Seed-mirror constant lens over five hand-Rust budget constants — and the 11-day fleet arming drift it caught (13GiB -> 15GiB)

[briansrls]

Contains a fleet arming change. Commit e5ee9bf022 raises DECLARED_RUNNER_SLOT_MEMORY_HIGH_BYTES from 13958643712 (13.0 GiB) to 16106127360 (15.0 GiB), converging a seed mirror onto the authority row #8388 moved on 2026-08-17. It is isolated in its own commit so it can be signed separately from the lens. Direction: this raises uncapped-host arming by 2 GiB to the line placement already sizes against.

Owned by session stern-heron-695. Branch session/stern-heron-695-seedlens (my session branch session/stern-heron-695 is held by #8619).

Routed by deep-ant-102 after a sibling-mirror check on #8635 turned up a live defect. Scoping the lens found the thing the lens was for.

The finding

Two seed_mirror_note rows — gunbc.typed_module_cache_capacity typed_module_cache_capacity_seed_mirror_note and gunbc.host_budget_source host_budget_source_seed_mirror_note — each asked for "one lens reading the seed's constants against their cited rows" as their covering dissolution. Neither was built. They also named different overlapping subsets, and neither was the union: two partial specifications of one mechanism, which is the §3 shape in its own right.

Under that unbuilt trigger, one constant was drifted:

seed constant	seed	authority row
TYPED_MODULE_BYTES_PER_ENTRY_ESTIMATE	3145728	typed_module_bytes_per_entry_estimate 3145728	match
TYPED_MODULE_CACHE_MAX_ENTRIES_FLOOR	100	typed_module_cache_entries_floor 100	match
TYPED_MODULE_CACHE_MAX_ENTRIES_CEIL	4000	typed_module_cache_entries_ceiling 4000	match
DECLARED_FLOOR_MINIMUM_VIABLE_ARMED_BUDGET_BYTES	12884901888	gunbc_floor_minimum_viable_armed_budget 12884901888	match
DECLARED_RUNNER_SLOT_MEMORY_HIGH_BYTES	13958643712	gunbc_runner_slot_desired.memory_high 16106127360	DRIFT

gunbc_runner_slot_desired.memory_high moved to 15.0 GiB in 936f451446 (#8388, 2026-08-17, "Raise fleet per-slot row to 16GiB/15GiB from a re-measured floor peak"). The mirror last moved in 47c602caa7 (2026-08-06) and did not follow — eleven days at a value a dated operator ruling had superseded. Measured at 36a1a42a2e, this PR's base.

Two independent surfaces were structurally unable to catch it, which is why eleven days passed. The typed_module_cache_capacity witness has 8 test fns and zero references to any .rs path, to stage0, or to the literal — it checks the model against itself. And test.claim.host_budget_source_witness built its expectation with byte_size(13958643712) — the mirror value under test, retyped — so it greened whichever way the mirror went. A measurement copied from the tree under test is not an oracle (2026-08-01 ruling).

What lands

1 — the lens (test.claim.seed_mirror_constant_lens_witness_test). The union of what both notes asked for: five constants, two seed files, two authority modules, as one folded SeedMirrorRow roster rather than hand-enumerated assertions.

It never writes an expected value. Each assertion renders its literal from the imported authority row, so editing the lens cannot satisfy it and editing the authority moves the expectation automatically.

Reach is a two-way join, and this is the part an earlier revision of this PR got wrong. Forward: every roster row must find its declaration and its authority symbol in the seed. Backward: marker occurrences per seed file must equal roster rows homed in that file. Rows are distinct and each is required, so agreeing counts mean no marked constant exists that the roster does not carry — set equality, not a count standing in for one. The backward count folds this module's own roster, so automating it does not collapse to measure() == measure() and it is not the tree-copied literal the 2026-08-01 oracle ruling forbids.

What that does NOT reach, stated because the first version of this PR overclaimed it: a seed constant carrying no marker at all is invisible to both arms. The marker is the enrollment act. So this raises the bar from "someone remembered to edit a list in another file" to "someone marked the declaration where they wrote it" — a real climb, and not a census of every const in the seed. Next-rung trigger: a Rust-declaration-level census enumerating candidates from the seed's own syntax, at which point the marker is redundant and the roster derives instead of being authored.

Also canonicalizes the in-scope seed literals to plain decimal (3 * 1024 * 1024, 4_000, 12_884_901_888) and adds the missing authority citations — a mirror's job is to equal its authority, and an equality no join can reach is not one. Values unchanged in that commit.

2 — the value correction, in its own commit (4905a9bb40) so it can be signed separately. 13958643712 → 16106127360. This is convergence, not a fleet-axis decision: a committed mirror may only move toward its authority, and the judgement was made by #8388. Direction stated plainly: the constant's one use site, uncapped_host_budget_from_mem_available, caps an uncapped host's MemAvailable sample at the declared throttle line — so the governor was capping 2 GiB below the declared line, and this raises arming to what placement and ci_budget_tree already size against. Source-level reading of the use site and its doc comment; not executed, and not a claim about observed fleet behaviour.

3 — the second oracle, and both notes. The witness now derives from gunbc_runner_slot_desired().memory_high. Both notes are rewritten out of the future tense: a dissolution trigger naming a mechanism that does not run reads as guarded to every later author, and this PR is the receipt for what that costs.

Execution receipt

Built and run in one remote dispatch (BuildBuddy, amd64), SHA=8573608, BUILD_EXIT=0. One binary, three arms. Each perturbation is reverted before the next.

arm	perturbation	assertion that fails	exit
1	none (HEAD)	— all four pass	0
2	value → the drifted 13958643712	every_seed_mirror_row_matches_its_authority	1
3	a marked constant with no roster row	no_marked_seed_constant_is_missing_from_the_roster	1

Each arm fails exactly one assertion, and a different one — so the forward and backward arms are independently discriminating and neither fires spuriously. Arm 2 is the real drift value, not a planted one. Arm 3 is the control for reach, which is a separate claim from firing: perturbing an enrolled row can never tell you anything about an unenrolled one, and conflating those two is exactly how the earlier revision of this PR came to claim a refusal it did not have.

The substrate refused this lens three times before it passed, and each refusal improved it. no field 'success' on type 'FilesystemReadResult' — the primitive carries one field and panics on an unreadable file, so no guard is warranted (cited to dag/tools/frontier_ingestion_probe frontier_read_refusal_disposition_note). Then no parameter named 'f' calling filter, twice-learned: I had copied filter(xs:, f:) from dag/std/filesystem_path_grant.dag absolute_path_segments, which contains that shape — a nearby file containing a call is not evidence the call compiles. Worth recording that the dispatch exited 0 on a run whose witness failed; only the in-script exit status made it visible.

What changed after that receipt, stated so the SHA is not read as covering more than it does. The three arms ran at 8573608. Two commits followed: afb920a990 (below) touches only the sibling witness, not the lens; 4806220c04 adds a prose row to the lens module and changes no assertion, roster entry, or expected value. The arms therefore still describe the lens's behaviour, but the authority for current HEAD is the floor run on this PR, not this receipt.

CI caught a regression these arms structurally could not

Worth stating plainly rather than leaving in the commit log, because it is the same lesson as the reach defect one layer out. Deriving the sibling witness's expectation from its authority row required adding import gunbc.runner_slot_allocation to it. v1-seed fn names are not module-scoped, so widening that closure pulled in v2.std.algebra and its contains(xs, item, eq) captured the bare name four lines I never edited were using for the string contains(haystack, needle).

The failure shape is worth knowing: the fold aborts during preparation, so a two-line edit to an expectation failed the entire ~9782-witness roster, and it presents as "nothing ran" — no planned= line, no per-witness output — rather than "a test failed". Fixed in afb920a990 by pinning those calls to string_contains(s:, pattern:), the builtin this PR's own lens already uses and has a green receipt for, and verified by resolving that module on its own (both its tests pass at afb920a990). import_widening_shadowed_contains_note records it as a receipt so it is not reverted as a style preference.

Why my own three arms missed it: all three ran one entry through claim_batch --entry, resolving the lens and its closure. Nothing imports a test witness — they are leaves — so the edited sibling was never resolved at all. A per-entry green proves the entry compiles, not that the PR does. The rule: resolve the module you edited, which equals "resolve your entry" only when they are the same file; and a per-module resolve still cannot see a capture that manifests only when the fold prepares one subject over the whole roster, so the floor run is the only sufficient check.

Rung, stated honestly — and it is lower than this PR first claimed

Mitigatable. NOT mechanically preventable. The floor run settled it, against me:

	claims	declined_live
base 36a1a42a2e (run 32333231183)	9782	778
this PR 4806220c04 (run 32337765205)	9782	782

Adding this module moved declined_live by exactly +4 — its four witnesses — and moved claims by zero. The floor discovers this lens and declines it. It does not execute in CI.

The declaration causing that is correct and stays: the lens reads .rs text, which is host state outside its resolved substrate closure, so ReadsLiveTree is true. The required floor folds one hermetic prepared subject, so a live-tree reader cannot participate by construction. SubstrateInputsOnly would make it eligible and would be a lie — and the enforcement live_tree_disposition_note names for a lying row, the nightly affected-set falsifier, died in the 2026-08-15 floor cut. That trade is not available honestly.

So: the lens discriminates by execution (three arms above, each failing exactly one assertion and a different one), and nothing runs it automatically. Between manual runs it is precisely the tier DESIGN §6 names — machinery that exists while nothing gates on it. Claiming mechanically preventable would have been the inflation this PR was written against, inside the PR written against it.

This is larger than this module, and is not a gap it opened. 778 live-tree witnesses were already declined at this PR's base. The entire class of check that compares committed seed .rs text to a .dag row is unexecutable by the fold as architected — so the covering mechanism both seed_mirror_notes asked for cannot be enforced by CI today, not because nobody built it but because the fold cannot run it.

Next-rung trigger: an executing consumer for the declined-live population — a cadence, a dedicated non-hermetic lane, or relocating a seed-vs-row check into a phase that already reads the tree (regen or ingestion parse the seed anyway). Any of those makes this lens mechanically preventable with no change to it.

No planted control, deliberately. Four rows matched at authorship and one did not, so the discriminating RED and its positive control came from live data. A synthetic mismatch would prove only that the lens can fire; this proved the class is not hypothetical as well.

What is not claimed

That CI protects this class. It does not — see the rung section above; that question is now answered by measurement rather than left open. Enrolled, executed, and held are three axes: this module is discovered (proven, +4), not executed by the floor, and therefore not held.

How that was nearly reported wrong, since it bears on the evidence. My first check grepped the run log for the module name: zero hits. But the known-positive shows the log names no individual witness — not host_budget_source, not v1_source_audit — only phase, heartbeat, and [floor-witness-slow] (>100ms) lines, and these witnesses run in single-digit ms. That zero was an instrument that cannot express the answer, not evidence. The fact lives in the site-projection phase line.