(OPT) Retain expression-fact lookup scratch across authenticated immutable queries #885

At source 25d6fc1786f853e92d64f8fd22845a3baaebcb93, ordinary immutable expression-fact lookups already retain one comparison frame across the nodes of one search, but reconstruct that full frame for every query. Retain the actual search scratch across consecutive queries on one exact immutable arena, preserving complete comparisons and the old result ABI.

This is discovery, not measured gain or application admission. Actual 6efb0d7 codec final-prefix Production StructuralAndState acquired 2,433,487 bytes; catalog acquired 565,155. These are whole-route upper ceilings, not attributable lookup costs. N (actual eligible queries), M (retained owner activations), and replacement costs are missing. Both applications still fail at the unchanged 67,108,864-byte cap. Codec production canonical costs are already addressed by #884 and separate canonical identity work; this issue must not duplicate either.

Concrete source:

• src/cleanup_plan/replay/expression_facts/arena.rs:341-353: the actual ActiveBuilder nonempty-arena dispatch to prefix::find_receiving.
• src/cleanup_plan/replay/expression_facts/arena/prefix.rs:9-28: LookupControl and LOOKUP_BYTES = sizeof(LookupControl) + 2*sizeof(Result<Option<&Option<CallFact>>, Diagnostic>).
• Same file159-207: ReceivingComparison and the repeated additional 2*sizeof(ReceivingComparison) reservation and initializer; zero-byte/work authentication precedes both real current payments.
• Same file208-302: the complete lexical comparison body, minimum/maximum probes, certified prefix logic, tree traversal and borrowed payload publication. This algorithm already eliminates per-node comparison Results; do not claim those again.
• src/cleanup_plan/replay.rs:665-699 holds the same immutable facts through status and block/edge validation. Current calls include receiving/retained/case_certified.rs:77,180, receiving/retained.rs:376, and receiving.rs:587-601 (require_expression, used by ordinary edge/transition checks). Keep every other consumer/fallback intact.

Implement one private invocation-owned search scratch bound to the exact arena backing, function, ReplayBudget and current ledger. It carries reusable comparison/control storage, never a memoized verdict or semantic authority. Reset all query fields and execute every original ordered comparison/work event. A borrowed result must point into the held immutable arena, never mutable scratch. Use explicit caller ownership if practical; if interior mutability is needed, pay and prove every guard, borrow failure, reset and dynamic receiver. Do not preserve a blanket paid-once flag while constructing the same full local objects anew.

Acquire the owner at the first actual old lookup frontier, after the same authentication, rather than shifting a large reservation ahead of earlier semantic checks. Any enclosing carrier/selection/initialization storage also needs its real funding before formation. Retain complete old compound Result/formal/actual receiving charges unless the implementation physically removes those boundaries. In particular, the two Result terms in LOOKUP_BYTES are not credit merely because scratch persists.

Let S = sizeof(LookupControl) + 2*sizeof(ReceivingComparison). A conservative source opportunity is (N-M)*S - A - sum(R_i), where A includes every additional owner, selector, seal, acquisition and failure control and R_i every new query reset/guard/transport/control. Count no per-node compare savings and no removed Result ABI. Require a positive whole-composition measured difference; disclose tiny/single-query, empty, dense/miss and fallback regressions. No numerical saving is established by this formula.

Keep the complete immediate-old prefix.rs, Arena dispatch and ordinary calling composition independently executable with exact original tariffs. Older unretained find or arena.find alone is not the immediate predecessor. Preserve full source-custody/inverse inventories and acquire new controls in the successor only; never inflate old baselines.

Required controls: exact full results and all six diagnostic fields across hit/miss, empty/nonempty, UTF-8/NUL/prefix keys, equal bytes in distinct allocations, minimum/maximum and all tree shapes; alternating queries and both present-noncall and absent identities; old work cuts and diagnostic order; zero/exact/one-short/floor, first and later query acquisition, sticky retry, reentrant/nested use if admitted, foreign arena/function/budget, restored ledger and moved/replaced backing. No owner may survive its source lifetime or borrow Drop. Measure allocated/reserved/reallocated/peak/live through successful, refusal and unwind Drop; instrument old N, new M and all A/R payments without changing admission. Keep mandatory test crosschecks on their original ledgers.

Add a small private owning contract such as docs/RETAINED-EXPRESSION-FACT-LOOKUP-V1.md specifying eligibility, custody/lifetime, exact funding events, first refusal and fallback. Then qualify complete current-vs-immediate-old callers, the unchanged codec/catalog/starter owners and scoped production Clippy in the authorized combined focused batch. No full suites, cap increase, tariff exemption, skipped validation or app/token/turn claim from source analysis.

Related: #813 (closed expression-fact backing constructor predecessor); #837/#808 remain application owners. This is a new retained query-lifetime successor, distinct from #883/#884, #877 and canonical id_inner work. External source-bound discovery: /Volumes/Semaprax/provenance/astra-actual-hir-cap-discovery-20261017/.