BAD: checkpoint-tail basis verifier still reads whole tree maps

[flyingrobots]

Summary

The Gate 1 verifier avoids graph.materialize(), but the current checkpoint-tail basis evidence check still depends on whole tree map reads. That keeps the path transitional rather than bounded: the verifier can prove an existing checkpoint-tail basis without loading the full read basis, but it still asks the tree port for complete OID maps.

Method Metadata

Field	Value
Source lane	bad-code
Legend	perf
Feature	graph-model-substrate
Release home	v18.0.0
Parent gate	#549
Related honesty gate	#546
Design context	docs/design/0269-v18-gate-1-optics-honesty/v18-gate-1-optics-honesty.md

Evidence

Evidence	Detail
Verifier path	src/domain/services/optic/CheckpointTailBasisVerifier.ts verifies checkpoint-tail basis evidence without calling the full loader.
Residual full map read	The verifier currently has to call TreePort.readTreeOids(...), whose contract returns a complete tree-entry map instead of a targeted entry probe or bounded cursor.
Product classification	docs/public-api-cost-inventory.tsv classifies Optics setup and coordinate reads as transitional/caveat until the large-graph product gate lands.
Risk	A checkpoint tree that grows with content anchors, index evidence, or future metadata can still force a whole tree map into memory on the first-use path.

Acceptance Criteria

• Checkpoint-tail basis verification can prove required basis evidence without loading a full tree-entry map.
• The implementation has a bounded tree-entry lookup or bounded cursor contract with explicit limits.
• First-use Optics tripwire coverage rejects accidental readTreeOids full-map dependency on the setup path once the replacement exists.
• Public API cost inventory is updated if this changes Optics setup/read classification.

Notes

This is blocked by the larger bounded-memory substrate work in #549. Gate 1 removed the worst full-materialization footgun; this issue tracks the next residual full-residency shape hiding beneath the verifier.