Measure the floor cost distribution near the 500ms ceiling: the plateau is real, the promotion mechanism is not, and #10133 was an outlier

[gunbai-bot]

Measurement, not a repair — commissioned after #10133 to decide whether further per-producer work is a treadmill. Docs only.

Nothing here ran a floor. Every figure is a reading of required-floor-claim-cost, required-floor-cross-claim-demand and the required-floor: summary already published by ten main runs. The [over-cost] log lines are a 25-row preview of that TSV and say so; the artifact is the complete 3,498-row population.

1. The band is dense — treadmill confirmed, and quantified

87 rows above 300ms, 32 above 400ms, no gap below the ceiling. Repairing modules top-down, worst row remaining across all ten runs:

modules repaired	worst	refused /10
(the 3 from #10133)	533	1
+3 more	490	0
+7 more	429	0

The first three buy 43ms; the next seven buy 61ms — ~10ms per module.

2. The new crossers do not share a root the way #10133's three did

eval_steps separates the cases. The repaired trio reported 612,662–658,336 steps — a 1.07× spread across seventeen rows with unrelated subjects, which is the fingerprint of one shared dominant producer. The families now near the ceiling span 63k–197k (3.1×) in three distinct shapes, one of which (emit_host_*, wall/cpu 2.05) spends half its wall off-CPU in the region required_floor already carries an OpaqueHostCallUnbounded rung drop for.

One shared-producer lead exists — bind_outcome, top of the cross-claim ranking by 13× and reaching both families — and it is explicitly not a plan: that artifact's own header declares cost_columns=inclusive_of_callees_do_not_sum, and its total is 14× the run's actual claim CPU. It ranks candidates; it cannot quantify a saving.

3. The margin is measurable and uniform

Same-identity run-to-run inflation: median 1.16×, p90 1.35×, max ~2.0×. Two mechanism hypotheses tested and both refuted — inflation does not vary with cost bucket (1.07–1.19 across all six) nor with host-call heaviness (1.13–1.16) — which is what makes a single global margin defensible rather than a per-family one. PR runs reach ~1.6×, implying a clean-run budget near 312ms, against 87 rows above 300ms today.

Also: run 33688140761 refused with a below-median run factor of 0.96, so a refusal is not evidence the fleet was busy.

4. The correction

This was commissioned on the reading that #10133 promoted the next rows into the margin. Promotion is refuted — rank does not cause a crossing, and removing rows above a row does not make it slower. Measured directly, the five post-repair crossers went above their own pre-repair maxima: median 343ms and max 472ms over 45 observations, against 504–533ms, on the most contended run in the sample.

Replaying all ten runs with the repaired modules excluded:

	runs refused
as observed	5 / 10
with #10133's modules excluded	1 / 10

Across the nine pre-repair runs, no row outside those three modules ever crossed. They were 17 of the 22 distinct identities that crossed anywhere in the sample — an outlier, not a sample of the plateau.

5. What follows

Per-producer repair is the wrong unit for 87 rows returning ~10ms each. The two sanctioned remedies stand (reduce what the witness reaches for, or a lane with its own dated ceiling naming its rows as executing consumers). Raising the ceiling is not a third option — required_floor records 500→1552→5000 and repudiates both raises, one as the same-tree oracle DESIGN §5 forbids by name.

Which remedy fits the emit and execution families is a decision this informs and does not make.

An eleventh run's artifact downloaded empty and is excluded — recorded in the doc because it silently emptied a ten-way intersection before it was caught.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WEFMasGn2cAGCMJW2694pb

[gunbai-bot]

Addressed — the finding was correct, and thank you for it. gunbc.witness_floor_workflow produces the raw rows and performs none of the analysis; the ten-run intersection, band histogram, counterfactual replay and inflation percentiles existed only as prose plus numbers, so a reader could check the arithmetic of nothing.

What landed (5ec00fa114f):

• gunbc.floor_cost_distribution — the derivations as pure functions over caller-supplied rows.
• tools.floor_cost_distribution_instrument — reads the artifacts and renders the report; entry point floor_cost_distribution_report, with the recipe in the module header.
• test.claim.floor_cost_distribution_witness — 14 rows, each with a discriminating red.

The split is deliberate and is what makes the evidence independent of which artifacts happen to be on disk: the analysis is witnessed on a hand-built fixture with no run artifacts present.

Verified by reproduction rather than inspection. Run against the ten artifacts the memo names, the instrument returns every figure the memo carries — bands 2231/502/441/148/89/55/27/5, 87 rows ≥300ms and 32 ≥400ms, 5 runs refused as observed against 1 with the repaired modules excluded, worst row 533ms, the ten-step ladder 525, 511, 490, 487, 486, 466, 458, 450, 434, 429, and inflation 1147/1345/1433/1643 permille implying 435/371/348/304ms budgets. The originals came from an independent ad-hoc script, so this is two implementations agreeing rather than one restating itself.

The memo no longer claims to be the authority: its figures are now stated as illustrative of what the instrument returned on the runs it names, and it says the instrument wins where they disagree.

One thing the fix added beyond the finding: an absent or empty artifact now refuses and is named rather than contributing an empty population. That is not hypothetical — an artifact downloaded empty during the original analysis and silently emptied a ten-way identity intersection, and a run reading as zero rows is indistinguishable from a run in which nothing crossed. Both arms are witnessed, with a discriminating red proving a complete sample produces no refusal line, and the actuator's refusal is exercised by execution in both directions.

— sent from warm-ibex-636

[gunbai-bot]

Review 59000 is addressed in 76bc095, and at the scope the review named rather than at the six flagged sites.

The finding is right about the shape: the module had no std.measure import at all, so rows, bands, ladder, threshold and budget all carried a domain quantity this repo already models as bare Int milliseconds. That is a parallel representation, not a leaky field. The whole time axis now carries Millisecond, wrapped at the parse boundary where the artifact's integer column becomes a quantity, and compared through millisecond_count — the carrier is what stops a figure read from one clock being compared against a figure from another, and the count is the projection a comparison is entitled to. implied_clean_run_budget_ms lost its suffix, since that suffix was the field name doing the carrier's job.

Deliberately still Int, so this is not a blanket sweep: row and refused-run counts are cardinalities, and the inflation permille and its percentile argument are a dimensionless ratio — giving a ratio a time unit is the same error facing the other way.

The control matters more than the diff here, because a unit refactor is exactly where an off-by-conversion hides: the instrument's output over the ten named artifacts is byte-identical to the pre-refactor run — same bands, same 87 and 32, same 5 refused and 1 after exclusion, same ladder, same permille percentiles and implied budgets. 14/14 witness rows pass. Re-derive with gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/floor_cost_distribution_instrument.dag --function floor_cost_distribution_check.

— sent from warm-ibex-636