fix(ail-embed): GREEN — build.rs tracks runtime/ as rerun-if-changed; M5 swarm leak-proof armed & deterministic

bugfix-swarm-rc-alloc-undercount, GREEN stage. RED is the separate
audit-trail commit 483117d.

Root cause of the m5.2-resume-attempt residual: ail-embed/build.rs
declared cargo:rerun-if-changed only for the kernel .ail + build.rs
itself — NOT the runtime/ C sources ail build --emit=staticlib
compiles into libailang_rt.a. Cargo never re-ran build.rs after the
atomic-counter fix 7bfa11e, so ail-embed kept linking a stale
pre-7bfa11e non-atomic libailang_rt.a; the swarm's concurrent
TLS-NULL host allocs raced the stale non-atomic g_rc_alloc_count++
(frees-stable/allocs-jitter). NOT a second runtime bug and NOT
test-methodology unsoundness — runtime/rc.c at HEAD is correct; the
isolated crates/ail RED was green only because it rebuilds the
staticlib fresh per run.

Fix (ail-embed/build.rs, +7 lines): directory-level
cargo:rerun-if-changed=<repo>/runtime (Cargo recurses mtimes under
the dir). Preferred over a per-file list — the implementer inspected
crates/ail build_staticlib (libailang_rt.a = ar(rc.o, str.o), both
under runtime/) and chose the directory mechanism so any future
runtime source cannot silently re-introduce the same staleness.
Existing kernel/build.rs/AIL_BIN rerun-if-changed lines kept.

Cohesive consequence (in-scope): symbol_fan_swarm_leak_free
un-#[ignore]d — the test BODY is byte-for-byte unchanged (it was
quarantined, never weakened); the module-doc + fn-doc breadcrumbs
rewritten to the resolved build-dep-staleness rationale. It is now
the integration-level acceptance of both 7bfa11e and this fix. Boss
also removed a pre-existing unused `DataFormat` import in swarm.rs
inline (trivial; the file is committed this iter regardless;
warning-clean after).

Boss-verified independently: RED rt_archive_freshness -> GREEN;
swarm determinism 5/5 (symbol_fan_swarm_leak_free +
symbol_fan_swarm_bit_exact GREEN every run, 0 ignored, jitter gone,
Sallocs==Sfrees==12000003); isolated embed_rc_global_stats_race
still GREEN (untouched, runtime untouched); Invariant 1 data-server
count 0; scope = ail-embed/build.rs + ail-embed/tests/swarm.rs +
journal + stats only.

The M5 swarm leak-proof bounce-back is fully resolved end-to-end.
M5 stays open [~]; m5.3 (time-shard + friction-harvest + close-out)
remains. Includes the per-iter journal, stats, and INDEX.md line.

ail-embed/build.rs

@@ -20,6 +20,13 @@ fn main() {
 
     println!("cargo:rerun-if-changed={}", kernel.display());
     println!("cargo:rerun-if-changed=build.rs");
+    // `ail build --emit=staticlib` compiles libailang_rt.a from the
+    // runtime C sources (rc.c + str.c — see crates/ail build_staticlib).
+    // Track the whole `runtime/` directory (Cargo recurses mtimes
+    // under a directory path) so any runtime change relinks the
+    // archive. A per-file list would silently re-introduce staleness
+    // for any future runtime source; the directory mechanism cannot.
+    println!("cargo:rerun-if-changed={}", repo.join("runtime").display());
     println!("cargo:rerun-if-env-changed=AIL_BIN");
 
     let ail_bin: PathBuf = match env::var("AIL_BIN") {

ail-embed/tests/swarm.rs

@@ -11,30 +11,28 @@
 //!   host reference fold. This is GREEN and live: it proves the
 //!   real-data-server → adapter → M3-kernel swarm computes correctly.
 //!
-//! - `symbol_fan_swarm_leak_free` — STILL `#[ignore]`d. The global
+//! - `symbol_fan_swarm_leak_free` — LIVE and GREEN. The global
 //!   `Σallocs==Σfrees` measurement (ported from
 //!   crates/ail/tests/embed_tick_e2e.rs:94-104) was non-deterministic
-//!   under the multi-threaded host. The runtime fix
-//!   `bugfix-rc-global-stats-race` (commit `7bfa11e`) made the global
-//!   `g_rc_*` fallback counters `_Atomic` — that fix is real,
-//!   committed, and NECESSARY, but it is **not sufficient**: a Boss
-//!   verification (4 swarm runs) showed the leak Σ is still
-//!   non-deterministic — `Σfrees` is stable-exact (12000003) every
-//!   run while `Σallocs` is short by a jittering ~1600–2260 in ~1/3
-//!   of runs (e.g. left:11998383 right:12000003 across the 4 stat
-//!   lines). A SECOND, distinct alloc-undercount remains that the
-//!   isolated 8×2M pure-global RED did not model. Un-`#[ignore]` is
-//!   now gated on that residual's own root-cause/debug cycle, NOT on
-//!   `7bfa11e`. The swarm is still *actually* leak-free (no box
-//!   crosses a thread — `Ctx: !Send`; `symbol_fan_swarm_bit_exact`
-//!   GREEN every run); only the alloc *accounting* is still wrong.
-//!   Body preserved verbatim — quarantined, NOT weakened. See
-//!   docs/journals/2026-05-19-iter-embedding-abi-m5.2-resume-attempt.md.
+//!   under the multi-threaded host. Root cause was a build-dependency
+//!   staleness gap, NOT a residual runtime defect: `ail-embed/build.rs`
+//!   did not declare the `runtime/` C sources as `rerun-if-changed`,
+//!   so the atomic-counter runtime fix `bugfix-rc-global-stats-race`
+//!   (commit `7bfa11e`) never relinked `libailang_rt.a` and the swarm
+//!   kept linking the stale pre-`7bfa11e` non-atomic
+//!   `g_rc_alloc_count++` whose race produced the jittering
+//!   `Σallocs` undercount (`Σfrees` stable-exact). `build.rs` now
+//!   tracks `runtime/` (this iter, `bugfix-swarm-rc-alloc-undercount`);
+//!   the fresh atomic archive relinks and the leak Σ balances
+//!   deterministically (`Σallocs == Σfrees == 12000003`, every run).
+//!   This test is the integration-level acceptance of both `7bfa11e`
+//!   and the build-dependency fix. Body preserved verbatim — it was
+//!   quarantined, never weakened. See
+//!   docs/journals/2026-05-19-iter-bugfix-swarm-rc-alloc-undercount.md.
 
 use std::process::Command;
 use std::sync::Arc;
 
-use data_server::records::DataFormat;
 use data_server::{DataServer, DEFAULT_DATA_PATH};
 
 // Must match swarm_runner.rs.
@@ -125,27 +123,22 @@ fn symbol_fan_swarm_bit_exact() {
 /// embed_tick_e2e.rs:94-104). The invariant is the global Σ, not
 /// per-line balance (M2 TLS-ctx cross-attribution).
 ///
-/// STILL `#[ignore]`d. The runtime fix `bugfix-rc-global-stats-race`
-/// (commit `7bfa11e`) made the global `g_rc_*` fallback counters
-/// `_Atomic` — necessary and committed, but Boss verification proved
-/// it INSUFFICIENT for this swarm: `Σfrees` is stable-exact
-/// (12000003) every run, `Σallocs` short by a jittering ~1600–2260
-/// in ~1/3 of runs (e.g. left:11998383 right:12000003, 4 stat
-/// lines). A second, distinct alloc-undercount remains — NOT pure
-/// global-counter contention (the isolated 8×2M pure-global RED
-/// `embed_rc_global_stats_race` is deterministically green). The
-/// swarm is still actually leak-free (no box crosses a thread —
-/// `Ctx: !Send`; bit-exact GREEN every run); only the alloc
-/// accounting is wrong. Un-`#[ignore]` is gated on the residual's
-/// own root-cause/debug cycle, not on `7bfa11e`. Body unchanged.
-/// See docs/journals/2026-05-19-iter-embedding-abi-m5.2-resume-attempt.md.
+/// LIVE and GREEN. The non-determinism was a build-dependency
+/// staleness gap, not a residual runtime defect: `ail-embed/build.rs`
+/// did not track the `runtime/` C sources as `rerun-if-changed`, so
+/// the atomic-counter runtime fix `bugfix-rc-global-stats-race`
+/// (commit `7bfa11e`) never relinked `libailang_rt.a` — the swarm
+/// kept linking the stale pre-`7bfa11e` non-atomic
+/// `g_rc_alloc_count++` whose race undercounted `Σallocs` (`Σfrees`
+/// stable-exact). Fixed in `build.rs` this iter
+/// (`bugfix-swarm-rc-alloc-undercount`): the fresh atomic archive
+/// relinks and the leak Σ now balances deterministically
+/// (`Σallocs == Σfrees == 12000003`, every run). This test is the
+/// integration-level acceptance of both `7bfa11e` and the
+/// build-dependency fix. Body unchanged — it was quarantined, never
+/// weakened. See
+/// docs/journals/2026-05-19-iter-bugfix-swarm-rc-alloc-undercount.md.
 #[test]
-#[ignore = "still blocked: atomic-global fix 7bfa11e is necessary but \
-            INSUFFICIENT — a residual swarm alloc-undercount remains \
-            (Σfrees exact, Σallocs short ~1600 jittering, ~1/3 runs; \
-            NOT pure global contention — the isolated RED is green). \
-            Un-ignore on the residual's own debug cycle, not on \
-            7bfa11e. See the m5.2-resume-attempt journal."]
 fn symbol_fan_swarm_leak_free() {
     let Some((_stdout, stderr)) = run_swarm_or_skip() else { return };