r2il: PR 2 first slice — §12 corpus profile (resolves O1) + RefinedTruthSink

[AdaWorldAPI]

Summary

A scoped first increment of PR 2 from .claude/plans/r2il-behavioral-ir-v1.md ("route → V3 projection + DTO hooks, gated on PR 1 numbers"). PR 2 has no type-level implementation spec the way PR 1 did (that plan's impl-spec doc is entirely PR-1-scoped) — writing that full spec, and then the round-trip reconstruction oracle + DTO/codebook wiring + optional SPO projection it calls for, is real remaining work sized similarly to PR 1 (which needed a 10-worker Sonnet fleet). This PR ships what's genuinely well-scoped and measurement-gated today, and is explicit about what it doesn't attempt.

1. §12 corpus profile — resolves O1

Task tracking had "run corpus profile + record §12 numbers" marked done with no artifact anywhere in the repo. Actually ran it:

cargo run --example r2il_corpus_profile --features lift --release

Across all 4 corpus binaries (130193 sampled ops total): 100.00% fit the dst+src0+src1 inline shape, 0.00% needed Vec routing — on every single binary, no exceptions. Full breakdown (per-binary op/CFG stats, facet-overflow check, furnace conservation cross-check, and the honest caveats — CallOther arity unmeasured, phi/Multiequal fan-in reaching 7 at the CFG level though never sampled as an Op row here) in .claude/harvest/r2il/CORPUS-PROFILE-RESULT.md.

This also let me correct a stale flag in STAGED-CODEGEN-GUIDE.md: FlatFact's existing a/b: u64 payload slots (already shipped in PR 1, 88 bytes, Copy, no Vec) were flagged "NOT stable, may be re-carved in PR 2." The measurement says otherwise — the shape needs no re-carving. What's still open is the per-kind meaning of those slots and the persistence byte encoding, both real PR 2 scope.

2. RefinedTruthSink — the sink trait

The plan's SUBSTRATE RULING calls for a trait behind which offline / lance-graph SoA / S3 are implementations, chosen at the call site. furnace/ore/slag already carry zero persistence assumption (verified — no file/network/env touch in any of the three modules), so this is additive.

• OfflineSink — real, tested. Writes facts/residuals/report as #version/#schema-headed TSV (same additive-export convention every other R2IL artifact already uses); read_report round-trips.
• S3Config::from_lookup/from_env — credential plumbing only (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_ENDPOINT_URL_S3/AWS_REGION, all-or-nothing, empty treated as unset). The actual signed PUT is not implemented — flagged explicitly in the module docs rather than faked.
• lance-graph SoA backend: intentionally absent from this crate. ruff_r2il takes no lance-graph dependency to define the trait; a lance-graph-side crate implements it against its own SoA (matches facet.rs's own PR-3 deferral — the real classid mint lives there).

Incidental finding, fixed

ruff/clippy.toml's disallowed-methods list is directory-scoped, not Cargo-workspace-scoped — it reaches this workspace-excluded crate despite every reason string saying "in ty crates" (ruff_r2il has no ty::System trait to route through). #[expect]'d at the two call sites (std::fs::create_dir_all, std::env::var) with that reasoning, per this repo's own AGENTS.md preference for #[expect] over #[allow].

Not in this slice (explicit, not silently dropped)

• The DTO/codebook wiring the plan calls for beyond what facet.rs already has.
• The round-trip reconstruction oracle (R2IL → routes → semantic-equivalent R2IL).
• Optional SPO projection of semantic facts (calls/objects only).
• A facts/residuals reader — only read_report exists; reconstructing FlatFact/ResidualLedger rows (incl. VarnodeFacet from its 3 columns) is real remaining scope.

Test plan

• cargo test in ruff_r2il — 46/46 pass (34 unit + 12 lossless-fixture), including 3 new sink::tests (disable-run-verified: the credential-refusal test drops exactly one env key at a time and confirms the whole config is refused, not just checks the all-present case)
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• cargo doc --no-deps — zero new warnings (4 pre-existing warnings in furnace.rs/ore.rs, untouched by this change)
• uvx prek run --from-ref origin/main --to-ref HEAD — clean

Draft: this is a genuine first slice, not the full PR 2. Marking ready once the maintainer confirms scope, or folding in the remaining pieces as follow-up commits on this branch.

---

Generated by Claude Code

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_09fc4d52-57eb-4319-822f-6ea5fbc8c042)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5aa3c587-61e1-4ad2-994c-c7c9974cf720)