Historical report imported 2026-10-10 from docs/experiments/benchmarks/catalog-cold-lifetime-findings.md. Original SHA-256: 576726de6abf4d607fb2fbe127173cc69ab54dac33e386302a0b9d25d0a59b1b. Measurements and outcomes retain their stated revisions. Links and local environment labels are normalized; $FABRIC_DATA is the mounted experiment drive. See evidence policy.

Cold discovery and metadata lifetime controls

These are finite correctness controls; no performance or full race claim follows. Root ran both jobs serially through the resource launcher on data-drive scratch. The receipts bind exact commands, revisions, protocol hashes and cleanup.

Cold discovery

Protocol (local checkout reference docs/experiments/benchmarks/catalog-discovery-cold-controls-protocol.md; not present at origin/main), receipt (local evidence omitted from stage), transcript (local evidence omitted from stage) and artifacts (local evidence omitted from stage). Command: cargo test --offline --locked -p fabric-server --lib read_catalog::race_tests::cold_and_shared_discovery_cuts_preserve_minimal_custody -- --exact --test-threads=1 --nocapture, with the receipt's FABRIC_STORAGE_EVIDENCE directory. catalog-discovery-cold-controls-01 exited 0, job 6.527734209 seconds.

Seed 0xCA7A10A1; each of four fresh fixtures contains one producer Batch: six logs, one metric and three spans. Cold-clone, primed-clone, cold-shared and primed-shared all recorded explicit Interrupted with segment coverage changed during discovery at the registered publication/reclaim gap. Each subsequent acquisition selected the exact one-Batch producer custody; all four selected-custody.jsonl files contain one entry. The 120 archived, numbered baseline independent-oracle calls all exited 0: 60 Scan and 60 Walk. The target catalog's cold state was not primed by its separate baseline object. Cold means derived catalog state, not the operating system's disk cache.

Whole-job cgroup peak 76,734,464 bytes, sampled scratch 79,455 bytes; zero swap/OOM events, successful scratch removed. These include grading/cache. The original eight-group Walk and Scan counterexamples remain failed and preserved. This adds four selected Walk acquisition states, not exhaustive races or an HTTP envelope observed during the cut.

Real Sources ownership

Protocol (local checkout reference docs/experiments/benchmarks/catalog-lifetime-protocol.md; not present at origin/main), receipt (local evidence omitted from stage) and transcript (local evidence omitted from stage). Command: cargo test --offline --locked -p fabric-server --lib catalog_lifetime_tests -- --test-threads=1 --nocapture. catalog-lifetime-01 exited 0, job 0.503527134 seconds; both controls passed in 0.13 seconds in target. Seed 2703163393. Evidence is the transcript and captured source/protocol; successful fixture scratch was removed.

Actual shared Sources initially referenced two unique Manifest owners; after publishing four more real Segments, the held and fresh views referenced six unique owners. The same-content detached Arc control was correctly distinguished by pointer identity. Actual sealer retention removed files while views still held Manifest/filter allocations; a held path could no longer be scanned. Refresh removed catalog ownership; final view release expired the corresponding Weak Manifest/filter handles. A second control held actual Sources in a paused Tokio future, then aborted and joined the task; its metadata/filter owners expired.

Whole-job peak 62,046,208 bytes, zero swap/OOM events. Sampled scratch zero missed the short-lived fixture and does not establish zero disk use. These checks measure allocation identity and release, not heap bytes, allocator RSS, HTTP client-disconnect behavior or a product memory bound. Page-token Gone is covered separately by paused cuts. Cached metadata still assumes immutable published Segment contents and no label reuse. No new oracle, partial-table availability semantics or full O1–O5 qualification is established.