V2-04: close remaining Memory Governor production-activation blockers

.gitignore

@@ -103,3 +103,8 @@ $RECYCLE.BIN/
 *.iml
 .fleet/
 .anthropic/
+/obsd\BaseMyAI
+obsd\BaseMyAI\.obsidian
+obsd\BaseMyAI\BaseMyAI
+obsd
+opencode.jsonc

crates/basemyai-engine/Cargo.toml

@@ -18,6 +18,13 @@ test-util = []
 # Témoin négatif D-6 d'ADR-053 : réintroduit volontairement un manifeste
 # d'index plat et non borné. Jamais activé par défaut ni par un build produit.
 unbounded-index-oracle = ["test-util"]
+# Témoin négatif GOV-RSS02 (ADR-071) : réintroduit volontairement, dans le
+# harnais de test `gov_rss_oracle` lui-même (jamais dans le governor ou un
+# cache réel), une fuite proportionnelle au volume que la comptabilité du
+# governor ne peut pas voir (une copie orpheline hors réservation, retenue à
+# côté de l'éviction correctement comptée). Jamais activé par défaut ni par
+# un build produit.
+governor-rss-negative-control-leak = ["test-util"]
 
 [[bin]]
 name = "crash_writer"
@@ -267,5 +274,17 @@ path = "tests/compaction/generation_gc_retry.rs"
 name = "generation_pointer_loss_is_rejected_and_gen1_survives"
 path = "tests/compaction/generation_pointer_loss_is_rejected_and_gen1_survives.rs"
 
+[[test]]
+name = "cb_t5_bounded_release_window"
+path = "tests/governor/cb_t5_bounded_release_window.rs"
+
+[[test]]
+name = "gov_rss_oracle"
+path = "tests/governor/gov_rss_oracle.rs"
+
+[[test]]
+name = "gov_rotation_rss_oracle"
+path = "tests/governor/gov_rotation_rss_oracle.rs"
+
 [lints]
 workspace = true

crates/basemyai-engine/src/memory_governor/mod.rs

@@ -71,7 +71,20 @@ pub use admission::{AdmissionPermit, MemoryGovernor};
 pub use config::GovernorConfig;
 pub use governed::{Governed, SharedGoverned};
 pub use reservation::MemoryReservation;
-pub use types::{AdmissionClass, GovernedMemoryKind, MemoryPlan, estimate_memtable_reservation_bytes};
+pub use types::{
+    AdmissionClass, GovernedMemoryKind, MemoryPlan, estimate_emergency_flush_headroom_bytes,
+    estimate_memtable_reservation_bytes,
+};
+// Crate-internal, test-only: lets `store::sst_block::write`'s `#[cfg(test)]`
+// tests ground the SstWriter-only half of the EmergencyHeadroom derivation
+// against a real writer run (`store::sst_block` is a private module, a
+// sibling of this one under the crate root, so it cannot reach `types`
+// directly). Gated by `cfg(test)` only, matching that consumer exactly — the
+// function itself is used unconditionally by
+// `estimate_emergency_flush_headroom_bytes` within `types.rs`, so only this
+// cross-module re-export needs gating at all.
+#[cfg(test)]
+pub(crate) use types::sst_writer_working_set_bytes;
 
 use scheduler::SchedulerQuanta;
 use state::GovernorState;

crates/basemyai-engine/src/store/memtable.rs

@@ -133,6 +133,18 @@ impl MemtableChargeHandle {
             .as_ref()
             .map(MemoryReservation::bytes)
     }
+
+    /// Test-only observability (ADR-072 CB-T5): the number of live strong
+    /// references to this generation's `Arc<Memtable>` right now — a witness
+    /// for proving the CB-07 release-window deviation stays bounded, never a
+    /// decision input (production code must never branch on
+    /// `Arc::strong_count`, which Rust documents as racy the moment more
+    /// than one thread can observe it — ADR-071 §"Pinning `Arc`", MG-14).
+    #[cfg(any(test, feature = "test-util"))]
+    #[must_use]
+    pub fn strong_count(&self) -> usize {
+        Arc::strong_count(&self.0)
+    }
 }
 
 impl Memtable {

crates/basemyai-engine/src/store/sst_block/write.rs

@@ -972,6 +972,67 @@ mod tests {
         assert_eq!(loaded.entries().expect("entries"), data);
     }
 
+    // ADR-071 §"Headroom de progrès background" / ADR-072 CB-08: grounds
+    // `memory_governor::sst_writer_working_set_bytes`'s steady-state terms
+    // (staged block, Bloom partition, leaf index, internal levels — every
+    // component `SstWriter::resident_bytes` can observe from outside)
+    // against a real writer run, not just arithmetic that agrees with
+    // itself. Same fixture shape as `partitioned_writer_builds_a_
+    // hierarchical_index` above (already proven to force multiple leaves
+    // *and* an internal index root), so every term the estimate computes is
+    // actually exercised here, not vacuously zero.
+    //
+    // `resident_bytes()` cannot see the transient `plain`/sealed/ciphertext
+    // copies `write_staged_block`/`seal_section` allocate and free within a
+    // single call (by design — its own doc comment defers that closure
+    // oracle to `r6_allocator_peak`), so this test validates the
+    // *steady-state* portion of the estimate exhaustively and leaves the
+    // transient-buffer portion to the direct code-reading recorded in that
+    // function's own doc comment.
+    #[test]
+    fn sst_writer_term_bounds_a_real_writers_steady_state_across_many_blocks_and_leaves() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let data = entries(200, 40);
+        let cache = Arc::new(MetadataCache::new(8 * 1024 * 1024));
+        let block_size: u32 = 128;
+        let max_key_bytes: usize = 32;
+        let mut writer = SstWriter::create(dir.path(), 0, block_size, None, max_key_bytes, 0, Arc::clone(&cache))
+            .expect("create writer");
+
+        let bound = crate::memory_governor::sst_writer_working_set_bytes(block_size, max_key_bytes, false)
+            .expect("no overflow");
+        let mut peak_resident_bytes = 0usize;
+        for (index, (key, value)) in data.iter().enumerate() {
+            let kind = if value.is_some() {
+                ValueKind::Value
+            } else {
+                ValueKind::Tombstone
+            };
+            writer
+                .push(InternalKey::new(key.clone(), 1, kind), value.clone())
+                .expect("push");
+            peak_resident_bytes = peak_resident_bytes.max(writer.resident_bytes());
+            assert!(
+                writer.resident_bytes() <= bound,
+                "writer.resident_bytes()={} exceeded the derived steady-state bound={bound} after {index} pushes",
+                writer.resident_bytes()
+            );
+        }
+        let written = writer.finish().expect("finish");
+        assert!(
+            written.footer.bloom_partition_count > 1,
+            "fixture must force multiple leaves — otherwise the leaf-index/Bloom terms are untested"
+        );
+        assert!(
+            written.footer.index_levels > 1,
+            "fixture must force an internal index root — otherwise the internal-levels term is untested"
+        );
+        assert!(
+            peak_resident_bytes > 0,
+            "the writer must have actually held something resident at some point"
+        );
+    }
+
     #[test]
     fn versioned_roundtrip_preserves_versions_and_snapshot_visibility() {
         let dir = tempfile::tempdir().expect("tempdir");