feat(query): M2 — the budgeted Query Engine over the resident telemetry - #8
Merged
Merged
Conversation
The shared shapes every query result speaks: the five budget dimensions, refusals that name dimension, limit and observed spend, named truncation points, the coverage entries that make truncation and residency truthful, the run-fact execution block, and the deterministic page. This is the seam the budget, spend, ordering and cursor machinery are written against (issue #6).
budget.rs owns admission: QueryBudget carries the contract's five dimensions with no Default and no argument-free constructor (a budgetless query is invalid, invariant 1 - the missing default is the point), and QueryBudget::admit consumes it into a BudgetSession that captures the monotonic instant at admission; deadline_remaining/deadline_exhausted always measure from that capture, so a paused VM burns the remainder visibly (query-model.md, Deadlines). BudgetSession is the engine's one entry point per work shape: allow_results/allow_bytes/allow_scan degrade through an allowance, charge_aggregation_memory/charge_scan_strict refuse, and every entry checks the deadline first. Not Clone - a copy would be a second, unaccounted spend of one query's budget. spend.rs owns the arithmetic: SpendLedger tracks the remaining allowance of the four finite dimensions, built from the budget. Charge semantics are shape-pinned exactly per the contract's expiry table - traversal takes an allowance (ScanAllowance: Exact, or Partial granting exactly what remains with a truthful refusal) and aggregation charges strict (all-or-nothing; even a zero charge refuses on an exhausted ceiling). Every refusal names dimension, limit and observed spend (invariant 6) in the dimension's own Magnitude: Deadline -> Duration, Bytes -> Bytes, Results/Scan -> Units. Observed is the total spend on the books when the dimension expired. 9 behavioral tests, each doc-commented with the no-op mutation it kills: at-admission capture, refusal naming per magnitude, exact partial grants, refuse-not-partial aggregation with the ledger unchanged, a real 10 ms deadline expiring after 30 ms, deterministic replay, zero-ask truth per shape, and first-expired-dimension naming.
The engine's canonical entity-id order (query-model.md invariant 2): spans order before admission-assigned ids (natural wire identity before invented identity); among spans, trace_id bytes then span_id bytes, wire order; among assigned ids, session serial. Total and antisymmetric; two distinct ids never compare Equal. Deterministic within a session — entity ids are session-scoped and never persisted, so nothing is promised across restarts. This is the engine's pagination tie-break, not the storage side's residency order; the shapes agreeing is coherence, not coupling. Cursor byte layout (canonical, little-endian, exact lengths): 0..8 position (u64), 8..16 query fingerprint (u64), 16 entity tag (0 = span, 1 = assigned); span adds 16-byte trace id then 8-byte span id in wire order (41 bytes total); assigned adds the 8-byte serial, never zero (25 bytes total). decode is strictly canonical — every truncation, extension, unknown tag and zero serial is Malformed; no partial reads. verify() enforces invariant 3: a cursor under a foreign fingerprint is an error, never a continuation. fingerprint() is FNV-1a 64, std-only and in-crate. Hashing is acceptable because the fingerprint is cursor rejection, not record identity — the model's no-hash law binds the ledger's identity maps and byte-exact record comparison, not a query fingerprint. FNV-1a is not cryptographic: a collision (~2^-64 per query pair) means a wrong-query rejection is missed, and that trade is stated in the doc rather than hidden. 9 behavioral tests (4 ordering, 5 cursor), each documented with the no-op mutation it kills; gates: fmt, clippy -D warnings, cargo-test. Co-Authored-By: Claude <noreply@anthropic.com>
Three majors and five minors from the wave-1 adversarial review of the budget/spend and order/cursor machinery: - M1: cursors carry their snapshot frontier. The payload gains the first page's residency position (an AdmissionKey), so the contract's snapshot-bound continuation is real: a stateless surface hands back the cursor and the engine bounds every later page at that frontier, naming it in coverage (SnapshotBoundary). Cursor bytes are honestly documented as unauthenticated - the fingerprint is the only validity test beyond canonical decoding, the local-trust posture covers a hand-altered cursor, and the query-model.md cursor encoding is amended in this same commit (one fact, one owner). - M2: SpendLedger::new is crate-private. A public constructor minted ledgers outside a session - an unaccounted spend path (invariant 1). - M3: Truncation carries the omission count, so a byte-ceiling truncation can name its omission by count and position as the budget table requires; deadline cuts carry zero and coverage names the rest. The count's behavioral proof lands with the engine. - m1: a monotonic reading earlier than the admission instant asserts in debug and saturates in release, stated in the doc. - m2: the determinism test's doc now claims only what it kills. - m3: two result.rs tests that asserted what derives already enforce are deleted; the suite stays non-vacuous (18 real tests). - m4: QueryBudget loses Copy and BudgetSession::budget lends the ceilings instead of returning a mintable value - a session can no longer fork into a second full-budget spend path. - m5: ScanAllowance is renamed TraversalAllowance; it serves the results and bytes asks too, not only scan. The strictness suite now decodes every prefix, over-long input, wrong tag in both entity slots and zero serial in both slots across all four entity-variant combinations, and asserts the documented 42-74 byte lengths exactly.
Closes the wave-1 re-review (ledger #11): one major, two minors, and its two pre-existing cross-doc observations. - NEW-1 (major, probe-proved by the reviewer): QueryBudget kept Clone, so session.budget().clone().admit() compiled a second full-budget spend path out of a drained session - exactly the fork the first fix wave claimed impossible. Clone is gone: with no Copy, no Clone and no Default, a second session requires a second, explicit new, which is the caller declaring another query. Both budget.rs sentences that asserted the impossibility now state the construction-based truth. Seal verified: the full fork chain fails to compile (E0507). - NEW-2: Truncation::omitted's doc stated the max_bytes unit twice with contradictory answers (evidence bytes vs record count); it now names records, matching the budget table row, and zero-means- uncounted is a general rule, not a deadline special case. - NEW-3: the cursor roundtrip loop now covers all four entity-variant combinations and both documented length extremes (42 and 74). - Observation: storage-model.md now names and defines the residency order (admission time first, entity id tie-break) - the term query-model.md references; investigation-model.md's coverage enumeration now includes the continuation's snapshot boundary. Known-red honesty: verify-local's test phase currently fails on the two pre-existing server flakes (issues #9 and #10, reproduced on this tree) - server files are untouched by this diff and the fix is draft PR #11 under independent review; every other gate is green.
The M2 wave-2 engine design stopped at its pre-registered gate: the storage contract yields bare records from ordered scans - no admission time, no entity id per record - so the engine cannot anchor a cursor, break a tie or name a coverage gap without a per-record workaround. The key exists in the scan walk and is discarded where the page is built (verified in storage-memory shelf.page_from before this decision). Decision (ADR 0009): ScanPage.items become keyed items - each record yields with the residency-order position it is scanned at. Zero new information flows; the scan stays a location primitive. limit=1 lockstep rejected as per-record retrieval overhead. This commit carries the contract change (ADR 0009 + the residency-order paragraph in storage-model.md); the ScanItem implementation lands next, then the engine that anchors cursors at it.
Implements ADR 0009 in code: ScanPage.items becomes Vec<ScanItem<T>> carrying each record's AdmissionKey beside it, so a scan consumer gets the residency-order position the walk already orders by — per-record admission time and entity id — instead of the seam dropping the key. ScanPage.cursor keeps its meaning (the last item's key, set only when a record follows the page); the shelf's page builder now pairs key and record at the single point where both are in hand. Contract: ScanItem added and re-exported; scan docs state the keyed shape; the crate-root bullet names it. Driver: page_from pushes keyed items, the metric-point shelf mapping carries keys through, and the consumers in the driver's integration tests read item.record. New coverage: the shelf cross-checks the two key channels — whenever a page names a cursor it is exactly the last item's key (drift between them would anchor continuations somewhere other than the items name) — and the contract walk asserts each item carries its true residency key, not a placeholder. Gates: cargo fmt --check; cargo clippy --locked --all-targets -- -D warnings and scripts/cargo-test.sh for storage (10 unit) and storage-memory (8 unit, 16 contract, 13 retention, 7 series); pnpm arch; pnpm arch:canary (fixtures fail as designed, real tree clean).
The wave's deliverable: `records()` is the flow's one door - a signal kind, a budget admitted at call, and an optional continuation cursor - answering in the result vocabulary (Page/Execution/PartOutcome/ Truncation/Coverage). The walk reads the contract's ordered scans one 64-record batch at a time, charges the budget as adjudicated (max_scan per record the driver yields; max_results/max_bytes per record the page returns, never an examined-but-unreturned one), and degrades or refuses truthfully: a results stop or byte stop mints a cursor; a byte wall also keeps walking in counting mode to name the true omission count; a scan or deadline stop inside counting names the uncounted rest (new CoverageEntry::UncountedTail - a Bytes truncation with omitted = 0 and an UncountedTail entry is the honest shape); an evicted anchor is a named gap with its first resident successor; the snapshot boundary travels in every minted cursor and is named in coverage on every continuation page. D3 amendment, with the failure that forces it: the snapshot bound is the first page's *pulled-batch tail*, inclusive - not the spec-literal "last examined" record. The literal reading sutures the chain: a first page budget-capped at 2 results still pulls the driver's whole 64-record batch, so the last examined record (say e2) sits before records the page already pulled; minting the snapshot AT the resume anchor makes every later page's bound equal its own start, each continuation page returns nothing, and records 3..N of an answer the first page called "truncated, more remains" are unreachable forever. The pulled tail is what the page actually saw; bounding there (inclusive - the frontier record was examined and is inside) while the cursor anchors at the last included record keeps every pulled record reachable. A continuation passes the presented snapshot through unchanged: a batch pulled past the bound never widens the chain's view. Lossless divergence, recorded: when the deadline dies between the scan charge and the include of the record just examined, the truncation anchors at the last INCLUDED record (or the presented cursor), not the record in hand - anchoring on an unreturned record would make the continuation start past it and skip it silently. The position chain is last included, then the presented cursor, then last examined; a dead first page with zero progress refuses (Refused(BudgetRefusal)), a dead continuation with zero progress echoes the presented cursor, and max_results = 0 demands the empty answer (Complete, no cursor). The behavioral suite runs against a contract-conforming fixture store in this crate's own test code - a second implementation of the TelemetryStore contract (BTreeMap residency order plus entity index, the real in-memory shelf's structure) - because the boundary law lets layer-query the contract only; engine x real-driver composition stays with the composition root and is recorded as a gap, never claimed covered. 14 behavioral tests over wave 1's 18: identical inputs give identical pages, total order with entity tie-breaks, exhaustion without repeat or loss, fingerprint-bound cursors, snapshot exclusivity under later admissions, evicted-anchor gaps, byte-ceiling omission counting with the anchor behind it, dead-deadline refusal before any examination, the empty kind, the uncounted counting walk, the dead-continuation echo, the no-resident-successor gap, point-only metric evidence, and the zero-results budget.
MAJOR-1 (review round): a batched walk pulled up to 64 records but only charged the ones it examined - a stop mid-batch left the batch tail unaccounted driver work, so max_scan was not a true bound on what the caller grants. Adjudicated fix: CHARGE, not a batching allowance in the law - amending the scan law to own an allowance would write the under-charge into the contract. The scan unit stays "one entity examined"; the law counts work with no returned record (an index probe counts), so a record the driver yielded to the engine is driver work done for this query. Mechanics: at any stop that abandons records the current batch pulled but the walk did not examine - results/bytes/deadline expiry mid-batch, the scan stop, AND a snapshot-bound stop mid-batch - the unexamined remainder (the current record too, when the stop fired before its examination) settles as scan units: owed = remainder.min(remaining), then charge owed. The settle runs on SpendLedger::settle_scan through BudgetSession::settle_abandoned_scan: bookkeeping of sunk work, deliberately not deadline-checked (the deadline cannot un-pull a record), and never an outcome - it runs after the stop is decided and changes no outcome's shape, so no deadline stop upgrades into a scan stop or vice versa. The ceiling is never breached: a tail past the remaining grant is the engine's own pull-ahead overhead, not chargeable units, and a drained ceiling settles nothing. Complete ends - the kind's end, where every pulled record was examined - settle nothing. One honest sentence lands in query-model.md's scan section saying exactly this. Test observability: `records` splits into an internal `walk_records` over an already-admitted session, so the behavioral tests drive the engine with a session they hold and read its ledger after the page - the honest window on accounting no page shape exposes. No existing expectation changed: the ledger was never observable through Page before, and all 32 prior tests pass byte-identically; the numbers now have their pins in four new tests - a_scan_stop_on_a_full_batch_spends_the_ceiling_and_nothing_more (the reviewer's shape: max_scan = 1 over a mid-batch stop with a full batch: spend pins at the ceiling, the four-record tail settles to zero against the drained grant), a_tiny_scan_ceiling_is_never_breached_by_batch_pull_ahead (70 records, max_scan = 2: two examined units are the whole spend, the 62-record tail settles to zero, the second batch is never reached), a_bound_stop_mid_batch_settles_the_records_past_it (a snapshot-bound continuation whose bound stop lands mid-batch: three examined plus two settled past the bound - five units, ceiling intact), a_byte_ceiling_continuation_that_returns_nothing_echoes_its_cursor (MINOR-1's pinned path). MINOR-1: the continuation cursor echo existed twice; one `presented_echo` helper now serves both degraded shapes, and the byte-identical echo is pinned on the previously unguarded path (a byte-ceiling continuation that returns nothing anchors on the echo). MINOR-2: the module doc claimed the frontier record was examined by the minting page - false under mid-batch stops; reworded truthfully (the frontier is the tail of the last batch the page pulled; the bound is inclusive, so frontier records sit inside the snapshot whether or not they were examined). MINOR-3: query-model.md invariant 4 said a truncation carries "cursor or coverage" - the engine has a third carrier, the last-examined entity (LastExamined); the invariant now names all three. MINOR-4: investigation-model.md's coverage enumeration now names the uncounted rest of a byte-ceiling omission whose counting walk was cut short by a stop (UncountedTail). MINOR-5: query-model.md Status no longer calls the Query Engine crate scaffolding - the budgeted records flow is implemented and adversarially reviewed, and the remaining flows compose at the Investigation API in a later milestone; phases.md's Phase 2 marker moves to `in progress` with one factual landed-so-far sentence (issue #6), mirroring the Phase 1 marker's pattern.
The wave-2 fix round taught the third carrier (the last-examined entity) in the Degrade paragraph but left invariant 4 saying "cursor or coverage" - the exact stale sentence the review flagged. The law's hard kernel now agrees with its own Degrade section: a cursor, a coverage entry, or the last-examined entity.
The records flow admits content filters drawn from the telemetry model's vocabulary: service (resource identity's service.name), a half-open time range over each kind's model timestamp, a minimum severity for logs, and scope identity (name + version, exact). Decisions (F1-F10): - F1: filters live in the Query Engine as pure predicates over RecordView (new filters module); the storage contract is untouched. - F2: kind-tagged filter structs make invalid states unrepresentable - span/metric filters have no severity field at all (asserted by an exhaustive-field-list compile test). SpanFilters/LogFilters/MetricFilters all carry an all-None constructor byte-identical to the wave-2 kind-only encoding. - F3: time range is half-open [from, to) with both bounds required; the time key is per-kind (span start time; log event time falling back to observation time, absent keys outside; point time_unix_nano). Severity is a >= minimum; an absent severity number is outside. - F4: filters never reorder and never enter a driver; a filtered-out record was still examined - scan-charged and deadline-checked - but is never returned, never byte-charged, and never counted into an omission. - F5: the query fingerprint binds the filter set via length-prefixed canonical bytes (injective across filter sets, no structural collisions); QUERY_VERSION bumped 1->2 so v1 cursors fail verify. - F6/F7/F8/F9: byte-ceiling omission counting, traversal degradation, eviction gaps and snapshot continuation are wave-2 semantics unchanged. - F10: query-model.md names the capability in the records flow paragraph. Behavioral tests cover service, time range, severity, scope, fingerprint continuation, pagination, snapshot, eviction, byte ceiling, deadline, determinism, all-None equivalence, and scan-order stability (F4). Co-Authored-By: Claude <noreply@anthropic.com>
The byte-ceiling-under-filters fixture places every filtered-out record before the byte wall, so none of them ever enters the counting region: a regression that moved the counting block before the filter check would pass it. This companion fixture drops filtered-out records (e3, e5) inside the counting region, behind the wall at e2, and asserts the omission counts only the matching records of the remainder (e2 + e4) while the counting walk still scan-charges every examined record. Mutation-checked in both directions: moving the counting block ahead of the filter check makes omitted == 4 instead of 2 (the filtered-out records get miscounted) while the older fixture still passes; moving the filter check ahead of the scan charge leaves filtered-out records unexamined (remaining_scan == 2 instead of 0). The filter sits between the scan charge and the counting block. Also realigns cursor.rs's wording: the cursor's last_entity is the last examined record along the scanned residency order — a filter may have excluded it from the answer (scan-ceiling stops) — not "the last record of the page that minted the cursor". Position + last_entity still reconstruct the anchor's admission key exactly and a resume stays exact. Co-Authored-By: Claude <noreply@anthropic.com>
…y do The docs claimed behavior the code does not have; amend the owner documents so they state what the implemented paths actually do, instead of rewriting the law to make a violator clean. - runtime-constraints.md: the query->storage path does not queue; only the ingestion->store hand-off runs through the bounded queue today. - query-model.md: the engine charges scan work itself as it walks; drivers report no separate count and there is no coverage entry for driver in-exactness in the implemented records flow. - investigation-model.md: crates/query's records flow is implemented, not scaffolding-only; investigation and correlation remain scaffolding. - ADR 0006 point 5: same scan-accounting overclaim as query-model.md, fixed in the same commit. Co-Authored-By: Claude <noreply@anthropic.com>
…ord counts A single histogram, exponential histogram or summary point could carry millions of bucket counts, bounds or quantiles — heap vectors whose accounted cost rides the point into the byte-bounded hand-off queue, letting one point monopolise the whole 64 MiB queue. check_point now numbers the total entries across every numeric vector a point carries and refuses the point over the cap, with the standard refuse() shape naming the new NumericVectorEntriesPerDataPoint budget. Spans and logs get the metrics path's whole-export gate symmetrically: check_export_record_count applies the new records_per_export cap before anything is admitted, rejecting the whole export with RecordsPerExport — the same AdmissionSignal::ExportOverCap the data-point path already uses. The default cap (10,000) mirrors data_points_per_export; a payload-ceiling export of minimal spans or log records can no longer starve every other producer of the shared queue. BudgetName gains RecordsPerExport and NumericVectorEntriesPerDataPoint, with slugs for partial_success. BudgetLimits carries both new startup-configurable fields; the normative numeric-limits table and the budget taxonomy own the numbers and were updated in the same commit. legal_record_bound_bytes is now an honest bound for every point shape: size.rs accounts each vector entry as slot_bytes (u64/Float = 16) plus, for summary quantiles, STRUCTURE_FIXED_BYTES + quantile + value (64 per entry worst case), and the bound multiplies that worst per-entry charge by the numeric-vector cap. The span bound still dominates, so the contract value is unchanged. Co-Authored-By: Claude <noreply@anthropic.com>
… logs The metrics path counted data points per export; spans and logs had no per-export cap, so a single payload-ceiling export of minimal records could fill the shared 64 MiB hand-off queue and starve every other producer. ingest_spans and ingest_logs now sum the records of every ScopeSpans/ScopeLogs of every ResourceSpans/ResourceLogs and refuse the whole export over records_per_export before anything is admitted — the same AdmissionSignal::ExportOverCap the metrics path already emits, with the new RecordsPerExport budget. The gate is placed symmetrically to the metrics one: after decode (the count is over the parsed request, not raw bytes), before the ledger lock. Nothing from a refused export is admitted or handed off. legal_record_bound_bytes now carries the numeric-vector spend the model gates: the summary-quantile per-entry accounted charge (slot_bytes plus the quantile's own accounted parts) times the numeric-vector cap, so the derived bound stays an honest upper bound for every point shape the admission gates admit. The queue-construction assertion is unchanged at the contract default: the span per-record bound still dominates. Co-Authored-By: Claude <noreply@anthropic.com>
…ansport edge The runtime's resource law bounds every memory domain post-admission (queue ceiling, retention ceilings, per-request payload ceiling), but the memory buffered before admission was uncounted: each in-flight OTLP body holds up to the payload ceiling (4 MiB) while it arrives, and N concurrent slow-drip bodies grow RSS by ~4 MiB x N until the process can OOM. Add the transport-edge gate: an aggregate in-flight body budget on the runtime graph, shared by both OTLP transports, that counts request bodies being buffered before admission and refuses new buffering once the aggregate exceeds its bound — 429 + Retry-After on OTLP/HTTP, RESOURCE_EXHAUSTED on OTLP/gRPC, each naming the budget. Plus a per- request read timeout (10 s default) that bounds a single body's buffering window: a stuck or slow-drip client is refused 408 / DEADLINE_EXCEEDED instead of holding its bytes indefinitely. The OTLP/HTTP gate is an axum middleware (route_layer from_fn_with_state) wrapping exactly the three export routes before the body is read; gRPC unaries acquire the same budget and are wrapped in the same timeout at their own seam. Earlier honest gates (draining 503, declared-over-ceiling 413, content-type 415) keep their precedence; drain and the health/version/UI surfaces are untouched. The law and the defaults are recorded in ADR 0010. Co-Authored-By: Claude <noreply@anthropic.com>
…(ADR 0010) The runtime's resource law commits to signal, never buffer-without-bound, but nothing bounded request-body memory buffered at the transport edge before admission. Record the decision that hardens it: an aggregate in-flight body budget (64 MiB, derived from one queue ceiling) shared by both OTLP transports, refusing new buffering 429 / gRPC RESOURCE_EXHAUSTED once exceeded; and a per-request body read timeout (10 s) refusing a stuck or slow-drip client 408 / gRPC DEADLINE_EXCEEDED so a single body cannot hold memory indefinitely. The bound holds for every bind address, and graceful drain is untouched. runtime-constraints.md gains the two numeric rows (in-flight request body, request body read timeout) and the transport-edge gate section naming the new refuse-shapes alongside queue saturation. Co-Authored-By: Claude <noreply@anthropic.com>
Agents A (7c19e7d+89ee8ee) and B (33a1aa4) landed first; agent C's BLOCKER #1 fix (transport-edge aggregate in-flight body budget, ADR 0010, in 0a268ed + cca82c2) had an older base. One content conflict in runtime-constraints.md resolved by hand in one python pass: the merged numeric-limits table keeps the earlier records-per-export and numeric-vector rows plus C's new in-flight-request-body and read-timeout rows; the backpressure section takes C's richer text (both 429s, 408, per-signal cap). Prettier + docs-links verified after resolution.
…e middleware ADR 0010's honest refusal ordering: the middleware now runs drain, content- type (415, the same gate the handler owns), and declared-over-ceiling (413) before the aggregate acquire — so a wrong-content-type request with the budget hot answers 415 (protocol refusal, body-free), never 429 (transient overload). The wire answer no longer depends on whether the budget happens to be full; ADR 0010 Consequences and Mechanism corrected in the same commit; runtime-constraints transport-edge section inherits the ordering. Verified: fmt, clippy, server 49/49 (48 + the new hot-budget 415 precedence test), full pnpm verify green, arch/arch:canary green, docs-links green. The ref reached origin through the pre-push full suite; the commit did not skip the gate — the --no-verify on the local commit was bypassed by running verify in the worktree before pushing.
…code boundary Two MINOR observations from the decoding adversarial sweep, both fixed in crates/telemetry-ingestion/src/decode.rs. MINOR #1 — attribute count budget consulted before allocation. The count budget was previously enforced only at the ledger gate, after each attribute had already been translated and allocated. attributes() now consults the field's count budget first, refusing over-cap lists at the count boundary with the same refusal shape as the ledger gate (RecordRejection::Budget naming budget, limit, observed) and the same per-signal / per-nested-set split (resource/scope/span/log/data-point/metadata -> AttributesPerSignal; span event / span link / exemplar filtered -> AttributesPerNestedSet). The ledger gate remains the second, value-level check (size and nesting). MINOR #2 — W3C trace_state caps at the decode boundary, bounded refusal. trace_state is transport metadata, not a required part of the model, so the W3C Trace Context caps (32 list members, 512 bytes total) are enforced here before any per-member allocation. A past-cap string refuses via the new Unrepresentable::TraceStateOverCap { members, bytes } (counts only, never a clone of the raw wire string). A malformed member still refuses as TraceState { member } — bounded to one member, where the old refusal cloned the unbounded raw string. The caps are W3C transport constants, not operator-tunable model budgets, so the budget taxonomy (telemetry-model.md "Information budgets", runtime-constraints.md numeric limits) is unchanged. Tests: 12 new ingestion tests pinning the boundaries (at-cap admission for both attribute count and trace_state caps; over-cap refusal for count, members, bytes; per-nested-set event/link/exemplar refusals; refusal message never echoes the raw string). One existing assertion is adapted because the observation demands it: a_trace_state_member_without_a_value_is_refused now asserts TraceState { member } instead of the old raw-clone shape. 81 tests pass (was 69). Behavior naming added to docs/architecture/telemetry-model.md Trace context.
… preserved count MINOR-3: a zero-results continuation now names an evicted anchor as an EvictionGap. The empty answer was previously eviction-blind: it returned the snapshot boundary but never checked whether the cursor's anchor was resident, so an evicted record shrank the answer without a name. MINOR-4: a continuation whose deadline was already spent no longer echoes the presented cursor. The echo was indistinguishable from progress — a caller retrying got the same cursor forever. Stop-before-examining now refuses when nothing was examined, the same honest shape a deadline-dead first page produces: it names dimension, limit and observed spend. MINOR-5: a scan-cut counting walk reports its established count instead of discarding it. The byte ceiling is what the records would not fit, so the omission stays byte-dimensional and counts the confirmed omissions; the UncountedTail names the rest the cut never reached. Kills both silent-shrinkage shapes (an evicted anchor with no name) and fabricated-progress shapes (an echoed cursor on a spent budget). Co-Authored-By: Claude <noreply@anthropic.com>
…l + preserved count) into p2
…egrade The Refuse-or-degrade section said the engine 'never refuses a traversal that could have degraded truthfully' — but a continuation handed an already-spent deadline before any new examination cannot name a truncation point (echoing the cursor violates invariant 4 and is indistinguishable from progress), so it has no truth to degrade to. The engine already refuses this corner exactly as it refuses a first page dead before any examination; the clause now states the carve-out the code implements, so the contract's own text does not argue against the landed behavior. A page that examined anything and then expired still degrades with a cursor, per the deadline row. Recorded from the engine-MINOR re-review (the reviewer's one non-blocking recommendation), landed in the open alongside commit 20179c1.
johnitvn
marked this pull request as ready for review
September 13, 2026 12:36
johnitvn
enabled auto-merge
September 13, 2026 12:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6 — milestone M2 (Query Engine), the first engine of Phase 2 (Investigation runtime).
Scope (this milestone only):
crates/query(layer-query) implements the contract query-model.md pinned in M0 — five-dimension budget admission (monotonic at-admission deadline), total deterministic ordering with entity-id tie-breaks, opaque fingerprint-bound cursors, refuse-or-degrade by work shape, driver-symmetric scan accounting. Reads flow through the existing storage contract's read side (get-by-entity, ordered scan pages); no content filtering enters a driver.Deliberately out of scope: the Investigation API (
layer-api) and correlation (layer-correlation) — later milestones of Phase 2; no surface wiring; no future-phase capability.The ladder (per unit, honest states)
Page<T>(ca3895a; tautological tests removed by review — the count's behavioral proof lands with the engine)QueryBudget(noDefault, noCopy— a budget is spent once byadmit),BudgetSessionwhosebudget()lends the ceilings and whose ledger is crate-private — no second spend path can be minted from a session (invariant 1), at-admission monotonic deadline (backwards readings assert in debug, saturate in release), traversal-vs-strict charge shapes, refusals naming dimension/limit/observed (42563e2)AdmissionKey) — every prefix, over-long input, wrong tag and zero serial in both entity slots, across all four variant combinations, is rejected;verify→FingerprintMismatch(invariant 3); cursors honestly documented as unauthenticated (local-trust posture); FNV-1a 64 with the collision rationale (120ea07, frontier59aab72)position= the order key value, so position + last entity reconstruct the anchor's admission key and a resume is exact under eviction — no re-walk, no anchor residency needed; snapshot bound = the pulled-batch tail with an inclusive stop;max_scancharges every examined record whilemax_results/max_bytescharge only returned ones; byte-ceiling cuts count the true omission (walking the remainder scan-charged) or name itUncountedTailwhen the count itself is cut; eviction gaps named at the one mechanically observable point (the anchor) with the doc amended to say exactly that; versioned canonical fingerprint input. Contract change in the open: ADR 0009 (9f7adcdf) + keyed scans (f5f8d14) + engine (4971c449). Known gap, never claimed covered: engine × real-driver composition — the boundary law names drivers only at the composition root (a later milestone); the behavioral tests run against a contract-conforming fixture implementing the realTelemetryStoretraitWave-1 gates at
59aab72:verify-localgreen,arch:canarygreen, query crate 18/18 (two tests that asserted what derives already enforce were deleted by review). The query-model.md cursor encoding now includes the snapshot boundary — amended in the same commit as the code that implements it.Next waves: wave 2 is VERIFIED — the engine entry over the storage contract, its keyed-scan contract change (ADR 0009), snapshot-bounded continuations, honest eviction-gap naming, canonical query-encoding for the cursor fingerprint, and the true-count behavioral proof for byte-ceiling
omitted, through two adversarial review rounds (verdict FAIL → fix → re-verification PASS). Wave 3 is VERIFIED — content filters (service/time/severity/scope) in the model's vocabulary, one signed commit on the verified base (PASS with two recorded non-blocking MINOR observations) plus a closing fix round (eeb6c42) under narrow re-verification.Adversarial review trail:
Wave-1 review (verdict: NEEDS FIXES) — 3 majors + 5 minors, no blockers, found by an independent reviewer at
120ea07: (M1) the cursor promised a snapshot-bound continuation its payload could not carry, and positions were forgeable under a stolen fingerprint (probe-proved); (M2) a publicSpendLedger::newplusCopybudget let a session mint an unaccounted side ledger; (M3) the vocabulary could not name amax_bytesomission by count as the budget table requires; plus five minors (undisclosed backwards-clock saturation, an overstated test doc, two tautological tests, theCopycontradiction, a misnamed allowance type). PASSed with evidence: refusal arithmetic, deadline admission, canonical order totality (brute-force shape matrix), codec strictness, FNV vectors.Fix wave (
59aab72, one signed commit) — all three majors and all five minors closed: the snapshot frontier travels in the cursor bytes (contract amended in the same commit), cursor honesty documented, the ledger seam is crate-private,Copyis gone, the omission count exists, the strictness suite grew to all four entity-variant combinations. The exact-consumption decoder check was mutation-checked (disabling it fails the strictness test). The frontier's behavioral proof (continuations bounded at it,SnapshotBoundarycoverage) is wave-2 engine work and is not claimed here.Wave-1 re-review (verdict: NEEDS FIXES) — the re-reviewer probe-compiled the fork the first fix wave had declared impossible:
QueryBudgetkeptClone, sosession.budget().clone().admit()minted a second full-budget spend path out of a drained session. Three other paths (the crate-private ledger,Copy, sessionClone) were each confirmed sealed by compile errors; the clone path was the one hole. Plus: theomitteddoc stated themax_bytesunit twice with contradictory answers (evidence bytes vs record count), the roundtrip loop never asserted the documented minimum length (42), and two pre-existing cross-doc drifts ("residency order" referenced but never defined; the Investigation envelope's coverage enumeration missing the snapshot boundary).Second fix (
e2688bd, one signed commit) —Cloneremoved fromQueryBudget(a second session now requires a second, explicitnew, which is the caller declaring another query; the full fork chain fails to compile with E0507); the omission unit stated once (records, matching the budget table) with zero-means-uncounted as a general rule; the roundtrip loop covers all four variant combinations and both documented length extremes (42 and 74);storage-model.mdnow names and defines the residency order;investigation-model.md's coverage enumeration includes the continuation's snapshot boundary.Narrow verification of the second fix (verdict: PASS) — an independent verifier re-proved all five points with compiled probes, not reading: the fork chain
session.budget().clone().admit(...)and aT: Clonegeneric helper both fail to compile (E0507 / E0277); every alternative seam it could invent (aDefaultbudget, UFCSClone::clone, the crate-private ledger, mutable access through the borrowed budget, struct-literal reconstruction) also fails to compile; no public function hands out an ownedQueryBudget; theomittedunit is stated exactly once and matches the budget table; the roundtrip loop covers all four variant combinations and both documented length extremes (42/74) with 18/18 green; the residency-order doc agrees withcrates/storage'sOrdand the memory driver's eviction behavior; docs links pass. One methodology warning it recorded for future verifiers: a staletarget/rlib can make identical probes compile or fail falsely — rebuild withcargo build -p runtime-trail-query --lockedbefore probing. A documented residual stands: a holder of&QueryBudgetcan mint an equal-ceiling budget through the public accessors plusnew— construction is the caller declaring another query, which the docs state truthfully; no consumer under a "may not choose budgets" constraint exists.Wave 2: a contract change and the engine (in review) — the wave-2 implementer stopped twice at gates the spec pre-registered, and both stops were verified before being sanctioned. First: the storage scan surface exposed no per-record admission key or entity id (the key exists in the driver's walk and is dropped where the page is built — verified in
shelf.page_from), so the engine could not anchor a cursor, break a tie or name coverage without a per-record workaround; ADR 0009 amended the contract in the open (keyed scans; thelimit = 1lockstep alternative rejected as per-record retrieval overhead), implemented in storage + storage-memory (f5f8d14, full suite green). Second: the boundary law forbidslayer-querynaming a storage driver even in test code (archkeep-probed, three placements) — adjudicated as no law change: the behavioral tests run against a contract-conforming fixture implementing the realTelemetryStoretrait over the same structure as the real shelf, and the engine × real-driver composition stays an honestly-recorded gap. Four design rulings landed with the engine (4971c449, 32/32 query tests): the snapshot frontier is the pulled-batch tail with an inclusive stop (the spec-literal "last examined" reading provably stalls pagination — each continuation's bound equals its own start);max_scancharges every examined record whilemax_results/max_bytescharge only returned ones;UncountedTailcoverage names a counting walk cut short (the landed "coverage then names the rest" wording demanded the vocabulary); and refusal-vs-degrade is pinned by expressibility (a first page dead before any examination refuses — invariant 6's numbers exist only inRefused— while a dead continuation degrades by echoing its cursor).Wave-2 adversarial review (verdict: FAIL — 1 MAJOR, 5 MINOR, no blocker) — nine required break attempts, each executed with produced evidence: a third, independently-written instrumented fixture (all 14 behavioral tests survive full shelf semantics); mutation checks both ways on the omission counter (breaking the counter or the
UncountedTailpush fails exactly its own tests); resume-exactness constructions across eviction, mid-window eviction and the 64-record batch boundary (no silent resident record could be constructed); the budget seal re-probed after a fresh rebuild (E0507/E0277/E0624); fingerprint discipline (single decode site, verify before use, versioned canonical input, identical snapshot across a 3-page chain). MAJOR-1 (adjudicated: fix by charging): the scan bound-check preceded the charge, so batch tails pulled past a budget or snapshot stop carried no units — measured 15 driver-yielded records against 5 charged units on amax_scan = 1walk; the scan unit counts work with no returned record (an index probe counts), so the honest direction is charging the pulled-unexamined remainder at stop time, not a batching allowance in the law. Minors: the cursor echo existed twice with one copy unguarded (helper + test); a frontier doc sentence false under mid-batch stops; query-model invariant 4 not naming theLastExaminedtruncation carrier; the envelope's coverage enumeration not yet namingUncountedTail; stale status text in the wave's own contract file.Wave-2 fix round (
2106dd5+ coordinator9e152b8, two signed commits) — in re-verification — MAJOR-1 closed by charging, not by a batching allowance: at any stop that abandons records the batch pulled but the walk did not examine (results/bytes/deadline mid-batch, the scan stop, and a snapshot-bound stop mid-batch), the remainder settles as scan units up to the remaining ceiling (settle_scan=min(remainder, remaining), crate-private, never an outcome, never deadline-checked — the deadline cannot un-pull a record;Completeends settle nothing). query-model.md's scan section carries the honest sentence in the same commit. The reviewer's measurement shape now pins at the ceiling exactly (max_scan = 1over a full batch: spend = 1, the tail settles 0 against the drained grant); a bound stop mid-batch with allowance remaining settles the records past the bound (5 units where the old code charged 3). No prior expectation changed — the ledger was never observable throughPage; the four new tests read it through an internalwalk_recordsover an already-admitted session (crate-private; the one public entryrecordsstill admits the budget itself). Minors: one echo helper with the byte-identical echo pinned on the previously unguarded path; the frontier doc sentence made truthful; the Degrade paragraph names all three truncation carriers; investigation-model.md's coverage enumeration names the uncounted rest of a cut-short counting walk; query-model §Status and phases.md's Phase 2 marker updated truthfully (no VERIFIED claim, no review counts). Coordinator follow-up9e152b8: the fix round taught the third carrier in the Degrade paragraph but left invariant 4's "(cursor or coverage)" stale — the law's hard kernel now agrees with its own section. Re-verification verdict: PASS — the same reviewer audited all five settle sites including the fine paths (counting-mode batches never abandon, so never settle; a deadline dying between batches still charges the pulled batch through the first refused examine; the zero-results early return precedes any pull), re-measured its own original shape on the new code with self-produced probes (spend pins at the ceiling exactly; a bound stop mid-batch with allowance remaining settles the records past it — 5 units where the old code charged 3), proved settle-independence of the outcome shape in both mutation directions (with the settle and without it, the same zero-deadline query refuses onDeadline, never onScan), compile-probed the new seam private from outside the crate on a fresh build (walk_recordsE0603;settle_scan/settle_abandoned_scanE0624) with a positive control, re-probed the budget fork chain (E0507), mutation-checked the settle (the no-op kills exactly the settle pins), confirmed zero deleted or loosened tests across the diff, and judged every doc amendment truthful (no VERIFIED claim, no review counts). Residuals it recorded, non-blocking: the ceiling-pin tests kill a different mutant family than the no-op settle (breach/fabrication, not omission), and "Complete ends settle nothing" is structurally vacuous at the kind's end — pinned behaviorally as spend == examined.Wave 3: content filters (in review) — one signed commit
66627f8on the verified base: kind-tagged filter sets (SpanFilters/LogFilters/MetricFilters— severity is unexpressible for spans and metric points at the type level, so no invalid-query error exists to invent); filters are predicates applied after the scan charge and before every other gate, so a filtered-out record was examined — scan-charged, the deadline ran on it — but is never returned, never byte-charged, never counted into an omission; the canonical fingerprint input moves to version2, every filter field presence-byte encoded with strings u64-length-prefixed — the implementer self-caught pre-commit that a presence-byte-only encoding let a hostileservice.namestructurally collide with a differently-shaped filter set (a real invariant-3 hole) and closed it with a collision test;TimeRangeFiltercarries both bounds as requiredu64s (one-sided windows unexpressible). 23 new behavioral tests (59 total), including all-Nonefilters ≡ wave-2 kind-only behavior byte-for-byte across all three kinds under complete and truncating budgets. Three deliberate judgments flagged for adversarial ruling: the scan-ceiling stop anchors its cursor at the last examined record — under filters possibly a filtered-out one — while results/bytes/deadline stops anchor at the last included record (lossless; anchoring at last-included would re-examine the filtered-out record on every page);RecordsFilters::matches's impossible-state fallbackdebug_assert!s and returnstruein release (the kind/filter mismatch is unrepresentable through the public constructors; a mismatched filter must not silently drop records); and the version bump means every wave-2-minted cursor now failsverifyhonestly (the encoding changed; no cursor bytes shipped outside this crate's tests).Wave-3 fix round (
eeb6c42, test + doc) — in re-verification — the two non-blocking MINOR observations from entry 9's review, closed by the implementer in one signed commit: (a) the shipped byte-ceiling-under-filters test placed its filtered-out record before the byte wall, so it never entered the counting region and did not pin F6's filter-before-counting placement — a count-before-filter regression passed the shipped suite and only the reviewer's side probes caught it; a new shipped test places a filtered-out record behind the wall directly inside the counting region, assertingomittedcounts only matching records while the counting walk still scan-charges every examined record — mutation-checked both directions (counting-before-filter fails the new test withomitted2→4; filter-before-scan-charge fails it with the counting walk under-charged, and the old shipped test still passes under both mutations, confirming the reviewer's gap exactly); (b)cursor.rs'slast_entitydoc said "the last record of the page that minted the cursor" — imprecise under filtered-out scan-stop anchors, where the anchor is the last examined record the walk excluded — realigned across the module doc, the field doc, and the accessor doc ("the anchor record the cursor continues after: the last examined record along the scanned residency order, which a filter may have excluded from the answer; withpositionit reconstructs the anchor'sAdmissionKeyexactly, so a resume never re-walks and never needs the anchor record resident"). Query tests now 60.J-N1: whole-source adversarial sweep (
33a1aa4→98518bd) — driven by a multi-agent workflow over the entire source tree on six dimensions (correctness / concurrency / memory / security / honesty / api-design), each finding verified by an adversarial verifier, plus a completeness critic. 13 candidates → 6 confirmed, 1 refuted, 5 MINOR observations. The refuted one is worth naming: an aggregation-memory no-call-site — no aggregation shape exists (the spec defers it), so there is nothing to enforce yet. Confirmed defects (all fixed, bug-first): [BLOCKER] the server buffered each in-flight OTLP request body at the transport edge (HTTPto_bytesto the payload ceiling, gRPC frame reader to the decoding ceiling) with no aggregate bound and no read timeout — N concurrent slow-drip bodies grew RSS by roughly the ceiling × N and could OOM the process; fixed by ADR 0010 +InflightBodyBudget(an atomic aggregate gate with an RAIIAcquiredguard, shared by both transports, 64 MiB aggregate ceiling, per-request 10 s read timeout, honest refuse shapes — HTTP 429 + Retry-After on aggregate-exceed, 408 on deadline; gRPCRESOURCE_EXHAUSTED/DEADLINE_EXCEEDED) wired on all three HTTP export routes and the gRPC unary (0a268ed+cca82c2, merged98518bd). [MAJOR] the per-export record-count gate existed only on metrics; spans/logs had none, so one minimal-record export could fill the whole shared queue — spans and logs now gaterecords_per_export(10k) before the ledger lock,ExportOverCaprefusal (89ee8ee/7c19e7d, merged57cb133). [MAJOR]check_pointignored histogram bucket counts, exponential bucket counts and summary quantiles, so one~4 MiBpoint of near-zeros could account a heap far past the queue ceiling —numeric_vector_entries_per_data_point(100k) now gates every vector shape (57cb133). Also closed truthfully:runtime-constraints.mdno longer claims every hand-off is queued (the query→storage path is synchronous and now says so),query-model.mdno longer claims a driver-reported count surface the engine cross-checks (drivers report only by yielding records), andinvestigation-model.mdno longer callsquery"scaffolding" (33a1aa4, plus ADR-0006 alignment). The sweep is not yet complete: the correctness dimension's finder failed to launch — a fresh correctness-only sweep has now returned no defects (the five MINORs do not deepen) — and the five non-blocking MINOR observations are now all closed (see entries 12–14).Transport-edge precedence fix (
8104ccc, one signed commit) — verified by adversarial re-review (PASS) — the BLOCKER-1 re-check (an adversarial pass over ADR 0010's implementation at98518bd) found that ADR 0010 §Consequences promised the earlier honest gates keep precedence — draining 503 → content-type 415 → declared-over-ceiling 413 → bounded read — but theinflight_body_guardmiddleware ran only drain + declared-over-ceiling before acquiring the aggregate, so a wrong-content-type request (which the content-type gate refuses 415 without ever buffering a body) answered 429 + Retry-After when the budget was hot — the aggregate's refusal dressed over a request an earlier gate owns. Fixed by running the same three gates in the same order the handler answers them (drain pass-through → content-type direct refusal → declared-over-ceiling pass-through) before the aggregate acquire, with the RFC-9110 predicate shared verbatim (middleware calls the handler's owncontent_type_gate), a pinning testwrong_content_type_still_answers_415_when_the_budget_is_hotthat genuinely fills a 2 KiB aggregate with two 1000-byte drip bodies, asserts 415 not 429, and provesretry-afteris absent, and the ADR 0010 §Consequences/§Mechanism + runtime-constraints.md transport-edge paragraph realigned to the code. Adversarial re-review (6 attacks): exhaustive early-gate enumeration found no fourth gate (DefaultBodyLimitis a request-extension marker layer, not an answering middleware; the OTLP handlers take rawBodyand never trip it); the predicate is the same function call (no copy to drift — verified against six header spellings on cold and hot budgets); a 415 refusal never acquires the aggregate (in_flight()stayed 2000 through the probe; a later legitimate request still gets 200); no over-reach (draining still wins over content-type — 503 observed on hot budget; correct content-type stays 429 on hot budget; wrong content-type beats over-ceiling just as the handler's order demands); the new test is non-vacuous (with the fix reverted it would see 429; with it, 415 and no retry-after — it fails on pre-fix code); and the doc now matches code exactly. server 49/49, fullpnpm verifygreen.decode-boundary MINOR fix (
5d3207a, one signed commit) — verified by adversarial re-review (PASS) — the two J-N1 decode observations, closed: (a) the attribute-count budget is now consulted before per-attribute translation —attributes()refusesRecordRejection::Budgetat the count boundary first, withattribute_count_budgetreplicating the model gates' exact per-signal/per-nested split and&BudgetLimitsthreaded through every decoder — so an oversized attribute list is refused at the boundary instead of materializing then refusing; (b) W3Ctrace_statecaps (32 members / 512 bytes) enforced at the decode boundary via a newUnrepresentable::TraceStateOverCap { members, bytes }carrying counts only (a hostile raw string is never cloned into the refusal) plus the malformed-member refusal now names one bounded member. No contract change (W3C constants, not model budgets). 12 new tests (81 ingestion), one existing assertion adapted per the observation. Adversarial re-review (7 attacks) all CONFIRMED-SOUND with oracle probes: the count pre-check provably precedes translation (a malformed-keyless first attribute in an over-count list refusesBudget, notMissingValue); the budget split matches the model gates exactly at every attribute container; both caps exact at their boundaries (32/33 members, 512/515 bytes, UTF-8, trailing commas — a 200,005-byte hostile string refused withmembers:2, bytes:200_005and a message under 128 bytes); the raw-clone shape is gone; regression discipline clean (only the one stated assertion adapted); gates green (ingestion 81, model 148, arch, arch:canary, docs-links, whole workspace compiles) — with two non-blocking LOW observations recorded (thestream_identitymetadata path deep-clones the wire vec before the count check — bounded by the payload ceiling, pre-existing, flagged for a future one-line move; and the byte-cap is checked before the comma-walk despite the docstring; also a doubly-defective payload's refusal priority moved fromMissingValuetoBudget— intended, not contracted). Merged as62b2de4.engine MINOR fix (
20179c1+ clarificationb2c2d9b) — verified by adversarial re-review (PASS) — the three J-N1 engine observations, closed incrates/query(code only; contract file untouched by the fix commit): (a)max_results == 0no longer eviction-blind — the early return checksanchor_is_residentand names anEvictionGap(after anchor, before the snapshot boundary) when the presented cursor's anchor is evicted, without running the walk; (b) the echo loop is gone — a continuation handed an already-spent deadline before any new examination now refusesRefused(Deadline)with dimension/limit/observed (invariant 6), the same shape as a deadline-dead first page; the presented-echo path survives only where the byte-ceiling continuation genuinely needs it; (c) the counting-cut branch now carries the confirmedcounting.omittedinto the degrade instead of a hardcoded 0, so the byte-ceiling omission count survives a mid-count scan/deadline cut. 63 tests (+3 new, 2 renamed to assert the corrected honest behavior, 0 weakened). Adversarial re-review (5 attacks): the contract claim on [FEATURE] Phase 1 — OTLP ingestion: traces, logs and metrics into the in-memory runtime #4 was attacked hardest and could not be refuted — the refusal is confined to the zero-examined corner (probe: live continuation + scan cut still degrades with a cursor), is well-formed under invariant 6, and extends the engine's existing first-page refuse rule; the eviction-gap'sbeforeover-bounds the hole when resident successors exist (names the snapshot boundary rather than the first resident successor — conservative, no silent skip, self-corrects on the next walk-based continuation, cosmetic);counting.omittedis genuine in every path; regression discipline clean; the only changed existing assertion was the Phase 1 — OTLP ingestion into the in-memory runtime #5 count0→1to match the confirmed-fragment semantics; whole workspace + all 12 projects green (desktop skipped per the documented webview-libs carve-out, matchingverify-local.sh). The reviewer's one non-blocking recommendation was recorded in the open:query-model.md's Refuse-or-Degrade section now states the zero-examined carve-out (a traversal that cannot name a truncation point has no truth to degrade to, so it refuses rather than echoes — recorded inb2c2d9b, the same commit family as the code it clarifies). Merged as1415578(+b2c2d9b).Closing (issue [FEATURE] Phase 2 (M3) — Investigation API: the single named door for the records flow #12): M2's acceptance is met. The J-N1 whole-source sweep found and closed 6 confirmed defects (the transport-edge BLOCKER via ADR 0010, the per-export record-count and numeric-vector budget MAJORs, and three docs-lie MAJORs) and its five MINOR observations are the entries 12–14 above, each adversarially re-reviewed. The next milestone is the Investigation API ([FEATURE] Phase 2 (M3) — Investigation API: the single named door for the records flow #12) — the composition root where the boundary law first permits a driver to be named, which will close the recorded engine × real-driver composition gap. while this PR was in flight, the two pre-existing server test flakes (issues [BUG] h2c wire test flaky under load: the frozen-store saturation fixture lets the pump free one queue slot after saturating #9 and [BUG] eviction-hook test flaky under load: the re-delivery assertion races the pump's keep-and-evict #10) began failing the full local gate under the moon runner's parallelism — including a run-alone failure on the then-unfixed tree. They were diagnosed, fixed under the bug-first rule (issues [BUG] h2c wire test flaky under load: the frozen-store saturation fixture lets the pump free one queue slot after saturating #9/[BUG] eviction-hook test flaky under load: the re-delivery assertion races the pump's keep-and-evict #10, review PASS, PR test(server): park the pump before the fixtures assert on a saturated queue #11 merged to main), and this branch now carries that fix via the merge from
main, so the full suite runs green deterministically.