diff --git a/dag/gunbc/ci_layer_roots.dag b/dag/gunbc/ci_layer_roots.dag index 5f7f7abc188..3b9951a8cf7 100644 --- a/dag/gunbc/ci_layer_roots.dag +++ b/dag/gunbc/ci_layer_roots.dag @@ -868,7 +868,7 @@ fn known_red_probe_roster() -> List { data long_lane_exclusion_note: String = "test/claim/long/ is the LONG-test home (operator 5-second rule, 2026-07-12; authority + enforcement: gunbc_ci_fast_lane_rule_note / gunbc_ci_fast_lane_witness_eval_budget in v2.workflow.ci_floor_plan): a witness whose own eval reaches 5s does not run in per-PR discovery — the executor's cooperative eval deadline REDs it by name (EvalBudgetExceeded), and the fix is moving its file here (dag/test/claim/long/, src/v2/test/claim/long/), where discovery excludes it at dir grain and it runs via the local recipe (claim_batch --source-root dag --source-root src/v2 --entry --functions ) or the scheduled lane's future enrollment. First residents (receipted): s1_closure_receipt_test (whole-closure re-parse through the interpreted v2 frontend, 90+min eval, the run-29183446733 wedge class) and self_host_module_emit_derisk_test (~31s/witness). Named consumer with file-grain exclusion row: compiler_frontier_per_module_probe_test.dag (compiler_frontier_per_module_probe_exclusion_note). Membership here was called a HOME rather than a per-file ruling on the ground that the 5s deadline makes an over-budget fast-lane witness unwritable-in-place, so the roster could not silently grow stale. THAT SENTENCE WAS FALSE AND IS RETRACTED (2026-08-04). The deadline is evaluated only while a witness RUNS; relocating its file under this prefix is precisely what stops it running, so the claimed construction backstop is disarmed by the exact move it was supposed to govern, and the home grew by whatever anyone moved into it. BudgetExceeded is an interruption plus a measured lower bound on cost — never a semantic verdict on a witness, and never a discharge of one by causing its relocation. Receipt: gunbc#7762 commit 0cfd199f8, thirteen witnesses relocated here under the title fix CI fast-lane budget failures with a claim_batch command line as their only stated consumer and no cadence row. WHAT NOW HOLDS THE LINE: this prefix still organizes the files, but it no longer answers the admission question. gunbc.witness_deferral_freeze enumerates the exact legacy identities path policy had already admitted, and any offline-classified witness outside that frozen set and outside gunbc.explicit_witness_admission refuses as UnclassifiedPathDeferral, while a frozen row the tree no longer carries refuses as StaleFrozenPathDeferral. Dissolve-on: the freeze reaching empty — every resident carrying an exact admission with a declared purpose, cost and executing cadence — at which point the pass-through arm and this dir row delete together." -data compiler_frontier_per_module_probe_exclusion_note: String = "src/v2/test/claim/long/compiler_frontier_per_module_probe_test.dag is operator-ruled OFFLINE (Lane 1 exact-head closeout): fixture-free per-module frontier_probe_emit_from_ingest receipts over all 27 compiler modules exceed the 5s per-PR fast-lane eval budget; discovery excludes via test/claim/long/ dir grain and per-PR CI never executes these witnesses — green CI says nothing about execution_measurement counts unless the local recipe below ran at a pinned FrontierSurveySubject. LOCAL RECIPE (authority): (1) predecessors #7776, #7762, and #7767 are merged; authoritative 27/27 remains on operator hold; (2) from a clean detached worktree at the selected commit, cargo build --release -p v1-compiler --bin frontier_probe_survey; (3) primary: target/release/frontier_probe_survey with every --source-root via v2.workflow.frontier_probe_survey_transport survey_manifest_emit_args (one-shot over compiler_frontier_sweep_order at one subject; OOM fallback: docs/probes/run_frontier_probe_survey_per_module.sh — TSV wire carries rejection_chain and overlap_roster_detail projections, not full detail/assemble_detail variant AST on manifest-only round-trip; every shard carries complete FrontierSurveySubject, all 27 subjects must compare exactly equal); (4) emit host_frontier_probe_survey_manifest FrontierSurveyManifest to target/frontier-probe-survey/; (5) claim_batch --source-root src/v2 --source-root dag --source-root target/frontier-probe-survey --entry src/v2/test/claim/long/compiler_frontier_per_module_probe_test.dag --functions compiler_frontier_per_module_probe_survey_holds,compiler_frontier_gap_clustering_common_root_at_blocker_class_holds,compiler_frontier_wave2_blocker_partition_totality_holds,compiler_frontier_roster_bidirectional_totality_live_survey_holds,compiler_frontier_receipt_totality_wall_live_survey_holds,compiler_frontier_wave2_emit_surface_dominates_holds,compiler_frontier_wave2_sizing_band_a_leaf_count_holds. Dissolve-on: execution_measurement=27 at one pinned FrontierSurveySubject, frontier.dag rows hand-authored from manifest, totality wall witnesses pass via this recipe — then this note, the file-grain exclusion row, and the probe scaffold delete together." +data compiler_frontier_per_module_probe_exclusion_note: String = "src/v2/test/claim/long/compiler_frontier_per_module_probe_test.dag is operator-ruled OFFLINE (Lane 1 exact-head closeout): fixture-free per-module frontier_probe_emit_from_ingest receipts over all 27 compiler modules exceed the 5s per-PR fast-lane eval budget; discovery excludes via test/claim/long/ dir grain and per-PR CI never executes these witnesses — green CI says nothing about execution_measurement counts unless the local recipe below ran at a pinned FrontierSurveySubject. LOCAL RECIPE (authority): (1) predecessors #7776, #7762, and #7767 are merged; authoritative 27/27 remains on operator hold; (2) from a clean detached worktree at the selected commit, cargo build --release -p v1-compiler --bin frontier_probe_survey — WRAP IT AS ctrl-build --local, which is REQUIRED and not a preference: ctrl-build defaults to CTRL_BUILD_MODE=remote in session containers and BuildBuddy refuses a detached worktree ('remote config: get base branch and commit: unexpected branch state * (no branch)'), so step (2)'s mandated DETACHED worktree and the default remote build path are mutually exclusive and anyone following this recipe verbatim hits it first (measured tidy-bee-50 2026-08-06); (3) primary: target/release/frontier_probe_survey with every --source-root via v2.workflow.frontier_probe_survey_transport survey_manifest_emit_args (one-shot over compiler_frontier_sweep_order at one subject; OOM fallback: docs/probes/run_frontier_probe_survey_per_module.sh — TSV wire carries rejection_chain and overlap_roster_detail projections, not full detail/assemble_detail variant AST on manifest-only round-trip; every shard carries complete FrontierSurveySubject, all 27 subjects must compare exactly equal); (4) emit host_frontier_probe_survey_manifest FrontierSurveyManifest to target/frontier-probe-survey/; (5) claim_batch --source-root src/v2 --source-root dag --source-root target/frontier-probe-survey --entry src/v2/test/claim/long/compiler_frontier_per_module_probe_test.dag --functions compiler_frontier_per_module_probe_survey_holds,compiler_frontier_gap_clustering_common_root_at_blocker_class_holds,compiler_frontier_wave2_blocker_partition_totality_holds,compiler_frontier_roster_bidirectional_totality_live_survey_holds,compiler_frontier_receipt_totality_wall_live_survey_holds,compiler_frontier_wave2_emit_surface_dominates_holds,compiler_frontier_wave2_sizing_band_a_leaf_count_holds. RUNS INTERRUPTED, not only held: step (3) has not yet produced a receipt for ANY module — six probe invocations were SIGKILLed with zero receipts, on both the primary one-shot and the per-module path. The CAUSE IS OPEN and is NOT a demonstrated capacity limit: the cgroup never reached its own cap (memory.events max 0, oom 0; memory.peak 8.5 GiB against a 31.3 GiB memory.max), so the kills came from outside it and probe memory cost is UNMEASURED rather than high. 'Unreachable' is NOT established — treat this recipe as interrupted and retryable, and per operator ruling retry it in a fresh job or runner whose real kill boundary is observable rather than trimming the probe to fit. Authority for the measurements and the withdrawn earlier claims is v2.compiler.self_host.frontier_probe_survey frontier_probe_run_interruption_note, which this clause must not restate beyond pointing at it. Dissolve-on: execution_measurement=27 at one pinned FrontierSurveySubject, frontier.dag rows hand-authored from manifest, totality wall witnesses pass via this recipe — then this note, the file-grain exclusion row, and the probe scaffold delete together." data wet_integration_offline_note: String = "Four wet-integration entries above (host_effect_apply, deploy_access_privilege, ci_deploy_observed_wet, random_bytes_csprng) are OFFLINE per the hermetic-floor posture (operator 2026-07-11: integration-style witnesses must not run regularly; CI runs hermetic/mocked behavior checks). Each performs genuinely live host effects the hermetic envelope refuses by construction: host_effect_apply drives real LocalShell/SSH host effects (the 133s row atop the slow-witness census), deploy_access_privilege applies privileged shell mutations through fixture actors, ci_deploy_observed_wet shells whoami + sudo -n, random_bytes_csprng reads host entropy. Hermetic duals stay discovered where they exist (the ci_deploy split keeps the pure half; deploy_access_check(access, actor) is the mock-shaped dual). Local recipe: claim_batch --wet --source-root dag --source-root src/v2 --entry per file. Dissolve-on: the scheduled (nightly) lane un-darkens and admits wet integration rows under its own budget — then these four enroll there as declared execution rows and the exclusion rows delete." diff --git a/dag/gunbc/doc_graph_roots.dag b/dag/gunbc/doc_graph_roots.dag index 417ec7d5f48..428af958c96 100644 --- a/dag/gunbc/doc_graph_roots.dag +++ b/dag/gunbc/doc_graph_roots.dag @@ -315,6 +315,13 @@ data hand_authored_doc_binds: List = [ additional_works: [DeclarationRef { module_path: "v2.compiler.self_host.frontier", decl_name: "compiler_frontier_receipt_totality_wall_holds", field: WholeDeclaration }], dissolution: HasTrigger { text: "execution_measurement=27 at one pinned source_head in host_frontier_probe_survey_manifest, frontier.dag rows hand-authored from that manifest, compiler_frontier_per_module_probe_survey_holds greens, and totality wall witnesses pass — then this interim audit receipt deletes with this row" }, }, + HandAuthoredDocBind { + home: ProbeDoc, + slug: "frontier_probe_run_interrupted_2026-08-06", + primary_work: DeclarationRef { module_path: "v2.compiler.self_host.frontier_probe_survey", decl_name: "frontier_probe_run_interruption_note", field: WholeDeclaration }, + additional_works: [DeclarationRef { module_path: "v2.compiler.self_host.frontier_probe_survey", decl_name: "frontier_roster_provenance_constructor_inflation_note", field: WholeDeclaration }], + dissolution: HasTrigger { text: "the probe emits a receipt for at least one module at a pinned FrontierSurveySubject and roster row provenance becomes structural — then this interrupted-run receipt deletes with this row" }, + }, HandAuthoredDocBind { home: ProbeDoc, slug: "srv2-05-native-agreement-divergence-diagnosis", diff --git a/docs/probes/frontier_probe_run_interrupted_2026-08-06.md b/docs/probes/frontier_probe_run_interrupted_2026-08-06.md new file mode 100644 index 00000000000..8469eb58bd3 --- /dev/null +++ b/docs/probes/frontier_probe_run_interrupted_2026-08-06.md @@ -0,0 +1,169 @@ +# Frontier probe runs interrupted — exact-head survey did not complete (2026-08-06) + +**Status:** EXECUTED RECEIPT OF AN INTERRUPTED RUN. This is not a frontier measurement and contains no blocker-class counts. The authoritative 27/27 survey **did not run**: every probe invocation was SIGKILLed before emitting a receipt for any module. + +**Do not read any frontier count out of this document.** The only numbers here are about the instrument, not about the compiler frontier. + +**Do not read a probe memory requirement out of it either.** The cause of the kills is **not attributable from inside this container**, and this receipt was renamed from `frontier_probe_memory_refusal_2026-08-06` precisely because that name asserted a memory-refusal conclusion the evidence does not support. Probe memory cost is **unmeasured**, not high. + +## What was attempted + +The Lane 1 exact-head closeout recipe (`gunbc.ci_layer_roots` `compiler_frontier_per_module_probe_exclusion_note`), rehearsed end to end. Predecessors #7776, #7762 and #7767 are merged on main. + +- Subject head (rehearsal only, **not** a pin): `2be88489b1303357a10b135dd90704103ea93b0e`. +- Build: clean detached worktree, `cargo build --release -p v1-compiler --bin frontier_probe_survey`. +- Provenance: `build.rs` stamps `BUILD_COMMIT` / `BUILD_TREE` / `BUILD_DIRTY`; `verify_build_provenance` refuses stale binary, commit mismatch, tree mismatch and dirty-worktree builds. All gates passed — the binary is genuinely from that tree. + +## The refusal + +Every probe invocation was SIGKILLed by an OOM killer. Host `memory.max` = 33578549248 bytes (31.3 GiB / 32023 MiB) — but see the counter analysis below: **this cgroup's cap was never the binding constraint.** + +| # | Invocation | Source roots | Result | +|---|------------|--------------|--------| +| 1 | one-shot, all 27 modules | `src/v2` + `dag` | killed **during module 1 of 27**, no manifest emitted | +| 2 | `03_normalize`, fresh process | `src/v2` + `dag` | exit 137 | +| 3 | `03_resolve`, fresh process | `src/v2` + `dag` | exit 137 | +| 4 | `01_tokenize`, fresh process | `src/v2` + `dag` | exit 137 | +| 5 | `03_normalize`, fresh process | `src/v2` only | exit 137 | +| 6 | `01_tokenize` retry, low host load | `src/v2` + `dag` | exit 137 — survived to 3.5 min at ~2.0 GB, past every earlier run, then killed anyway without raising `memory.peak` | + +Six for six. Zero receipts produced. + +**Located identically in all five:** death occurs immediately after the `probing ` line, inside the interpreted `frontier_probe_emit_from_ingest` evaluation. The ingest closure is read to completion first (the `[file] read …` lines), so this is not an ingest or discovery failure. + +### Instrument check — and the misattribution it caught + +Exit 137 alone does not establish an OOM — it is also the shape of a harness timeout or an external kill (see the repo's standing `exit 137 != red` caution). cgroup `memory.events` `oom_kill` incremented **1 → 2 → 3 → 4 → 5**, one per killed run, in exact lockstep, which establishes that these were genuine kernel kills of processes in this cgroup. + +**It does not establish what killed them, and an earlier revision of this receipt drew exactly that wrong conclusion.** The full counter set: + +``` +memory.max 33578549248 (31.3 GiB) +memory.peak 9136902144 ( 8.5 GiB) <- cgroup high-water across ALL runs +memory.events max 0 oom 0 oom_kill 8 +``` + +- `max 0` — allocation in this cgroup **never** reached `memory.max`. +- `oom 0` — the **cgroup** OOM killer was **never invoked**. +- `oom_kill 8` — eight processes in this cgroup were nonetheless killed. In cgroup v2 this counter also counts tasks in the cgroup reaped by the **global** OOM killer. +- `memory.peak` **8.5 GiB against a 31.3 GiB cap** — the cgroup never exceeded 27% of its limit at any point tonight. + +**Conclusion: these kills came from host-level memory pressure on a shared machine, not from this cgroup's limit and not from the probe's own working set.** The probe was killed at or below 8.5 GiB cgroup-wide, which is *not* the signature of a runaway. + +Two claims an earlier revision of this receipt asserted are therefore **withdrawn as refuted**: + +1. ~~"the probe requires more than 31 GiB"~~ — refuted by `memory.peak` = 8.5 GiB. +2. ~~"this host cannot cold-build `v1-compiler` at all"~~ — refuted by an independent control on the same fleet under a **byte-identical** `memory.max` of 33578549248: a genuine cold build (sccache cache hits 0, 1 compilation, 163 s of rustc) completed in 2m59s at a **3.26 GiB** peak with `oom_kill 0`. The crate needs ~3.3 GiB, not 31. + +The `oom_kill` counter incrementing in lockstep is a sound control for *"was this a kill?"* and a worthless one for *"what hit the limit?"*. Reading the second off the first is the mistake this section now records. `memory.events max` / `oom` and `memory.peak` are the fields that answer it, and they were available the entire time. + +## Two hypotheses raised and refuted by execution + +Both were plausible, both were wrong, and both were killed by a control before being reported as causes. + +**H1 — "the 10 never-measured modules are the ones that exhaust memory."** The interim TSV holds exactly 17 rows, and the 10 absent ones are sweep-order positions **1–9 and 11** — a near-prefix, with only `source_authority` (position 10) interrupting it. That clustering made a module-specific property look likely. **Refuted:** `01_tokenize` is one of the 17 that *did* measure, and it OOMs now (run 4). + +**H2 — "the widened root set (`src/v2` + `dag`) is the cause."** The interim audit probed with `src/v2` only; the authoritative closeout mandates both roots, which genuinely widens the closure. **Refuted:** `03_normalize` OOMs with `src/v2` alone (run 5). + +The cause is therefore *not* module identity and *not* the root set. It remains open. + +## Open: regression vs host capacity + +The decisive experiment is to build the probe at the interim audit head `9f978aa8df` — where 17 modules measured cleanly — and run it on this host. Success would mean a regression landed since; failure would mean the host cap is simply too small for this probe. + +That experiment did not complete here. Three attempts to build `v1-compiler` at the old head were all killed (`sccache: Compiler killed by signal 9`): + +| Attempt | Configuration | Result | +|---|---|---| +| 1 | release, `CARGO_BUILD_JOBS=15` (default) | killed, `oom_kill` → 6 | +| 2 | release, `CARGO_BUILD_JOBS=1` | killed, `oom_kill` → 7 | +| 3 | debug profile (`opt-level=2` per dev profile) | killed, `oom_kill` → 8 | + +**These are victims, not diagnoses.** Per the counter analysis above, none of them hit this cgroup's limit, and an independent same-cap control cold-builds this crate at a 3.26 GiB peak. So the builds died to host-level pressure they did not cause, and they say nothing about the crate's requirements. The tempting inference — one rustc died, therefore one rustc needs the whole cap — is invalid, because a process killed by an external OOM killer tells you about the machine at that moment, not about itself. + +Consequence: **regression vs host capacity is UNRESOLVED**, but the reason is contention on a shared host rather than any established capacity limit, and it is retryable rather than blocking. Per operator direction it is reported, not chased, and the probe is not trimmed to fit. + +### One candidate, not a diagnosis + +#7762 closed the manifest-elision hole — the silent-narrow the survey carrier describes. Before it the probe elided closure rows; after it, it admits the full closure. Closing a narrowing that had been *implicitly* bounding memory would produce this shape, and it has a named precedent in DESIGN: removing the scan-all-keys fail-open exposed 8 real deficits its silence had hidden. + +This is a hypothesis with a mechanism, **not** a finding. It has not been tested, and it should be assessed by the owner of that change rather than diagnosed from outside. + +## Consequence for the closeout + +27/27 **did not complete in this window** on either documented path — the one-shot or the per-module fallback (`docs/probes/run_frontier_probe_survey_per_module.sh`). + +**"Unreachable" is not established, and an earlier revision of this receipt wrongly claimed it.** Since no run reached the cgroup limit, nothing here shows the probe cannot fit; the runs were interrupted by external pressure they did not cause. The correct reading is *interrupted and retryable*, not *impossible*. + +Any per-module cost figure for the probe remains **unmeasured**. It becomes measurable only when a run completes, or when a kill is attributable to this cgroup — `memory.events` `max` or `oom` incrementing, rather than `oom_kill` alone. + +Per operator direction the probe must **not** be trimmed to fit the host; a probe shrunk to fit a box measures a different question. On this evidence there is also nothing to shrink it *to*. + +**The retry is redesigned rather than repeated.** The most expensive property of the runs above is not that they died — it is that each death cost *everything*: the one-shot lost all 27 modules when module 1 was killed, six times over. The ruled execution model is therefore **27 independent module jobs** against one pinned subject, one receipt artifact per module, and a final exact-subject aggregator, so a killed job costs one interrupted row instead of the whole survey. Authority and full conditions: `v2.compiler.self_host.frontier_probe_survey` `frontier_probe_exact_head_closeout_note` — not restated here. + +## Recipe defects found while rehearsing + +**1 — the mandated detached worktree and the default build path are mutually exclusive.** `ctrl-build` defaults to remote (`CTRL_BUILD_MODE=remote`) in these sessions, and BuildBuddy refuses a detached worktree: `remote config: get base branch and commit: unexpected branch state * (no branch)`. The closeout recipe requires a clean *detached* worktree, so `ctrl-build --local` is **required**, not a preference. Anyone following the recipe as written hits this first. + +**2 — WITHDRAWN: the suspected module collision is refuted by execution.** I predicted that the recipe's `--source-root target/frontier-probe-survey`, passed alongside `src/v2`, would refuse: both declare module `v2.test.workflow.host_frontier_probe_survey_manifest`, and the seed carries `duplicate_module_path_across_roots_refuses_loudly` (`v1_compiler.cli_run`). + +Two executed runs say otherwise. A duplicate of the manifest module was placed in a third source root and `claim_batch` run over `compiler_frontier_per_module_probe_test.dag`: + +| Third root | Location | Result | +|---|---|---| +| `target/collision-test` | inside `target/` | exit 0, witness PASS, zero refusal messages | +| `dup_root_probe` | outside `target/` | exit 0, zero refusal messages | + +Duplicates across roots are tolerated on this path, so **the recipe does not collide** and the prediction is withdrawn. The seed wall evidently governs a different index path than the one `claim_batch` takes — worth knowing, but not a defect in this recipe. + +**2b — ALSO WITHDRAWN: `target/`-resident source roots are read.** The collision runs could not distinguish "read" from "ignored", because the stub and the duplicate carry identical content and both produce the same outcome either way. That mattered, because the seed skips `target/` beside a `Cargo.toml` as build output (`cargo_target_dir_output_never_enters_the_module_index`); had that applied to an explicitly-passed root, the recipe's emitted manifest would be **silently ignored** and the witnesses would read the stub — worse than a collision, since several of them green **vacuously** on `Empty` receipts (`compiler_frontier_wave2_blocker_partition_totality_holds` did exactly that in both runs above, a green asserting nothing). + +Settled by a discriminating probe rather than by reasoning: a syntactically invalid `.dag` placed in a third root under `target/` is loud if the root is indexed and silent if skipped. It was **loud** — + +``` +for_each_parsed_module_binding: parse error in .../target/broken_root/b.dag: expected item declarat… +exit 101 +``` + +So an explicitly-passed source root under `target/` **is** indexed, the recipe's emitted manifest **will** be read, and the vacuous-green risk does not arise from this mechanism. + +**Net: no recipe defect survives except item 1.** Both predictions here were wrong, and both were killed by execution rather than argument. The vacuous-green *property* is nonetheless real and worth remembering independently: `compiler_frontier_wave2_blocker_partition_totality_holds` passes on an empty manifest, so it must never be read as evidence that a survey ran. + +## Incidental: 4 hard diagnostics on this head, unrelated to this work + +While verifying that this PR's `.dag` edits compile, all three edited modules returned **zero diagnostics in their own files** — but every compile still exits 1, on 4 hard diagnostics in `dag/extdeps/systems/nvidia.dag`: + +``` +source annotation sits inside a declaration body. Only module-item grain is modeled; +move it above the declaration it describes. (dag/extdeps/systems/nvidia.dag:4538-4620, :4625-4701, :4706-4788, :4793-4869) +``` + +The cited offsets exceed the file's 120 lines but fit its 5555 bytes, so they are **byte** offsets. The refusal is exactly what DESIGN §4c specifies: the initial `.dag` realization admits only standalone leading `//` blocks on module-scope declarations, and body-grain forms refuse until separately modeled. + +Attribution: that file arrives with SPARK-0 (`2be88489b13`) and is **not touched by this branch** — this diff is four files and none is `nvidia.dag`. The diagnostics also appear when compiling a 26-source closure that does not contain the file, so they surface tree-wide rather than closure-scoped. + +Recorded as an observation for routing, not diagnosed here. Whether the compile-clean gate scopes around it has not been investigated. + +## Roster provenance finding (independent of the OOM) + +Separate from the memory refusal, and not caused by it. + +`v2.compiler.self_host.frontier` declares `knowledge_attributed_blocker_class_seed_retained_row` — the constructor whose name honestly marks a row as knowledge-attributed rather than measured. It has **zero call sites**: repo-wide, the only occurrence of that symbol is its own definition. + +Meanwhile all **10** roster modules that have never been execution-measured at any head are authored through `execution_measured_seed_retained_row`, the constructor whose name asserts execution measurement — 8 directly, and 2 (`03_normalize`, `03_body_producer`) via `quarantine_seed_retained_row_from_oracle`, which itself delegates to it. + +The never-measured 10, derived by joining `compiler_frontier_sweep_order` against the interim TSV's module column: + +`03_body_producer`, `03_name_resolve`, `03_normalize`, `03_resolve`, `05_emit_orchestration`, `emit_host`, `emit_module`, `emit_produced`, `emit_semantic_decl`, `program_assembly` + +This is DESIGN §4b **rung inflation**: a carrier named for the top rung while occupying the bottom, and "an inflated class never ranks for climbing." + +**The mechanism matters more than the count.** `execution_measured_seed_retained_row` takes `measured_blocker`, `located_stage` and `located_reason` as ordinary parameters. It therefore *cannot* distinguish a measured row from an attributed one — the constructor's **name** asserts a provenance the **type** does not carry, so no amount of care at the call site can make the claim checkable. The §5 construction fix is a provenance field on the row, making an attributed row unrepresentable as measured; the honest-constructor-plus-discipline approach has already been tried here and produced zero adoption. + +No roster row is edited by this receipt. `frontier.dag` is load-bearing and the change above is a model change, flagged for routing rather than landed. + +## What is still true and unaffected + +The interim audit at `9f978aa8df` (`frontier_probe_exact_head_survey_2026-08-03`) stands exactly as written: 17 modules, 14 `^parse_grammar_choice_overlap_residue` and 3 `^resolve_module_not_found`, all at `ProbeStageAssemble`, at that head with `src/v2`-only roots. Verified directly from the TSV for this receipt. + +It remains **not combinable** with any later head or changed source-root set, and nothing in this document changes or extends it. diff --git a/src/v2/compiler/self_host/frontier_probe_survey.dag b/src/v2/compiler/self_host/frontier_probe_survey.dag index a896cd6e681..aa9fdc135c5 100644 --- a/src/v2/compiler/self_host/frontier_probe_survey.dag +++ b/src/v2/compiler/self_host/frontier_probe_survey.dag @@ -165,7 +165,11 @@ data frontier_roster_measurement_status_vocabulary_note: String = "STATUS VOCABU data frontier_roster_measurement_census_at_9f978aa8df_note: String = "Dated census at source_head 9f978aa8df only (docs/probes/frontier_probe_exact_head_survey_2026-08-03.tsv; probe pre-#7762 — three NameResolutionGap rows are suspect manifest-elision artifacts, not name-resolution facts). Probe invocation used --source-root src/v2 only; authoritative closeout uses src/v2 + dag (different source_roots_digest even at the same commit). At that head: execution_measurement=17, no_execution_measurement=10, self_emit_ready=0, emitter_produced=0. All 27 rows remain SeedRetained disposition. Not combinable with any later head or changed source-root set; superseded by post-#7762 27/27 rerun." -data frontier_probe_exact_head_closeout_note: String = "Lane 1 exact-current-head closeout (sleek-pike-668): LAST of four — #7776 vocabulary, #7762 final, and #7767 assemble diagnostic payloads are merged on main; authoritative 27/27 remains on operator hold (not predecessor blockers). #7762 ref-population gap closed on main — do not forge subjects on today's probe. Definitive run: clean detached worktree; build receipt binding commit, tree, compiler sources, probe executable digest, source-root set, and probe-policy revision; every shard carries complete FrontierSurveySubject; all 27 subjects must compare exactly equal before aggregation. Prior interim audit at 9f978aa8df recorded execution_measurement=17, no_execution_measurement=10, self_emit_ready=0, emitter_produced=0 at that head only. Closeout completes when host_frontier_probe_survey_manifest is a well-formed FrontierSurveyManifest with 27 receipts at one subject, frontier.dag rows hand-authored from that manifest, compiler_frontier_per_module_probe_survey_holds greens, and the offline claim_batch recipe passes." +data frontier_probe_exact_head_closeout_note: String = "Lane 1 exact-current-head closeout (sleek-pike-668): LAST of four — #7776 vocabulary, #7762 final, and #7767 assemble diagnostic payloads are merged on main; authoritative 27/27 remains on operator hold (not predecessor blockers). ADMISSION CONTRACT FOR THE AUTHORITATIVE SURVEY (operator ruling, 2026-08-06). Stated as CONDITIONS ON THE TREE, deliberately naming no PR number, no head SHA, no draft state and no control tally. A receipt that names those is a second mutable copy of the board: it is wrong again every time the board moves, and it has to be patched by hand each time — which is the SAME defect class frontier_roster_provenance_constructor_inflation_note files one layer down, a claim asserted in a place that cannot check it. So this note does not commit it. THE AUTHORITATIVE SURVEY MAY START ONLY WHEN ALL FOUR HOLD: (1) whole-tree hard diagnostics equals zero; (2) ConstructorReferenceAdmission has ONE authority and NO known-red control; (3) all seven partition crates are continuously checked; (4) FrontierEvidenceProvenance is CONSTRUCTION-ENFORCED. Each is decidable against whatever head is current, so the contract stays true as heads move and changes land. For WHICH change currently carries which condition, read the board — not this receipt. Two conditions are easy to under-read and are therefore spelled out. Condition (2) is not discharged by a de-fork landing while a control remains inverted: one authority AND no known-red are both required, because a partially admitted constructor authority means a survey measures a tree in which a sealed constructor is reachable without admission. Condition (4) is what stops the survey writing all 27 roster rows through the provenance-conflating constructor; it is a construction wall to be BUILT, and this receipt does not build it — this receipt RECORDS the provenance defect, and the separate FrontierEvidenceProvenance change FIXES it.\n\nEXECUTION MODEL — 27 INDEPENDENT JOBS, NOT ONE PROCESS (operator ruling, superseding any single-process retry): one pinned survey subject; 27 independent module jobs; ONE RECEIPT ARTIFACT PER MODULE; one final exact-subject aggregator. A killed module job yields an interrupted ROW and is rerun independently — twenty-six completed rows must not be lost because the twenty-seventh receives SIGKILL. This is designed out of the failure this receipt records: the monolithic run lost everything each time it died, six times. Do NOT retry a monolithic 27-module process in the same opaque session envelope; the ancestor killer is still there and still unobservable from inside, so the response is independent jobs with a visible kill boundary, never a bigger cap. Every receipt carries the same exact subject and a killed job is RERUN, never hand-reconciled into the manifest — reconciling a job that ran against a different subject is what turns a partial survey into a fabricated one.\n\nREQUIRED OUTPUT SHAPE: frontier population 27; exact-head measured 27; SelfEmitReady N; EmitterProduced 0; blocker groups BY DETAILED CAUSE. The last is load-bearing and is not a table of high-level reason strings: the 14 modules that shared ^parse_grammar_choice_overlap_residue at 9f978aa8df must have their detailed causes separated, because the next phase picks the lowest-cost module in the largest DETAILED group on the premise that one root governs many. A high-level grouping cannot rank that. #7762 ref-population gap closed on main — do not forge subjects on today's probe. Definitive run: clean detached worktree; build receipt binding commit, tree, compiler sources, probe executable digest, source-root set, and probe-policy revision; every shard carries complete FrontierSurveySubject; all 27 subjects must compare exactly equal before aggregation. Prior interim audit at 9f978aa8df recorded execution_measurement=17, no_execution_measurement=10, self_emit_ready=0, emitter_produced=0 at that head only. Closeout completes when host_frontier_probe_survey_manifest is a well-formed FrontierSurveyManifest with 27 receipts at one subject, frontier.dag rows hand-authored from that manifest, compiler_frontier_per_module_probe_survey_holds greens, and the offline claim_batch recipe passes." + +data frontier_probe_run_interruption_note: String = "EXECUTED RECEIPT OF AN INTERRUPTED RUN, rehearsal at source_head 2be88489b1303357a10b135dd90704103ea93b0e (tidy-bee-50, 2026-08-06; receipt docs/probes/frontier_probe_run_interrupted_2026-08-06.md). The authoritative 27/27 did NOT run and this note carries no frontier counts. frontier_probe_emit_from_ingest was SIGKILLed before emitting a receipt for ANY module: six invocations, six kills, zero receipts — one-shot over all 27 (killed during module 1 of 27), plus 03_normalize, 03_resolve and 01_tokenize individually at --source-root src/v2 + dag, plus 03_normalize at --source-root src/v2 alone, plus a later 01_tokenize retry under low host load that survived to 3.5 minutes at about 2.0 GB before being killed anyway. Host cgroup memory.max = 33578549248 (31.3 GiB). Every death is located identically: immediately after the per-module probe begins, inside the interpreted evaluation, with the ingest closure already read to completion — so it is not an ingest or discovery failure.\n\nINSTRUMENT CONTROL, AND THE MISATTRIBUTION IT CAUGHT. cgroup memory.events oom_kill incremented 1 through 5, one per killed run, in exact lockstep — which establishes these were real kernel kills of processes in this cgroup, and establishes NOTHING about what killed them. The full counter set: memory.max 33578549248 (31.3 GiB), memory.peak 9136902144 (8.5 GiB), memory.events max 0 / oom 0 / oom_kill 8. max 0 means allocation NEVER reached memory.max; oom 0 means the CGROUP oom killer was never invoked; and in cgroup v2 oom_kill also counts tasks reaped by the GLOBAL killer. The cgroup never exceeded 27 percent of its cap at any point. THEREFORE these kills came from host-level pressure on a shared machine, not from this cgroup limit and not from the probe working set — the probe was killed at or below 8.5 GiB cgroup-wide, which is not a runaway signature.\n\nTWO CLAIMS WITHDRAWN AS REFUTED, both asserted by an earlier revision of this note: (1) that the probe requires more than 31 GiB — refuted by memory.peak 8.5 GiB; (2) that this host cannot cold-build v1-compiler — refuted by an independent same-fleet control under a byte-identical memory.max of 33578549248, which cold-built the crate (sccache cache hits 0, 1 compilation, 163s rustc) in 2m59s at a 3.26 GiB peak with oom_kill 0. The crate needs about 3.3 GiB, not 31. The oom_kill counter is a sound control for 'was this a kill' and a worthless one for 'what hit the limit'; memory.events max/oom and memory.peak answer the second and were available throughout.\n\nTWO HYPOTHESES REFUTED BY EXECUTION, both plausible, neither reported as a cause. (a) 'the 10 never-measured modules are the memory-bound ones' — refused by 01_tokenize, which is one of the 17 that DID measure at 9f978aa8df and OOMs now. (b) 'the widened src/v2 + dag root set is the cause' — refused by 03_normalize OOMing at src/v2 alone. Cause is neither module identity nor root set, and remains OPEN.\n\nREGRESSION-VS-CAPACITY UNRESOLVED, CAUSE IS CONTENTION NOT CAPACITY: the discriminating run (build the probe at 9f978aa8df, where 17 modules measured cleanly, and probe here) did not complete — three builds at that head were killed under sccache (Compiler killed by signal 9): release at CARGO_BUILD_JOBS=15 (oom_kill 6), release at CARGO_BUILD_JOBS=1 (oom_kill 7), debug profile (oom_kill 9 incl. a later gunbc compile). Those three are VICTIMS, NOT DIAGNOSES: none reached this cgroup limit, and the same-cap control above cold-builds the crate at 3.26 GiB, so they died to host pressure they did not cause and say nothing about the crate. The tempting inference — one rustc died, therefore one rustc needs the whole cap — is invalid, because a process reaped by an EXTERNAL oom killer reports the machine at that moment, not itself. The condition is retryable rather than blocking; per operator direction it is reported, not chased, and the probe is not trimmed to fit. Preserve the distinction when assessing: 15 parallel rustc processes collectively reaching the cap is ordinary; ONE probe process reaching it for ONE module is not, and only the second is evidence about the probe.\n\nCANDIDATE, NOT A DIAGNOSIS: #7762 closed the manifest-elision silent-narrow, so the probe now admits the full closure where it previously elided rows. Closing a narrowing that implicitly bounded memory would produce this shape (DESIGN precedent: removing the scan-all-keys fail-open exposed 8 deficits its silence had hidden). Untested; to be assessed by that change's owner, not diagnosed from outside.\n\nCONSEQUENCE, STATED AT THE SCOPE THE EVIDENCE SUPPORTS: 27/27 DID NOT COMPLETE in this window on either documented path — the one-shot or the per-module fallback docs/probes/run_frontier_probe_survey_per_module.sh — but 'unreachable' is NOT established and an earlier revision of this note wrongly said so. Since no run reached the cgroup limit, nothing here shows the probe cannot fit; the runs were interrupted by external pressure. Retry under low host load before concluding anything about probe cost, and treat any per-module cost claim as unmeasured until a run completes or a kill is attributable to this cgroup. Operator direction: the probe must NOT be trimmed to fit the host; a probe shrunk to fit a box measures a different question. Dissolve-on, BOTH conditions: the probe emits a receipt for at least one module at a pinned FrontierSurveySubject AND roster row provenance becomes structural — then this note and its receipt delete together. Both are required because the bound receipt also carries frontier_roster_provenance_constructor_inflation_note as an additional work, so the emit condition alone would delete a finding that is still live; this matches the dissolution on the HandAuthoredDocBind for slug frontier_probe_run_interrupted_2026-08-06 in gunbc.doc_graph_roots, which is the single authority for when that doc deletes." + +data frontier_roster_provenance_constructor_inflation_note: String = "RUNG INFLATION in the roster carrier itself (DESIGN 4b), found 2026-08-06 (tidy-bee-50), independent of the run interruption above and not caused by it. v2.compiler.self_host.frontier declares knowledge_attributed_blocker_class_seed_retained_row — the constructor whose name honestly marks a row knowledge-attributed rather than measured — and it has ZERO call sites: repo-wide the only occurrence of that symbol is its own definition. Meanwhile all 10 roster modules never execution-measured at any head are authored through execution_measured_seed_retained_row, whose name asserts execution measurement: 8 directly, and 03_normalize plus 03_body_producer via quarantine_seed_retained_row_from_oracle, which itself delegates to it. The 10, derived by joining compiler_frontier_sweep_order against the interim TSV module column: 03_body_producer, 03_name_resolve, 03_normalize, 03_resolve, 05_emit_orchestration, emit_host, emit_module, emit_produced, emit_semantic_decl, program_assembly.\n\nMECHANISM MATTERS MORE THAN THE COUNT: execution_measured_seed_retained_row takes measured_blocker, located_stage and located_reason as ordinary parameters, so it CANNOT distinguish a measured row from an attributed one — the constructor NAME asserts a provenance the TYPE does not carry, and no care at the call site can make that claim checkable. This is why a carrier reading 'execution_measured' is not evidence of measurement, and why a status report derived from constructor names overstates the frontier. The DESIGN 5 construction fix is a provenance carrier making an attributed row unrepresentable as measured; the honest-constructor-plus-discipline approach has already been tried here and produced zero adoption in the live roster.\n\nNAMED SUCCESSOR (operator-authored, 2026-08-06) — FrontierEvidenceProvenance = ExecutionMeasured { subject: FrontierSurveySubject, receipt: FrontierProbeReceipt } | KnowledgeAttributed { source: DeclarationRef, dissolve_on: DeclarationRef } | OracleDerived { oracle: DeclarationRef }. The load-bearing detail is that ExecutionMeasured requires a TYPED SUBJECT AND A TYPED RECEIPT rather than free-form fields, and the row constructor must CONSUME the variant — so a row cannot claim execution-measured provenance without carrying the receipt that proves it. Operator words: a constructor named execution_measured_* that accepts ordinary caller-provided blocker fields is a name-level claim, not evidence. That is exactly the defect above, made unwritable rather than merely documented, and it lands BEFORE the authoritative survey so the survey cannot rewrite the 27 rows through the conflating constructor.\n\nNO roster row is edited by this note — frontier.dag is load-bearing and the successor is a model change, flagged for routing rather than landed here. Dissolve-on: FrontierEvidenceProvenance lands, row provenance becomes structural, and the unused knowledge-attributed constructor deletes with the transition." fn frontier_survey_probe_policy_revision_holds(revision: ContentHash) -> Bool { match compare_content_hash(left: revision, right: frontier_probe_policy_revision()) {