2 Commits

Include renames

Author	SHA1	Message	Date
zeekayandHanzo Dev	1b7a28d31f	planes: one assembly, one identity for an offer, and a bound nobody can spend twice ... The defining failure of the last review was not in a plane. It was that there were TWO wirings: cmd/amld assembled a Handler by hand and the tests assembled a different one, so the record fingerprint could be a struct field the suite exercised and no column stored — every retry a permanent 409 in production while every test passed. api.Wire is now the only assembly. It creates every collection, opens every shelf, makes every join and registers what has to run on a cadence; cmd/amld supplies only what an installation answers differently, the tests call the same function, and internal/source.NoLiteral reads cmd/amld to refuse a second copy. Handler completeness is checked by reflection, because a hand-written field list would be the third copy. A retry is not a second transaction. pkg/receipt resolves the identity of an OFFER once, at the top of ingest, before anything is read or written, and returns the prior answer byte for byte — so the ledger, the aggregates, the history, the alerts and the case plane all agree on one transaction instead of the ledger holding one record while the aggregates hold three. Two different facts under one reference is 409 and never 503. Because the answer is kept AFTER the work, a process that dies in between leaves no receipt, so every plane past it also recognises the transaction for itself: history does not append a second row, alerts keep the first judgement, and a judged transaction opens no second case. A bound over a COUNT of caller-sized values is not a bound. types.MaxIdent bounds every identifier at the door, which is what turns the counts downstream into figures in bytes; dictionary.MaxName does the same for a payload key, and dictionary.Ceiling is the product a test WEIGHS a full accumulator against. The field catalog's accumulator moves into roster, which admits and never removes, so per-tenant bounds multiply by ONE number an operator can hold against a pod. engine.Evaluator now keeps no compiled rules at all. A candidate's text arrives on the wire at /v1/aml/rules/test, so a compiled-rule table there was keyed by a string a caller wrote, sized by how many distinct ones a caller sends, with no cap and no removal, in the memory every institution's ingest runs in — an OOM from one authenticated caller, which on this deployment is every control off at once. A rule's compiled form is a value with an owner: the installed library, or one replay. Nothing shared, nothing to grow. Found here, not reported. Handler.history is the one function that materialises a whole retained history, so it now REQUIRES a *topology.Grant, and a Grant comes from Budget.Admit and nowhere else. An ungated whole-history read is something a caller has to write on purpose rather than something a new door can forget. The rule replay and the activation rate fold take the same one budget the model studies take. Reaching a bound is allowed; reaching it quietly is not. GET /v1/aml/load is the one door for "is anything of mine quietly degraded": the tenant's aggregates against its own ceiling in bytes with a grade, whether it has a behavioural model at all, the field catalog's pressure, and the process's counts of institutions held and refused. It names no other institution. Closing R1-R8 from the review plus R11, the two recurring classes, and the silent degradation the load door answers. Twenty-four mutations, twenty-four killed. Co-authored-by: Hanzo Dev <[email protected]>	2026-08-02 11:32:15 -07:00
zeekayandHanzo Dev	90fef65897	planes: a bound in bytes, and a tenant that only ever spends its own ... Two shapes, both on the ingest path, both proven by measurement. A bound over a COUNT of caller-sized things is not a bound. A velocity key is not a pointer to what the caller sent: it is one ring per window, 444 buckets allocated whole on the first transaction, a measured 22.7 KB. So MaxKeys=100000 meant 2,163 MiB against a 1 GiB pod — the honest reading was that the process dies at about 46,000 keys, from one tenant, with ordinary traffic. The ceiling is now in BYTES and the key count is derived from it in one place (keyCost), so the two cannot disagree; Store.Ceiling() is an upper bound a test WEIGHS a full store against. One store shared by every tenant under one cap is a way for one institution to switch another's monitoring off. Measured: a victim's 24h window went count=1 to count=0, and a victim's model went learned=40 to learned=0, purely from two other tenants' traffic — no error, no alert, and an aggregate that reads zero is what a clean account also reads. Per-tenant state now lives in pkg/roster, which ADMITS and has no removal at all: a tenant keeps what it holds, a tenant arriving with no room is refused by name (anomaly's ReasonCrowded) and counted, and the only key a tenant can drop is its own least recently used. internal/source reads both packages to keep the shape out. Reaching a bound is allowed; reaching it quietly is not. velocity.Load grades a tenant clear/crowded/full and counts what it dropped, anomaly.State carries Crowded and Pressure counts it, and roster.Default is ONE answer to how many institutions this process holds state for, so the per-tenant bounds multiply to a figure an operator can hold against a pod. Closing R5 (cross-tenant model eviction) and R5b (the adopted reload was read once per TRANSACTION under thrash, now once per admission) from the review, plus the same two shapes in pkg/velocity, which nothing had reported. Co-authored-by: Hanzo Dev <[email protected]>	2026-08-01 23:29:18 -07:00