostics in dag/extdeps/systems/nvidia.dag (SPARK-0 2be88489b13) — body-grain source annotations, the DESIGN §4c refusal. Cited offsets are byte offsets in a 120-line file. They appear even for a 26-source closure that excludes the file, so they are tree-wide. This diff touches four files and none is nvidia.dag.

Changes

• docs/probes/frontier_probe_run_interrupted_2026-08-06.md — the receipt (new)
• src/v2/compiler/self_host/frontier_probe_survey.dag — frontier_probe_run_interruption_note and frontier_roster_provenance_constructor_inflation_note, so the authority lives on the carrier rather than only in a doc (DESIGN §6: no parallel-ledger docs)
• dag/gunbc/doc_graph_roots.dag — HandAuthoredDocBind with dissolution trigger (an unbound probe doc passes PR CI and reds the falsifier)
• dag/gunbc/ci_layer_roots.dag — recipe corrected with the --local requirement and pointed at the interruption note

Status

Ready for review; operator ruled the negative evidence should merge, because it prevents the next worker from increasing memory, narrowing source roots, or rerunning the same unobservable experiment and calling the result an OOM. It does not wait for the eventual successful survey — a negative result is publishable on its own.

Admission contract for the authoritative survey

Stated as conditions on the tree, naming no PR number, no head SHA, no draft state and no control tally. A receipt that names those is a second mutable copy of the board: wrong again every time the board moves, and patched by hand each time. That is the same defect class this PR's own finding is about, one layer down — a claim asserted somewhere that cannot check it — so this PR does not commit it.

The authoritative survey may start only when all four hold:

1. whole-tree hard diagnostics equals zero
2. ConstructorReferenceAdmission has one authority and no known-red control
3. all seven partition crates are continuously checked
4. FrontierEvidenceProvenance is construction-enforced

Each is decidable against whatever head is current. For which change currently carries which condition, read the board — not this PR.

Two are easy to under-read. Condition 2 is not discharged by a de-fork landing while a control remains inverted: one authority and no known-red are both required, because a partially admitted constructor authority means a survey measures a tree in which a sealed constructor is reachable without admission. Condition 4 is what stops the survey writing all 27 roster rows through the conflating constructor.

Named successor to the rung-inflation finding — proposed shape, NOT landed here

Operator-authored. This PR does not implement it: no type is declared, no constructor changed, no roster row touched. #7901 records the defect; a separate small carrier change fixes it, and must land before the survey (condition 4 above):

type FrontierEvidenceProvenance
  = ExecutionMeasured   { subject: FrontierSurveySubject, receipt: FrontierProbeReceipt }
  | KnowledgeAttributed { source: DeclarationRef, dissolve_on: DeclarationRef }
  | OracleDerived       { oracle: DeclarationRef }

The load-bearing detail: ExecutionMeasured requires a typed subject and a typed receipt, and the row constructor must consume the variant — so a row cannot claim execution-measured provenance without carrying the receipt that proves it. A constructor named execution_measured_* that accepts ordinary caller-provided blocker fields is a name-level claim, not evidence. That is what would make the finding in this PR unwritable rather than merely documented — once the separate change lands. Until then the defect stands recorded and unfixed, which is the honest state.

Survey execution model: 27 independent jobs, not one process

One pinned subject · 27 independent module jobs · one receipt artifact per module · one final exact-subject aggregator.

This is designed directly out of the failure this receipt records. The costly property of the six runs was not that they died but that each death cost everything — the one-shot lost all 27 modules when module 1 was killed. Under the ruled model a killed job yields one interrupted row, rerun independently; twenty-six completed rows are not lost because the twenty-seventh receives SIGKILL.

A monolithic 27-module process must not be retried in the same opaque session envelope: the ancestor killer is still there and still unobservable from inside, so the response is independent jobs with a visible kill boundary, not a bigger cap. Every receipt carries the same exact subject, and a killed job is rerun, never hand-reconciled — reconciling a job that ran against a different subject is what turns a partial survey into a fabricated one.

Required output shape when it runs

frontier population:  27
exact-head measured:  27
SelfEmitReady:        N
EmitterProduced:      0
blocker groups by DETAILED cause

The last line is load-bearing and is not a table of high-level reason strings. The 14 modules that shared ^parse_grammar_choice_overlap_residue at 9f978aa8df need their detailed causes separated, because the next phase picks the lowest-cost module in the largest detailed group on the premise that one root governs many — a high-level grouping cannot rank that.

[gunbai-bot]

Both findings in review 49553 verified against current code and both are real. Fixed in 1019b3d2e47.

You caught the exact defect this PR documents, committed by me while documenting it: c2edc865cbb corrected the survey carrier and left the recipe text behind, producing a second authority that contradicted the first. DESIGN §3, in the file whose subject is §3.

1 — ci_layer_roots.dag compiler_frontier_per_module_probe_exclusion_note. Replaced "BLOCKED BY EXECUTED REFUSAL / OOM-killed / both paths unreachable / a single module exhausts the cap alone" with what the counters actually support: runs interrupted; cause open and not a demonstrated capacity limit (memory.events max 0, oom 0; memory.peak 8.5 GiB against a 31.3 GiB cap); probe memory cost unmeasured; "unreachable" not established; retry in a fresh job/runner with an observable kill boundary. The clause now points at frontier_probe_run_interruption_note instead of restating it — one authority, not two.

2 — doc_graph_roots.dag bind dissolution. Dropped the "(memory refusal resolved)" parenthetical and the "refusal receipt" wording. The trigger is now the carrier's own: the probe emits a receipt for at least one module.

Swept the rest of the diff for the same class rather than fixing only the two cited sites — which surfaced two more you did not flag:

• The interruption note still opened "EXECUTED REFUSAL" and said the probe "is OOM-killed".
• A wrong count. Both the note and the receipt said five invocations. There were six. The missing one is the low-host-load 01_tokenize retry — the run that survived to 3.5 minutes at ~2.0 GB, past every earlier attempt, and then was killed anyway without raising memory.peak. It was described in prose but absent from the count and the table, so the single strongest piece of evidence against the capacity reading was not being counted as evidence.

An undercount in a receipt whose entire purpose is negative evidence is the same defect you caught, so it is fixed here rather than left for a later reader.

Verified: all three edited .dag modules compile with zero own-file diagnostics. The non-zero exit is 4 pre-existing nvidia.dag diagnostics from SPARK-0 (2be88489b13), tree-wide and untouched by this branch — documented in the receipt as an incidental observation for routing.