From 1598f65644b1e2724b8492953522e359bd0b6bc9 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 03:00:03 +0000 Subject: [PATCH 1/4] The emit near-ceiling family is not a defect: file the negative result, and the two derivations it rests on Three v2.test.emit identities refused the required floor and the question routed here was whether the family carries a repairable cost defect. It does not, and the useful part of that answer is the four plays that look obviously right from outside and are each already measured and dead: serving the shared producer across claim frames (three candidate rows, every one made its consumers WORSE), finding the one dominant shared producer (refuted twice, independently), per-producer repair (8ms against a question 87 rows deep), and reading an interrupted row's printed cost as a margin (it is the ceiling that interrupted it, not a cost). TWO DERIVATIONS, NOT PROSE, because the memo must cite a producer rather than carry figures. identity_inflation_permille_at_equal_work restricts the existing per-identity pairing to rows whose eval_steps are EQUAL across the two runs. That removes the work confound by construction instead of modelling it: the evaluator executed the same number of steps, so the only thing that could have changed did not, and the remaining cpu movement is inflation. It needs no control population, which is what distinguishes it from every normalisation this lane ran in gunbc#10094 -- two of which had to be withdrawn. Its discriminating red is the row whose steps MOVED: admitting it would report a work change as contention. crossing_recurrence and recurring_crossers join the per-run crossing sets across runs, which is the question that separates a property of the ROW from a property of the RUN. An identity crossing in many runs is expensive and tightening the line reaches it; identities that each cross once are being selected by the run. The empty answer is the finding, so it lands with a positive control -- without one, "no identity recurs" is indistinguishable from a join that never matches. FloorCostRow gains eval_steps, parsed from its own column, with a witness for that column specifically: the artifact carries wall, cpu, steps and a diagnostic threshold side by side and reading the wrong one produces a plausible number rather than an error. WHAT THE MEMO REFUSES TO CLAIM is as load-bearing as what it does. The eleven runs span tree vintages, so "no identity crossed twice" is confounded by repair. Equal steps is equal EVALUATOR work, not equal host work. And a 500/p90 safe-cost figure this lane circulated is recorded as WITHDRAWN with both of its errors named -- a p90 answers a per-row question while the ceiling refuses the whole run, and the stratum quoted stopped one bucket short of the population that can reach 500, where inflation rises again. Both ran in the unsafe direction. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QWLoiyrKq3zNTiDNtrs9gC --- dag/gunbc/floor_cost_distribution.dag | 89 +++++++++++++- .../floor_cost_distribution_witness_test.dag | 71 ++++++++++- ...mit-near-ceiling-family-is-not-a-defect.md | 116 ++++++++++++++++++ 3 files changed, 268 insertions(+), 8 deletions(-) create mode 100644 docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md diff --git a/dag/gunbc/floor_cost_distribution.dag b/dag/gunbc/floor_cost_distribution.dag index f64d6df5e7a..731232f4e33 100644 --- a/dag/gunbc/floor_cost_distribution.dag +++ b/dag/gunbc/floor_cost_distribution.dag @@ -27,6 +27,13 @@ type FloorCostRow { identity: String module: String cpu_ms: Millisecond + // THE THIRD COLUMN THIS ANALYSIS NEEDS, and it is the only one that is not a clock. Evaluator + // steps are counted by the interpreter and netted by the same shared-fill rule the CPU figure + // is, so a row's step count is a property of what it evaluated and carries no term for the + // machine it evaluated on. It is what lets `identity_inflation_permille_at_equal_work` below + // separate "this row got more expensive" from "this row got inflated" without choosing a + // control population at all. + eval_steps: Int } // One run's population, named by its run id so a finding can cite which runs it rests on. @@ -44,7 +51,7 @@ fn parse_claim_cost_line(line: String) -> FloorCostRow? { none } else { let fields = split(s: line, delimiter: "\t") - if count(fields) < 6 { + if count(fields) < 7 { none } else if fields[0] == "identity" { none @@ -55,7 +62,11 @@ fn parse_claim_cost_line(line: String) -> FloorCostRow? { value: FloorCostRow { identity: fields[0], module: fields[1], - cpu_ms: millisecond(count: cpu) + cpu_ms: millisecond(count: cpu), + eval_steps: match parse_int(s: fields[6]) { + Absent => 0 + Present { value: steps } => steps + } } } } @@ -224,3 +235,77 @@ fn implied_clean_run_budget(ceiling_ms: Millisecond, inflation_permille: Int) -> millisecond(count: (millisecond_count(m: ceiling_ms) * 1000) / inflation_permille) } } + +// INFLATION WITH THE WORK CONFOUND REMOVED BY CONSTRUCTION, WHICH IS WHY IT NEEDS NO CONTROL. +// +// `identity_inflation_permille` above pairs a row against itself across two runs, which is already +// the right pairing -- but a row whose cost moved because the TREE changed is inflation and cost +// change mixed, and separating them normally means choosing a control population and defending +// the choice. Every such choice made in gunbc#10094 had to be defended and two were withdrawn. +// +// Restricting the pairing to rows whose `eval_steps` are EQUAL removes the confound instead of +// modelling it: the evaluator executed the same number of steps in both runs, so the only thing +// that could have changed did not, and any remaining cpu movement is inflation. Reach is not +// assumed -- `count` the result against `identity_inflation_permille`'s to see what fraction of +// the population the discriminator covers, because a clean instrument over three rows is not a +// measurement of a corpus. +// +// TWO ROWS CAN SHARE A STEP COUNT WITHOUT SHARING WORK, and the honest statement of what this +// establishes accounts for it: equal steps means equal EVALUATOR work, not equal host work. A row +// that spends its time inside one opaque host call reports few steps in both runs and is admitted +// here while its real variation lives outside the evaluator. `v2.workflow.required_floor` already +// carries a declared rung drop for exactly that region, so the population this instrument is +// cleanest over is the one that is CPU-bound in the evaluator. +fn identity_inflation_permille_at_equal_work( + base: RunCost, + other: RunCost, + min_base_ms: Millisecond +) -> List { + base.rows + |> filter(b => millisecond_count(m: b.cpu_ms) >= millisecond_count(m: min_base_ms)) + |> flat_map(b => match other.rows |> filter(o => o.identity == b.identity && o.eval_steps == b.eval_steps) |> first { + Absent => [] + Present { value: o } => [(millisecond_count(m: o.cpu_ms) * 1000) / millisecond_count(m: b.cpu_ms)] + }) +} + +// HOW MANY RUNS ONE IDENTITY CROSSED IN, which is the question that separates a property of the +// ROW from a property of the RUN. +type CrossingRecurrence { + identity: String + runs_crossed: Int +} + +// THE RECURRENCE JOIN. A ceiling that refuses the whole run makes "which rows crossed" a per-run +// set, and reading one such set says nothing about cause: a row crosses because it is expensive, +// because the run was slow, or both. Joining the sets across runs decides it. An identity that +// crosses in many runs is expensive and tightening the line reaches it; identities that each cross +// once and never again are being selected by the run, and the line is adjudicating something the +// tree does not control. +// +// IT DOES NOT DECIDE THE QUESTION ON ITS OWN, and the confound is not hypothetical. Runs sampled +// across different tree vintages have had crossing families REPAIRED between them, so an identity +// that stops recurring may have been fixed rather than never re-selected. A recurrence census is +// evidence about cause only over runs whose relevant population did not change, and a caller +// spanning vintages owes that qualification with the result. +fn crossing_recurrence( + runs: List, + ceiling_ms: Millisecond, + excluded_modules: List +) -> List { + let crossers = runs |> flat_map(run => run_crossings(run: run, ceiling_ms: ceiling_ms, excluded_modules: excluded_modules)) + crossers + |> fold(init: [], f: (acc, id) => + if any(acc, r => r.identity == id) { + acc + } else { + concat(acc, [CrossingRecurrence { identity: id, runs_crossed: count(crossers |> filter(c => c == id)) }]) + }) +} + +// THE POPULATION THAT DECIDES WHETHER A CEILING IS ADJUDICATING THE TREE OR THE RUN: identities +// observed crossing in more than one of the sampled runs. Empty means every crossing was +// single-run, which is the shape a run-level cause produces. +fn recurring_crossers(recurrence: List) -> List { + recurrence |> filter(r => r.runs_crossed > 1) +} diff --git a/dag/test/claim/floor_cost_distribution_witness_test.dag b/dag/test/claim/floor_cost_distribution_witness_test.dag index aab4ffafeed..f7d3214f7a4 100644 --- a/dag/test/claim/floor_cost_distribution_witness_test.dag +++ b/dag/test/claim/floor_cost_distribution_witness_test.dag @@ -12,6 +12,10 @@ import tools.floor_cost_distribution_instrument { refused_load_lines } import gunbc.floor_cost_distribution { + CrossingRecurrence, + identity_inflation_permille_at_equal_work, + crossing_recurrence, + recurring_crossers, FloorCostRow, RunCost, CostBand, @@ -43,13 +47,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly // Shape: two runs over the same three identities in two modules, one of which ("hot") crosses the // 500ms ceiling on run B only. That is the exact shape the real analysis turns on -- a row whose // membership in the crossing set depends on the run rather than on the row. -data row_a1: FloorCostRow = FloorCostRow { identity: "m.hot.x", module: "m.hot", cpu_ms: millisecond(count: 400) } -data row_a2: FloorCostRow = FloorCostRow { identity: "m.mid.y", module: "m.mid", cpu_ms: millisecond(count: 200) } -data row_a3: FloorCostRow = FloorCostRow { identity: "m.mid.z", module: "m.mid", cpu_ms: millisecond(count: 50) } +data row_a1: FloorCostRow = FloorCostRow { identity: "m.hot.x", module: "m.hot", cpu_ms: millisecond(count: 400) , eval_steps: 9000 } +data row_a2: FloorCostRow = FloorCostRow { identity: "m.mid.y", module: "m.mid", cpu_ms: millisecond(count: 200) , eval_steps: 4000 } +data row_a3: FloorCostRow = FloorCostRow { identity: "m.mid.z", module: "m.mid", cpu_ms: millisecond(count: 50) , eval_steps: 900 } -data row_b1: FloorCostRow = FloorCostRow { identity: "m.hot.x", module: "m.hot", cpu_ms: millisecond(count: 600) } -data row_b2: FloorCostRow = FloorCostRow { identity: "m.mid.y", module: "m.mid", cpu_ms: millisecond(count: 300) } -data row_b3: FloorCostRow = FloorCostRow { identity: "m.mid.z", module: "m.mid", cpu_ms: millisecond(count: 100) } +data row_b1: FloorCostRow = FloorCostRow { identity: "m.hot.x", module: "m.hot", cpu_ms: millisecond(count: 600) , eval_steps: 9000 } +data row_b2: FloorCostRow = FloorCostRow { identity: "m.mid.y", module: "m.mid", cpu_ms: millisecond(count: 300) , eval_steps: 4400 } +data row_b3: FloorCostRow = FloorCostRow { identity: "m.mid.z", module: "m.mid", cpu_ms: millisecond(count: 100) , eval_steps: 900 } data run_a: RunCost = RunCost { run: "runA" as NonEmptyStr, rows: [row_a1, row_a2, row_a3] } data run_b: RunCost = RunCost { run: "runB" as NonEmptyStr, rows: [row_b1, row_b2, row_b3] } @@ -176,3 +180,58 @@ test fn an_unreadable_or_empty_run_is_named_and_never_counted_as_loaded() -> Boo test fn a_complete_sample_produces_no_refusal_lines() -> Bool { count(refused_load_lines(loads: [RunLoaded { run: run_a }, RunLoaded { run: run_b }])) == 0 } + +// THE STEP COUNT COMES FROM ITS OWN COLUMN, and this is worth a witness because it is the column +// every other one in this artifact could be mistaken for: the row carries wall, cpu, steps and a +// diagnostic line threshold side by side, and reading the wrong one produces a plausible number +// rather than an error. 1000 is the steps field of the fixture's first row; 400 is its cpu and 402 +// its wall. +test fn a_parsed_row_takes_eval_steps_from_the_steps_column() -> Bool { + match parse_claim_cost_tsv(text: sample_tsv) |> first { + Absent => false + Present { value: r } => r.eval_steps == 1000 && millisecond_count(m: r.cpu_ms) == 400 + } +} + +// THE WORK-CONTROLLED PAIRING, AND ITS DISCRIMINATING RED IS THE ROW WHOSE WORK CHANGED. Fixture +// shape: `m.hot.x` runs 9000 steps in both runs and moves 400 -> 600ms, which is inflation; +// `m.mid.y` moves 200 -> 300ms but its steps move 4000 -> 4400, so its cost change is not +// separable and it must be DROPPED rather than counted at 1500 permille. A pairing that admitted +// it would report a work change as contention, which is the whole confound this exists to remove. +test fn equal_work_pairing_admits_the_unchanged_row_and_drops_the_changed_one() -> Bool { + let controlled = identity_inflation_permille_at_equal_work(base: run_a, other: run_b, min_base_ms: millisecond(count: 100)) + let uncontrolled = identity_inflation_permille(base: run_a, other: run_b, min_base_ms: millisecond(count: 100)) + count(controlled) == 1 && count(uncontrolled) == 2 + && match controlled |> first { Absent => false Present { value: v } => v == 1500 } +} + +// AND THE REACH IS REPORTABLE, which is the first thing a reader should doubt: a work-controlled +// figure over one row of two is a clean instrument over half the population, and the caller must +// be able to say so rather than quoting the percentile alone. +test fn the_controlled_population_is_smaller_than_the_paired_one_and_countable() -> Bool { + count(identity_inflation_permille_at_equal_work(base: run_a, other: run_b, min_base_ms: millisecond(count: 100))) + < count(identity_inflation_permille(base: run_a, other: run_b, min_base_ms: millisecond(count: 100))) +} + +// RECURRENCE OVER THE FIXTURE: `m.hot.x` crosses on run B alone, so it recurs ONCE and the +// recurring-crosser population is EMPTY. That is the shape a run-level cause produces, and an +// empty answer here is the finding rather than the absence of one. +test fn a_single_run_crossing_recurs_once_and_no_identity_recurs() -> Bool { + let rec = crossing_recurrence(runs: both_runs, ceiling_ms: millisecond(count: 500), excluded_modules: []) + count(rec) == 1 + && match rec |> first { Absent => false Present { value: r } => r.identity == "m.hot.x" && r.runs_crossed == 1 } + && count(recurring_crossers(recurrence: rec)) == 0 +} + +// THE POSITIVE CONTROL FOR RECURRENCE, so the empty answer above is not vacuous: over a run pair +// where the SAME identity crosses twice, it is counted twice and reported as recurring. Without +// this, `recurring_crossers` returning empty would be indistinguishable from a join that never +// matches anything. +test fn an_identity_crossing_in_two_runs_is_counted_twice_and_reported_recurring() -> Bool { + let hot_a = RunCost { run: "hotA" as NonEmptyStr, rows: [row_b1] } + let hot_b = RunCost { run: "hotB" as NonEmptyStr, rows: [row_b1] } + let rec = crossing_recurrence(runs: [hot_a, hot_b], ceiling_ms: millisecond(count: 500), excluded_modules: []) + count(rec) == 1 + && count(recurring_crossers(recurrence: rec)) == 1 + && match rec |> first { Absent => false Present { value: r } => r.runs_crossed == 2 } +} diff --git a/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md b/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md new file mode 100644 index 00000000000..4bc28ea5b6d --- /dev/null +++ b/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md @@ -0,0 +1,116 @@ +# The emit near-ceiling family is not a defect + +*A negative result, filed so the next lane skips four plays that do not work. Produced by +jolly-ferret-412 while owning the charge subject behind the required floor's 500ms per-claim CPU +ceiling. Every figure below names the producer that re-derives it; where a number and a producer +disagree, the producer is right.* + +## What this closes + +Three `v2.test.emit` identities refused the required floor on run `33695697323`. The question +routed to this lane was whether the emit family carries a repairable cost defect. **It does not.** +Four rows, two clusters, 292–350ms off the floor, none individually remarkable; what put two of +them over 500ms is the run they landed in. + +That answer is only useful with the plays that were tried attached, because each looks obviously +correct from the outside: + +| play | outcome | where it is recorded | +| --- | --- | --- | +| serve the shared producer across claim frames | **measured and refused**, three candidate rows, every one made its consumers worse | `v2.workflow.floor_pure_producer_share` `floor_cross_claim_refused_candidates` | +| find the one dominant shared producer, as gunbc#10133 did | **refuted twice**, independently | `eval_steps` fingerprint in `docs/plans/floor-cost-distribution-near-the-ceiling.md`; and the present-vs-absent runs behind the refused rows above | +| repair the worst row per-producer | **8ms**, against a question 87 rows deep | the top-down table in the same memo | +| read the interrupted rows' printed cost as a margin | **not a cost at all** — an interrupted row reports the ceiling that interrupted it | `v2.workflow.required_floor`, and the in-band sentence the floor prints beside it | + +## The four rows, measured off the floor + +Two of the three refusing identities were `budget_interrupted`, so their cost was **unbounded +above** — `required_floor_claim_cost.tsv` records them at 505/503 and 508/504, which is the +interrupt point, not a measurement. A row with no upper bound cannot be ranked, cannot be compared, +and cannot be shown to have improved by any repair, so the first step was to bound them. + +Instrument: `claim_batch --source-root dag --source-root src/v2 --entry --functions +`, one entry per module, no floor and no budget. + +| identity | floor | off-floor | +| --- | --- | --- | +| `produced_decl_two_targets_render_own_order` | ≥503 interrupted | 346ms | +| `rust_produced_decl_emits_named_add` | ≥504 interrupted | 294ms | +| `rust_produced_decl_emits_named_add2` | 489 passed | 292ms | +| `rust_produced_decl_name_discriminates` | 527 over-budget | 350ms | + +**No absolute figure crosses between those columns.** The off-floor arm is a different +architecture and a different execution context; every conclusion here uses within-column ordering +only, four rows measured under identical conditions in each column. + +## Two rows, two mechanisms + +`named_add` off the floor is 294ms against its sibling `named_add2` at 292ms — the same row within +1% — while on the floor the sibling completed at 489 and it was interrupted. **Contention**, and +three instruments that share no mechanism agree: + +1. µs/step from the floor artifact: 3.238 against the sibling's 2.990, 8.3% slower per unit of + work — derived from `cpu_ms` and `eval_steps`, which are sampled in consecutive statements after + `run_claim` returns and netted by the same shared-fill rule, so the ratio survives reordering. +2. off-floor sibling parity, above. +3. required multiple: both siblings needed ~1.70x to cross, above the measured p90, and exactly one + of them did. + +`two_targets` is the opposite. Its 188,416 steps at interrupt exceed every sibling's *completed* +total, so it does more work — but off the floor it lands at 346ms beside `name_discriminates` at +350ms. **Biggest in work, ordinary in time**, and time is what the ceiling adjudicates. A work +bound is not a cost property; inferring one from the other is the error this row exists to +document. + +## What the ceiling is actually adjudicating + +Eleven floor runs joined on claim identity: `33661252708`, `33664119594`, `33667640710`, +`33671317370`, `33688140761`, `33695697323`, `33699325123`, `33699540412`, `33700216949`, +`33700681714`, `33701938720`. + +**No identity crossed twice.** Four runs had crossings; not one identity recurs. Producer: +`gunbc.floor_cost_distribution` `crossing_recurrence` and `recurring_crossers`, whose empty answer +over single-run crossings is the finding rather than the absence of one — and whose positive +control in `test.claim.floor_cost_distribution_witness` is what keeps the empty answer from being +vacuous. + +**Crossings cluster by family within a run.** Run `33688140761`: ten crossers, all ten in +`test.claim.self_host_compile_phase_live_gate_witness`. Run `33695697323`: three, all in the emit +produced-decl family. A run tips a family; which identity inside it tips is arbitrary. + +**The run factor is large.** Over 296 identities present in all eleven runs with median cpu ≥100ms, +taking each row's cross-run median as its own baseline, the per-run median factor runs +0.858 … 1.154 — 1.35x best to worst on the *median* row, not a tail. The near-ceiling population +tracks it: rows ≥350ms per run come out 3 on the 0.959 run and 36 on the 1.154 run. Producer: +`identity_inflation_permille` composed with `permille_percentile`. + +So the run factor decides **whether** anything crosses; a row's baseline cost decides **which +family** is exposed when it does. The line adjudicates a product of two things and attributes it to +one. + +## The instrument that needs no control population + +`eval_steps` is host-independent and byte-identical for the large majority of identities across a +run pair. For those rows the only thing that could have changed did not, so any cpu movement is +inflation **by construction** — no normalisation, no control population to choose and defend. +Producer: `identity_inflation_permille_at_equal_work`, which drops any row whose step count moved +rather than smoothing it. + +Its reach must be reported beside it — `count` it against `identity_inflation_permille` — because a +clean instrument over three rows is not a measurement of a corpus. + +## What is NOT claimed + +- **The vintage confound is load-bearing.** The eleven runs span different tree vintages, so "no + identity crossed twice" is confounded by repair: the ten `live_gate` crossers stopped recurring + partly because that family was fixed. This is not a pure contention result. +- **Equal steps is equal EVALUATOR work, not equal host work.** A row whose time sits inside one + opaque host call reports few steps in both runs; `v2.workflow.required_floor` carries a declared + rung drop for that region. +- **No safe-cost figure is derived here, and one was withdrawn.** A `500 / p90` derivation was + circulated by this lane and retracted: a p90 answers a per-row question while the ceiling refuses + the whole *run*, and the stratum quoted stopped one bucket short of the population that can + actually reach 500 — where inflation rises again rather than continuing to fall. Both errors ran + in the unsafe direction. The stratified table with n per bucket belongs with the decision-maker, + and the quantile choice is theirs. +- **Nothing here is a recommendation about where the line should sit.** From 248ef33c873dcc65d3c2475ae4709905b36b14cf Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 03:07:04 +0000 Subject: [PATCH 2/4] The artifact's columns move between vintages, so locate them by NAME: a positional read produced a plausible number, not an error MEASURED, NOT IMAGINED. Extending this parser to carry eval_steps at index 6, I ran the microseconds-per-step figure across eleven sampled runs and three of them came back near 2500 instead of near 2 -- three orders of magnitude off and perfectly well-formed. The cause is that `eval_steps` was INSERTED into this artifact between vintages: run 33661252708's header is `identity module outcome verdict_reached wall_ms cpu_ms cost_line_ms` and run 33699540412's is the same with `eval_steps` before `cost_line_ms`. A parser keyed on index 6 reads the older artifact's `cost_line_ms` -- the constant 100 -- as a step count. That is DESIGN section 3's standing rule applied to a TSV: a position is a second naming scheme for something the header already names, and any insertion above the cited index silently invalidates it. So the header is now the schema. `claim_cost_columns` resolves identity, module, cpu_ms and eval_steps by NAME and REFUSES when one is absent, and `parse_claim_cost_line` takes the resolved layout rather than assuming one. An artifact that does not carry a needed column yields no rows, which is the whole population refusing rather than a silently wrong one. THREE WITNESSES, and the third is the discriminating one. The old-vintage header must yield zero rows; the same shape WITH the column must parse, so the empty answer cannot be read as a broken parser; and a REORDERED header must be followed, which under the previous parser returns a row with cpu and steps swapped -- two plausible numbers rather than an error, which is the silent-wrongness shape this whole change is about. The old vintage's absence of the column is also why the eleven-run figures in the memo are the ones that do not need it: the run-factor and crossing-recurrence results read cpu and outcome, both of which sit at stable indices in both layouts and are now resolved by name regardless. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QWLoiyrKq3zNTiDNtrs9gC --- dag/gunbc/floor_cost_distribution.dag | 104 +++++++++++++++--- .../floor_cost_distribution_witness_test.dag | 41 ++++++- 2 files changed, 126 insertions(+), 19 deletions(-) diff --git a/dag/gunbc/floor_cost_distribution.dag b/dag/gunbc/floor_cost_distribution.dag index 731232f4e33..b9fdfeaa37c 100644 --- a/dag/gunbc/floor_cost_distribution.dag +++ b/dag/gunbc/floor_cost_distribution.dag @@ -42,30 +42,85 @@ type RunCost { rows: List } +// COLUMNS ARE LOCATED BY NAME, NOT BY POSITION, AND THIS IS NOT STYLE. +// +// DESIGN section 3's standing rule -- cite the symbol, never the position -- applies to a TSV +// exactly as it applies to a source file, and for the same reason: any insertion ABOVE the cited +// index silently invalidates it. That is not hypothetical here. The `eval_steps` column was +// INSERTED into this artifact between vintages: run 33661252708's header is +// `identity module outcome verdict_reached wall_ms cpu_ms cost_line_ms` and run 33699540412's is +// the same with `eval_steps` before `cost_line_ms`. A parser keyed on index 6 reads the older +// artifact's `cost_line_ms` -- the constant 100 -- as a step count, which is not an error, it is a +// PLAUSIBLE NUMBER: the resulting microseconds-per-step figures came out near 2500 instead of near +// 2, off by three orders of magnitude and still perfectly well-formed. Measured, not imagined: +// three of eleven sampled runs produced exactly that before the header was consulted. +// +// So the header IS the schema and a missing column REFUSES. `Absent` here means "this artifact +// does not carry the column this analysis needs", which is a fact about the artifact and must +// reach the caller as one, rather than being defaulted into a zero or a constant that flows into +// every downstream percentile. +type ClaimCostColumns { + identity: Int + module: Int + cpu_ms: Int + eval_steps: Int +} + +fn claim_cost_column_index(header_fields: List, name: String) -> Int? { + header_fields + |> enumerate + |> filter(e => e.second == name) + |> map(e => e.first) + |> first +} + +// THE HEADER LINE IS THE ONE THAT NAMES `identity` FIRST. The artifact's `#`-prefixed summary +// precedes it, and a data row can never be mistaken for it because no claim identity is the +// literal string "identity". +fn claim_cost_columns(header_line: String) -> ClaimCostColumns? { + let fields = split(s: header_line, delimiter: "\t") + match claim_cost_column_index(header_fields: fields, name: "identity") { + Absent => none + Present { value: id } => match claim_cost_column_index(header_fields: fields, name: "module") { + Absent => none + Present { value: md } => match claim_cost_column_index(header_fields: fields, name: "cpu_ms") { + Absent => none + Present { value: cpu } => match claim_cost_column_index(header_fields: fields, name: "eval_steps") { + Absent => none + Present { value: steps } => Present { + value: ClaimCostColumns { identity: id, module: md, cpu_ms: cpu, eval_steps: steps } + } + } + } + } + } +} + // A TSV LINE IS EITHER A ROW OR IT IS NOT, AND "NOT" IS NEVER A FABRICATED ROW. The artifact // carries a `#`-prefixed summary line and a header line before the data, and a short or // unparseable line is refused rather than defaulted to zero -- a zero would sit silently at the // bottom of every band and inflate the safe population. -fn parse_claim_cost_line(line: String) -> FloorCostRow? { +fn parse_claim_cost_line(line: String, columns: ClaimCostColumns) -> FloorCostRow? { if starts_with(s: line, prefix: "#") { none } else { let fields = split(s: line, delimiter: "\t") - if count(fields) < 7 { + let widest = max_int(a: max_int(a: columns.identity, b: columns.module), b: max_int(a: columns.cpu_ms, b: columns.eval_steps)) + if count(fields) <= widest { none - } else if fields[0] == "identity" { + } else if fields[columns.identity] == "identity" { none } else { - match parse_int(s: fields[5]) { + match parse_int(s: fields[columns.cpu_ms]) { Absent => none - Present { value: cpu } => Present { - value: FloorCostRow { - identity: fields[0], - module: fields[1], - cpu_ms: millisecond(count: cpu), - eval_steps: match parse_int(s: fields[6]) { - Absent => 0 - Present { value: steps } => steps + Present { value: cpu } => match parse_int(s: fields[columns.eval_steps]) { + Absent => none + Present { value: steps } => Present { + value: FloorCostRow { + identity: fields[columns.identity], + module: fields[columns.module], + cpu_ms: millisecond(count: cpu), + eval_steps: steps } } } @@ -74,12 +129,27 @@ fn parse_claim_cost_line(line: String) -> FloorCostRow? { } } +fn max_int(a: Int, b: Int) -> Int { + if a > b { a } else { b } +} + +// AN ARTIFACT WHOSE HEADER LACKS A NEEDED COLUMN YIELDS NO ROWS, WHICH IS THE WHOLE POPULATION +// REFUSING RATHER THAN A SILENTLY THINNER ONE. A caller that wants to distinguish "old vintage" +// from "empty run" reads `claim_cost_columns` itself; this function answers only the question it +// is asked, and answers it with nothing rather than with rows built on a guessed layout. fn parse_claim_cost_tsv(text: String) -> List { - split(s: text, delimiter: "\n") - |> flat_map(line => match parse_claim_cost_line(line: line) { - Absent => [] - Present { value: row } => [row] - }) + let lines = split(s: text, delimiter: "\n") + match lines |> filter(l => starts_with(s: l, prefix: "identity\t")) |> first { + Absent => [] + Present { value: header } => match claim_cost_columns(header_line: header) { + Absent => [] + Present { value: columns } => + lines |> flat_map(line => match parse_claim_cost_line(line: line, columns: columns) { + Absent => [] + Present { value: row } => [row] + }) + } + } } // THE BAND HISTOGRAM (question 1: is the population near the ceiling dense). diff --git a/dag/test/claim/floor_cost_distribution_witness_test.dag b/dag/test/claim/floor_cost_distribution_witness_test.dag index f7d3214f7a4..3b64ec7f601 100644 --- a/dag/test/claim/floor_cost_distribution_witness_test.dag +++ b/dag/test/claim/floor_cost_distribution_witness_test.dag @@ -12,6 +12,8 @@ import tools.floor_cost_distribution_instrument { refused_load_lines } import gunbc.floor_cost_distribution { + ClaimCostColumns, + claim_cost_columns, CrossingRecurrence, identity_inflation_permille_at_equal_work, crossing_recurrence, @@ -62,6 +64,41 @@ data both_runs: List = [run_a, run_b] // PARSING: the artifact's own preamble must not become rows. data sample_tsv: String = "# summary\texecuted=3\tcost_basis=cpu\nidentity\tmodule\toutcome\tverdict_reached\twall_ms\tcpu_ms\teval_steps\tcost_line_ms\nm.hot.x\tm.hot\tpass\ttrue\t402\t400\t1000\t100\nm.mid.y\tm.mid\tpass\ttrue\t201\t200\t900\t100" +// The layout the current artifact ships, resolved from its own header rather than assumed. +data sample_columns: ClaimCostColumns = ClaimCostColumns { identity: 0, module: 1, cpu_ms: 5, eval_steps: 6 } + +// THE OLD VINTAGE, VERBATIM. Run 33661252708's artifact has no `eval_steps` column at all -- the +// header is one field shorter and index 6 holds `cost_line_ms`, the constant 100. A positional +// parser reads that as a step count and produces microseconds-per-step near 2500 instead of near +// 2: not an error, a PLAUSIBLE NUMBER, which is why this is a refusal and not a warning. +data old_vintage_tsv: String = "# summary\texecuted=2\tcost_basis=cpu\nidentity\tmodule\toutcome\tverdict_reached\twall_ms\tcpu_ms\tcost_line_ms\nm.hot.x\tm.hot\tpass\ttrue\t402\t400\t100" + +test fn an_artifact_without_the_steps_column_yields_no_rows_rather_than_reading_the_next_one() -> Bool { + count(parse_claim_cost_tsv(text: old_vintage_tsv)) == 0 + && match claim_cost_columns(header_line: "identity\tmodule\toutcome\tverdict_reached\twall_ms\tcpu_ms\tcost_line_ms") { + Present { value: _ } => false + Absent => true + } +} + +// AND THE POSITIVE CONTROL FOR THAT REFUSAL, so an empty population cannot be read as "the parser +// is broken": the same rows under a header that DOES carry the column parse normally. +test fn the_same_shape_with_a_steps_column_parses() -> Bool { + count(parse_claim_cost_tsv(text: sample_tsv)) == 2 +} + +// COLUMNS ARE FOUND BY NAME, WHICH MEANS A REORDERED HEADER STILL READS CORRECTLY. This is the +// discriminating red for the whole change: under a positional parser this fixture returns a row +// whose cpu and steps are swapped, and swapped values are two plausible numbers rather than an +// error. +test fn a_reordered_header_is_followed_rather_than_the_old_positions() -> Bool { + let reordered = "identity\tmodule\teval_steps\tcpu_ms\nm.hot.x\tm.hot\t1000\t400" + match parse_claim_cost_tsv(text: reordered) |> first { + Absent => false + Present { value: r } => millisecond_count(m: r.cpu_ms) == 400 && r.eval_steps == 1000 + } +} + test fn the_summary_and_header_lines_are_not_rows() -> Bool { count(parse_claim_cost_tsv(text: sample_tsv)) == 2 } @@ -77,9 +114,9 @@ test fn a_parsed_row_takes_cpu_from_the_cpu_column_not_the_wall_column() -> Bool // line must produce NO row rather than a zero-cost one. A fabricated zero would sit silently in // the bottom band and make the population look safer than it is. test fn an_unparseable_line_yields_no_row_rather_than_a_zero_cost_row() -> Bool { - match parse_claim_cost_line(line: "m.broken\tm\tpass") { + match parse_claim_cost_line(line: "m.broken\tm\tpass", columns: sample_columns) { Present { value: _ } => false - Absent => match parse_claim_cost_line(line: "m.x\tm\tpass\ttrue\t10\tNOT-A-NUMBER\t1\t100") { + Absent => match parse_claim_cost_line(line: "m.x\tm\tpass\ttrue\t10\tNOT-A-NUMBER\t1\t100", columns: sample_columns) { Present { value: _ } => false Absent => true } From 41d8c4f0c97838ef8c7892d353924e764a22d5fe Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 03:29:47 +0000 Subject: [PATCH 3/4] Sorted-scan grouping for crossing_recurrence: the quadratic fold is always fixed, not priced per site Review 59079 flagged the nested filter as an efficiency observation and explicitly declined to request a change, because the population is per-run crossers and n is small. DESIGN section 6's standing rule says the opposite and is the authority here: a proven cost-shape defect -- the rule names a quadratic fold and a copied accumulator specifically -- is ALWAYS fixed, because "n is small here" is not a time-stable fact and pricing per-site exceptions is itself redundant work. The population is small today because the floor is healthy; a bad week is exactly when this runs on a large one. Both defects were present: the fold re-filtered the whole crossing list for every unseen id, and it appended with `concat`, which copies the accumulator each time. The ids are now sorted once and scanned once, runs of equal ids counted in a single pass, and the accumulator prepended and reversed at the end. The output order changes from first-appearance to identity order, which is the stronger property: a census whose order depends on which run happened to be sampled first cannot be diffed against another. Both recurrence witnesses and the two pre-existing crossing witnesses pass unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QWLoiyrKq3zNTiDNtrs9gC --- dag/gunbc/floor_cost_distribution.dag | 52 ++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 8 deletions(-) diff --git a/dag/gunbc/floor_cost_distribution.dag b/dag/gunbc/floor_cost_distribution.dag index b9fdfeaa37c..96edd8cad48 100644 --- a/dag/gunbc/floor_cost_distribution.dag +++ b/dag/gunbc/floor_cost_distribution.dag @@ -358,19 +358,55 @@ type CrossingRecurrence { // that stops recurring may have been fixed rather than never re-selected. A recurrence census is // evidence about cause only over runs whose relevant population did not change, and a caller // spanning vintages owes that qualification with the result. +// SORTED-SCAN GROUPING, NOT A NESTED FILTER. The first version folded the crossing ids and +// re-filtered the whole list for every unseen one, which is quadratic in the number of crossings, +// and appended to an accumulator with `concat`, which copies. Both are named in DESIGN section 6's +// bare-minimum-cost rule, whose whole point is that "n is small here" is not a time-stable fact: +// the population is per-run crossers today because the floor is healthy, and a bad week is exactly +// when this function gets called on a large one. +// +// So the ids are sorted once and scanned once, runs of equal ids are counted in a single pass, and +// the accumulator is built by prepending and reversed at the end. The output order becomes +// identity order rather than first-appearance order, which is a stronger property than the one it +// replaces -- a census whose order depends on which run happened to be sampled first is not a +// census anyone can diff. +type RecurrenceScan { + started: Bool + current: String + seen: Int + done: List +} + fn crossing_recurrence( runs: List, ceiling_ms: Millisecond, excluded_modules: List ) -> List { - let crossers = runs |> flat_map(run => run_crossings(run: run, ceiling_ms: ceiling_ms, excluded_modules: excluded_modules)) - crossers - |> fold(init: [], f: (acc, id) => - if any(acc, r => r.identity == id) { - acc - } else { - concat(acc, [CrossingRecurrence { identity: id, runs_crossed: count(crossers |> filter(c => c == id)) }]) - }) + let crossers = runs + |> flat_map(run => run_crossings(run: run, ceiling_ms: ceiling_ms, excluded_modules: excluded_modules)) + |> sort_by(id => id) + let scanned = fold( + crossers, + init: RecurrenceScan { started: false, current: "", seen: 0, done: [] }, + f: (acc, id) => + if acc.started && acc.current == id { + RecurrenceScan { started: true, current: acc.current, seen: acc.seen + 1, done: acc.done } + } else if acc.started { + RecurrenceScan { + started: true, + current: id, + seen: 1, + done: concat([CrossingRecurrence { identity: acc.current, runs_crossed: acc.seen }], acc.done) + } + } else { + RecurrenceScan { started: true, current: id, seen: 1, done: [] } + } + ) + if scanned.started { + reverse(concat([CrossingRecurrence { identity: scanned.current, runs_crossed: scanned.seen }], scanned.done)) + } else { + [] + } } // THE POPULATION THAT DECIDES WHETHER A CEILING IS ADJUDICATING THE TREE OR THE RUN: identities From 7578d22a2dbe18c08e9090566aa1bf4922c8fbbf Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 04:38:58 +0000 Subject: [PATCH 4/4] A field comment is inside a declaration body: hoist the eval_steps prose above the type Second grain of the same rule that refused this session's other PR. DESIGN section 4c models annotations at MODULE-ITEM grain only, so a `//` line on a record field refuses with `source annotation sits inside a declaration body` -- six parse errors, and the floor refuses the whole run on them. The prose is unchanged and now leads `type FloorCostRow`, naming eval_steps in its first clause so it still reads as being about that field rather than about the record. MY PRE-PUSH SCANNER MISSED IT BECAUSE IT ONLY KNEW THE FIRST GRAIN. It walked forward from each comment looking for a following item and reported clean, which is exactly true and exactly insufficient: a field comment HAS a following item. The check now tracks brace depth, because "attached to something" and "attached to a MODULE ITEM" are different questions and only the second is the rule. Five witnesses pass locally. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QWLoiyrKq3zNTiDNtrs9gC --- dag/gunbc/floor_cost_distribution.dag | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/dag/gunbc/floor_cost_distribution.dag b/dag/gunbc/floor_cost_distribution.dag index 96edd8cad48..f2b014090f7 100644 --- a/dag/gunbc/floor_cost_distribution.dag +++ b/dag/gunbc/floor_cost_distribution.dag @@ -23,16 +23,16 @@ import std.measure { Millisecond, millisecond, millisecond_count } // THE INPUT IS THE `required-floor-claim-cost` ARTIFACT that every required-floor run uploads -- // the COMPLETE executed population, not the 25-row `[over-cost]` preview the job log prints. +// `eval_steps` IS THE THIRD COLUMN THIS ANALYSIS NEEDS, and the only one of the three that is not +// a clock. Evaluator steps are counted by the interpreter and netted by the same shared-fill rule +// the CPU figure is, so a row's step count is a property of what it evaluated and carries no term +// for the machine it evaluated on. It is what lets `identity_inflation_permille_at_equal_work` +// below separate "this row got more expensive" from "this row got inflated" without choosing a +// control population at all. type FloorCostRow { identity: String module: String cpu_ms: Millisecond - // THE THIRD COLUMN THIS ANALYSIS NEEDS, and it is the only one that is not a clock. Evaluator - // steps are counted by the interpreter and netted by the same shared-fill rule the CPU figure - // is, so a row's step count is a property of what it evaluated and carries no term for the - // machine it evaluated on. It is what lets `identity_inflation_permille_at_equal_work` below - // separate "this row got more expensive" from "this row got inflated" without choosing a - // control population at all. eval_steps: Int }