docs(headless): record K4 resource envelope

docs/research/2026-07-27-slice-k4-resource-telemetry-checkpoint.md

@@ -1,13 +1,13 @@
 # Slice K4 resource telemetry checkpoint
 
 **Date:** 2026-07-27
-**Status:** Instrumentation and CPU-wakeup correction complete; fixed-binary
-connected baselines remain active
-**Production commit:** `cb512fd0`
+**Status:** Implementation and automated gates complete; exact connected
+terminal gate active
+**Production commits:** `cb512fd0`, `97c174fb`, `bd236ce5`, `776482da`
 
 ## Outcome
 
-The Linux headless process now emits one structured resource sample at
+The Linux headless process emits one structured resource sample at
 startup, every 30 seconds, before scheduler stop, and after terminal disposal.
 Sampling is driven by the existing process scheduler's absolute deadline. It
 does not add a worker, timer, or callback per session.
@@ -36,7 +36,8 @@ One native Linux process connected the two locally available accounts:
 - `testaccount2` / `+Horan`
 
 Both entered Rynthid and maintained independent Runtime roots and movement.
-The user asked that this process stay running for the retail-observer gate.
+The user asked that the current exact `776482da` process stay running for the
+retail-observer gate.
 
 The first process sample after both world entries reported:
 
@@ -55,12 +56,20 @@ The first process sample after both world entries reported:
 The roughly 29.9 GB mapped-package value is address space, not resident or
 private memory. The mmap remains shared and demand-paged.
 
-After movement and additional portal/density activity, the latest recorded
-sample before this checkpoint reported 305,393,664 private bytes, 332,742,656
-working-set bytes, 139,609,360 managed live bytes, 418 entities, 16 threads,
-117 handles, and the same three socket descriptors. Entity count changed from
-187 to 418 during that interval, so the memory delta is not treated as a
-same-workload per-session ceiling.
+The earlier fixed scheduler artifact ran for roughly 16 minutes and plateaued
+near 311.8 MiB private / 303.8 MiB resident while entity count rose to roughly
+600. Its steady combined two-bot CPU was 2.3–3.2% of one core, scheduler mean
+lateness was about 3.3 ms, and it retained 15–17 threads, 115 handles, 116
+Linux descriptors, and three sockets. It recorded no session fault or
+reconnect debt. That process ended without a terminal sample, so it is soak
+evidence rather than the closeout teardown gate.
+
+The current exact `776482da` process entered Rynthid with both accounts and
+reported four consecutive passing samples in its first 90 seconds. After
+initial hydration, combined CPU was 2.5–2.9% of one core, waits were
+89–96/second, turns were 133/second, continuing catch-ups were zero, mean
+lateness was about 3.1 ms, and maximum lateness was 145.1 ms. It had zero
+faulted or reconnecting sessions and exactly two Runtime/content leases.
 
 ## Scheduler finding and correction
 
@@ -86,30 +95,77 @@ its high wait counter belongs to the pre-correction artifact. The committed
 correction is protected by deterministic rebase/lateness tests and a real
 system-timer test that fails if the scheduler busy-loops between turns.
 
-## Automated gates
+## Committed resource envelope
 
-- Windows Headless Release: 56 passed.
-- Native Ubuntu Headless Release: 56 passed.
-- Complete Windows Release suite: 8,773 passed / 5 skipped.
+`776482da` commits the `k4-linux-30-session` numeric profile. For `N`
+configured sessions, the principal ceilings are:
+
+| Dimension | Ceiling |
+|---|---:|
+| private bytes | 224 MiB shared + 64 MiB/session |
+| working set | 224 MiB shared + 64 MiB/session |
+| managed live bytes | 64 MiB shared + 48 MiB/session |
+| managed heap | 64 MiB shared + 48 MiB/session |
+| CPU | 2% of one core shared + 3%/session |
+| threads | 48 process-wide |
+| handles | 128 shared + 3/session |
+| Linux descriptors | 128 shared + 3/session |
+| sockets | 1 shared + 2/session |
+| scheduler waits | 250/second process-wide |
+| scheduler catch-ups | 1/second process-wide |
+| mean/max lateness | 10/750 ms |
+
+The evaluator fails closed on non-finite metrics, reports named violations,
+requires exact running lease/session accounting, and requires all Runtime
+roots plus shared content to converge in the `disposed` sample. It is
+observational only.
+
+## Automated endurance and adversarial gates
+
+- Content sharing and same-GUID/portal/reconnect isolation run at 1, 5, 10,
+  and 30 roots.
+- The 30-root workload advances 480,000 frames per root: two simulated hours
+  and 14.4 million stable-order scheduler turns.
+- Every root performs recurring movement, use, combat, spell, chat, portal,
+  death, and reconnect activity.
+- Whole-process allocation stays below 384 KiB/second and retained growth
+  stays below 16 MiB in the deterministic endurance fixture.
+- Five 30-root process runs inject randomized cancellation across lifecycle
+  edges and converge every Runtime root and shared-content lease.
+- The resource evaluator covers a passing recorded Rynthid sample, every
+  individually named resource/ownership debt, terminal success/failure, and
+  non-finite metrics.
+
+- Windows Headless Release: 67 passed.
+- Native Ubuntu Headless Release: 67 passed.
+- Runtime Release: 412 passed.
+- App Release: 3,722 passed / 3 skipped.
+- Complete Windows Release suite: 8,784 passed / 5 skipped.
 - Windows and native Ubuntu Release builds complete.
-- Diagnostics assert two configured sessions, no password text, and exact
-  two-runtime terminal convergence.
+- Diagnostics assert no credential text and exact 1/5/10/30-root terminal
+  convergence.
 
 ## Remaining K4 gate
 
-The next connected restart must use exact binary `cb512fd0` or a documented
-descendant and prove the wait counter remains cadence-bounded, initial
-catch-up remains zero, CPU falls accordingly, and terminal resource samples
-converge. Available credentials support a two-account connected scale gate.
-The 5/10/30-session isolation and endurance dimensions therefore remain
-automated in-process gates unless additional local ACE accounts are
-provisioned.
+The exact `776482da` two-account process is running under the committed
+envelope. After the observer window it must receive graceful cancellation and
+emit a final `disposed` sample with:
 
-Numeric ceilings are not yet committed: they will be derived only from the
-fixed binary under matched 1- and 2-session workloads.
+- two converged Runtime roots;
+- zero in-world/reconnecting/faulted sessions;
+- zero entities, inventory objects, and host leases;
+- zero shared-content leases with content disposed/converged;
+- `withinCeilings=true`.
+
+Only then does Slice K close. Available credentials support two simultaneous
+connected accounts; 5/10/30-session scale and two-hour duration are therefore
+proved by the deterministic in-process production-owner fixtures.
 
 ## Rollback
 
 ```text
-git revert cb512fd0
+git revert 776482da8225d88a7c6128022d137d26f9266a87
+git revert bd236ce553718cfb1248703f4a2b17b35733b11c
+git revert 97c174fbb2d72fb94e2fe07448bb257989ed8941
+git revert cb512fd0916fbf49285c9b64df1630c5a69a0d20
 ```