docs(storage): record the ingest authentication regime and its closeout evidence (#1384)

[DecisionNerd]

Summary

Closes the documentation half of #1384: the ADR of record for the authentication regime, the surviving-boundary justification ledger with measured costs, and the integrated-tree measurement that closes the acceptance criteria.

Contents

• ADR 0043 — the accepted decision of 2026-09-17 as a governing record: hash once on write; SHA-256 keeps the naming role; XXH64 (dependency-free, corruption_checksum.rs) detects corruption; prove-the-store-intact work lives behind graphforge verify, never in ingest; the two assumptions (threat model, unchecked substrate) recorded beside the code and in the ADR. Contains the surviving-boundary ledger: mechanism, uniquely-caught failure, and measured bytes/edge for every authentication read left in the lifecycle — plus the removed-pass inventory and the phase-name accounting note (shape_consume_reauthentication/encode_write_postwrite_authentication are region names, not authentication quantities).
• Closeout evidence (authentication-regime-1384.{md,json}) — fresh native S18–S20 ladder on ed273d2b (contains perf(storage): hash CSR shards on write instead of reading them back (#1384) #1552):
  • Throughput at three scales: 92,340 / 92,851 / 92,349 edges/s (S22 baseline 92,470) — AC9.
  • Ingest application reads at S22: 310.1 GB → 68.5 GB; authentication read-backs 4,579 → 74 B/edge (recovery boundary 68.6 + open-time hydration 5.1; the 0.906 GB CSR read-back removed by perf(storage): hash CSR shards on write instead of reading them back (#1384) #1552) — AC1, with the shortfall vs the ~25 GB hashed target named, justified and measured.
  • Per-phase ingest I/O counters byte-identical to the b6ffb088 baseline — determinism and digest reproducibility demonstrated, not asserted (AC10).
  • Write-volume attribution (AC5): device writes are a consistent 4.25–4.72× application writes across all four scales, owned by the shaping spill/merge pattern; publication decomposed by perf(storage): attribute construction publication and fit it into the ingest floor budget #1481, transient peak by perf(storage): attribute the transient peak that gates S26 admission #1415.
  • Run evidence archived with verified receipts under ladder/ed273d2b…/ and indexed in the retained-evidence README per docs(evidence): retain clean-ladder rung evidence the plan cites; the ladder root was deleted on 2026-09-21 #1530.

Validation

• Receipts verified against rung digests by make retain-ladder-evidence before anything was copied.
• All rungs passed with correctness, digest reconciliation and result-digest checks; admission projection admitted S20.
• Docs-only diff (ADR, evidence, archive, index rows); no code paths touched.

Closes #1384

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9951858d-f9e1-43e2-be6b-25f8c36611a3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DecisionNerd]

Third CI iteration root-caused: //crates/graphforge-cli:verify failed in Bazel because a_corrupted_reachable_object_is_refused_one_way_or_another flips bytes[0] of the first object directory order returns — and a populated project can legitimately retain zero-byte CAS objects, so enumeration order decides between a real bit-flip and an index panic. Bazel passed on main at the same tree (0016934), confirming order-dependence, not the docs diff. Fixed in 5f8814c by skipping zero-byte objects when selecting the corruption target; the test's intent (corrupt a reachable non-empty object, assert fail-closed refusal) is unchanged. The first two failures were the ADR-number collision with the concurrently merged research ADRs (renumbered to 0045 with regenerated indexes).