Merge branch 'pratik/otel-phase10-workload-validation' into pratik/otel-sync-diagnostics

Brings in the hierarchy-check sampling fix: the check now asks Tempo for traces
containing both parent and child rather than inspecting the three newest parent
traces, so a child conditional on a state the workload rarely reaches is found
wherever it occurred. Merged clean, no conflicts, no resolution decisions.

This unblocks ledger.acquire -> ledger.acquire.txtree on this branch, which was
skipped for exactly that sampling problem and is un-skipped in the next commit.

.github/workflows/telemetry-validation.yml

@@ -333,8 +333,10 @@ jobs:
           fi
 
       # Publishes captured OTel timings + regression report to the Step Summary.
-      # When the committed baseline is a placeholder, emits a fenced JSON block
-      # that can be copy-pasted directly into baselines/baseline-timings.json.
+      # When the committed baseline is a placeholder AND the capture is
+      # complete, emits a fenced JSON block that can be copy-pasted directly
+      # into baselines/baseline-timings.json. An incomplete capture is named as
+      # such and its JSON withheld — see the comment on that branch below.
       # When the baseline is populated, summarises the top regressions so the
       # PR author sees the failure reason without downloading artifacts.
       - name: Print regression summary
@@ -367,15 +369,62 @@ jobs:
               exit 1
           }
 
+          # Whether the capture is usable as baseline material is the capture's
+          # own verdict, carried in the artifact by capture_timings.py, which
+          # computes it against --min-capture-ratio. It is READ here, never
+          # re-derived: a second copy of the ratio rule in shell would be a
+          # second source of truth and would drift from the producer.
+          #
+          # `// false` covers both an artifact written before the block existed
+          # and a truncated one. Neither can prove it is complete, so neither is
+          # offered — the whole point is that a degraded capture must not look
+          # like a good one. Same `jq -r` reasoning as the baseline parse above.
+          CAPTURE_COMPLETE=$(jq -r '.capture.complete // false' "$TIMINGS") || {
+              echo "::error::Failed to parse timings JSON"
+              exit 1
+          }
+          if [ "$(jq -r 'has("capture")' "$TIMINGS")" = "true" ]; then
+              CAPTURE_COUNTS=$(jq -r '"\(.capture.captured)/\(.capture.declared)"' "$TIMINGS")
+              CAPTURE_SHORTFALL="only **$CAPTURE_COUNTS** declared metrics came back, below the capture's own minimum ratio"
+          else
+              CAPTURE_COUNTS="unknown"
+              CAPTURE_SHORTFALL="the artifact carries no \`capture\` block, so it predates completeness reporting and cannot state what it captured"
+          fi
+
           echo "## OTel Timings Regression Gate" >>"$GITHUB_STEP_SUMMARY"
           echo "" >>"$GITHUB_STEP_SUMMARY"
 
-          if [ "$IS_PLACEHOLDER" = "true" ]; then
+          if [ "$IS_PLACEHOLDER" = "true" ] && [ "$CAPTURE_COMPLETE" != "true" ]; then
+              # The placeholder path is the ONLY route to a committed baseline,
+              # which makes it the one place an incomplete capture does lasting
+              # damage: pasted in, it silently narrows the gate to the keys that
+              # happened to come back. So the JSON is withheld rather than
+              # printed with a caveat — a warning above a copyable block is
+              # still a copyable block. The counts are shown so the reader knows
+              # how thin it was, and the artifact is still uploaded for anyone
+              # who needs to inspect it deliberately.
+              echo "### Baseline NOT refreshable from this run" >>"$GITHUB_STEP_SUMMARY"
+              echo "" >>"$GITHUB_STEP_SUMMARY"
+              echo "The committed baseline is a placeholder, so this run would" \
+                  "normally print a block to paste into" \
+                  "\`baselines/baseline-timings.json\`. It is withheld because" \
+                  "$CAPTURE_SHORTFALL, so the JSON may describe metrics that" \
+                  "were never measured. Pasting it would narrow the gate to" \
+                  "whichever keys were captured, with nothing reporting that" \
+                  "it had narrowed." >>"$GITHUB_STEP_SUMMARY"
+              echo "" >>"$GITHUB_STEP_SUMMARY"
+              echo "Fix the capture first — the usual cause is Prometheus not" \
+                  "being scraped for long enough, or nodes not reaching" \
+                  "consensus — then re-run. See the \`timings.json\` artifact's" \
+                  "\`capture\` block for the exact counts." >>"$GITHUB_STEP_SUMMARY"
+              echo "::error::Timing capture is incomplete ($CAPTURE_COUNTS metrics) — no baseline block printed. Do not refresh the baseline from this run."
+          elif [ "$IS_PLACEHOLDER" = "true" ]; then
               echo "### Paste into \`baselines/baseline-timings.json\`" >>"$GITHUB_STEP_SUMMARY"
               echo "" >>"$GITHUB_STEP_SUMMARY"
               echo "The committed baseline is a placeholder. Open a PR replacing" \
                   "its contents with the JSON block below to activate the" \
-                  "regression gate." >>"$GITHUB_STEP_SUMMARY"
+                  "regression gate. The capture is complete" \
+                  "($CAPTURE_COUNTS declared metrics)." >>"$GITHUB_STEP_SUMMARY"
               echo "" >>"$GITHUB_STEP_SUMMARY"
               echo '```json' >>"$GITHUB_STEP_SUMMARY"
               cat "$TIMINGS" >>"$GITHUB_STEP_SUMMARY"