The 500ms-exact question is a RENDER defect, not a comparator one: strict > on nanoseconds, truncated to milliseconds

[briansrls]

Answers the routed 500ms-exact question. It is arm (b), and arm (a) is false.

The measurement

cli_run's budget_completion_outcome compares

cpu_nanos > u128::from(budget_ms) * 1_000_000

— strict, and on nanoseconds. A claim landing at exactly 500_000_000ns therefore passes. The comparator does not admit equality, so there is no boundary defect and no one-line fix there.

What crosses is a claim between 500_000_001ns and 500_999_999ns — genuinely over budget, by up to 999,999ns. The rendered field is (cpu_nanos / 1_000_000), integer division, so that entire window renders as 500. The report then calls it EXACT, which is true of the measurement and false of the rendering.

Changing the comparator would not fix the report; it would break a correct refusal.

Why it is filed rather than answered in a thread

The direction of the error is what makes it worth a row. Truncation moves the figure downward — toward the threshold and then past it — so the rendering is biased precisely toward making a correct refusal look wrong, and never toward making an incorrect one look right. An auditor reading the artifact sees only false-positive-shaped evidence and files against the comparator, the one component that was right. That is a self-perpetuating misdiagnosis, and it is what would have happened here without the nanosecond read.

The population is not one unlucky row: the run that raised this carried 339 rows with an over-cost line diagnostic against 3,601 executed, of which 2 crossed. A dense near-budget population standing at a wall whose crossing evidence is unreadable at the rendered grain.

Not a duplicate of right_censored_cost_read_as_exact

Both populations live in the same cpu_ms column of required_floor_claim_cost.tsv, so the check matters:

• there: the subject was stopped; the value is a lower bound; its magnitude is approximately the ceiling that stopped it;
• here: the subject ran to completion; the value is a measurement — correct and exact — rendered too coarsely to show what it was compared against.

One is a bound wearing the shape of a value; the other is a value wearing the wrong number of digits. A repair for either leaves the other standing.

Rung, ceiling, trigger

Rung 1, mitigatable — stated with its reason, because filing every reporting defect as silent wrongness is inflation. Nothing is fabricated: the comparison, the measurement and the refusal are all correct; the line stops and the diagnostic is typed and located. What is lost is the reader's ability to check it from the artifact, which is a containment failure rather than a wrong answer.

Ceiling: structurally impossible — membership is decidable at the write, since the producer holds the nanosecond value and the budget at the moment it formats.

Trigger, capability-grained: the artifact carries the compared quantity at the comparison's grain. Explicitly not satisfied by a reworded diagnostic — "just over 500ms" is a better sentence and not a climb, because every consumer reading the column still reads a value equal to the budget. It is satisfied when a consumer can recompute the gate's own decision from the row and get the gate's answer.

The eval_steps discriminator is recorded too: a bit-stable step count whose millisecond figure straddles the budget is truncation, not a comparator admitting equality; a rising step count is a different subject.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QWLoiyrKq3zNTiDNtrs9gC

[gunbai-bot]

Good catch, and it was a dropped comma rather than intent — fixed in 8de52c968d.

Two things worth adding, because the diff can't show either and both cut against the natural reading:

It was not a parse error on this tree. The regeneration succeeded before the fix, so .dag accepted the adjacent literals rather than refusing them. Your conditional was the right way to raise it, but the first branch is the one that doesn't apply here.

And the projection is byte-identical before and after — 516,564 both times, rendering ...that question. That harm is SHARED... either way. That is not evidence the comma was harmless in general. It is because the carrier hub's authored folds the receipts list with concat, so receipt boundaries are invisible in the projection by construction. The list is an authoring convenience, not a rendered structure.

Which makes this a nice small instance of something I filed a row about tonight: the defect changed the authored structure while leaving every projected byte identical, so no regeneration, drift gate, or diff of the generated artifact could have surfaced it. It needed a reader looking at the authority. Thanks for being that.

— sent from jolly-ferret-412

[gunbai-bot]

PARKED — do not merge, and do not spend review effort here until it is resumed.

This PR's transaction was ParkedReleased under a drain ruling: an enumerated census found 9 live evidence-producing transactions against a charter ceiling of 3, and the decision was to drain rather than restate the ceiling (redefining "transaction" after observing nine would fit the rule to the breach). Its owning session is archived; the branch head is preserved deliberately.

Park disposition, which is why nothing is happening here:

• no push, rebase, regeneration, dispatch, or merge attempt
• pending/running workflow results are VoidedByPark for admission; queued runs were cancelled to return runner capacity to the fleet
• unsolicited reviews and late CI results do not reactivate the transaction — an approval landing here changes nothing
• resumption re-derives admission against then-current main; any receipt on this head is provenance for the head, not a would-land receipt for a future main

Resumption is gated on the merge-route repair (clever-gull-870): merge-tree CLEAN is necessary and explicitly insufficient for ledger-touching PRs, because the design-ledger route's provisional commit moves the merge base, after which the driver is never consulted and the merged projection silently under-renders rows the authority still carries. Until an unconditional would-land admission exists, these branches stay pinned.

— sent from bright-ram-778

[gunbai-bot]

Both findings in review 59917 are correct and are fixed at 6f65bb903f96. The first is sharper than stated — the row's own specimen refutes its rung claim.

Rung. The row argued rung 1 on the grounds that nothing is fabricated: comparison right, measurement right, refusal right, only the reader's ability to check lost. But the artifact it quotes is not a bare 500ms, which would be coarsening — it is cost=500ms EXACT. The word EXACT asserts a precision the arithmetic does not have, so a true cost in (500.000, 500.999]ms printed as literally equal to the budget it was refused against is a self-contradicting sentence, and §5 puts a fabricated plausible output outside the ladder rather than low on it. Corrected to below-the-ladder. The earlier claim is recorded rather than quietly replaced, because filing this at rung 1 was the exact error the row exists to name, committed in the row.

Discriminator. Correct that eval_steps cannot decide the mechanism from the artifact alone. A stable step count controls for changed evaluator work and establishes the crossing is a timing fact — but a strict comparator with a truncating renderer and a comparator admitting equality both produce a stable step count beside a figure equal to the budget. Separating them needs the comparator and rendering path: here budget_completion_outcome compares cpu_nanos > budget_ms * 1_000_000 strictly while the arm rendered cpu_nanos / 1_000_000. Narrowed to what the artifact supports.

Added, because it landed while this PR was parked: #10341 repaired this renderer — replaced the adjective with CEILING and made crossing_figure_ms round up, so a reported crossing cost can never tie the budget it crossed. Its own commentary reaches this row's conclusion independently: "an adjective asserting a precision the arithmetic does not have is the same defect the rounding was landed to repair."

Two limits are stated rather than glossed: it does not carry the compared quantity at the comparison's grain — the figure is a ceiling, not the nanosecond value the gate compared — so whether it satisfies this row's own trigger is arguable and is not claimed; and it repairs one renderer on one arm, while every other site formatting a measured quantity beside its threshold stays constructible. Per §4b(4) the discriminating evidence stays enrolled rather than retiring with the fix.

Context: this row was authored by jolly-ferret-412, whose lane is closed. The PR is orphaned to me and the rewrite is mine.

— sent from bright-ram-778

[gunbai-bot]

This PR is orphaned — its session (jolly-ferret-412) no longer exists — and it has two problems, the second of which looks like success.

1. DIRTY. mergeable=false/dirty, conflicting on dag/gunbc/recurring_failure_mode/roster.dag and docs/design-failure-modes.md — the ledger carrier and its projection, the busiest contention surface in the repo today.

2. The green receipt was produced under a gate roster that no longer exists. Check-runs at head 1df59cb17996:

emit-copy-qualification-battery : skipped
fabric-evidence                 : success
rust-unit-tests                 : success
heal-generated-artifacts        : success
required-witnesses-build        : success
required-witnesses-floor        : success
witnesses                       : success

Three of those jobs were deleted by #10390 (the 2026-09-04 runner-capacity ruling): emit-copy-qualification-battery, fabric-evidence, rust-unit-tests. The current required roster is exactly four — heal-generated-artifacts, required-witnesses-build, required-witnesses-floor, witnesses.

So this green is a receipt from a superseded gate set. It is honest — it really did pass what it ran — which is what makes it dangerous: nothing about it reads as stale, and the check names are the only thing that dates it. The discriminator is one line: if any of those three names appears, the receipt predates #10390.

Both are fixed by the same act. Integrate main and push once — that re-derives refs/pull/10352/merge and produces a receipt under the four-job roster. Do not re-run: a re-run replays the merge sha pinned at the last push, so it reproduces the same stale-roster composition.

Two cautions for whoever resolves it, both measured today:

• Do not resolve by keeping both sides. Union resolution in two unrelated PRs (we need to cut/kill some of our CI jobs - too many jobs - not enough runners #10408, Model printer LAN access as a two-locus SecretRef roster #10376) is what authored three copies of one annotation block into main — with no conflict markers and nothing red.
• docs/design-failure-modes.md is a generated projection of roster.dag. Resolve the authority only and let heal regenerate the projection. A refusal is only a refusal if it survives its caller: file the class a correct producer and a re-absorbing consumer produce together #10375 went through exactly this today: resolving roster.dag alone and pushing, after which heal added the projection rows itself — verified at 107 roster entries / 107 projection entries.

Expect two CI cycles and two reviews: heal pushes a new head after yours, and an approval at your head does not carry to heal's.

— sent from bright-ram-778