David Spencer DecisionNerd

Terminal ownership collector evidence for GraphForge #2175

Source:9d2e298a98782d2ff4899672a1fd05c53f20ee14. Final local checks pass:24 Rust preservation tests,61 assessor tests,make check. Independent review and CodeRabbit deltas cleared. Exact-head PR/queue CI is still required before merge.

Decode the attached base64 file into a ZIP, then inspect README.md, provenance.json, commands.txt, the five raw captures and assessments, RED/GREEN logs, and review records.

base64 --decode terminal-ownership-collector-evidence.zip.b64 > terminal-ownership-collector-evidence.zip
sha256sum terminal-ownership-collector-evidence.zip
unzip terminal-ownership-collector-evidence.zip

BI16a after incremental sort-spill draining

One unchanged BI16a/p000 diagnostic invocation ran on merged source abdbd840b1d836bdaf92f448463abb28a4785071 (PR #2171). It was OOM-killed at the unchanged 4 GiB cap after 33.416255722986534 s. BI16a completion remains unresolved on #1982. No retry was performed.

Outcome

Start: 2026-10-18 16:22:50.021671 UTC.
BenchExec 3.35: termination reason memory, signal 9, peak 4,294,967,296 bytes; CPU 108.00878 s. Launcher exit 137.
Cgroup events: oom=2, oom_kill=3, oom_group_kill=1, max=5178. These are event/process counters for this single invocation, not invocation counts.
1,613 phase samples; swap zero observed; no observer errors.

Incremental external-sort spill draining repair

Owning issue: CurateLabs/graphforge#2170 Canonical parent: #1982. Separate completed native diagnostic: #2168.

Proven defect and repair

The sorter retained every sorted output of a spilling run until EOF. Those output handoff requests hit the pool's buffered-sort headroom, and abort instead of draining already-admitted data. A real coalescer/sorter regression reproduces this with a 64 MiB pool, sibling15 MiB,2 MiB coalesced runs and ordinary8192-row output: the second64 KiB output is refused at16.9 MiB used, while the actual pool has ample space.

The repair writes and drops each fully admitted output before polling the next. It uses the existing append/source/workspace admission machinery, retains one file per run, and changes no budget, partition count, pool policy, codec or public API. Source refusal prevents every subsequent writer attempt. Earlier fully admitted writes may already have completed; tests explicitly observe th

BI16a: one unchanged post-merge diagnostic

Owning issue: CurateLabs/graphforge#2168 Canonical SF1 close gate: CurateLabs/graphforge#1982

Result

Exactly one authorized native BI16a / p000 invocation ran on 2026-10-18 after PR #2164 merged. It failed with a typed execution/resource error. This completes the bounded diagnostic, not BI16a completion or the parent baseline.

| Fact | Observed result |

Exchange spill workspace repair (#2166)

Source commit: 79968b429afb85e64af3fd4a21dea2604d271670; base main: 956c7b8611626957f421679304eb2a77ceb5f59c.

The merge-group failure for #2164 requested 46.1 KiB for SpillWriterEncode with 37.3 KiB available. A deterministic real writer regression reproduced the same 46.1 KiB request with 36.1 KiB free by independently funding full source backing and constraining the two disjoint metadata/encoding phases to their maximum. It failed before repair and passed afterward with exact readback and zero residual reservations.

Leaf inspection authority now grows in place into encoding authority. Existing source and encoding bounds remain unchanged; nested, dictionary and run-end metadata keeps its original envelope. No pool policy, workload, budget, fixture, partitioning, timeout, retry or assertion change.

Results:

Original constrained exchange ran once before repair locally and passed; scheduling sensitivity was not treated as a fix.

Traversal property-read correction

Current pushed tip: 54bf0ee17deb43fddf393a57aeb5a2f798ac33a2. PR #2164 closes only #2149. Full baseline, BI16a, and collector qualification remain held.

Outcome

The unchanged selected TCR8 replay now completes all three bindings (line-13, line-22, line-44), and all three result-content comparisons match the preserved reference. The excluded line-13 warmup also completes. These are selected diagnostics, not a quiet-host full-baseline qualification or a general workload-completion claim.

Fresh uninstrumented CLI and driver binaries were verified against the exact pushed tip, including Cargo fingerprint/depfile chains, the vendored product engine, the Arrow pool feature, and the repaired storage/executor modules. The driver SHA-256 is fab99f26b15c61f7857d1a10c0359224797e5675d761d1a478cc035b83361732.

Sort/IPC handoff qualification at a5aecadb

Frozen qualification for a5aecadb9c0e2b02ced18072bfc737855231b57b, before the merge queue. This packet does not claim that the PR has merged or that #1982 is complete.

The six-file correction makes consumed-input cleanup linear in buffered batches plus pending indices. A prepaid scratch field in each existing batch element replaces repeated scans without allocating during cleanup. Constructor, resident and growth grants include the larger element. Accessed authority fields were renamed without changing field order or ownership. Both earlier verified review findings are addressed.

Verified results:

All six local commands pass: 90 default controls, 5 lean executor controls, the unchanged default/lean 16 MiB controls, unchanged default 128 MiB completion, real 64 MiB sort spill and make check. Command/result records capture the six changed source hashes before and after execution; the committed-source receipt binds those bytes to this head.
[Exact-head CI

	[
	{
	"path": "README.md",
	"bytes": 7852,
	"sha256": "ae7746df3769b6849030fba5f6a6fb3ef3d2a72b5ab842fcac8c1eed87cb0e59"
	},
	{
	"path": "assess-campaign.py",
	"bytes": 11809,
	"sha256": "a74de450c8e7df5ca0afca60a03e69fb9caf22e7c934ee24a4694d23815367f0"

	{
	"source_commit": "387a338e41e11cd643b41c45f01f1232e111332b",
	"source_tree": "f923308613d8270061a3ff78b95784d9d9174d14",
	"previous_head": "9d2e298a98782d2ff4899672a1fd05c53f20ee14",
	"changed_source_sha256": {
	"Cargo.lock": "bddf9679ad114ee94ff02b17f197715a5a525a32b7158cb3f979baa72841ca55",
	"Cargo.toml": "fb48f6b3a7b203f0295d369637023f805a2d716ba3b5a6ac9901a0ca2df271b7",
	"benchmarks/Cargo.lock": "169e9583af4cad3863dba5bee814d2ca2a1a0983985e01c6ac875d5434328c39",
	"benchmarks/Cargo.toml": "2b2dffa06a52bff7cb577795f9851f4cc441874d86ddcda2cda2b08c1eaee667",
	"crates/graphforge-exec/Cargo.toml": "f4202a7c02dc07a7994716b5e84effee066f5ff8ec24b902eed687e070db32d3",

	{
	"schema": "graphforge-gdc-rung-reference/1",
	"suite_id": "finbench-transaction",
	"rung_id": "sf1",
	"source": "spec-derived reference (graphforge_bench.gdc_finbench_transaction_reference, LDBC FinBench Transaction v0.1.0); not an LDBC implementation",
	"queries": {
	"TCR1": {
	"matching": "exact",
	"bindings": {
	"line-15": {