#140 chore: catch up co-core 0.19.6 -> 0.36.0

.skills/context-loss-ok

@@ -725,3 +725,12 @@ AGENTS.md :: duplicate :: never resolved as a path. Read [docs/CONVENTIONS.md](d
 AGENTS.md :: duplicate :: - **Watcher alone issues `content.fetch` (#90).** `scripts/seed_fetch.py` seeds
 AGENTS.md :: duplicate :: scratch streams; the live one takes `--production` and Watcher's identity, never
 AGENTS.md :: duplicate :: `replicator`'s.
+
+# ---- #140 curation: Memory protection demoted out of docs/DEPLOYMENT.md ----
+# Each read against its replacement. The memory section moved whole to
+# docs/MEMORY-PROTECTION.md; these four lines pointed at it or at the table it
+# left behind, so the same change that moved it retargets them.
+AGENTS.md :: retarget :: - [DEPLOYMENT.md](docs/DEPLOYMENT.md) — the unit's lifecycle, its start guards, the co-core pin, the host's memory tunables
+docs/DEPLOYMENT.md :: retarget :: The systemd unit's lifecycle, the guards it starts behind, the host's memory
+docs/DEPLOYMENT.md :: retarget :: tunables, and the co-core pin. What it reports when it *fails* is in
+docs/DEPLOYMENT.md :: retarget :: from the table above — `daemon-reload` alone silently keeps the old values, and

.skills/context-metrics.jsonl

@@ -60,3 +60,7 @@
 {"actions": ["baseline:scheduled"], "budget": 6000, "bytes": 14190, "claims_dropped": null, "claims_warranted": null, "counts": null, "counts_acked": null, "delta_days": 7, "delta_tokens": -4, "docs_orphaned": 0, "docs_total": 22, "docs_unindexed": 0, "file": "AGENTS.md", "lines": 249, "links_dead": 0, "links_dead_anchors": 0, "no_loss": null, "no_loss_warrants": null, "note": null, "over_budget": true, "repo": "replicator", "repo_commit": "bd49943", "seams": 2, "seams_acked": 35, "skill_commit": "5ff7a82", "skill_version": "1.31", "tokens": 6005, "tokens_exact": true, "tokens_live": 166891, "top_section": "Bus Conventions", "top_section_share": 28, "ts": "2026-10-13"}
 {"actions": ["baseline:pre-curation"], "budget": 6000, "bytes": 14641, "claims_dropped": null, "claims_warranted": null, "counts": null, "counts_acked": null, "delta_days": 3, "delta_tokens": 194, "docs_orphaned": 0, "docs_total": 22, "docs_unindexed": 0, "file": "AGENTS.md", "lines": 259, "links_dead": 0, "links_dead_anchors": 0, "no_loss": null, "no_loss_warrants": null, "note": null, "over_budget": true, "repo": "replicator", "repo_commit": "931ddbf", "seams": null, "seams_acked": null, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 6199, "tokens_exact": true, "tokens_live": 167028, "top_section": "Bus Conventions", "top_section_share": 27, "ts": "2026-10-16"}
 {"actions": ["prune:Bus Conventions/blob-backends (dup docs/STORAGE.md; to_thread rule kept inline)", "prune:Bus Conventions/replicate-gcs (dup docs/CONVENTIONS.md+STREAMS.md)", "prune:Bus Conventions/watcher-issues-fetch (dup docs/STREAMS.md)", "ack:seams x4", "prune:stale counts-ok entry"], "budget": 6000, "bytes": 14099, "claims_dropped": 0, "claims_warranted": 0, "counts": 0, "counts_acked": 4, "delta_days": 0, "delta_tokens": -244, "docs_orphaned": 0, "docs_total": 22, "docs_unindexed": 0, "file": "AGENTS.md", "lines": 251, "links_dead": 0, "links_dead_anchors": 0, "no_loss": "ok", "no_loss_warrants": 9, "note": null, "over_budget": false, "repo": "replicator", "repo_commit": "c95aa3f", "seams": 0, "seams_acked": 39, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 5955, "tokens_exact": true, "tokens_live": 166784, "top_section": "Bus Conventions", "top_section_share": 24, "ts": "2026-10-16"}
+{"actions": ["baseline:pre-curation"], "budget": 6000, "bytes": 14099, "claims_dropped": null, "claims_warranted": null, "counts": null, "counts_acked": null, "delta_days": 1, "delta_tokens": 0, "docs_orphaned": 0, "docs_total": 22, "docs_unindexed": 0, "file": "AGENTS.md", "lines": 251, "links_dead": 0, "links_dead_anchors": 0, "no_loss": null, "no_loss_warrants": null, "note": null, "over_budget": false, "repo": "replicator", "repo_commit": "f638266", "seams": null, "seams_acked": null, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 5955, "tokens_exact": true, "tokens_live": 166784, "top_section": "Bus Conventions", "top_section_share": 24, "ts": "2026-10-17"}
+{"actions": ["baseline:pre-curation"], "budget": 10000, "bytes": 27998, "claims_dropped": null, "claims_warranted": null, "counts": null, "counts_acked": null, "delta_days": 23, "delta_tokens": 1533, "docs_orphaned": 4, "docs_total": 21, "docs_unindexed": 10, "file": "docs/DEPLOYMENT.md", "lines": 265, "links_dead": 0, "links_dead_anchors": 0, "no_loss": null, "no_loss_warrants": null, "note": null, "over_budget": true, "repo": "replicator", "repo_commit": "f638266", "seams": null, "seams_acked": null, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 10889, "tokens_exact": true, "tokens_live": 142762, "top_section": "Server Lifecycle", "top_section_share": 97, "ts": "2026-10-17"}
+{"actions": ["index:MEMORY-PROTECTION.md", "retarget:Detail Docs DEPLOYMENT.md line"], "budget": 6000, "bytes": 14154, "claims_dropped": 0, "claims_warranted": 0, "counts": 0, "counts_acked": 4, "delta_days": 0, "delta_tokens": 36, "docs_orphaned": 0, "docs_total": 23, "docs_unindexed": 0, "file": "AGENTS.md", "lines": 252, "links_dead": 0, "links_dead_anchors": 0, "no_loss": "ok", "no_loss_warrants": 1, "note": "#140: pointer for the doc demoted out of DEPLOYMENT.md; 9 tokens headroom left", "over_budget": false, "repo": "replicator", "repo_commit": "2b1fd5b", "seams": 0, "seams_acked": 39, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 5991, "tokens_exact": true, "tokens_live": 167285, "top_section": "Bus Conventions", "top_section_share": 24, "ts": "2026-10-17"}
+{"actions": ["demote:Memory protection", "retarget:preamble", "fix:manifest StartLimitBurst"], "budget": 10000, "bytes": 19715, "claims_dropped": 0, "claims_warranted": 0, "counts": 17, "counts_acked": 0, "delta_days": 0, "delta_tokens": -3319, "docs_orphaned": 4, "docs_total": 22, "docs_unindexed": 11, "file": "docs/DEPLOYMENT.md", "lines": 137, "links_dead": 0, "links_dead_anchors": 0, "no_loss": "ok", "no_loss_warrants": 3, "note": "#140: Memory protection -> docs/MEMORY-PROTECTION.md (3449 tokens, class B)", "over_budget": false, "repo": "replicator", "repo_commit": "2b1fd5b", "seams": 0, "seams_acked": 29, "skill_commit": "3cea77a", "skill_version": "1.31", "tokens": 7570, "tokens_exact": true, "tokens_live": 143227, "top_section": "Server Lifecycle", "top_section_share": 95, "ts": "2026-10-17"}

.skills/context-seams-ok

@@ -478,3 +478,13 @@ docs/SKILLS.md :: | `brainstorming` | Intent and design before building; this re
 # Provenance heading from #131, not this run's; nothing links its anchor (grep "in-flight-count"),
 # so the slug is not load-bearing. Rename it with the next COMMANDS.md edit rather than widen this one.
 docs/COMMANDS.md :: The patching gate's in-flight count (#131)
+
+# --- #140 curation: Memory protection split out of DEPLOYMENT.md ----------
+# Judged one by one; each points at content that STAYED in DEPLOYMENT.md or
+# is the new doc's own split note. ENVIRONMENT.md's two name the start budget
+# (#134) and the checkout guard, neither of which moved.
+docs/ENVIRONMENT.md :: `REPLICATOR_MAX_CONSECUTIVE_CYCLE_FAILURES` — consecutive failed cycles
+docs/ENVIRONMENT.md :: `REPLICATOR_ALLOW_ANY_CHECKOUT` — bypasses the `main`-checkout guard
+docs/MEMORY-PROTECTION.md :: [DEPLOYMENT.md](DEPLOYMENT.md) (#140), which keeps the unit's lifecycle and the
+docs/MEMORY-PROTECTION.md :: from [DEPLOYMENT.md](DEPLOYMENT.md#server-lifecycle)'s table
+.socraticodecontextartifacts.json :: "description": "Memory protection for co-replicator, split out of docs/DEPLOYMENT.md (#140).

.skills/context-token-counts

@@ -3,14 +3,15 @@
 # The offline estimators prefer a file's own last exact measurement to the
 # repo-wide figure in .skills/context-token-ratio, falling back to it for a
 # file never counted exactly or since drifted far from the size recorded here.
-14099 5955 AGENTS.md
+14154 5991 AGENTS.md
 5692 2194 docs/ARCHITECTURE.md
-26724 10372 docs/COMMANDS.md
+26738 10378 docs/COMMANDS.md
 26391 9745 docs/CONVENTIONS.md
-27998 10889 docs/DEPLOYMENT.md
+19715 7570 docs/DEPLOYMENT.md
 25412 10014 docs/ENVIRONMENT.md
 8941 3330 docs/FAILURE-NOTIFICATION.md
 21824 8554 docs/INFRASTRUCTURE.md
+9228 3778 docs/MEMORY-PROTECTION.md
 18208 6458 docs/POLITENESS.md
 26669 10059 docs/SKILLS.md
 11592 4447 docs/SOCRATICODE.md

.skills/context-token-ratio

@@ -1 +1 @@
-2.67
+2.66

.skills/doc-sections

@@ -16,6 +16,7 @@
 
 AGENTS.md: Project Layout (a new package under src/), the co-core pin under Environment & Tooling (pyproject.toml), Server Lifecycle (deploy/), and the Detail Docs roster of docs/*.md
 docs/DEPLOYMENT.md: the co-core pin and wheelhouse story (pyproject.toml, uv.lock); the systemd unit and its guards, which README.md's Deploy section restates (deploy/)
+docs/MEMORY-PROTECTION.md: OOMScoreAdjust= on both units and tailscaled, swap and vm.min_free_kbytes, the MemoryLow= slice grant, earlyoom declined (deploy/)
 docs/ARCHITECTURE.md: Project Layout, one line per module (src/, scripts/)
 docs/ENVIRONMENT.md: every REPLICATOR_* variable, its default and the reasoning behind it (src/core/config.py)
 docs/COMMANDS.md: every script with its flags (scripts/) — README.md's Setup, Seeding a fetch and Deploy blocks repeat some of them

.socraticodecontextartifacts.json

@@ -88,7 +88,12 @@
     {
       "name": "deployment-reference",
       "path": "./docs/DEPLOYMENT.md",
-      "description": "How the systemd unit runs and the guards it starts behind; where it runs is docs/INFRASTRUCTURE.md. Every deploy situation as one table — pull or push by where the merge happened, the cp each installed file under deploy/ needs, reset-failed after start-limit-hit — why the installed units are copies, the dev-server invocation, and the start budget: StartLimitBurst=6 in two hours, sized against the worst observed cluster outage (#94). The checkout guard's verdict table (#37, #48) and the dev worker's check at the writer (#52). The co-core pin and why its patch floor is load-bearing. Memory protection: OOMScoreAdjust=-900 on both units (#92), so the worker ranks below the dev sessions sharing the VM, which sit at oom_score_adj 0 since exe-init 14fd603 and were exempt at -1000 before it (#125); tailscaled's drop-in at -950, below the worker so the network path outlasts its only consumer (#113, #112); MemoryLow= real only through the system.slice.d grant, since cgroup2 here has no memory_recursiveprot; and why earlyoom is declined twice (#112): at -1000 it could not reach the sessions, and at 0 the kernel's own order already takes them first, so it would add only an earlier kill on reclaimable cache — the cohort's reading too (archiver#285, watcher#337, power-map#588). Also: a co-core bump that makes a field required is a two-repo deploy (#28), and the dedupe keys' stream segment (#29). The variables are in docs/ENVIRONMENT.md, the OnFailure= handler in docs/FAILURE-NOTIFICATION.md, the reconnection rehearsal in docs/TESTING.md."
+      "description": "How the systemd unit runs and the guards it starts behind; where it runs is docs/INFRASTRUCTURE.md. Every deploy situation as one table — pull or push by where the merge happened, the cp each installed file under deploy/ needs, reset-failed after start-limit-hit — why the installed units are copies, the dev-server invocation, and the start budget: StartLimitBurst=8 in two hours, sized against the worst observed cluster outage (#94, #134). The checkout guard's verdict table (#37, #48) and the dev worker's check at the writer (#52). The co-core pin and why its patch floor is load-bearing. The host's memory tunables are docs/MEMORY-PROTECTION.md. Also: a co-core bump that makes a field required is a two-repo deploy (#28), and the dedupe keys' stream segment (#29). The variables are in docs/ENVIRONMENT.md, the OnFailure= handler in docs/FAILURE-NOTIFICATION.md, the reconnection rehearsal in docs/TESTING.md."
+    },
+    {
+      "name": "memory-protection-reference",
+      "path": "./docs/MEMORY-PROTECTION.md",
+      "description": "Memory protection for co-replicator, split out of docs/DEPLOYMENT.md (#140). OOMScoreAdjust=-900 on both units (#92), so the worker ranks below the dev sessions sharing the VM, which sit at oom_score_adj 0 since exe-init 14fd603 and were exempt at -1000 before it (#125); tailscaled's drop-in at -950, below the worker so the network path outlasts its only consumer (#113, #112); 8 GiB + 4 G swap and vm.min_free_kbytes pinned in deploy/99-co-replicator-memory.conf (#99); MemoryLow= real only through the system.slice.d grant, since cgroup2 here has no memory_recursiveprot; and why earlyoom is declined twice (#112): at -1000 it could not reach the sessions, and at 0 the kernel's own order already takes them first, so it would add only an earlier kill on reclaimable cache — the cohort's reading too (archiver#285, watcher#337, power-map#588). Not a substitute for capping a SocratiCode launch (docs/COMMANDS.md)."
     },
     {
       "name": "failure-notification-reference",
@@ -148,7 +153,7 @@
     {
       "name": "dependency-contract",
       "path": "./pyproject.toml",
-      "description": "Project and tooling contract. The co-core / co-core-aio / co-core-sync pins (>=0.19.6,<0.20, for the content.persist contract since #114 step 6 — cannobserv#493; 0.19.3 brought the shared content-addressed BlobStore, cannobserv#475) with their [extract], [bus,gcs] and [gcs] extras, the floor history that explains each raise, the [tool.uv] find-links wheelhouse resolution, the ruff rule set and its skills-vendor exclusion, the ty exclusion, the replicator-worker console script, pytest configuration (asyncio auto mode, the integration and gcs markers both deselected by default, timeout) and the 80% coverage gate."
+      "description": "Project and tooling contract. The co-core / co-core-aio / co-core-sync pins (>=0.36.0,<0.37 since #140, a no-feature catch-up whose wheel diff covers the whole import closure; 0.19.6 brought the content.persist contract, cannobserv#493, and 0.19.3 the shared content-addressed BlobStore, cannobserv#475) with their [extract], [bus,gcs] and [gcs] extras, the floor history that explains each raise, the [tool.uv] find-links wheelhouse resolution, the ruff rule set and its skills-vendor exclusion, the ty exclusion, the replicator-worker console script, pytest configuration (asyncio auto mode, the integration and gcs markers both deselected by default, timeout) and the 80% coverage gate."
     },
     {
       "name": "main-checkout-guard",

AGENTS.md

@@ -34,7 +34,7 @@ Python ≥3.12, uv, pytest, ruff. `ty` (`uv run ty check`) is a **non-gating** t
 uv run --no-project --with 'google-cloud-storage>=2,<4' python scripts/sync_wheelhouse.py
 ```
 
-Auth is ADC. Pin the current minor — `>=0.19.6,<0.20` — and raise the **patch** floor with every co-core feature the code starts depending on; the ways a skew has already failed are in [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md).
+Auth is ADC. Pin the current minor — `>=0.36.0,<0.37` — and raise the **patch** floor with every co-core feature the code starts depending on; the ways a skew has already failed are in [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md).
 
 <!-- BEGIN socraticode-policy -->
 ## Code Exploration Policy
@@ -232,7 +232,8 @@ source — each with its rationale and ruff gate in [docs/STYLE.md](docs/STYLE.m
 - [POLITENESS.md](docs/POLITENESS.md) — per-host pacing: the policy stream, sleep vs park, 429/503 escalation
 - [CONVENTIONS.md](docs/CONVENTIONS.md) — rules common to every stream: idempotency, validation, DLQ, `claim_stale`, the `replicator:cmd:*` keys (#80)
 - [STORAGE.md](docs/STORAGE.md) — blob paths and modes, the populations under `REPLICATOR_BLOB_DIR`, TTL and ceilings
-- [DEPLOYMENT.md](docs/DEPLOYMENT.md) — the unit's lifecycle, its start guards, the co-core pin, the host's memory tunables
+- [DEPLOYMENT.md](docs/DEPLOYMENT.md) — the unit's lifecycle, its start guards, the co-core pin
+- [MEMORY-PROTECTION.md](docs/MEMORY-PROTECTION.md) — the host's memory tunables
 - [FAILURE-NOTIFICATION.md](docs/FAILURE-NOTIFICATION.md) — the `OnFailure=` handler: `REPLICATOR_NOTIFY_*`, notifier mode, delivery scoring
 - [INFRASTRUCTURE.md](docs/INFRASTRUCTURE.md) — VM topology, ports, the broker, buckets either side of the test/production line
 - [tailscale.md](docs/reference/tailscale.md) — this node: tailnet, ACL, DNS, broker latency

docs/COMMANDS.md

@@ -385,7 +385,7 @@ since #99 — headroom, not immunity, as broker was 8 GiB too — and runs the
 worker beside these sessions. On CannObserv/broker's VM an uncapped
 launch degraded the tailnet for 57m48s with nothing OOM-killed (broker#17, our
 #94). `OOMScoreAdjust=-900` on the units is the other half and is already in
-place ([DEPLOYMENT.md](DEPLOYMENT.md)) — it does not remove the need for the cap.
+place ([MEMORY-PROTECTION.md](MEMORY-PROTECTION.md)) — it does not remove the need for the cap.
 `choom -n 500` is part of it: under an `exe-init` that starts sessions at
 `oom_score_adj=-1000`, as this host's did until #125, a cgroup cap *stalls* a
 process rather than killing it.