From 151d91c8be7b3f34902eb274441c3429770f50e2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 22:28:22 +0000 Subject: [PATCH] File the class the repair was named for: a right-censored cost read as an exact one DELIVERABLE 1 of this lane's work item, held out of gunbc#10210 while `recurring_failure_mode.dag` was a monolith and every appending lane contended one file. #10206 made it one file per row, so the row lands as its own file plus a roster entry appended at the END -- the roster is source-ordered and sorting it would destroy the empty-diff oracle the split was checked against. THE CLASS. An instrument stops because a POLICY THRESHOLD fired before the subject completed, so the figure it emits is a LOWER BOUND. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line or deflated into a budget as though it were the cost. WHAT MAKES IT INVISIBLE is that the bound looks like data -- right units, right magnitude, right shape. And its magnitude is approximately THE CEILING THAT STOPPED IT, which inverts every ranking built on it: a preempted row sorts above genuinely expensive completed rows, so a "worst observed" derived from the population describes the ceiling rather than the machine, and a remedy sized from it is sized against a policy constant wearing the authority of a measurement. RUNG FOUND AT: BELOW THE FLOOR, which is not rung 1. Rung 1 requires harm CONTAINED; a column rendering a bound and a completion under one name contains nothing, and a censored value consumed where an exact cost is read is a fabricated plausible output, which DESIGN section 4b places outside the ladder and forbids outright. The row records that it was first filed claiming `mitigatable` and refused by review -- the inflated reading was written by the author of the repair, inside the change that fixed it. CEILING: structurally impossible, because membership is decidable AT THE WRITE. The instrument always knows which arm it took; it stopped the subject itself. THE TRIGGER IS THE WHOLE PAIRING, and a trigger naming less than all four retires the row while the harm persists: disjoint constructors; disjoint WIRE field names, because a shared column re-fuses them at the artifact boundary whatever the in-memory type does; every arithmetic consumer requiring the exact type in its signature; and a dynamic mixed population that REFUSES rather than filtering -- because silently dropping the censored members is `censored_estimator_drops_its_own_tail`, the repair for one failure mode arriving as the other. The fourth clause is the one authors omit. BOUNDED AGAINST THREE SIBLINGS, all of which resolve on main today so they are cited by identity rather than described: it is the INVERSE of `censored_estimator_drops_its_own_tail` (exclude the tail vs admit the tail as a point -- opposite mistakes over one population, and this project committed both about the same artifact); distinct from `window_rendered_subject_misattribution` (there the figure is a real measurement attributed to the wrong subject); and a guard that excludes the censored population by a CORRELATED PROXY is `incidental_denominator_as_wall` rather than this repair -- which also defeats the evidence, since a witness keyed to the proxy stays green under a fold that reads the bound as a cost. Projection regenerated through `tools.generated_artifact_gate` `main_wet_one` on a gunbc built from source, per the recipe `gunbc.rung_drop` `required_gate_bankruptcy` names. The diff is the row and nothing else. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01FU5gCEQhoMLxxABm2GcvYf --- .../right_censored_cost_read_as_exact.dag | 38 +++++++++++++++++++ dag/gunbc/recurring_failure_mode/roster.dag | 2 + docs/design-failure-modes.md | 2 + 3 files changed, 42 insertions(+) create mode 100644 dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag diff --git a/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag b/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag new file mode 100644 index 00000000000..398e0ad87e9 --- /dev/null +++ b/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag @@ -0,0 +1,38 @@ +module gunbc.recurring_failure_mode.right_censored_cost_read_as_exact + +import std.types { NonEmptyStr } +import gunbc.recurring_failure_mode { RecurringFailureMode } + +data right_censored_cost_read_as_exact: RecurringFailureMode = RecurringFailureMode { + identity: "right_censored_cost_read_as_exact" as NonEmptyStr, + + receipts: [ + "**a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. ", + + "WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. ", + + "AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. ", + + "RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. ", + + "THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. ", + + "SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. ", + + "RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. ", + + "IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ", + + "ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. ", + + "NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. ", + + "THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. ", + + "A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. ", + + "THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.)", + ], + + evidence: [], +} diff --git a/dag/gunbc/recurring_failure_mode/roster.dag b/dag/gunbc/recurring_failure_mode/roster.dag index a20a8a88a54..b28ee0af72f 100644 --- a/dag/gunbc/recurring_failure_mode/roster.dag +++ b/dag/gunbc/recurring_failure_mode/roster.dag @@ -95,6 +95,7 @@ import gunbc.recurring_failure_mode.join_judged_against_its_sibling_rather_than_ import gunbc.recurring_failure_mode.one_dissolution_event_recorded_twice_or_not_at_all { one_dissolution_event_recorded_twice_or_not_at_all } import gunbc.recurring_failure_mode.exact_duplicate_match_arm_not_refused { exact_duplicate_match_arm_not_refused } import gunbc.recurring_failure_mode.premise_that_a_shared_subject_means_disagreement { premise_that_a_shared_subject_means_disagreement } +import gunbc.recurring_failure_mode.right_censored_cost_read_as_exact { right_censored_cost_read_as_exact } data recurring_failure_mode_roster: List = [ censored_estimator_drops_its_own_tail, @@ -181,4 +182,5 @@ data recurring_failure_mode_roster: List = [ one_dissolution_event_recorded_twice_or_not_at_all, exact_duplicate_match_arm_not_refused, premise_that_a_shared_subject_means_disagreement, + right_censored_cost_read_as_exact, ] diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 271e53b3651..da01c9d5000 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -88,6 +88,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `one_dissolution_event_recorded_twice_or_not_at_all` - `exact_duplicate_match_arm_not_refused` - `premise_that_a_shared_subject_means_disagreement` +- `right_censored_cost_read_as_exact` --- @@ -187,3 +188,4 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **one dissolution event, recorded twice or not at all** (a roster rule assigns deletion of CONSUMED admissions to the next roster-touching change. The rule is CORRECT AND THIS ROW DOES NOT DISPUTE IT: the obligation reaches every concurrent roster-touching change and is discharged by whichever observes it first, exactly as its own prose says. What recurs is not a broken trigger but an ASYMMETRY BETWEEN THE TWO THINGS IT OBLIGES, AND BOTH HALVES OF IT CAN MERGE SILENTLY. The DELETION COMPOSES IDEMPOTENTLY: two branches removing the same rows compose to one absence with no conflict, which the authority itself records -- `v1_compiler.namespace_wave_admission` says of the 57-row case MAIN EMPTIED INDEPENDENTLY, WHICH IS THE TRIGGER MECHANISM WORKING RATHER THAN A COLLISION. The RECORD COMPOSES ADDITIVELY: each observer authors an ordinal-bearing dissolution writeup, and two writeups of ONE event merge cleanly into two. AN EARLIER REVISION OF THIS ROW CLAIMED THE DELETION COLLIDES LOUDLY, WHICH ITS OWN CITED SPECIMEN CONTRADICTS, and the error is instructive: this row's author generalised from a TEXTUAL CONFLICT they hit on gunbc#10248, which was an ADD/ADD on a roster line and not a deletion at all. Idempotence is exactly what lets the duplicated observation collapse while the duplicated history survives, so the deletion never reliably announces the race. INVALID STATE: one dissolution event carrying two records, or carrying none. HARM: both wrong arms are silent and neither is countable. Yield when nothing else is recording and N admissions vanish from main unexplained, which is precisely what the roster history exists to prevent; author when something else is recording and one event acquires two ordinal-bearing records, a DESIGN section 3 meaning fork committed inside the ledger that explains the deletion. THE DECIDING INPUT IS UNREADABLE, WHICH IS THE WHOLE CLASS: choosing between the arms requires knowing whether a competing branch is LIVE AND RECORDING. That is not derivable from the artifact, is not visible to review, and CHANGES BETWEEN CI ROUNDS -- so the decision is correct or incorrect for reasons the author cannot read and a later reader cannot reconstruct. No amount of care closes it. DISCOVERED BY valiant-bee-316 AND tidy-koi-619 across their own cuts; drafted here by a third lane at their request, from shas they supplied, so that one record exists rather than two -- which is this row obeying its own subject. The two main-side quotations below were verified verbatim against origin/main by the drafter rather than relayed. SPECIMENS -- THREE EVENTS, FIVE INSTANCES, TWO BRANCHES, ABOUT TWENTY HOURS. EVENT 1, 57 rows: main and a branch deleted the same consumed rows independently, recorded in main as SEVENTEENTH TRANSITION in `v1_compiler.namespace_wave_admission` -- neither aware of the other, both paying the rule. No double record, because one side was main. EVENT 2, 3 rows, consumed when gunbc#10011 merged as 4acf8ac234: TWO branches observed it independently and BOTH authored NINETEENTH DISSOLUTION -- 889a5f52493 and 29db34e975. One was yielded at 2fafa0f9591, deletion kept and record dropped in favour of a pointer. THIS IS THE CLASS FIRING AND BEING CAUGHT BY HAND. EVENT 3, 47 rows, consumed when gunbc#10106 merged as 78e022c51e4: only one branch observed it, so the same trigger correctly produced the OPPOSITE action -- record rather than yield, TWENTIETH DISSOLUTION at edbfcd7b45f. SAME TRIGGER, OPPOSITE CORRECT ACTION, DECIDED ENTIRELY BY WHETHER A COMPETING RECORD EXISTED. Plus three ORDINAL COLLISIONS on one file from one branch: SIXTEENTH TRANSITION taken mid-branch by gunbc#10010, then SEVENTEENTH TRANSITION and NINETEENTH DISSOLUTION both taken by gunbc#10106, forcing EIGHTEENTH TRANSITION -- the same silent-merge surface reached through the ordinal rather than the record. THE COST AND THE MECHANISM ARE TWO CLAIMS AND A READER WHO CONFLATES THEM REPAIRS THE WRONG THING. The cost is real: a branch touching the roster for its own unrelated reasons inherits another lane's sweep, each inheritance costing a commit, a CI round and a judgement call -- one call-reachability cut paid it TWICE for two upstream transitions it did not cause. But the same evidence shows the TRIGGER WORKING. Repairing the trigger would break the only part that is sound. RUNG FOUND AT: 1, mitigatable, resting on author diligence -- nothing refuses either wrong arm and nothing counts them. CEILING: 2, mechanically preventable, and the reason it is not higher is that the record is author-assigned PROSE; making the state unwritable means the record ceasing to be prose, which is a carrier question this row deliberately does not decide. Reaching 2 is decidable, BUT NOT FROM THE MERGE-BASE ALONE: a base containing no record admits BOTH concurrent branches, each locally clean, and the duplicate prose then composes without conflict -- so a check with perfect merge-base access still passes both and admits the second record. Decidability requires the EXACT WOULD-LAND COMPOSITION at a serialized boundary, which is why the trigger below names that rather than the base. NOT MEASURED, AND CARRIED AS UNMEASURED BECAUSE THE ORIGINATING LANE FLAGGED IT: whether the merge-base is REACHABLE to such a check at the point the admission phase runs. If it is not, the ceiling argument needs re-deriving before anyone builds against it. NEXT-RUNG TRIGGER, named as the CAPABILITY AND JOINING BOTH DIRECTIONS: at the serialized merge boundary, derive a dissolution-event identity from the CONSUMED ADMISSION POPULATION and require the exact would-land tree to contain EXACTLY ONE history record per event and EXACTLY ONE event per record -- refusing zero, refusing duplicates, and refusing or re-executing when current main differs from the main revision adjudicated. AN AT-MOST-ONE WALL IS NOT SUFFICIENT AND AN EARLIER REVISION OF THIS ROW NAMED ONE: refusing a record whose label already carries one says nothing about consumed rows deleted with NO record, which is half of the invalid state above. That is the section 4b(3) grain mismatch -- a two-armed loss under a one-armed trigger -- committed in the same row that warns against it. ITS DISCRIMINATING REDS ARE BOTH ARMS AND ONE OF THEM MUST CROSS THE RACE: consumed rows deleted with ZERO record; one event carrying TWO records; and, because a static two-record fixture does not exercise the actual specimen, TWO CONCURRENT BRANCHES SHARING A BASE WITH NO RECORD, each locally clean and admissible, where the SECOND composition refuses after the first lands. Positive control: one event, one record, admitted. CROSS-REFERENCE, NOT A MERGER: `ambient_process_state_read_by_a_concurrent_reader` shares the sentence CORRECTNESS DEPENDS ON CONCURRENT STATE THE ACTOR CANNOT READ, but there the defect is a READ that returns a well-formed value about a different subject, repaired by making the ambient fact a parameter. Here it is a WRITE DECISION with no readable input at all, repaired by making a second record refuse. Neither repair transfers, which is DESIGN section 4b's keying-on-the-repair test.) - **an exact duplicate constructor pattern appears twice in one match, the second arm is unreachable, and the compiler accepts both -- so SOURCE ORDER silently decides which body answers** (INVALID STATE: two arms of one `match` name the SAME closed-variant constructor with DIFFERENT bodies. HARM: the second body is dead, and nothing says so. The author wrote it believing it would run; the reader cannot tell which of the two the machine picks without knowing the arm-selection rule; and the wrong one being first is a wrong answer that type-checks, projects and passes every gate. THE SPECIMEN IS MINE AND IS MEASURED (gunbc#9981, 2026-09-03). `probe_owner_is_wet_lib_module` in `v2.test.claim.self_host.stage0_executable_assembly_test` carried `WetActuatorLibModuleOwner` twice -- once as the matching arm binding `module_basename` and `declaration_route`, and again in the trailing list of `=> false` arms, where I had added it while enumerating the coproduct for exhaustiveness. The compiler accepted it in every lane it reached. It was found by a review reading the arm list, not by any check. THIS IS THE DUAL OF EXHAUSTIVENESS, NOT AN INSTANCE OF IT. Exhaustiveness asks whether the UNION of the arms covers the domain, and gunbc does refuse when it does not -- the same file's missing `WetActuatorLibModuleOwner` arm refused loudly earlier in the same PR. The unasked question is whether each arm CONTRIBUTES an inhabitant no earlier arm already covers. A duplicate arm makes the union no larger, so an exhaustiveness check is green by construction on exactly the source that carries this defect: adding the duplicate is the one edit that cannot move that verdict. THE MEASURED GRAIN IS NARROW AND IS STATED NARROWLY, because the general form is not the same question. Deciding whether an arbitrary later pattern is subsumed by the union of earlier ones is a coverage problem over guards, nested patterns and bindings; the measured specimen is the decidable corner of it -- two SYNTACTICALLY IDENTICAL closed-variant constructor heads at the same match. Claiming the general form here would put a ratchet where a wall is available, and would let the narrow wall be cited as coverage for the broad class. RUNG FOUND AT: outside the ladder -- the state is writable, accepted, and silent. CEILING: 3, structurally guaranteed, and the reason it is not 4 is that a `match` is written arm by arm, so a second identical head is spellable in any source a human or a generator can emit; no constructor arrangement removes it. What rung 3 buys is that no `Accepted` program contains one. NEXT TRIGGER, NAMED AS THE CAPABILITY: **a match-arm usefulness judgment in the compiler frontend that REFUSES a second arm whose constructor head is already covered, locating both the duplicate and the arm that covers it** -- with a discriminating RED (two identical constructor patterns, different bodies, refused at the second arm), an accepted positive control (two distinct constructor patterns, accepted), and a retention control establishing that adding a variant to the coproduct does not weaken the duplicate judgment. A diagnostic that names the duplicate without refusing it does not discharge this: a warning on an accepted program is the tier DESIGN section 6 calls an inert lens, and this class is silent precisely because nothing stops the line.) - **A PREMISE THAT MAKES A COST LOOK CORRECT RENDERS THE REGION BEHIND IT UNEXAMINABLE, AND THE TELL IS REPEATED REPAIRS THAT ALL STOP AT THE SAME BOUNDARY.** The invalid state is a stated justification -- not a check, not a type -- that classifies an observed cost as intended, so no instrument is ever pointed at it and its absence looks like the absence of a problem rather than the absence of a measurement. SPECIMEN, and it is this carrier's own history: `gunbc.recurring_failure_mode` was repaired twice for merge contention -- blob to `data` rows, then rows to one line each -- and BOTH repairs measured only the APPEND OF A WHOLE ROW. Both rested on a premise stated in the first: that two lanes editing the SAME class conflicting is "correct, because that is real disagreement about one fact." THE PREMISE IS FALSE FOR THIS CARRIER, and the discriminator is what actually accretes on a class. What lands is INDEPENDENT RECEIPTS from unrelated lanes -- a second specimen, a climb receipt, a corroboration reached from the opposite direction -- not competing claims about one fact. On 2026-09-02/03 three lanes appended three independent receipts to `state_space_conflation` and resolved it by hand-negotiating byte order; that row reached 23,023 characters. Independent accretion is not disagreement, so the conflict was textual contention wearing the mask the premise had fitted for it. **WHAT MAKES THIS A CLASS RATHER THAN ONE MISTAKE IS THE SHAPE OF THE EVIDENCE: the premise was load-bearing for two repairs, and neither repair's author looked inside a row.** A false premise does not merely produce a wrong answer -- it produces NO answer, because it removes the question. That is why it survived a measurement campaign that was otherwise careful: the same lane that measured `git merge-file` at a named merge base to characterise the block-tail defect never measured an intra-row edit, because the premise said the result would be correct. RECOGNITION RULE: when a repair of a recurring cost is being scoped, find the sentence that explains why the ADJACENT cost is acceptable, and ask what measurement would falsify it. If no measurement was ever run against it -- and especially if the same boundary has now been re-approached more than once -- the premise is a candidate, not a finding, and the cheap discriminator is to run the instrument the premise made look unnecessary. Here that was one `git merge-file` on two lanes editing one row: 0 conflicts on different receipts, 1 minimal conflict on two appends. **WHAT IS NOT CLAIMED.** This is not the claim that stated justifications are suspect in general, which would be unusable. The class is narrower and its two conditions are jointly required: a premise that classifies an observed, RECURRING cost as intended, AND a repair history in which the same boundary was approached more than once without that cost being measured. One repair stopping at a boundary is ordinary scoping. RUNG: mitigatable, and honestly so. The harm is deferred author time -- three lanes hand-negotiating byte order on one row -- and it is contained only by someone eventually re-deriving the premise, which is a review practice and not a mechanism. CEILING, derived rather than aspirational: this cannot climb to construction, because whether a stated justification is true is not decidable from the tree -- the premise here was refuted by an empirical fact about how lanes ACTUALLY append, which no property of the source expresses. It is a ratchet forever in the sense of DESIGN section 5. NEXT-RUNG TRIGGER, a capability and not an artifact: the ability to measure contention on a carrier CONTINUOUSLY rather than at repair time -- a per-declaration conflict count over merge history -- so that a region the premise renders unexaminable still produces a number that rises. That is what would have made the intra-row cost visible without anyone doubting the sentence. +- **a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.)