ADR 0098 P9: the test-host-sim CI lane, the nightly host swarm, the Phase 2 bookend close

[nikhilunni]

What this is

The final row of ADR 0098 Phase 2. Stacked on #758 (P8) — merge order: #757 → #758 → this; the diff is only the commit on top.

The PR lane

• Detector: test_host_sim flag in detect-rebake-lanes.py, keyed on the release closure of engram-dst-host itself — engram-host-agent, engram-host-core, engram-sim, and the chunk/storage crates ride in as normal deps, so any change that can alter host-sim behavior trips the lane and nothing else does. Disjoint from engram-dst's coordinator closure by construction.
• test-host-sim in ci.yml: a whole-binary replay-twice determinism self-check first (seed 5 run twice, stdout diffed — the per-seed OK lines are a pure function of the seed, so this is the cheapest guard against a nondeterminism leak), then fixed windows: chaos 0..60 × 1000 steps, calm 0..30 × 1000. Own rust-cache key (workspace-release-host-sim). Any failure replays locally with just sim-host <n> <steps> <profile>.
• Added to CI Gate.needs: — never individually required, per the aggregator rule (a path-skipped lane must not wedge the merge queue).

The nightly arm

nightly-sim.yml gains a host-swarm job mirroring the coordinator swarm: date-derived non-overlapping seed windows (360 chaos + 120 calm × 4000 steps — sized below the coordinator swarm's volume because the host sim's steps run real tempdir fs + chunk-store I/O), --failure-report → the same slug-deduped sim-failure issue auto-filing, with the title prefixed nightly host sim: so host slugs never collide with same-named coordinator invariants. Fix flow in the filed issue points at crates/engram-dst-host/tests/regression_seeds.rs.

The bookend

• P9 row → Landed; the Phase 2 header flips to COMPLETE with the full commit chain (P0 ADR 0098 Phase 2 opened: host-agent simulation — the P-series (P0) #733 → … → P8 ADR 0098 P8: Flow E migration — now_mono TTL, the #216 decision-table oracle, the gap-family seeds #758 → this PR), the six-flow / eight-oracle inventory, and the explicit note that oracle chore(web)(deps): bump framer-motion from 11.18.2 to 12.38.0 in /web #4 is subsumed by the P4.5 published-floor split.

Verification

• python3 -m py_compile on the detector; yaml.safe_load + actionlint on both workflows (remaining findings are the pre-existing classes: custom Blacksmith runner labels + the same shellcheck style infos the sibling jobs carry).
• Lane arithmetic: the debug-profile chaos swarm (3 seeds × 400 steps) runs ~25s in nextest; the release windows above are sized to land well inside the 5-minute target — if the first real run says otherwise, the windows are one-line tunables.
• The replay-twice + swarm invocations were exercised locally via the release bin (just sim-host).
• This lane runs ON this PR (the detector's ci_self arm trips on any .github/** change), so the merge itself proves the lane green.

This closes ADR 0098 Phase 2. After the stack merges: six flows extracted and simulated, eight standing oracles, both #743 gaps closed, 26 pinned regression scenarios + two swarm suites, PR-lane + nightly coverage for both simulators.

Per the standing P-series policy: leaving this open for your review — no admin-merge.

🤖 Generated with Claude Code

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	⏩ skipped	✅ passed	Jul 18, 2026, 1:16 AM

[nikhilunni]

Two updates:

The CI failure was the lane doing its job — on its very first run. The calm swarm (seeds 14, 16) fired oracle #7 on an explicit coordinator abort of a state_served export. Production's migration_abort RPC explicitly allows that (the coordinator carries the postcopy-never-loaded knowledge, ADR 0045 C2); only the dumb-host TTL self-resume is forbidden. The sim was modeling stricter than prod — a fidelity bug in P8's world model, not a product bug. The fix rides the rebased #758 (explicit-abort no longer records a split-brain; the sweep's recording stays as ttl_verdict's guard; new pin explicit_abort_after_state_served_is_legal_and_resumes; oracle #7 doc + ADR row corrected). Rebased this branch on top — the full calm/chaos windows are green locally.

The ADR close now records the residual-risk assessment (new §"Residual risk, recorded at close"): the ranked honest boundary — kernel/data-plane assumptions (with the named FC-lane "kernel assumptions audit" next increment), the un-co-simulated coordinator↔host boundary (with the recorded-trace boundary-harness increment), oracle-coverage-is-what-someone-asserted (the gut-check ritual as the standing mitigation), the deliberate point-test residue, the untouched ops layer, and exploration volume. Phase 2 still closes officially — the section is the boundary of what closing it bought, and the two named increments are explicitly outside this ADR.

[nikhilunni]

Rebased onto main after #758 merged — clean replay, diff is exactly this PR's own commit. This is the last one: merging it closes ADR 0098 Phase 2.