id(world-manifest): world.toml [profile] total_memory_bytes is rejected as an unknown field — the #2876 probe struct was never updated for the #557 profile field #5268

Problem

In pkgs/id, a world.toml manifest that sets the legitimate execution-profile field total_memory_bytes under [profile] fails to parse — world_manifest::parse rejects it as an unknown field, even though the field is a real, validated member of WorldExecutionProfile:

• WorldExecutionProfile gained total_memory_bytes: Option<u64> in the id(world): F12.12 many worlds per node: 1,000 idle / 100 active with a per-world memory budget #557 per-world memory-budget work (pkgs/id/crates/id-core/src/world_limits.rs:307). It is validated in WorldExecutionProfile::validate (world_limits.rs:351, nonzero) and resolved/clamped in resolve (world_limits.rs:380-381).
• WorldManifest::validate runs self.profile.validate() at parse time, and parse's own docs promise the profile bounds in a manifest are honored (see the id(world-manifest): validate() never checks the execution profile or the schedule count — manifests parse and plan clean, then fail partway through a live apply #3015 comment in pkgs/id/src/world_manifest.rs).
• But the unknown-key probe reject_unknown_profile_keys (pkgs/id/src/world_manifest.rs:179-215) still lists only the six pre-id(world): F12.12 many worlds per node: 1,000 idle / 100 active with a per-world memory budget #557 fields in its #[serde(deny_unknown_fields)] ProfileKeysProbe (wasm_fuel, wasm_memory_bytes, wasm_message_bytes, native_memory_bytes, native_cpu_seconds, native_call_deadline_ms). total_memory_bytes is missing, so the probe — which parse runs first (world_manifest.rs:156) — refuses the valid key before the real parse ever sees it.

The inconsistency is self-contained: WorldManifest::to_toml serializes a manifest whose profile.total_memory_bytes is set, emitting total_memory_bytes = … under [profile], and round_trip (parse of to_toml) then fails on the manifest's own output.

Evidence (verified this run, laptop probe at origin/main ece818d)

Laptop cargo probe (~/git/fleet/probe-2026-11-03-laneA3-manifest on the laptop, one test added to world_manifest::tests, kept for inspection):

• parse("[profile]\ntotal_memory_bytes = 67108864\n") → Err: TOML parse error at line 2, column 1: unknown field 'total_memory_bytes', expected one of 'wasm_fuel', 'wasm_memory_bytes', 'wasm_message_bytes', 'native_memory_bytes', 'native_cpu_seconds', 'native_call_deadline_ms' — the expected list is exactly the probe's six stale fields
• The same probe test's later assertions (never reached) cover the round_trip of a WorldManifest with profile.total_memory_bytes = Some(67108864), which fails for the same reason on the manifest's own to_toml output
• Controls: all 29 pre-existing world_manifest::tests pass on the same binary (the typo-refusal tests for id(world-manifest): unknown or misspelled world.toml keys are silently ignored — a typo'd grants/ceiling revocation parses clean, plans zero steps, and diff reports 'no drift' #2876 among them); only the probe test fails

Probe result: world_manifest::tests::probe_total_memory_bytes_profile_key_parses FAILED at the first assertion on unmodified main; full module run: 29 passed, 1 failed (the probe).

Why it matters

The per-world total memory budget (#557) is settable through the server/profile paths and is persisted/restored, but the declarative path — world.toml + id world apply/diff — cannot express it at all: any manifest naming the budget is refused wholesale, so an admin cannot set or pin a world's total memory budget declaratively, and any tooling that round-trips a manifest carrying the field breaks. The probe struct is a hand-maintained mirror of WorldExecutionProfile's field list, so the same failure recurs the next time a profile field is added unless the fix also guards the mirror (see acceptance criteria).

Acceptance criteria

• parse accepts [profile] total_memory_bytes = <u64> and the value reaches WorldManifest.profile.total_memory_bytes; validate still refuses total_memory_bytes = 0 via the existing WorldExecutionProfile::validate rule.
• A manifest carrying total_memory_bytes survives to_toml → parse round-trip unchanged.
• Typo'd/unknown [profile] keys are still refused, naming the key (the id(world-manifest): unknown or misspelled world.toml keys are silently ignored — a typo'd grants/ceiling revocation parses clean, plans zero steps, and diff reports 'no drift' #2876 behavior is preserved — e.g. wasm_fuell still fails).
• A regression test pins the probe's field list against WorldExecutionProfile's actual fields (or the probe is restructured so drift is impossible), so adding a future profile field cannot silently reintroduce this.
• Existing world_manifest and world_limits tests stay green.