ReferenceChainTracker: per-klass class tags, the frontier table of
retained references, the BFS expansion thread, chain resolution into
per-sample ReferenceChainEvent payloads, and leak-tag correlation.
LivenessTracker: the per-klass population table, heap-floor ring with
time-to-OOM projection, and leak-candidate selection feeding the
tracker's search gate. Adds the referencechains Arguments block, the
string-dictionary generation counter used to invalidate the class-tag
cache, and the container-memory/os queries the projection needs.

hopLabelClassFor() was the only GetObjectsWithTags() call site that did
not Deallocate() the returned object/tag arrays - a per-cache-miss leak
on the BFS thread's hop-label path (caught by the asan gtest run). Free
both right after the class object is extracted, and null-guard the error
path, matching the file's other call sites.

- collectStaticFieldAnchorsForRotation: the other tier is the last
  consumer of the anchor budget - stop accumulating its leftover back
  into budget_left (dead store).
- buildCanaryChainEvent: capture the chain size before moving the vector
  into the event instead of reading the moved-from object for the log.
- secondsToOOM: check ringThirdsStats()'s return for the time ring
  instead of reading time_stats uninitialized on its (unreachable-in-
  practice, but analyzer-visible) failure path - same head/fill/min-fill
  gate as the byte call, so it cannot trigger once the byte call passed.

- Leak-tag pool: start() reset the free list while the preserved tracking
  table still had tagged entries (the table survives stop()/start()), so a
  new object could receive a tag another live object owns and a later
  double release could write past the free list. Reclaim owned tags first
  and keep their correlation info.
- track() published a reserved slot before initializing it while shared-mode
  scanners (tagLeakInstances, getLiveTraceIds) could read the uninitialized
  malloc storage; slots now carry a release/acquire ready flag and fresh
  table regions start unpublished.
- secondsToOOM projects BOTH the heap and the container boundary and takes
  the shorter time instead of picking a ring by the raw limit comparison -
  container usage includes native memory and siblings, so a container with
  a numerically larger limit can still be closer to exhaustion.
- cleanup_table() claimed the GC epoch before acquiring the table lock, so
  a newer epoch's fold could enter the population history before an older
  one's; the claim now happens under the lock (the pre-lock check remains
  as an advisory early exit).
- threadLoop's urgency ramp multiplied the budget by four on every rounded
  pause-target change and never restored it; the boost now applies once
  per urgency episode and the configured budget is restored when it ends.
- The terminal restart gate now charges the finished search's accumulated
  safepoint cost BEFORE checking affordability, so an expensive search no
  longer earns one free immediate successor (restartSearch() no longer
  spends it itself; the pain-budget test asserts the new order).
- hopLabelClassFor() deleted cls twice on the superclass-walk path.
- The class-shape reconciliation loop never deleted the class-object local
  refs GetObjectsWithTags() returned (BFS thread - pins classes against
  unload).
- walkStaticFieldAnchors() early breaks left later anchors' local refs
  undeleted; a cleanup pass now releases them.
- The static-field sweep's truncation cursor resumed by a visited-count
  index that assumes HotSpot's LIFO FollowReferences order; it now redoes
  the chunk, which is order-independent (shared code must not rely on
  HotSpot internals).
- buildDiscoveredInstanceChains() treated a cache hit from an earlier
  search generation as current; the generation check now mirrors the
  representative-refresh paths.
- cacheResolvedChain() reports success so coverage accounting (found bits,
  resolved counts) only advances for a chain that was actually stored.
- os_linux: container usage is now read from the same cgroup level that
  supplied the selected limit (an ancestor limit covers sibling cgroups
  whose usage the leaf excludes).

Moves referenceChains_ut.cpp and livenessTracker_ut.cpp into this layer -
they test exactly this code, and the pain-budget ordering change requires
its test to land with it.

A stale full scratch surviving klassPopulationResetForTest() lets the
first post-reset GC fold fill the population table in one pass, making
the synthetic-epoch seeded entry the permanent LRU-eviction victim - a
fold landing mid-seeding (few-ms GC cadence on slow runners) resets the
seeded ring and breaks the trend gate. Observed as the
shouldSelectSeededKlassAsLeakCandidateOnPositiveSlope flake on
musl-aarch64 (librca 21 and 11).

Comments pointing at locally-kept plan documents, rotted .cpp:NNN
references, and a duplicated four-times comment block consolidated to
the constant it documents.

fillHopEdgeLabels() fills hop edge labels in place; buildChainEvent()
and the canary builder assemble ReferenceChainEvent::_hops from the
parallel internal vectors.

No references to Java integration tests, stresstest repros, or
uncommitted plan documents from this layer; the gtest files carry the
comment cleanups with the code they test.

staleLeaf handling and the line-number-table copy boundary tests.