Merge train: #9861, #9965, #9969, #9970, #9971, #9973, #9975 - #9978

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit d5115df)

The extractor only admitted commands beginning with `python3 scripts/`,
`./scripts/`, or `cargo fmt`. The public-baseline commands instead begin
with an inline PYTHONPATH assignment and `python3 benchmarks/`, so both
were filtered out; the YAML block's comments and step metadata were not
the cause.

Recognize every executable family currently used by lint, retain workflow
step names in the derived list, and reject any run step that produces no
commands. Keep the two GitHub-context commands on a stale-checked explicit
skip list, and self-test both comment-led extraction and the loud failure.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 75885c0)

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 942e5f4)

Derive the warnings and check job gates from test.yml, including the
product-only warnings check, both host-compatible workspace scopes, and the
API-docs regeneration and drift assertion. Expand the workflow's package
exclusions portably for macOS Bash 3.2.

Extend the extractor self-test to require the product check under -D warnings,
reject its removal, and prove newly added warnings commands are replayed.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 3e6aeef)

Replace arm 5b's expected verifier panic with positive correctness and
liveness checks for the retained-growth workload. Compare Perry's stdout
byte-for-byte with Node, require a successful exit, and require copied
objects so the evacuation verifier cannot pass vacuously.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 83b90a0)

Include PERRY_SEGVIEW in the build-cache environment fingerprint so
switching the lowering cannot reuse a binary built under the other mode.
Record PERRY_SEGVIEW_DIAG as diagnostics-only, and cover the real cache
miss with a qualifying Intl.Segmenter compile.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 9929ed0)

…opy (#9851)

The adaptive tenuring loop takes its one and only survivor-round mortality
sample on the FIRST minor of the process -- when the cohort really is immortal
(99.1 % survival) -- drops the threshold to 1, and thereby destroys its ability
to ever sample again: n=1 across 352 minors. In steady state an aging round
filters 26.1 % of each cohort, and the loop cannot see it.

`retune_after_scavenge` picks the threshold from `S = 1 + desired / influx`, the
largest S whose projected survivor occupancy `(S-1) x influx` fits the desired
survivor size. With integer division, any influx above `desired` yields exactly
1 -- there is no rung at 2 or 3. On the compiled claude-code TUI the first drop
reads `eden_live_bytes=12075344` against `desired=1048576`.

S=1 does not reduce the surviving data; it relocates it, from the survivor space
-- where the next minor re-examines it for free -- to the old generation, which
only a full can reclaim. The occupancy formula has no term for that. And S=1 is
self-sealing: nothing is copied, so `copied_bytes` is 0, so next cycle
`prev_copied` is 0, so the survival-rate lock's guard (`prev_copied >=
substantial`) is false forever. Both remaining exits -- the occupancy recompute
and PROMOTE_LOCK's unlock -- are QUIET-INFLUX exits, which say nothing about
lifetime. The loop concludes "long-lived" from a premise about space and then
removes its ability to check.

Measured, 4 streamed turns in one process, both arms from one binary via the
diagnostic knob PERRY_GC_TENURING_SURVIVALS, 3300-character replies:

                                   adaptive        pinned S=2
  minors at S=1            351 of 352 (100 % of promotion)     0
  threshold transitions                   1                    7
  mortality samples                       1                  393
  median mortality                     0.9 %               26.1 %
  ...steady turns 2 / 3 / 4    not measurable   26.1 / 26.1 / 26.1 %
  substantial cohorts < 10 %            1/1                5/358
  promoted                          1057 MB               792 MB

The occupancy rule now stops at the lowest threshold that still PRODUCES that
measurement. 2 is forced by the requirement rather than tuned: at S=1 nothing
enters the survivor space, at S=2 exactly one cohort does.

The clamp is at the USE SITE, not inside `compute_target_survivals`: that pure
function has a second caller, `full_seed_promotes_on_first_copy`, which gates the
sweep seed on `... != 1`. Clamping the shared function would silently disarm the
sweep seed, which is one of the two paths that IS allowed to reach 1. Reaching 1
still belongs to the survival-rate lock and the sweep seed, which measure
mortality; both are untouched, so the rule is self-limiting -- on a workload
whose cohort genuinely does not die the lock fires after one cohort's copy and
takes the loop back to 1. On claude-code it correctly does not: 5 of 358
substantial cohorts sit under the lock's 90 % bar, so the clamp holds rather
than oscillating.

Tests. `target_formula_matches_projected_occupancy` is byte-identical -- the
arithmetic is untouched, and that test is the proof. Four tests move an expected
value 1 -> 2 and keep their names, structure and invariants:
`drops_immediately_and_rises_debounced` (asymmetric response: immediate drop,
debounced rise -- 4 -> 2 shows it as well as 4 -> 1),
`steady_heavy_influx_is_a_fixed_point` (fixed-pointness, now at 2),
`heavy_influx_lowers_threshold_and_promotes_next_cycle` (its promotion half is
untouched: the cohort was copied once, so `next_age` is 2 on cycle 2 and it
still tenures exactly when the test says) and
`quiet_cycles_restore_power_on_threshold_debounced` (the debounced restore is
asserted structurally and survives). Two new tests: the two-phase attributed
pair -- occupancy alone holds at the floor and has not taken the lock's route,
then a substantial fully-surviving cohort still reaches 1 through the lock --
and a dying-cohort test at claude-code's measured 74 % survival.

(cherry picked from commit 925ceb2)

… survivor space

Follow-up to the previous commit, and caused by it. #9851's clamp stops the
occupancy rule concluding "promote on first copy", and measuring the relinked
candidate showed it buys -7 % of promotion where the pinned control buys -26 %:
85 % of promotion still happens at S=1, now reached through the survival-rate
lock 8-12 times per four-turn run.

That is a consequence of the clamp, not a coincidence. At S=1 nothing is copied,
so `prev_copied` is 0 and the lock's guard can never be satisfied -- the previous
commit's own argument. Removing the seal hands the lock its guard back, and the
lock then reaches 1 by itself.

The lock tested

    prev_copied >= substantial && survivor_live_bytes * 10 >= prev_copied * 9

where `survivor_live_bytes` is every live byte leaving the from-survivor space
this cycle, of any age, and `prev_copied` is the previous cycle's whole intake.
Those two scopes MATCH: the survivor spaces are a strict semispace pair (to-space
reset before the minor, everything copied into it, then flip), so the from-space
at cycle N holds exactly what cycle N-1 copied. The ratio is well-formed and
cannot exceed 1. The defect is not the arithmetic.

The defect is which POPULATION the ratio rates, and that is chosen by the very
threshold the lock sets. At S <= 2 the space holds one fresh cohort (age-2 is
promoted) and the ratio is one aging round's survival -- 74 % on the compiled
claude-code TUI, under the 90 % bar. At S = 3-4 it also holds age-2 and age-3
objects, which have already survived a round and are therefore selected for
longevity, so the aggregate clears 90 % while a fresh cohort does not. The rule
reads its own setting back as evidence. The clamp is what lets the debounced
rise reach 3 and 4, which is why this only became visible once the seal was gone.

The copier now accounts the fresh half of each cycle. `eden_copied_bytes` is
what this cycle copied out of EDEN into the to-survivor space (no re-copies) --
one cohort's intake. `survivor_first_round_live_bytes` is what came back out of
the from-survivor space alive with a stored survival age of 1, i.e. members of
exactly the cohort the previous cycle's `eden_copied_bytes` counted; the age is
already in the header at copy time (`copied_survival_age`), so no new per-object
state is needed. `retune_after_scavenge` keeps its arity and its two lock
parameters are redefined to those, which is the whole change at the policy end:
both sides of the ratio are now scoped to one cohort at every threshold.

Both new counts are on the `[gc-copy-minor]` diagnostic line next to the
whole-space ones, so first-round mortality is readable from ANY build rather
than only from an instrumented branch -- the measurement this policy is about
should not require a custom binary.

Measured, one binary, three arms via `PERRY_GC_TENURING_SURVIVALS`, 3300-char
replies, 4 turns in one process, macOS arm64:

  arm                          minors   promoted   S=1 share   via the lock
  =1 (pre-clamp equivalent)      356     1055 MB      100 %          -
  clamp only, run 1              368      982 MB       85 %          8
  clamp only, run 2              384      980 MB       84 %         12
  =2 (positive control)          380      785 MB        0 %         n/a

Tests. No existing expected value moves -- all 1,069 gc tests pass unchanged,
which is itself the finding: nothing in the suite distinguished the two scopes,
because they are equal on every heap whose survivor space holds one generation,
and that is every heap at a threshold of 2 or below. So the premise gets a test
of its own on a real heap: two rooted objects introduced one cycle apart at the
power-on threshold, asserting that the two numbers AGREE while only one
generation is resident and then DIFFER once an aged resident joins it, with the
aged object in the whole-space number and not in the cohort number. A test-only
witness (`test_last_cohort_split`) reports the pair the copier computed.

The two lock tests keep their values and gain the scoping in their names and
comments; `a_cohort_that_dies_in_its_round_holds_at_the_occupancy_floor` now
states that this same heap locks if the call site passes the whole space, which
is what it used to pass.

The previous commit's changelog fragment claimed the lock correctly stays out on
claude-code (5 of 358 substantial cohorts under the bar). That figure was taken
with the threshold PINNED, where every cohort the lock can rate is a first-round
cohort; it does not describe the rule running, and the fragment is corrected
rather than left to be read as a result.

Claude-Session: https://claude.ai/code/session_014knX724SYDogwzsXybCGxp
(cherry picked from commit c154ba6)

…d is measured

The symmetric half of #9851. That commit stopped the occupancy rule concluding
"promote on first copy" -- a claim about LIFETIME derived from a measurement of
SPACE. The same formula makes the same category error at the other end:

    compute_target_survivals = 1 + desired / influx      (capped at the ceiling)

returns the ceiling for a tiny influx AND for a zero one. On the first minors of
a process -- heap nearly empty, no cohort ever followed -- occupancy therefore
claims the MAXIMUM, before a single object has been given the chance to die.
It is the expensive direction of the error, because every survivor is then
copied up to three times before it may be promoted.

Measured on the landing base (main5 + #9881, one binary, four env arms, two
rounds of 4 turns at 3300 and 400, quiet host), this startup excursion is the
WHOLE difference between the adaptive loop and a pinned threshold:

  * unset vs pinned S=1: turn-1 CPU 3.41 s vs 3.02 s at 3300 (+0.35..0.45 s
    both rounds) and 1.05 s vs 0.72 s at 400 (+50 %), while the sum over turns
    2-4 is within noise (6.18-6.23 vs 6.35-6.41);
  * the adaptive arm's transitions are `4 -> 2 (occupancy) -> 1 (lock)` and ALL
    of them land inside turn 1; turns 2-4 run at S=1 with nothing copied.

So the adaptive policy's only cost on this workload was a startup claim it had
no evidence for, and its steady state was already the pinned one.

The rule is now symmetric: **until one survivor round has actually been rated,
the occupancy rule holds at `OCCUPANCY_MIN_SURVIVALS`.** That value is not a
tuning choice; it is the lowest threshold that PRODUCES the measurement the
rule needs in order to say anything -- at 1 nothing enters the survivor space,
at 2 exactly one cohort does. The power-on threshold becomes the same value for
the same reason: starting at the ceiling is a lifetime claim made before the
process has run.

`SURVIVOR_ROUND_MEASURED` is set the moment a cohort the previous cycle copied
becomes rateable, so the gate lifts after about two minors and the ladder is
unchanged from then on -- it delays the claim until evidence exists, it does not
remove the ladder. The two paths that MEASURE mortality are untouched: the
survival-rate lock and the sweep seed may still reach 1 whenever they have the
evidence for it.

`compute_target_survivals` is again left alone, and its test is again the proof:
the arithmetic still returns the ceiling for a zero and a tiny influx. Only what
the loop may do with that changes.

Tests. A new two-phase test: eight startup-shaped minors (tiny influx, nothing
copied) must leave the loop at the floor and out of the lock; then, once a
cohort has gone through the survivor space and been followed, the debounced rise
must still reach the ceiling. Sabotage: delete the gate, or restore the power-on
value to the ceiling, and phase 1 fails.

Two existing tests move with the power-on value and keep their properties:
`drops_immediately_and_rises_debounced` is about the ladder's ASYMMETRY, so it
now seeds a fully-dying cohort first (which rates a round without involving the
lock) and then tests the same immediate-drop / debounced-rise behaviour;
`sweep_seed_refuses_a_small_fully_live_eden` asserts the threshold is unchanged
from power-on, which is the floor now. `survival_rate_lock_breaks_a_saturated_
pipeline` needs no change -- the lock firing implies a rated round, so its
ladder recovery is unaffected.

NOT COMPILED: the box is at 7 GB free, under this campaign's 12 GB build floor,
so neither the build nor the suite has been run against this commit. The braces
balance and the reasoning above is stated per test, but that is a review and not
a check.

(cherry picked from commit 481e941)

…the floor

(cherry picked from commit 939187c)

LAST_COHORT_SPLIT (cfg(test), copying.rs) is test_only; SURVIVOR_ROUND_MEASURED
(tenuring.rs) is a boolean, not a GC pointer. Inventory only; no code change.

(cherry picked from commit 9c85be5)

Snapshot malloc-backed headers before running verifier callbacks so exact
child validation can lazily rebuild the malloc registry without re-entering
its RefCell borrow. Add a worker-thread copying-minor regression fixture.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 499b716)

Record the re-entrancy path, structural fix, disk-gated validation status,
and the requested perrymaster campaign handoff.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 4295d39)

Name heap parents, layout slots, root scanners, and collection coverage
when evacuation verification finds a stale forwarding alias. Emit a compact
success witness with heap-walk and remembered-edge counts under GC diagnostics.

Add focused failure-attribution and success-line regression tests.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 1ec9e0e)

Record VF2 field derivation, covered failure sites, passing-path cost,
focused test evidence, disk-limited gates, and the perrymaster campaign
request.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 38229cc)

Re-pin the PASS1_MARKED non-moving window after auditing the verifier
diagnostic plumbing, and classify its three counter-only TLS holders.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 4fc86a2)

Instrument headerless receiver producers and dynamic receiver funnels behind
the opt-in PERRY_RECEIVER_REPR_DIAG sink. Add explicit native return storage
kinds while retaining the existing pointer-boxing lowering, plus checked
provider inventory and fail-capable fixtures.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit 9b6884e)

Record the producer map, corrected executable-row census, sabotage proofs,
gate results, and the perrymaster measurement request for campaign PR 1.

Claude-Session: https://claude.ai/code/session_011dhBmdn4vGgNibjo3oZqTo
(cherry picked from commit ecbfba3)

#9969 makes run_lint_gates.sh derive every command of every run: step (80
now, up from 67). Two of the newly-run gates were red on this train:

- addr_class_inventory rejected #9973's two GcHeader casts in
  hot_diag/receiver_repr.rs. Both are allowlisted with reasons rather
  than converted: the block is a #[cfg(debug_assertions)] trust-the-tag
  audit that compares the ownership-derived header against a direct
  byte-offset read and counts disagreements. Routing the raw side through
  try_read_gc_header would validate the address first and return None for
  exactly the implausible cases the audit exists to catch, so the
  canonical predicate cannot stand in there.

- RUSTFLAGS="-D warnings" cargo check --workspace --all-targets rejected
  #9861's doc comment on a thread_local! macro invocation, which cannot
  carry one. Moved inside the macro onto the static it describes. This is
  a warning, not an error, so it only fails under -D warnings — which the
  driver never replayed before #9969.