File the class the repair was named for: a right-censored cost read as an exact one

[gunbai-bot]

Deliverable 1 of this lane's work item, held out of #10210 all evening while recurring_failure_mode.dag was a monolith and every appending lane contended one file. #10206 made it one file per row, so this lands as its own row file plus a roster entry appended at the end — the roster is source-ordered, and sorting it would destroy the empty-diff oracle that split was checked against.

The class

An instrument stops because a policy threshold fired before the subject completed, so the figure it emits is a lower bound. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost.

What makes it invisible is that the bound looks like data — right units, right magnitude, right shape. Nothing about the value marks it as incomplete.

And its magnitude is approximately the ceiling that stopped it, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts above genuinely expensive completed rows, and a "worst observed" derived from the population describes the ceiling, not the machine. A remedy sized from it is sized against a policy constant the operator chose, wearing the authority of a measurement.

Recognition rule: wherever a cost, duration, size or count can be truncated by a deadline, budget, retry cap, page limit or timeout, ask whether the stopped case and the completed case inhabit the same carrier. If one field holds both, the conflation already happened and no consumer can undo it — the distinguishing information was destroyed at the write. The tell is a field named for the quantity (cpu_ms) rather than for the measurement's completeness, beside a separate flag nobody joins to it.

Rung, ceiling, trigger

Rung found at: below the floor — not rung 1, and the distinction is the point. Rung 1 requires harm contained by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing, and a censored value consumed where an exact cost is read is a fabricated plausible output, which §4b places outside the ladder and forbids outright. The row records that it was first filed claiming mitigatable and refused by review — the inflated reading was written by the author of the repair, inside the change that fixed it.

Ceiling: structurally impossible, because membership is decidable at the write. The instrument always knows which arm it took — it stopped the subject itself — so the distinction needs no inference at any consumer.

Next-rung trigger — the whole pairing. Each half alone is satisfiable while the class stays alive, so a trigger naming less than all four retires the row while the harm persists:

1. disjoint constructors, so a bound and a completion cannot inhabit one value;
2. disjoint wire field names, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped;
3. every arithmetic consumer requiring the exact type in its signature, so summing or ranking a bound is a compile refusal rather than a discipline;
4. a dynamic mixed population that refuses rather than filtering — because silently dropping the censored members is censored_estimator_drops_its_own_tail, the repair for one failure mode arriving as the other.

The fourth clause is the one authors omit, and omitting it converts this class into its inverse in a single edit that looks like a fix.

Boundaries

All three siblings resolve on main today, so they are cited by identity rather than described:

• Inverse of censored_estimator_drops_its_own_tail — there censored observations are excluded and the statistic is biased low; here one is included and read as exact. Opposite mistakes over the same population, and this project committed both about the same artifact.
• Distinct from window_rendered_subject_misattribution — there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all.
• A guard that excludes the censored population by a correlated proxy is incidental_denominator_as_wall, not this repair. In the specimen a verdict-absence flag very nearly separates the populations, but the axes are independent by construction — an unwound claim reaches no verdict with exact clocks. Worse, the proxy guard defeats the evidence: a witness keyed to it stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted.

Provenance

Specimen is gunbc#10210, whose construction is the repair. Projection regenerated through tools.generated_artifact_gate main_wet_one on a gunbc built from source, per the recipe gunbc.rung_drop required_gate_bankruptcy names — the diff is the row and nothing else, which also confirms main's projection was current.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FU5gCEQhoMLxxABm2GcvYf