A right-censored bound could inhabit the field consumers read as an exact cost — close the artifact path

[gunbai-bot]

READING GUIDE — this body describes two heads, and says which is which.
Sections marked HISTORICAL or SUPERSEDED record the tree before #10226 wired
PositionGenericTypeArgument and before #10259's envelope arm was merged in. They are kept
because the transition out of them is the evidence for the rung, not because they still hold.
Everything else describes 77ceb95bac, the current head. Witness-execution counts are
explicitly marked stale and are not restated from inference — see What CI actually executed.

The class, and why this is the artifact half of it

right_censored_bound_read_as_exact_measurement. When an instrument stops because a policy threshold fired before the subject completed, the value it emits is a lower bound, and it then gets read as a completed cost. It reads as data because it has units, and the number it wears is approximately the ceiling that stopped it — so a statistic over such values describes the ceiling, not the machine.

This is one invalid state on two emission paths, and only one of them had climbed:

path	state on main before this PR
console diagnostic	climbed. ClaimOutcome::BudgetInterrupted { elapsed_at_least_ms } vs CompletedOverBudget { elapsed_ms }; budget_figure_phrase renders cost=UNMEASURED; an_interrupted_rows_cost_field_never_holds_a_number forbids a digit in that field
per-claim cost artifact	not climbed. WitnessExecutionOccurrence discarded that split at the mint site — flat wall_nanos/cpu_nanos beside a separate verdict_reached: bool — and write_required_floor_claim_cost_tsv rendered plain wall_ms/cpu_ms for every executed row

required_floor_claim_cost.tsv is the artifact this repository's own ledger rows name as the complete population, so the silent path was the load-bearing one.

What the artifact's own modelled consumer did with it

gunbc.floor_cost_distribution resolves columns by name, refuses correctly on a missing column — and never asked for verdict_reached. So every right-censored bound flowed into the band histogram, run_worst_cpu, the max-over-runs candidate ranking, and identity_inflation_permille, which divides one cost by another to produce a contention ratio.

The sharpest harm is the ranking, and it is an inversion rather than a distortion. A bound is approximately the ceiling that stopped the row — which is the largest figure in the artifact. So reading bounds as costs ranks the rows the deadline stopped above the rows that are genuinely expensive, and identity_max_cpu / module_max_cpu are exactly the contention-independent ranking the repair ladder's candidate order is built from. The instrument does not merely report slightly wrong numbers; it hands back a candidate list ordered partly by which rows the budget happened to interrupt.

The two neighbouring harms compound it: the band histogram places every censored row in whichever band contains the ceiling, manufacturing the "population dense near the ceiling" shape the histogram exists to test for — guaranteed for any ceiling over any population, carrying zero information — and identity_inflation_permille feeds implied_clean_run_budget, so one promoted bound moves a derived budget.

Two independent receipts that a discriminator beside the number is a warning and not a repair:

• BudgetCompletion::elapsed_reading was deleted on the console path for exactly this reason: it answered "at least"/"exactly" as a qualifier handed to a caller who then supplied the sentence, and every caller supplied the same cost template. Its own deletion comment records three readers building wrong models on it in one night, one of them transcribing the sentence's warning while drawing an inference those words forbid. Someone already had to remove a working-looking mechanism for this class.
• The author of the class's own row consumed a censored value as a point measurement while documenting the class (jolly-ferret-412, verified on run 33713196398): the two attempts of v2.test.emit.rust_call_emit.rust_call_fold_closure_emit_holds render as budget_interrupted / false / 513 / 509 and pass / true / 382 / 381 — same columns, one a bound and one exact, separated only by an adjacent status string and a bool.

And no monotone correction recovers the value: gunbc#9629 measured one rendered 502ms figure denoting a completed cost of 2,902ms in one case and 355ms in another. Same displayed number, opposite subjects. The calibration authored on that reading is already retracted by gunbc#10205 (1ea6a949e0); this PR does not re-retract it.

The mechanism is already stated in the tree and is cited rather than restated: gunbc.witness_row_cost, on witness_cost_seed_timed_out_event.

The construction — four legs, not a better warning

A cost_observation_kind column beside a still-common cpu_ms field would only be a louder caveat, so the whole pairing lands together:

1. Disjoint constructors. ClaimCostReading = Observed { observed_cpu_ms, observed_wall_ms } | RightCensored(SafetyInterruptReading), minted from ClaimTerminality with no wildcard, reusing the existing reading type rather than re-spelling its five fields.
2. No total accessor. The only millisecond accessor is exact_cost_ms -> Option<u64>, None on the censored arm, so a bound cannot be summed, ranked, or compared against a line without the caller writing None. There is deliberately no cpu_ms(): a total accessor is what let the bound travel.
3. Disjoint wire field names. The TSV has no cpu_ms column. A completed row fills observed_cpu_ms; a preempted one fills cpu_at_least_ms beside its ceiling. A consumer projecting the cost column gets an empty cell for a censored row rather than a figure near the ceiling.
4. A mixed population refuses — enforced on both paths as of the integration below. v2.workflow.claim_cost_observation carries the exact-only remedy partition and an admission that refuses on the first censored member, returning population / exact / censored / unavailable so no result can state a numerator without its denominator.

HISTORICAL STATE, at the pre-#10226 head — leg 4 enforced on one path and not judged on the other

Read this section as a record of a state that no longer holds. Everything under this heading
describes the tree before PositionGenericTypeArgument was wired by #10226. The current state
is the table below it, measured at 77ceb95bac. Both accounts were previously written in the
present tense, so the superseded one and the correct transition each claimed to describe now —
that ambiguity is the defect this scoping removes, and the historical text is kept rather than
erased because the transition out of it is the evidence for the rung.

This section recorded a gap that has since been closed, and the record is kept because the closing is the evidence. When this PR was written, leg 4 held on the Rust path — exact_cost_ms -> Option<u64> with no total accessor, so rustc refuses a caller that ignores the absent arm — and the .dag path did not judge it: handing remedy_partition a List<RightCensoredCost> where List<ExactCompletionCost> is declared compiled. The seam was named by the compiler itself — v1.compiler.infer DeclaredTypePosition declared twelve positions and stated as a count that only two were wired, and a mismatch at the element of a generic container is PositionGenericTypeArgument, which had no obligation producer. That was not "the compiler admits a wrong element type" and not "the wall is absent": the obligation was never constructed at that position.

So this PR named PositionGenericTypeArgument as leg 4's next-rung trigger, and asserted the gap in an inverted witness — probe_censored_arm_only asserted the forbidden program was admitted — because asserting a refusal that did not exist would have been rung inflation inside the PR about rung inflation.

gunbc#10226 wired that producer and named this specimen as the case it closes. On the integrated head, before any edit, only the censored arm and its composite moved:

PASS probe_calibration_undefined_name_only
PASS probe_calibration_wrong_scalar_only
FAIL remedy_sizing_type_wall_state_on_the_dag_path
PASS probe_exact_arm_only          <- the legitimate program still compiles
FAIL probe_censored_arm_only       <- the forbidden program now refuses

Both calibrations staying green means the probe still discriminates; probe_exact_arm_only staying green means the new producer did not over-refuse. That is the wall arriving, not the probe breaking — so the arm is tightened to assert the refusal, not deleted (§4b(4)), and it is now the permanent regression control that the wall stays real.

The recomputed rung, which is substantive rather than a wording change, because an in-scope path moved:

path	rung	why
producer (seed mint)	4 — structurally impossible	ClaimCostReading::of derives the arm from ClaimTerminality with no wildcard; an exact reading for a preempted claim has no constructor
consumer (.dag call sites)	3 — structurally guaranteed	the source can still write the wrong call, and the compiler refuses it from modeled structure
artifact boundary	outside the modeled guarantee	observed and refused at a declared boundary

Class rung = the minimum across in-scope paths = 3. PositionGenericTypeArgument is retired as leg 4's trigger, by the capability it named and by nothing else. Rung 4 is not claimed for the class: §4b reserves it for an invalid state with no constructor, and this one is writable and refused.

Two axes that must not fuse

ClaimTerminality::Unwound — a host panic — reaches no verdict and its clocks are exact, because the unwind ended the evaluation. Censoring is a property of a deadline preempting the subject, not of a verdict being absent. So verdict_reached is retained beside the reading and is not derivable from it; collapsing them would mint a bound for a row that has a measurement.

Why not just filter the censored rows out

That is the opposite operation on the same population, and it creates censored_estimator_drops_its_own_tail — a statistic over the survivors of a threshold on the very variable being estimated, biased low with no bound, and biased low exactly where the analysis is looking. So each derivation names its arm:

• a crossing is a lower-bound question ("was this row known to reach the line") → admits both arms; excluding censored rows here would under-count crossings and make the floor read healthier than it is;
• a worst cost is a point question → returns WorstCost = WorstObserved | WorstIsLowerBound { at_least_ms, censored_rows }, union-propagated across runs so a maximum is exact only when every member it ranged over was;
• an inflation ratio needs two costs → the pair refuses and the refusal is counted (censored_pairs), which is what makes the exclusion stated rather than silent.

The one place a bound is admitted — and its guard

A crossing is a lower-bound question, so a censored row can answer it: a row stopped at a ceiling is known to have cost at least its bound. Excluding them here would under-count crossings and make the floor read healthier than it is — the single direction runs_refused must never err in.

But that admission is sound today and unsound by construction: it holds only because the CPU safety ceiling (v2.workflow.required_floor required_floor_claim_cpu_safety_limit_ms) sits above the cost line the artifact records — a coincidence of two constants in different modules, with nothing asserting the ordering. Raise the line above the ceiling, or lower the ceiling, and every censored row is silently counted as a crossing it never made.

So row_crossing has three arms — RowCrossed, RowBelowLine, RowCrossingUndecidable — and the third is refused and counted, never resolved. Defaulting it to "crossed" is tempting because it errs pessimistically, and it is still the absorbing fallback §5 forbids: it conflates the safe answer with no answer, destroys the signal that the ordering has broken, and fabricates a fact about a row. That is the same argument this module already makes for refusing an inflation pair rather than dropping its censored member — now applied to its own admission. run_crossing_census carries undecidable as identities, not a count, and the instrument prints it beside the refusal verdict.

Today that arm is provably empty, which is exactly why it is worth having: a discriminating red that cannot currently fire, costs nothing while the ordering holds, and fires the moment it stops. Its witness moves the line on a fixture rather than either live constant, and pairs it with the arm that holds today so a function answering Undecidable for every censored row cannot pass.

Disposition of draft #9029

Explicitly replaced, with its model half revived. Its src/v2/workflow/claim_cost_observation.dag is genuinely good and is the basis of leg 4 here. Two things changed since it stalled (734 commits):

• its stage0 diff cannot be revived — the model half it was proposing landed on main by another route as the ClaimOutcome split above, which post-dates it;
• its ObservationBinding / ObservationCoordinates / terminal-ledger wire are dropped, with reason: they answer which attempt may certify the required floor, a purpose-closure question with a different invalid state. Its own body records that half as unfinished. Carrying it would have quadrupled the diff for a second class.

The revived model now has an executing consumer, which is what #9029 lacked

v2.workflow.claim_cost_observation had no importer — a grep returned exactly one hit, a comment citing it. That is specification-without-execution (§5) and §6's experimental-residue tell, and it is precisely what left #9029 unlanded. dag/test/claim/claim_cost_observation_type_wall_witness_test.dag executes it as a compiler fixture, which is §4b's own resolution when the forbidden state has no constructor in accepted source: a corpus-facing assertion would be permanently green by construction, worse than absent because it would be cited as coverage.

Five arms, 5/5 PASS, and the two calibrations are what make the other three mean anything. compile_dag_rust_emit_check collapses three outcomes into one Bool — hard diagnostics, no emitted file matching the path, a failed content assertion — so a false has three readings and only one is refused. #9029 authored this probe with invented emitted paths and never ran it, so its refusal arm was green on a lookup miss rather than on a wall for its entire life. The emitted path is derived from the declared module name and is not free to choose. Inheriting that arm unexamined is exactly the defect this PR exists to name, arriving inside the fix for it.

SUPERSEDED — the arm was inverted only until its trigger fired, and it has since been tightened. At 77ceb95bac probe_censored_arm_only asserts a refusal, both calibration arms are retained beside it, and PositionGenericTypeArgument is discharged as the prior trigger rather than named as a future one. The paragraph that follows describes the pre-#10226 state and is kept for the same reason as the section above. — The fourth arm asserted the admission rather than a refusal — a discriminating red with its sign inverted. When PositionGenericTypeArgument is wired, the planted program refuses, the arm returns false, and this witness goes red — to be tightened back to a refusal and raise the rung, per §4b(4), never deleted. The file says so in a comment addressed to that lane, and they have the reproduction.

Run locally, not on BuildBuddy: the process there sits at the cgroup v2 root, where the kernel does not create memory.max at all — there is nothing misconfigured to find — so gunbc refuses to plan and no .dag executes.

A correction to my own account of that, because I published the wrong cause. I reported the dispatch as exiting 0 while refusing, and treated that as a fail-open. It is not: gunbc does stop the line — a missing entry and an unresolvable input both exit 1, and a panic exits 101. The 0 came from my own | head -20: a pipeline's status is its last command's, and head succeeds. The sentence in which I explained why the panic was invisible contained the pipe that also masked the status. The genuinely fail-closed half is the other one — a failing dispatch contains zero occurrences of error, so a grep for failures is silent over an empty domain.

The recurring_failure_mode row is deliberately not in this PR

One invalid state, two emission paths → one row. Per DESIGN §4b(1), a class's rung is the minimum across its in-scope paths, and citing the strongest while another stays silent is inflation. Two rows would have let a row report a climbed rung for the class while the unclimbed path sat elsewhere.

It folds into the row authored as interrupt_point_read_as_the_subjects_cost in gunbc#10203, which is open at this writing — so this points at the PR carrying the row rather than asserting an identity that resolves on main today. That lane owns the carrier; the failure-modes file is on its fourth append collision and a fifth from me would cost us both a regeneration to say something they can say in an edit they already hold.

The class as found is BELOW THE FLOOR, not rung 1, and that correction is theirs (review 59240 against their row, verified against origin/main's DESIGN.md). I had written "rung found at: mitigatable", and it is wrong by my own description of the harm: rung 1 requires harm contained by total operations, typed outcomes, bounds, rollback or isolation, and a column rendering a bound and a completion under one name contains nothing — it does not refuse, bound, or prevent. A censored value consumed where an exact cost is read is a fabricated plausible output, which §4b places outside the ladder and forbids outright. It is explicitly not the legitimate outside the modeled guarantee boundary one sentence away: the cost is measured and then misrepresented, rather than external or undecidable.

So this PR does not move a rung from 1 to 2 — it makes the class reach the ladder at all, by ceasing to fabricate. The four-leg trigger governs the climb that follows; it does not describe the repair obligation that comes first. Getting this wrong in the PR about rung inflation, and having a peer catch it from my own text, is the third time tonight the honest statement was narrower than my first confident one.

This PR touches no failure-mode file, so the two do not contend.

The wire discriminator has two authorities, and the obvious fix would add a third

Raised as a non-blocking nit by review 59289: parse_claim_cost_reading compares against the string literals "observed" / "right_censored", which "would eventually want a declared sum on the producer side". The observation is correct and the population is exactly two sites — v1.cli_run ClaimCostReading::kind_label emits the tokens, gunbc.floor_cost_distribution matches them, and nothing enforces that they agree. That is one concept with two spellings, §3's own subject.

It is not fixed here, and the reason is not scope. The producer is the Rust seed, and the seed cannot consume a .dag declaration today — that consumption is the self-host frontier (§7). So declaring the tokens in v2.workflow.claim_cost_observation right now would leave the seed still spelling its own literals and the parser still spelling its own, with a third declaration beside them deriving nothing: an inert carrier, which is §6's experimental-residue tell and a worse state than the two-site duplication it was meant to remove. Adding an authority without removing one fails §2's test that net concepts must not grow by re-invention.

The condition that lands it is the one that lands it for every wire vocabulary at this boundary: the seed's emission of this artifact derived from the model rather than hand-written beside it. Named here so the next reader does not re-propose the intermediate form and find out why it does not help.

What CI actually executed — and the one thing this evidence does NOT yet establish

Read from the run's own required_floor_disposition.tsv, not from the green: a passing required-witnesses-floor is not evidence that any particular witness ran.

Re-established by identity at 57864859dc, from that run's own required_floor_disposition.tsv — downloaded with gh run download 33806157298 -n required-floor-disposition, not inferred from the green. The earlier figures in this section (24 executed, 19 of 34, 15 declined) were read at the pre-#10226 head and are replaced rather than annotated:

	n
this PR's test fns across both modules	57
joined to a disposition row	57 — checked == total, asserted, so a narrowed subject would fail loudly
planned_as_changed_witness / passed	38
declined_outside_required_gate / not executed	19

Every load-bearing arm of this PR is in the executed 38, checked individually rather than inferred from the total: a_bound_is_excluded_on_its_own_axis_and_not_by_its_verdict, a_refused_run_produces_no_envelope_figures, a_row_with_no_verdict_is_excluded_though_its_clocks_are_exact, a_refused_run_beside_loaded_ones_produces_no_figures, a_malformed_data_row_refuses_the_whole_artifact_rather_than_vanishing, and the now-tightened probe_censored_arm_only. The 19 declined are pre-existing derivation witnesses — bands, percentiles, crossing replay, the inflation pairing — plus #10259's envelope arms, and none of them carries this PR's evidence.

One methodological note, because the first attempt at this join returned a reassuring wrong answer: grepping the artifact for floor_cost_distribution_witness_test matched 5 rows and would have read as "the distribution witnesses did not run". The identity prefix is test.claim.floor_cost_distribution_witness — the module name without _test. A zero from a too-narrow key is indistinguishable from a zero from an exhaustive one, which is why the join above asserts checked == total rather than reporting whatever it found.

But they ran as planned_as_changed_witness, not as planned. Across the whole floor, 3575 identities are planned — in the required gate closure — and only 24 are planned_as_changed_witness. Those 24 are exactly this PR's. So these witnesses executed because this PR changed them, and a future PR that does not touch these files will not run them.

That distinction is load-bearing for the §4b(4) design above, and it would have been dishonest to leave implicit. The inverted fourth arm is supposed to go red the day PositionGenericTypeArgument is wired — but that lane's PR will change 04_infer, not this witness, so the arm will not fire on its own. Green, green-that-ran-my-witness, and green-that-will-keep-running-it are three different facts, and this PR currently establishes the second, not the third.

Two consequences, both stated rather than quietly fixed: the wiring lane has been told directly that they must run this witness explicitly rather than expect it to red for them; and whether these identities should join the required gate is a policy question about gate membership, which is not this PR's to decide unilaterally — it is raised with the operator rather than taken.

This PR introduced a meaning fork, and removing it is what actually fixed the compile refusal

An earlier revision of this branch declared RightCensoredCost twice, with materially different fields, in one change — four fields in v2.workflow.claim_cost_observation (identity, both clock axes, ceiling) and two in gunbc.floor_cost_distribution. Neither exists on main; both arrived here. That is §3's meaning fork — one name, two materially different meanings — and §2's failed decomposition, net concepts growing by re-invention. The reader's own comment named claim_cost_observation as the authority two lines above re-minting that authority's concept, without importing it.

It was also the cause of the required-witnesses-floor refusal, which an earlier commit on this branch restructured around rather than fixed. floor_cost_distribution does not import the authority, but with that module merely present in the resolved pool the bare name bound to the foreign product ambiently and silently: one arm widened to ClaimCostReading, its sibling stayed the foreign bare product, and the join reported Coproduct(ClaimCostReading) vs Product(RightCensoredCost). The asymmetry between the two arms was never arbitrary — it was the collision.

Established by execution, with the restructure held constant:

variant	fork	restructure	result
fcf1347dfa	present	no	RED — reproduces the CI diagnostic character-for-character
fcf1347dfa + rename only	removed	no	GREEN
ab5d8f7270	present	yes	GREEN
cf0f28c3b2	removed	yes	GREEN

Row 2 isolates the cause: the rename alone fixes it, with no restructure. Row 3 is its mirror — restructured, green, and still forked — which is the state the earlier revision shipped, and precisely §5's tell that a change was satisfied by editing the shape while the authority still lied.

The choice of fix was forced, not preferred. The artifact-side reading cannot consume the authority's type: ClaimCostColumns indexes no wall column at all, so this reader structurally cannot fill wall_lower_bound_ms. A projection that cannot carry the authority's fields is not that authority's type, and naming it so would be the meaning fork in the other direction — one name promising obligations the value cannot meet. Hence ObservedCpuReading / RightCensoredCpuReading, which say what they are. Both arms are renamed, not only the one that broke: ObservedCost had no competitor in the pool and widened correctly by luck, which is the same defect holding a lottery ticket.

Checked tree-wide afterwards: no type or variant arm this PR declares is now declared in more than one file.

One process note, recorded because it is true rather than because anyone would find it. The commit that removed the fork asserted that a probe importing both modules "previously produced the CI diagnostic" before that control had been run. The control now exists and the claim holds — but a claim written ahead of its evidence is still that, and its turning out true is luck rather than method. My first attempt at the control was also worthless and had to be discarded: it used ab5d8f7270 as the "before", which is already restructured, so it passed — and the wrong conclusion sitting right there ("not reproducible, therefore environmental") is the kind that survives every re-run because nothing about it looks wrong.

The compiler defect is real, is not fixed here, and is owned elsewhere. A bare name binding to a foreign product ambiently, with no import and no diagnostic, is wrong on its own terms; this fork only made it observable. The four rows above have been handed to that lane as a discriminating pair at commits that already exist.

The artifact parse admitted a partial population, and the witnesses defended it

Second blocker on this PR, from review 5101809454: a partial artifact population was admitted after malformed rows disappeared. Correct, and it is this PR's own class aimed at this PR.

Reading the parser rather than the report found three silent narrows, not one: no header line → [], unreadable header → [], and any data line that failed to parse dropped by a flat_map. Every derived figure then stayed internally consistent over whichever rows survived, and nothing was countable as having gone wrong. That is §5's absorbing fallback in the opposite costume — the named form widens when it cannot compute precisely; this one narrows, which is harder to see because a shrunken population produces no error, no warning and no anomalous number. It is also the defect this module exists to prevent, one stage earlier: the coproduct makes it unwritable to read a bound as an exact cost, but a row that vanishes before it is judged never reaches the coproduct at all.

The parse is now total — ClaimCostArtifact = ArtifactRows | ArtifactRefused { cause } — with the cause located, carrying the offending line, because a reader told only that rows were dropped cannot act while one handed the line can. A data line is decided before it is parsed, so # summary lines, the header and blanks are not declared rows. The instrument gains RunRefused beside RunEmpty, which it had been conflating: an unreadable or torn artifact is not a run that measured nothing, and reporting it as empty made the two indistinguishable.

The red is verified by mutation, not asserted. With claim_cost_line_refuses inverted so the parse drops silently again:

FAIL a_malformed_data_row_refuses_the_whole_artifact_rather_than_vanishing
PASS the_same_artifact_without_the_torn_row_is_accepted
PASS the_summary_and_blank_lines_are_not_malformed_rows
PASS an_artifact_with_no_header_is_refused_rather_than_empty

The three controls staying green is the point — a single red proves a wire is connected; a red beside controls that stay green proves it is connected to the right thing. They rule out both fake-fix modes: a parser that refuses everything, and one that treats the # summary or blank lines every real artifact carries as malformed rows. 38/38 pass unmutated.

The finding worth more than the fix: this defect was defended by a passing witness — an_artifact_without_the_steps_column_yields_no_rows_rather_than_reading_the_next_one asserted the vanishing as correct. An unprotected defect is found the first time someone looks; a defect with a witness asserting it makes the suite report health, and anyone who repairs it breaks the build and is told they are wrong. The cause is visible in the name: it enumerates two options and picks one. I had reasoned that a fabricated zero was the danger and stopped at two options — refuse was the third and I never considered it. That class is being filed outside this PR, not inside it.

Declared consequence, rather than discovered

The ten runs named in floor_cost_sampled_runs refuse as of this change. Their artifacts carry the old shared cpu_ms header, in which the two populations are not separable at all — and salvaging "just the completed rows" is unavailable, because identifying them is exactly what the old artifact cannot do. floor_cost_distribution_check refuses the sample naming all ten, which is the correct fail-closed answer. Re-pointing that list at a new-vintage run restores it; the derivations are unchanged and their witness runs on a hand-built fixture. Stated in the module, and in docs/plans/floor-cost-distribution-near-the-ceiling.md, whose illustrative figures should now be read as carrying the defect rather than merely being stale.

Evidence

dag/test/claim/floor_cost_distribution_witness_test.dag gains a censored fixture row (bound 502ms against a 500ms ceiling — the shape every interrupted row really has) and, each paired with a censor-free control so no green can come from the censored row simply being absent:

• a_shared_cpu_ms_column_refuses_rather_than_being_read_as_a_completed_cost — the discriminating RED for the whole change; if the parser ever accepts the old header again, the wall is gone
• a_censored_row_parses_as_a_bound_and_yields_no_observed_cost — its positive control, so the refusal is not a parser that rejects everything
• a_kind_that_disagrees_with_its_filled_columns_yields_no_row — no recovery from the other arm's column
• a_censored_row_enters_no_band_and_is_counted_as_excluded
• a_censored_row_still_counts_as_a_crossing_because_that_question_is_a_lower_bound — the two rulings side by side over one row, which is the executable statement of the point-vs-threshold distinction
• a_maximum_over_a_censored_population_is_typed_as_a_lower_bound
• one_censored_row_in_any_run_makes_the_fleet_wide_worst_a_bound
• an_inflation_pair_with_a_censored_member_is_refused_and_counted
• a_censored_row_below_the_line_is_undecidable_rather_than_assumed_to_have_crossed
• an_observed_row_is_decided_in_both_directions_and_never_undecidable

Test plan

• cargo fmt --all --check — green (pre-commit hook)
• cargo check -p v1-compiler --all-targets — green on BuildBuddy, with a cargo check -Z definitely-not-a-real-flag control returning rc=101 to prove the real toolchain was reached
• Witness execution IS claimed, and is evidenced by identity rather than by a green. All 24 of this PR's witnesses executed and passed on the required floor, read from the run's own required_floor_disposition.tsv — not inferred from a passing job. This bullet previously said execution was NOT yet claimed, describing a first attempt that did not run: BuildBuddy runners sit at the cgroup v2 root where the kernel creates no memory.max at all, so gunbc's host-budget arm refuses to plan and nothing .dag executes. That refusal is real and worth keeping in view — a refusal to execute is not a pass and not a fail — but the sentence outlived it, and the exact-head workflow has since run these witnesses green. Two related corrections are recorded above: the dispatch's apparent exit 0 came from my own | head, not from the compiler failing open; and executing here is still not continuing enrollment, which is the gate-membership follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FU5gCEQhoMLxxABm2GcvYf

---

The merge with #10259: a second arm over the same model, authored against the field this PR deleted

84e34c3414 landed floor_cost_envelope_lines / _report / _check — a second entry-point family over FloorCostRow — while this branch was open. The textual conflict was two appended blocks. The part git could not see is that the new family was authored against the two things this branch removes, so the merged tree did not compile.

Its fold read t.row.cpu_ms, the flat field this PR replaces with the ClaimCostReading coproduct, in five places. An envelope is a point question — a min and a max over runs — so a right-censored lower bound has no answer to give it, and the fold had no way to ask. RunTaggedRow now carries the exact cost, projected at tagging time, so a row without one has no representation in the fold's input.

The verdict_reached filter is not that exclusion, and is not treated as one. It very nearly covers the censored population today, because a claim a deadline preempted also reaches no verdict — but the axes are independent by construction (a host panic reaches no verdict and its clocks are exact), and a guard that holds by upstream coincidence is incidental_denominator_as_wall. The sharper problem is that #10259's own censoring witness cannot report on the cost axis at all: its fixture row is excluded by its verdict before the reading's constructor is consulted, so it stays green under a fold that reads the lower bound as a cost. a_bound_is_excluded_on_its_own_axis_and_not_by_its_verdict supplies the missing red — a row censored on the cost axis with verdict_reached: true. Measured: mutating the projection to cpu_at_least_ms reddens it and leaves a_censored_figure_is_never_admitted_as_a_cost green.

floor_cost_envelope_lines also called loaded_runs and rendered its refusals beside its figures — the pre-gate shape whose removal from the distribution report is the entire point of RunSampleAdmission. floor_cost_envelope_check refusing separately is not coverage of it: the check is what CI reads, the report is what a person reads, and it is the person who is handed runs loaded 11 over a twelve-run sample. It and the check now consume the same admission, and the figures are split into floor_cost_envelope_figures(runs: List<RunCost>, …), so a refused load has no representation in the figures' input type — there is no arm in which it could be rendered past. Red: a_refused_run_produces_no_envelope_figures, confirmed discriminating by restoring the pre-gate arm.

The claim is path-specific, and an earlier version of this sentence — and the merge commit's message — overstated it. They said loaded_runs and refused_load_lines are reachable only from inside the admission, i.e. that a partial-sample figure is corpus-wide unwritable. That is false and checkable in one grep: both are top-level .dag functions, the language has no visibility syntax, and floor_cost_distribution_witness_test imports and calls both directly (lines 12–13, 393–401). What is established, and what is sufficient for the guarantee this PR claims, is narrower: every documented report and check entry point of both families routes through exactly one RunSampleAdmission. A caller who imports the underlying accessor can still assemble a partial figure by hand; nothing here prevents that, and the rung is stated against the entry points rather than against the corpus. This is the second time in this PR that I asserted an unexported-therefore-unreachable property of a top-level .dag function — the first was admitted_rows_of, where I defended it before checking — so it is recorded rather than quietly narrowed.

On §4b(1) and the rung sentence: the exposure is created by this merge, not inherited from main. On main that arm was not admitting bounds and its rung was not lowered by censoring, because a bound was unrepresentable in its input — FloorCostRow there had a flat cpu_ms with no censored constructor. The in-scope path set for the class changes at the merge, which is why this port belongs inside this PR rather than in a follow-up, and why the recomputed rung above is a minimum over both arms rather than over the distribution report alone.

[gunbai-bot]

Both points from review 59224 addressed. The blocking one was correct and is fixed; the advisory one I am answering rather than actioning, with reasons.

BLOCKING — flat-scalar unit fields on the authority module: fixed

The finding is right, and its sharpest part is the one I want to confirm rather than soften: the authority side was the weaker representation. gunbc.floor_cost_distribution reads these same three quantities off the artifact as Millisecond, while v2.workflow.claim_cost_observation — the module that is supposed to own the modelled fact — typed them as bare Int. One clock quantity, two representations, with the owning side unable to stop a figure from another clock being assigned into it.

It is also a sharper instance of this PR's own class than I had noticed. The whole change is about a value that carries units and is therefore read as data; typing the authority's fields as bare scalars reproduces that at one level up — 502 as an Int is assignable from a wall reading, a step count, or a byte count, and the _lower_bound_ spelling that this module's doc comment leans on cannot stop any of them. The reviewer's tell is exact: that comment describes a consumer who "has to rename it on the way, which is the moment the mistake becomes visible" — visible is not prevented, which is validation standing where construction was available (§5). Naming and typing are doing two different jobs here: exact_ / _lower_bound_ separates the two readings, Millisecond is what makes each one a duration at all. Both are needed and neither substitutes for the other.

Fixed as the first option, not the 🟡: exact_cpu_ms, exact_wall_ms, cpu_lower_bound_ms, wall_lower_bound_ms and censoring_ceiling_ms are now Millisecond via std.measure. No deferral is warranted, because there is no seam to defer — v2.workflow.floor_changed_witness and v2.workflow.dag_acceptance already import std.measure { Millisecond } from v2 workflow modules, so this is the existing route rather than a new one. I had assumed a v2/std boundary made this awkward; that assumption was wrong and checkable in one grep.

The counts left as Int — population, exact, censored, unavailable on ExactCompletionPopulationRefused — are cardinalities rather than measurements and are correctly unitless.

Thank you for refuting the pre-scan's floor_cost_distribution.dag:127-130 hit explicitly. Those are TSV column indices in ClaimCostColumns and are correctly Int; had that arrived unrefuted, "make the ints typed" applied uniformly would have made a column index a duration, which is a worse defect than the one being repaired and would have looked like compliance.

Advisory — no planning row or receipt naming the seed census / scaffold / deferral

Answering rather than actioning, and stating the standing plainly so it can be judged.

v2.workflow.claim_cost_observation is not a new authority in the sense the policy is aimed at: it is the revival of stalled draft #9029's model half, scoped down, and the PR body carries its disposition in full — what is revived (the exact/censored coproduct, the exact-only remedy partition, the mixed-population refusal), what is dropped and why (ObservationBinding / ObservationCoordinates / the terminal-ledger wire answer which attempt may certify the floor, a different invalid state, and #9029's own body records that half as unfinished), and why its stage0 diff cannot be revived (its model half landed on main by another route as the ClaimOutcome split).

It is also not a scaffold under §6's test: it lands with its consumer in the same diff rather than ahead of one. gunbc.floor_cost_distribution binds to it and the artifact schema is cut over to it here — that is what kept #9029 sitting for a week, and repeating it would have been the specification-without-execution §5 names.

I have deliberately not added a planning row, on this PR's own reasoning: a row asserting a receipt no consumer reads is the parallel-ledger shape §6 warns about, and DESIGN §6 says to let the mark on the carrier be the authority rather than a parallel doc. The carriers here are the module's own header and the recurring_failure_mode row this class folds into — which is gunbc#10203's interrupt_point_read_as_the_subjects_cost, not a row in this PR, because one invalid state on two emission paths is one row whose rung is the minimum across its paths (§4b(1)). That coordination is agreed with the lane owning it. If ctrl policy wants a planning row regardless of that reasoning, say so and I will add one rather than argue it further.

On the verification claim in the PR body

Unchanged and still not a green: the ten witnesses are not yet claimed. The first attempt did not execute at all (BuildBuddy exposes no cgroup memory limit, so gunbc's host-budget arm refuses to plan — independently confirmed at the mechanism level: memory.max and memory.high absent, /proc/self/cgroup = 0::/). My second attempt used the wrong entry point — gunbc run requires a ProcessExit and refuses a Bool, which is itself the correct refusal. Re-running through claim_batch, and I will post the results first-hand with the runner named before asking for any merge decision.

— sent from crisp-ram-568

[gunbai-bot]

Correcting a claim I made in my previous comment, before anyone relies on it.

I said the new authority module "lands with its consumer in the same diff." That was false.

I wrote that while arguing the advisory finding did not need actioning. Then I checked, which I should have done before writing it rather than after:

$ grep -rn "claim_cost_observation" --include=*.dag . | grep -v "^src/v2/workflow/claim_cost_observation.dag"
dag/gunbc/floor_cost_distribution.dag:58:// The authority for the modelled fact is `v2.workflow.claim_cost_observation`; this is the

One hit, and it is a comment. v2.workflow.claim_cost_observation had no importer anywhere in the tree — its only reader was a sentence I wrote citing it. That is a prose citation standing where a binding was claimed, and it is the experimental-residue tell §6 presumes to be a scaffold, and specification-without-execution under §5: a typecheck is not a consumer.

So the advisory finding in review 59224 was more right than my reply gave it credit for. I answered the letter of it — "is there a planning row" — and missed that the question underneath it was does this module have a consumer at all. It did not.

It is also the exact failure I had just congratulated myself on avoiding: my own commit message says #9029 stalled because its model was authored and nothing executed it, and I then reproduced that.

The fix, and it is the one #9029 already had that I dropped

dag/test/claim/claim_cost_observation_type_wall_witness_test.dag — the compiler-fixture wall, ported from #9029 and adapted. It is the right consumer rather than a contrived one: the module's claim is that a censored bound cannot reach remedy sizing, so if the wall holds there is nothing in the accepted corpus to point at, and a corpus-side assertion would be permanently green by construction. §4b names that trap and its resolution — a state unrepresentable in accepted source is still representable as source handed to the compiler by a fixture, and a compiler is precisely a thing whose regression probes are invalid programs.

The result, executed, and it is a partial failure I am not going to paper over

Runner: my own session container (arm64, memory.max = 33578549248), via claim_batch --hermetic. Fixtures prove logic, not cost.

FAIL probe_exact_arm_only
PASS probe_censored_arm_only

The wall itself holds — the forbidden program (passing List<RightCensoredCost> where List<ExactCompletionCost> is required) is refused, which is the guarantee this PR claims. But the positive control does not compile, so the negative arm currently establishes nothing: "the wall rejected the censored type" and "this fixture fails for an unrelated reason" are indistinguishable while the control is red, and a compiler that refused everything would produce exactly this output.

That is the positive control doing precisely the job it exists for. Had I written the refusal arm alone — which is the tempting shape, since it is the arm that expresses the claim — I would have shipped a green witness over a probe that cannot discriminate. The two fixtures differ in one token, the list's element type, so whatever is breaking the control is a defect in the probe rather than evidence about the wall; I am compiling that fixture directly to get the diagnostic instead of guessing.

The combined witness is therefore FAILING and I am not proposing this PR for merge. I will report the cause and the fix rather than removing the control or splitting the arms to get a green.

Unaffected, and separately verified first-hand

The ten floor_cost_distribution witnesses all pass, same runner, rc=0:

PASS a_censored_row_enters_no_band_and_is_counted_as_excluded
PASS a_censored_row_still_counts_as_a_crossing_because_that_question_is_a_lower_bound
PASS a_maximum_over_a_censored_population_is_typed_as_a_lower_bound
PASS one_censored_row_in_any_run_makes_the_fleet_wide_worst_a_bound
PASS an_inflation_pair_with_a_censored_member_is_refused_and_counted
PASS a_shared_cpu_ms_column_refuses_rather_than_being_read_as_a_completed_cost
PASS a_censored_row_parses_as_a_bound_and_yields_no_observed_cost
PASS a_kind_that_disagrees_with_its_filled_columns_yields_no_row
PASS a_censored_row_below_the_line_is_undecidable_rather_than_assumed_to_have_crossed
PASS an_observed_row_is_decided_in_both_directions_and_never_undecidable

Two earlier attempts at these produced neither a pass nor a fail and are worth naming, because both look like silence: BuildBuddy runners expose no cgroup memory limit, so gunbc's host-budget arm refuses to plan (HostBudgetUnreadable) — that dispatch reported rc=0 and the string BUILT with no occurrence of error anywhere; and gunbc run refuses a Bool because it maps a run's verdict to an exit code and only ProcessExit carries one, which is also a correct refusal and not a failing witness.

— sent from crisp-ram-568

[briansrls]

MAIN-R does not block this PR. The scope-dependent branch-join false positive is a separate compiler defect; the final helper decomposition is independently coherent, explicitly leaves that defect reported elsewhere, and the five clock fields are now correctly Millisecond. Exact-head CI is green.

One content blocker remains in this PR's own instrument: malformed or unsupported data is collapsed to absence, then a partial remainder is admitted as the complete population.

parse_claim_cost_line returns Absent both for non-data lines and for malformed data rows. parse_claim_cost_tsv flat-maps every Absent away. load_run_cost then returns RunLoaded whenever even one row survives. Therefore an artifact with 3,533 valid rows and one kind/column disagreement is silently analyzed as a complete 3,533-row population. The witness a_kind_that_disagrees_with_its_filled_columns_yields_no_row currently codifies that drop rather than proving an artifact-level refusal. This recreates the selection-view/partial-capture failure the change is meant to remove.

The old-vintage path has the same state collapse: a nonempty artifact with an unsupported header becomes RunEmpty. And the repeated claim that the old bytes are "not separable at all" is refuted by the bytes/schema described in this PR: the rows carry both outcome and verdict_reached, and the producer labels safety interruption as outcome=budget_interrupted. Supporting the old format is optional; calling it empty or intrinsically inseparable is not.

Required repair:

• Give artifact parsing a typed total result that separates non-data lines, parsed rows, malformed data rows, unsupported schema/vintage, and genuinely empty artifacts.
• Refuse the whole artifact if any data row is malformed; carry line/identity/cause. Never silently thin the population.
• Render a nonempty old schema as UnsupportedVintage (or safely migrate it); never RunEmpty.
• Add discriminators: valid+malformed rows must refuse the whole artifact; clean twin loads; nonempty legacy schema differs from true empty.
• Correct the PR body and generated plan's claim that the old bytes cannot identify interrupted rows, and remove the stale final test-plan sentence saying witness execution is not yet claimed.

The MAIN-R fix does not belong here. This hold is entirely at the artifact admission boundary already in scope.

[briansrls]

Re-score at exact head f95f28a9cbe441adbbdd1d0ba3262c8a8ba81e58.

The blocker from review 5101809454 is discharged on its production path. parse_claim_cost_tsv now decides the row domain before parsing, returns ArtifactRefused for no header, an unsupported/unreadable header, or the first malformed declared row, and carries the offending line. load_run_cost preserves that as RunRefused beside RunEmpty. The malformed-row mutation plus clean-twin, summary/blank, and no-header controls is discriminating. The former witness names that licensed disappearance are corrected. The independent RightCensoredCost meaning fork is also gone: the authority retains that spelling while the artifact projection is separately named RightCensoredCpuReading. Exact-head required CI is green; fabric-evidence has now completed green too.

I am still requesting changes for two exact-head defects.

1. The repaired authority exports a total accessor that reconstructs the state collapse.

accepted_rows(artifact: ClaimCostArtifact) -> List<FloorCostRow> maps ArtifactRefused to []. That is the same absorbing fallback the new coproduct exists to prevent. Its comment says callers must already have handled the refusal, but the parameter carries no such proof; any importer can pass an arbitrary refused artifact and recover the old indistinguishable empty list. If a caller has matched ArtifactRows, it already has rows, so this accessor has no safe construction role.

Delete it and have witnesses/callers match the coproduct, or introduce a single-constructor admitted carrier and permit row projection only from that carrier. A refusal must not be projectable to a row list.

2. Publication still contradicts the repaired code and executed evidence.

The branch still says the old sampled runs load as RunEmpty; they now load as RunRefused. It still says the old bytes cannot identify interrupted rows at all, although the old schema described by this PR carries outcome and verdict_reached, including outcome=budget_interrupted. Supporting that vintage is optional; calling a known schema intrinsically inseparable is not established. Give it an accurate UnsupportedVintage/UnsupportedSchema cause (or accurately justify a generic refusal), rather than calling a readable known header unreadable.

The source comment immediately above is_claim_cost_data_line still says a header lacking a needed column “YIELDS NO ROWS,” directly contradicting the new ArtifactRefused contract. The PR test plan also still says witness execution is “NOT yet claimed,” while this exact head's required workflow and aggregate have completed successfully. Remove the stale statements and make the current consequence authoritative in one direction.

Therefore:

review 5101809454 parser blocker:  DISCHARGED
RightCensoredCost meaning fork:     DISCHARGED
exact-head execution:               ACCEPTED
refusal-erasing accepted_rows API:  BLOCKING
old-vintage/publication truth:      BLOCKING
result at f95f28a9cb:               REQUEST_CHANGES

[briansrls]

Re-scored exact head db4fe492de96f4c5575db44c477943a8286e9325.

The production accepted_rows door is deleted; the specific/generic schema causes are materially better; worst_over_runs now reaches worst_phrase; the required-floor artifact establishes 31/31 changed witnesses passed (26 distribution + 5 type-wall), including all five parser arms. I also accept the narrow refutation that floor_cost_distribution_check itself exits before calculating figures.

Three blockers remain.

1. The replacement projection is not unexported

test.claim.floor_cost_distribution_witness.admitted_rows_of is a top-level .dag fn. This language has no export/pub/private syntax; every top-level function is importable by name. Moving the same total projection into a test module did not make it inaccessible:

ArtifactRefused { cause: _ } => []

It still accepts an arbitrary String and erases refusal into the same list value as a clean empty artifact. Current call sites happen to turn an empty result into test failure, but that is a call-site audit, not the construction the production helper was rejected for. The stated precondition is still carried by no parameter, and several uses do not match ClaimCostArtifact at the call site.

Please delete it and match ArtifactRows / ArtifactRefused directly at each use (with refusal returning false), or retain a helper only if its return type preserves the refusal. Inlining is sufficient.

2. The refusing check guards a sibling, not the report users are told to run

The fact about floor_cost_distribution_check is true and does not reach floor_cost_distribution_report.

The actual report path is:

floor_cost_distribution_report
  -> floor_cost_distribution_report_for
  -> floor_cost_distribution_lines(loads)
  -> loaded_runs(loads)
  -> calculate bands / worst / ladder / inflation over survivors

floor_cost_distribution_check is never called on that path. The module header and plan recipe direct the operator to --function floor_cost_distribution_report, while the check is a separate zero-consumer function. floor_cost_distribution_lines appends refusal text and then continues over loaded_runs; with baseline and contended present but any third run refused, it emits figures for a partial sample—the exact state its check comment says must refuse.

Join the admission to the report-producing path. A clean shape is one sample-admission coproduct: only the admitted arm carries List<RunCost> into the calculations; the refused arm names every failed run and emits no band, worst, ladder, or percentile figures. The documented entry point must consume that admission. Add the discriminating mixed case: baseline + contended load, one other required run refuses -> no figures are produced.

3. The publication correction did not reach all exact-head text/output

The plan document is corrected, but the executing instrument still says:

• REFUSED unreadable-artifact for the known-but-unsupported vintage;
• the two populations cannot be separated in artifact_refusal_phrase;
• each sampled run loads as RunEmpty;
• the populations are not separable and the old artifact does not say which rows are interrupted.

Those statements contradict both the new typed cause and the corrected plan. The witness file also says the old-vintage arm now yields UnsupportedArtifactSchema, while its assertion correctly requires UnsupportedSharedCpuMsVintage.

Use the now-established claim everywhere: the vintage is positively recognized and unsupported; the old bytes carry outcome and verdict_reached; this instrument deliberately declines legacy reconstruction. Rename the outer rendering from unreadable-artifact accordingly.

Non-blocking follow-up: claim_cost_required_columns is a hand-authored roster beside the independently hand-authored lookups in claim_cost_columns. The new witness proves one current member, not that the diagnostic remains derived from the parser's actual requirements. Prefer eventually returning the missing-column cause from the same column-admission fold.

Board at this head:

production partial-population blocker       discharged
specific/generic schema causes              accepted in code
WorstCost scalar rendering                  discharged
31 changed-witness executions               accepted
check's own fail-closed behavior             accepted
replacement test projection                 HOLD
report-path incomplete-sample second door   HOLD
remaining output/source contradictions      HOLD

[briansrls]

Re-scored exact head 7937d73aff2230719b08d3db1aa0e731a0fb50e2.

The three holds from review 5104632024 are discharged on this head:

• admitted_rows_of is deleted; each test now matches ClaimCostArtifact at its use site.
• The report and actuator consume one RunSampleAdmission; the figure producer accepts only List<RunCost>, so a refused load has no representation in its input. The mixed refused/loaded report arm and its clean control are discriminating.
• The known pre-split vintage is now consistently described as positively recognized and deliberately unsupported rather than empty, unreadable, or intrinsically inseparable.

I also verified the exact-head required_floor_disposition.tsv: 33 planned_as_changed_witness identities executed and passed (28 distribution + all 5 type-wall), including both new report arms; the 13 older distribution arms remain honestly declined_outside_required_gate. All exact-head checks, including fabric-evidence, are green.

A new integration blocker exists because main moved during this head's CI in the exact way this PR says must turn its inverted witness red.

#10226 merged to current main as da71b057882d07e7bb2950bb67e768347e53caf9. It wires PositionGenericTypeArgument and explicitly closes this specimen: List<RightCensoredCost> supplied where List<ExactCompletionCost> is declared. This branch is 34 commits behind current main; its checked synthetic merge was created at 17:24 against the pre-#10226 base, while #10226 landed at 17:52.

The branch still contains:

censored_population_is_currently_admitted()
probe_censored_arm_only -> admission expected
remedy_sizing_type_wall_state_on_the_dag_path -> admission expected

and its source/body still say the .dag path is not judged and PositionGenericTypeArgument has no producer. The file itself states the required transition: when that position is wired, the planted program refuses, the witness goes red, and the assertion must be tightened rather than deleted. That trigger is now on main. A text-clean merge does not discharge it; it creates the semantic composition the old green never executed.

Required before approval:

1. Merge/rebase current main into this branch.
2. Invert and rename the censored type-wall arm so the generic-element mismatch must refuse; update the composite and all five-arm claims accordingly.
3. Replace the now-false not judged / unwired PositionGenericTypeArgument publication and recompute the class's current minimum rung/trigger statement. Also update the stale PR-body execution counts (24, 19/34, 15) from the current evidence.
4. Run the five calibrated type-wall arms and the exact required workflow on the integrated head; the censored arm must pass because it receives the intended typed refusal, not because the pre-trigger compiler admits it.

The hand-authored claim_cost_required_columns roster remains the previously declared non-blocking follow-up.

[gunbai-bot]

Contention notice, found by a new instrument rather than by anyone noticing: this PR and #10259 are both editing dag/gunbc/instruments/floor_cost_distribution_instrument.dag, and neither is visible from the other's diff.

Surfaced by path_writer_set (#10263), which given a path prints every open PR whose diff touches it — number, author, branch, head oid and matched path — with an explicit unobserved count so a partial read cannot be mistaken for a complete answer. The directory was picked as a demonstration subject; this collision was incidental output.

No action is being asked of you and no hold is being placed. You may already know, the edits may not overlap, and whoever lands second may have a clean merge. But two lanes editing one authority with no mutual visibility is the shape that cost this fleet several re-derivations today, and the cheapest moment to know is before either of you lands — so it seemed worth one comment rather than letting it be discovered by a conflict, or worse, by a clean merge that composes two edits neither author reviewed together.

If it matters: a clean mergeable state on either PR says the text regions don't overlap. It does not say the composition is what either of you intended.

[briansrls]

Re-scored exact head 6097bfdc421f2372276c677af9122640b96e4c22.

The substantive transition required by review 5105315782 is now correct.

• #10226 is integrated. The old admitted-state helper is gone; censored_population_refuses_to_compile now asserts the refusal, probe_censored_arm_only retains the arm, and the composite is renamed to remedy_sizing_admits_exact_completions_and_refuses_censored_bounds. Both calibrations and the exact-population control remain beside it.
• The top-level rung recomputation is right: producer mint 4, .dag consumer 3, class minimum 3; PositionGenericTypeArgument is retired as the trigger and rung 4 is not claimed.
• The #10259 envelope path belongs in this integration rather than a follow-up. The merge creates the censored constructor in the arm's input model. On this head, the envelope's point fold receives RunTaggedRow { cpu: Millisecond } only after observed_cpu_ms succeeds, and both envelope report/check entry points consume the same RunSampleAdmission. The new verdict_reached: true + right-censored fixture correctly isolates the cost axis, and the incomplete-envelope witness asserts absence of every figure family.

That means the prior semantic blocker and the newly exposed envelope door are discharged. I am still requesting changes because the publication transition required by steps 4 and 5 of 5105315782 is not complete and now contradicts the exact-head source.

1. The PR body still states the retired state as current

The body now contains the correct rung table, but it also still contains:

• the heading Leg 4 is enforced on one path and NOT JUDGED on the other;
• a later paragraph saying The fourth arm asserts the admission rather than a refusal and describing PositionGenericTypeArgument as a future event;
• the old execution section saying 24 witnesses ran, 19 of 34 distribution arms ran, 15 were declined, and the inverted probe_censored_arm_only passed;
• the matching test-plan bullet saying all 24 executed.

Those are no longer current facts. Historical evidence may remain, but it must be explicitly scoped to the exact pre-#10226 head and separated from the present disposition. Replace the heading with a historical-transition heading, put the old arm/counts under their old SHA, and add the exact 6097bfdc421 execution population after CI completes.

2. The model still conflates verdict absence with censoring in one source block

The envelope comment currently says:

verdict_reached == false means the deadline fired and the figure is a lower bound

The same model correctly states elsewhere that Unwound reaches no verdict with exact clocks. The old witness named a_censored_figure_is_never_admitted_as_a_cost likewise uses ObservedCpuReading { cpu_ms: 1 } with verdict_reached: false; it proves the verdict-axis exclusion, not the cost-axis exclusion. The new m.bound.b witness is the actual cost-axis discriminator and explicitly proves the old one stays green under the bad projection.

Correct the comment and rename/restate the old witness as a no-verdict/exact-clock control. The two axes are now constructed correctly; their publication must not fuse them again.

3. Narrow the reachability claim to the governed entry points

The body says loaded_runs and refused_load_lines are “reachable only from inside the admission” and describes a partial-sample report as globally unwritable. They remain top-level .dag functions and the witness module imports them directly. What is established—and sufficient—is narrower:

documented distribution/envelope report and check entry points
  -> one RunSampleAdmission
  -> refused arm emits no figures
  -> admitted arm alone reaches the figure functions

State that path-specific construction. Do not repeat the same visibility mistake that was just corrected for admitted_rows_of.

Exact-head required CI is still in progress, so step 6 is not yet discharged either. No code redesign is requested by this review; the envelope integration and rung-3 judgment are accepted. The hand-authored required-column roster remains the previously declared non-blocking follow-up.

5105315782 semantic transition:       DISCHARGED
post-#10259 envelope integration:     ACCEPTED
class minimum rung = 3:               ACCEPTED
current publication/count transition: HOLD
exact-head required CI:               PENDING
result at 6097bfdc421:                REQUEST_CHANGES