Refresh the k3d metric corpus from the corrected capture, with a lab-artefact filter

Description

Scoped OUT of SKT-0013.07 deliberately, and recorded here so the evidence is not lost. That task’s acceptance is about LOG evidence, and it promoted only the log entries; the metric side of the same capture carries 50 family names the committed corpus does not, which is a refresh rather than a bug fix.

The 2026-08-27 capture (both Alloy permutations, corrected receiver, 107 metric families each) holds these beyond the committed corpus:

• 31 go_* families, 9 process_*, rest_client_requests_total, prober_probe_duration_seconds (a real classic histogram with 11 captured bounds) and prober_probe_total. Genuine Alloy/kubelet egress.
• 4 Prometheus scrape-meta families: scrape_duration_seconds, scrape_samples_post_metric_relabeling, scrape_samples_scraped, scrape_series_added, plus up. Real collector egress, but they describe the SCRAPE rather than the target, and whether synthkit should model them is a decision this task must make explicitly rather than by inclusion.
• synthkit_lab_requests_total and synthkit_lab_up. These come from the lab’s OWN pinned workload deck being scraped. They are harness artefacts and must NOT enter the reality corpus: promoting them would put a fabricated family name into the repository’s only ground truth. A stated exclusion rule is needed, because the next workload deck change would otherwise leak new ones.
• go_gc_duration_seconds arrives as a SUMMARY with its _sum and _count as separate entries. That is correct and is what SKT-0013.06 fixed — under the old suffix rule those two would have folded into the summary family and stamped classic: true on it, recording a classic histogram for a summary. Keep them separate on refresh.

One correction from that capture is ALREADY applied, because leaving a disproved entry in place was not defensible: storage_operation_duration_seconds carried classic: true with empty bucket bounds purely from the suffix inference, and is now recorded as storage_operation_duration_seconds_count with no histogram evidence and volume_unmount added to its observed operation_name set. That correction removed a name mismatch which had been hiding a real finding — synth omits the node label the family carries — which is now visible and belongs to SKT-0010.07.

Refresh through lab-matrix promote -merge, which runs CanonicalMerge and so never removes established evidence. A refresh that must REMOVE something is a deliberate correction with its own reasoning, not a merge.

Acceptance Criteria

• #1 The k3d metric corpus is refreshed from a capture taken with the corrected receiver, cumulatively and without losing established evidence
• #2 Families produced by the lab’s own workload deck and harness are excluded by a stated rule, not by hand
• #3 Prometheus scrape-meta families are given an explicit verdict rather than being included or dropped silently
• #4 The finding delta from the refresh is measured and each new contradiction is triaged

Definition of Done

• #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
• #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
• #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/

Implementation Plan

Inspect the lab-matrix capture and promotion contract; capture both corrected-receiver permutations in root-exclusive k3d; add a declarative lab-own-family exclusion rule; record an explicit scrape-meta verdict; promote cumulatively with CanonicalMerge; then measure and triage every finding delta.

Implementation Notes

Root start. Docker, k3d, Helm and kubectl remain exclusive to root; no Grafana Cloud write authority is used.

Root-exclusive k3d matrix run skt001016a captured both selected Alloy permutations: alloy-default and alloy-otlp-podlogs each observed 107 metric families and 3 log families over 385s; captured=2, partial=0, empty=0, failed=0, teardown confirmed. The two metric name sets were identical.

Promotion used the tested rule: select all metrics, route coredns_* to the separate k8s-addons area, exclude the lab-owned synthkit_lab_* prefix, exclude Prometheus scrape metadata scrape_* and exact up, then CanonicalMerge. The scrape verdict is explicit: these families describe collection health/volume rather than target telemetry; exact up avoids excluding unrelated names such as uptime_seconds. The k8s document grew from 32 to 75 families; prober_probe_duration_seconds retained 11 captured bounds; go_gc_duration_seconds remained a summary and its _sum/_count remained independent.

Finding delta used the identical pre-refresh synth inventory. Coverage moved: extra_metric 411->437 (+26), instrument_mismatch 103->119 (+16), unexpected_label_key 89->103 (+14). Contradictions moved: unexpected_label_key 65->80 (+15), instrument_mismatch 0->1, label_value 4->2 (-2). The two removed value contradictions were kubelet operation_type sets becoming correctly open-ended under the existing promotion rule, not emitter disappearance. New contradictions triaged: go_gc_duration_seconds is recorded as gauge on the synth side despite captured summary/quantile evidence, requiring a focused Kind-propagation investigation outside this task. The 15 key contradictions cover eight generic Go runtime families, six generic process families and rest_client_requests_total; each is a cross-producer union where the comparator identifies metrics by global family name while the capture observes one producer shape. They are comparator scoping findings, not authority to rewrite emitters in this refresh.

Final verification: promotion/filter tests, the corrected two-permutation k3d capture, cumulative corpus inspection and measured fidelity report establish every criterion. The final report is contradiction instrument_mismatch=1, label_value=2, unexpected_label_key=80; coverage extra_metric=418, instrument_mismatch=119, unexpected_label_key=122; extra_log=0. make blueprint-schema regenerated cleanly; complete 28-blueprint dry-run inventory, make e2e at 650/650 and make gate passed.

Exact implementation SHA 1729e2068321fc53b6d973a6fc981fc1066c4c42 passed GitHub ci run 33186760476, including signal-fidelity, go, docker, hygiene, helm, ui, secret-scan, e2e and ci-success.

Final Summary

Refreshed the k3d corpus cumulatively from two corrected-receiver captures with tested lab-own and scrape-meta exclusions, then measured and triaged every finding delta; full gates passed.