Phase 3 resource campaign (#239)

Status: the retained provider, renderer/shared-storage and OCI campaigns cover the requested measurement populations; integration and Phase 3 gate review are pending. Each immutable receipt preserves its original checkpoint status. The executable provider checkpoint uses a separate real latentd, authenticated CLI, compiled HTTP/blob guests and the maintained signed provider fixture. A successful build, a synthetic unit test, or an unexecuted recipe is not resource evidence. Actual SSR/backend/browser qualification is coordinated with #236/#226; no renderer heap, event, secret, child-call or OCI-network result is inferred from HTTP/blob. Separate small Rust HTTP/blob/secret/event/child measurements are documented in the checkpoint; they are not a standalone node or SSR campaign. The event population uses the maintained controlled TLS peer at running ceilings one and two. It records four cold/warm acknowledged guest publications, then actual peer receipt before cancelling held publications and checking physical owner reclamation; the retained event report contains its measured values. The peer is a protocol fixture; these measurements do not claim durable acceptance by a real JetStream server.

Ownership and populations

• Fixed: one explicitly owned node, configured runtime/control/compiler pools, installed provider registrations and shared listeners. The external HTTP fixture and ephemeral CLI processes are different owners, not node workers.
• Dormant: increasing actual admitted capability-enabled deployment records, without invocation. The profile uses two shared service/contract bindings; that fixed binding configuration is included in the baseline. Metadata and configuration growth are not presented as zero-cost service density.
• Active: actual guest Stores/cells, broker handles/calls/results, provider queues/connections/workers and I/O buffers. An explicitly held real TCP request must be observed before cancellation. Acceptance of cancellation is not cleanup: peer EOF, terminal result, reclaimed counters and process reap are separate observations.
• Recovered/unrouted: repeated quiescent snapshots after bounded churn and after deletion of deployments. Unrouting does not delete retained publication evidence, package files, terminal records or prepared-cache contents.

Component, package, publication and deployment counts are separate. The current standalone checkpoint counts three actual admitted package/component/publication identities and independently pages deployments. The separate renderer/shared-storage campaign measures one component, two packages and two independent publications, including unique-inode and allocated storage. The OCI campaign measures bounded token/acquisition, resolver-answer/waiter, connection-byte and redirect owners.

Collection and load

tools/phase3_resource_campaign.py has explicit finite smoke and campaign profiles. Both are manual; the larger profile is not added to CI. The shared Process/OwnedProcess harness reserves the unreaped process group, bounds stdout/stderr, cancels descendants and reaps before refunding ownership. No unrelated container, system PID or target volume is adopted.

The sampler walks only the owned process tree, with byte, task, descriptor, network-row, process-count and wall-time limits. TCP/UDP namespace rows count only when their inode belongs to a sampled process descriptor. PID/start-tick and actual executable hashes bind observations. Every scan is non-atomic; descriptor disappearances and inventory/inspection/proc time brackets are retained. The sampler's own process is outside the node population.

Open-loop arrivals have an immutable monotonic origin and fixed planned times. Completions do not pace new arrivals. A full finite outstanding-client set produces a recorded client-shed arrival, never an invisible queue, retry or success. Retain offered, attempted, shed and completed populations separately, including launch lateness and scheduled-to-completion delay. The explicit overload episode is separate from successful-call latency distributions.

Provider failure is not the same as RPC failure. The maintained HTTP guest returns 11 for typed uncertain delivery after the controlled peer actually disconnects. The blob guest returns 10 for an invalid-state handle, not 11 (permission denied). The collector retains unclassified call results before checking expectations, records the peer observation, and does not count these guest-returned error values as successful provider work.

Likewise, grpcCode: resource-exhausted on a transport failure is not the same as a platform code: resource-exhausted with known nonacceptance. The overload episode records both populations and unknown outcomes separately; it never retries an ambiguous mutation or attributes a transport limit to the node's activation queue without observation.

A requested dormant population can receive resource-exhausted before the catalog's configured entry ceiling. The collector stops that population at the first definite refusal, pages the actual committed population and retains requested versus admitted counts. It neither retries that mutation nor infers a proven capacity ceiling or which owner refused when the CLI does not expose it. Subsequent diagnostic samples use the actual admitted count, but a refused or incomplete requested population makes the overall campaign fail. The parent's bec5d8bf startup recovery fix is included in the post-merge checkpoint. The density refusal persists in that actual run; neither the startup fix nor successful active-owner recovery reclassifies a refused population as successful density evidence.

CLI latency includes process creation, connection setup, RPC, possible queueing and preparation, provider work, and actual process reap. It is not isolated provider network latency or a single-hot-service throughput comparison. Cold means the first invocation of that target in a fresh node; cache/preparation counters must accompany interpretation. Cache eviction can make later requests cold again. No universal Docker/Kubernetes or hardware-independent timing claim is supported by this protocol.

Unknowns are not zero

/proc RSS is actual resident process memory, not an allocator-retained-byte counter or a JavaScript allocator live-byte measure. The latter remain explicitly unavailable. Actual renderer Wasm linear-memory high-water marks, including the JavaScript engine heap, are measured separately from RSS. Provider/cache accounting bytes are conservative ownership charges, not interchangeable with RSS or unique physical disk blocks. Inventory entries with an unavailable live count remain unavailable even if their configured ceiling is known. Quiescence fails when a required provider counter is missing.

The checkpoint asserts only observed process/thread/listener/provider-object plateaus across dormant populations and return of measured active owners after failure/cancellation/churn. It reports RSS distributions without inventing an exact memory-return invariant. The linked current campaigns add multiple configured ceilings, bounded churn, retained-byte/cache/storage analysis and actual mixed SSR success/failure/cancellation measurements.

Exact inputs and immutable reports

Use a new container/target volume, at most three CPUs and 6 GiB. The recorded build runs cargo build --locked -p latentd -p latent -j 3; it hashes the actual binaries, lockfile and explicit workspace source population before and after building. The supplied Git revision is operator-asserted, not an attestation. Compiler implicit inputs and dependency hermeticity are not fully attested. Generated guest build observations, package/evidence files and collector source hashes are retained independently. A later build or source change requires a new identity, never relabeling an old binary.

The maintained guest fixture's signature/provenance lifetime is 1,200 seconds. Export fresh signed evidence to a new directory for each campaign; do not alter timestamps, clocks or trust policy to reuse expired evidence. Record the native build after fixture export because Cargo integration-test compilation can replace a native executable. The preflight retains declared validity windows and requires enough remaining time for the entire bounded profile plus cleanup; this is not signature verification, which remains the real node's responsibility.

python3 tools/install_guest_bindgen.py /workspace/target/phase3-resource-bin
PATH=/workspace/target/phase3-resource-bin:$PATH python3 tools/build_guest_capsules.py --output /workspace/target/phase3-resource-guests
LSF_GUEST_CAPSULES=/workspace/target/phase3-resource-guests LSF_PHASE3_WORKFLOW_FIXTURE_ROOT=/workspace/target/phase3-resource-fixtures cargo test --locked -p latentd --test phase3_workflow_fixture export_signed_provider_workflow_fixtures -- --exact --ignored --nocapture --test-threads=1
python3 tools/phase3_resource_campaign.py --record-build /workspace/target/resource-build.json --revision FULL_TESTED_COMMIT
python3 tools/phase3_resource_campaign.py --profile smoke --node /workspace/target/debug/latentd --cli /workspace/target/debug/latent --fixture-root /workspace/target/phase3-resource-fixtures --build-identity /workspace/target/resource-build.json --output /workspace/target/resource-smoke.json --host-condition shared-docker-desktop-host
python3 tools/phase3_resource_campaign.py --validate /workspace/target/resource-smoke.json
python3 -m unittest tools.tests.test_phase3_resource

Outputs use exclusive creation, bounded canonical JSON and exact-byte SHA-256 sidecars. Failed attempts retain status: failed; a later pass is a different file. The only current success status is checkpoint-passed, with ticketAcceptance: pending; later campaigns fill earlier missing populations without rewriting the earlier report. Keep full temporary data under the owned target volume; commit concise immutable reports under docs/testing/phase3-resource-evidence/. Host outages remain host-condition evidence, not successful cleanup and not an assumed application leak. No automatic retry reclassifies such failures.

Small regression boundary

tools/tests/test_phase3_resource.py exercises finite open-loop load shedding, immutable arrival identities, deadline/error cleanup, false-empty rejection, missing-counter rejection, inode-scoped socket accounting, bounded input inventory and immutable output refusal. Linux also measures and reaps a real owned process. These synthetic regression fixtures are not benchmark evidence. The shared SDK runner, Angular T1 implementation and Phase 3 gate have their own evidence. A resource checkpoint does not implicitly qualify those workflows.

tools/phase3_resource_rust.py builds the dedicated phase3_resource integration test, selects only the executable named by successful Cargo JSON metadata, checks its exact nonempty libtest listing, and runs it through the maintained owned-process harness. The receipt records commands, compiler/profile/input identity, bounded output, process reap and the separately hashed observation file. Failed execution or incomplete active/recovered populations cannot pass.

python3 tools/phase3_resource_rust.py --revision FULL_TESTED_COMMIT --output /workspace/target/resource-rust-run.json --report /workspace/target/resource-rust-observations.json --host-condition shared-docker-desktop-host
cargo test --locked -p latent-wasmtime --test phase3_resource -- --test-threads=1

See renderer memory and shared storage qualification for the measured one-cell/two-cell Angular profiles. See OCI pool qualification for token, DNS and redirect costs at two concurrent-operation ceilings and after physical peer retirement.