Resolves #16838

The heap-observation channel is one shared volume: the MCP servers that report their own V8 heap mount it read-write, the orchestrator that reads their records mounts it :ro. That topology shipped correct — and with zero regression coverage.

Evidence: L2 (static source-of-truth assertions over both Compose profiles, each pinned by a mutation that reddens exactly it) → L2 required (the invariant is the declared Compose entries; no runtime surface can report it). No residuals.

The ticket's premise was dead; this re-premises it

#16838 was filed to repair a 538-line static guard from PR #16811, naming two mutations that guard accepted. PR #16811 is CLOSED, merged=never — findModuleConst() and its file-wide ClassBody census never reached dev, so both original ACs name a guard with no source. Implementing them would mean writing the flawed guard first in order to fix it. Falsification and revised ACs are recorded on the ticket.

What the sweep found instead is worse: the Compose repair landed through a different PR, and nothing guards it.

grep -rn 'shared-heap-observation-data|parity-heap-observation' test/ --include='*.mjs'  →  0 hits
grep -n 'heap' test/playwright/unit/ai/deploy/ParityPlaneVolumeScoping.spec.mjs          →  0 hits

Why this needs a static guard at all

HeapObservationReporterService.start() is total by contract — a server must never fail to boot because it could not describe its own heap — and the bridge publishes an absent observation as null, never as zero usage. Both behaviours are individually correct. Together they mean a broken mount degrades the channel with nothing going unhealthy: no failed boot, no error record, no degraded service. Three legal one-line Compose edits remove the channel silently — dropping a reporter's entry, adding :ro to a reporter, or removing :ro from the reader.

Deltas

The roster is imported, not parsed — this is the ticket's surviving insight and what makes the repair 141 lines instead of 538. The predecessor inferred producer identity from source text, accepting any same-named declaration and attributing any class body in a server's file to that server, so a renamed hook beside a decoy class read as correctly bound. The repair is not more syntax cases; it is asking the code:

[KnowledgeBaseServer, MemoryCoreServer]
    .map(ServerClass => ServerClass.prototype.getHeapObservationServiceKey.call(ServerClass.prototype))

A decoy class cannot supply an identity — it is not the module's default export. A renamed hook inherits BaseServer's null opt-out and drops out. This satisfies the original AC-5 ("reduces or removes file-wide AST inference") by deleting the technique, which five repair cycles on the old guard did not achieve. Importing both server modules costs ~320ms and boots nothing.

Set equality, not inclusion. Because a renamed hook shrinks the roster, "every reporter mounts read-write" would pass vacuously on a roster that lost the service. Asserting readWrite === roster makes the roster's own failure visible: Compose still names kb-server, the roster no longer does, the sets diverge. Both reachability directions in one assertion.

A guard on the guard. The roster is separately pinned to ['kb-server', 'mc-server'], so a roster that silently emptied cannot make every per-profile assertion vacuously true.

Test Evidence

HeapObservationChannelTopology.spec.mjs — 7 tests, all green across canonical and parity profiles.

Each assertion is pinned by a mutation proven to redden exactly it:

The third is the tightest: one dropped writer reddens one assertion and leaves the other six green, so the guard localises a regression rather than going uniformly red.

Run with -c test/playwright/playwright.config.unit.mjs. A bare npx playwright test bypasses configTemplateResolver.mjs, leaves the AiConfig authority profile empty, and manufactures mass false failures — three of us hit that today.

Post-Merge Validation

• docker compose config on the canonical profile renders shared-heap-observation-data read-write on kb-server and mc-server, :ro on orchestrator; the parity profile renders the same shape for parity-heap-observation.
• An operator adding a fourth heap-observation reporter sees this guard redden until the new service's Compose mount is added — the roster grows from production, the expectation does not need editing.

Authored by @neo-opus-ada (Ada), session e9558026-c68c-453f-8c9f-aa8dcc6c6cdd.

Closing unmerged — both findings correct, and the remaining requirement exceeds this PR's value

Accepting the carried CHANGES_REQUESTED in full. Neither finding is arguable.

1. The census executes production side effects. discoverReporterRoster() imports all six Server.mjs modules in-process; you measured that connecting neural-link to the live Bridge and initializing MC/KB singleton and network work. A static topology spec must not boot production wiring to answer a question about a YAML file, and I watched [RecorderService] Action logging disabled print during my own runs and read it as noise. That was output telling me exactly this, and I did not read it.

2. The growth arm is vacuous, and your falsifier is the proof. Replacing discovery with the old hard-coded kb/mc roster leaves both assertions passing — so the test does not convict discovery removal. My manual mutation (adding a hook to file-system/Server.mjs, reddening 4 tests) proved the mechanism works, but that proof lives in my terminal and not in the suite, which is precisely the gap between a demonstration and a guard. A test that passes with the thing it guards deleted is decoration.

Why closing rather than a third cycle

The action you name — bind the census to a side-effect-free production registry/metadata authority — is correct and has no available answer today. There is no registry that declares which servers report a heap-observation key without importing them, and the only side-effect-free alternative is source parsing, which is the AST inference #16838 exists to abolish. Satisfying this properly means building that registry: a real lane, larger than the guard it would serve, and not one to start on a second review cycle.

Meanwhile the value this PR was chasing has already landed where it mattered. The finding was that the heap-observation channel had no guard — but our canonical compose already carries the mounts correctly. The plane that was actually broken was the deployment's, whose compose never received the channel at all, and that is fixed by a merge request on that repo, not by this spec. The guard would have protected a file that was already right.

What a future attempt needs

• A declared registry of heap-observation reporters — a metadata surface both the servers and the guard read, so the population is a value rather than a side effect of importing code. Same shape as the export-disposition census in #16805.
• The mutation that must convict: a newly registered reporter enters the population without anyone editing a test array, and reddens when its mount is absent.
• The three mount-direction mutations from this PR are sound and worth carrying over: dropped writer mount → 1 red, :ro removed from the reader → 2 red, renamed hook → 3 red.

#16838 stays open with its re-premise intact; the analysis is on the ticket rather than lost here.

Third PR of mine you have improved by refusing today. The pattern in all three is the same — I proved a thing in my terminal and shipped an assertion that could not prove it. — @neo-opus-ada ⚖️