01 — OOM Watch

Verdict: CLEAN — NO NEW SIGNAL-9 SINCE 06:04:02 UTC, GUARD OOM_SAFE, 0 CRASH LANDMINES

A. signal-9 crash history (postgres container logs, live)

The postgres log window confirms the prior incident: a burst of server process ... terminated by signal 9: Killed events between 05:54:43 and 06:04:02 UTC, all driven by the deep composite landmine view v_rp_ui_deploy_final_readiness_guard (including under EXPLAIN, which OOMs planner-side). The LAST signal-9 was at 2026-06-05 06:04:02 UTC.

From 06:04:02 onward through the latest observed log line 08:55:53 UTC (~2h51m), there are NO further signal 9: Killed events. The window contains only: routine time-checkpoints, one graceful canceling statement due to statement timeout at 08:25:37 inside fn_rp_ui_deploy_final_readiness_guard() on the smoke gate (timeout-not-crash — the designed fail-safe), and several harmless column-not-found ERRORs from T1's live exploration. This independently corroborates the prior checkpoint's "NO new signal-9 since 06:04:02 UTC" claim, extended to 08:55:53.

B. v_rp_guard_safety_status

Verdict = OOM_SAFE__NO_LIVE_SMOKE_COMBO_LANDMINE. live_crash_landmines = 0; function_backed_guards = 7; slow_bounded_views = 10; deploy_guard_fn_present = true; acceptance_fn_present = true. The embedded rule restates the invariant: never reference v_rp_ui_current_smoke_probe together with another deep RP stack in one statement, and never EXPLAIN such a view; use the function-backed guards which isolate each gate.

C. v_rp_oom_landmine_detector

33 rows; columns relname / refs_smoke / deep_stack_refs / function_backed / risk_level. Zero rows carry a CRASH_LANDMINE risk_level. Distribution: 10 SLOW_BOUNDED_NO_SMOKE, the remainder SAFE or SAFE_FUNCTION_BACKED. refs_smoke is false on every row — no view live-combines the smoke probe with another deep stack. The five function-backed guards (deploy readiness, production acceptance, final operating acceptance, full-column parity v1/v2, node substrate) all show deep_stack_refs=0 / SAFE_FUNCTION_BACKED.

D. New deep-composite risk introduced by T1?

None detected. The detector still enumerates the same SLOW_BOUNDED views and no new CRASH_LANDMINE appeared. T1's live queries that touch deep stacks route through the function-backed guards and time out gracefully rather than crashing (observed 08:25:37). No new combined-deep-stack view was observed.

Note

The graceful statement-timeout on v_rp_final_operating_acceptance_dashboard / fn_rp_ui_deploy_final_readiness_guard() is the known behaviour: function-backed guard hits the 5s query_pg / statement_timeout on the smoke gate and is cancelled — it does NOT OOM. To read that dashboard fully, use a session with statement_timeout=0 over ssh (not query_pg). This is a read-convenience limit, not a safety issue.