Repository navigation
Model the Ethernet link mode and the SFF-8636 leg coding: a part number is not a link contract - #10614
Merged
Conversation
…er is not a link contract Two 400G QSFP-DD to 4x100G breakout cables (FS order FS260902769849, part QDD-400G-4QPC015) link and run stably at half their purchased rate between a MikroTik CRS812 and ConnectX-7 NICs. The legs' EEPROMs report extended compliance 0x0B, which attests 25G-per-lane modes; nothing in them attests 100GBASE-CR2, so the NIC refuses to enable 100G_2X. The corpus could not state any of that. "100G" was one Bandwidth, so 100GBASE-CR4 (4x25G NRZ) and 100GBASE-CR2 (2x50G PAM4) were indistinguishable -- one spelling, two contracts, DESIGN section 3's meaning fork. And a cable leg's coding, which is what actually decides the negotiated rate, was unmodelled entirely. extdeps.ethernet.link_mode makes the aggregate DERIVED and never authored, so "100G" is unsayable as a primitive fact. A lane carries three distinct numbers -- service rate, encoded rate, symbol rate -- and they are three fields, not one. std.measure gains SymbolRate for the baud axis, because the first draft of this work typed a baud field as Bandwidth: the module written to prevent the units conflation committed it. extdeps.transceiver.sff_8636 owns the EEPROM field layout, reading BOTH extended-compliance codes (bytes 192 and 116), because SFF-8024 lets a multi-application module report the encoding of its primary application -- a predicate over one code and one encoding byte is not a soundness proof. Its assessment is relative to a REQUESTED mode and splits three ways: contradictory under the observed profile, insufficient evidence for the requested mode, or not understood by this decoder. The delivered cable lands on the second, which is strictly weaker and strictly more defensible than calling its EEPROM self-contradictory. NOT ESTABLISHED, recorded rather than guessed: no clause attribution is carried on any mode row, since an unread clause number is a fabricated citation; the SFF-8024 code that attests 100GBASE-CR2 is not authored here for the same reason; byte 140 may hold the 0xFF escape rather than a rate, which needs the raw dump to settle; and stable 50G operation is evidence about 50G only -- it does not certify the 26.5625 GBd PAM4 path. NOT VERIFIED LOCALLY. Six attempts to typecheck this failed on the toolchain, never on the source: a pipeline-clobbered exit code, an installed gunbc that reds every section 4c annotation in the corpus, two memory-admission refusals, an OOM through the --entry path, and a dispatch that returned no output. CI is the instrument for this branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W
…elivered leg The modules typechecked and executed nothing. hundred_gig_aggregate_collision and sff8636_assess_leg_coding had no consumer, which is specification-without-execution -- DESIGN section 5's deepest trap, and the shape that looks finished precisely because it type-checks. A scheduled review approved the diff without noting it; an approval reports no blocking defect, it does not establish that evidence exists. The discriminating subject is the real delivered part: the EEPROM reading from FS order FS260902769849 (part QDD-400G-4QPC015, leg SN S2630771509-4) is a fixture, and the central test asserts that this leg does NOT attest 100GBASE-CR2. That is the failure that shipped a half-rate fabric which links, pings clean at MTU 9000 and tests green everywhere else the fleet looks. Three arms keep it from being vacuous. The same leg IS admitted for 100GBASE-CR4, the mode it is actually coded for, so a decoder that refused everything would not pass. A synthetic correctly-coded leg is admitted for the requested mode -- and it is marked synthetic, because it validates the DECODER and establishes nothing about whether any physical cable works. A leg whose attestation arrives only via the byte-116 secondary code is still admitted, so a collapse back to reading only byte 192 reds here rather than being caught by inspection a second time. The units separation executes too: a PAM4 lane is asserted at 26.5625 GBd carrying 53.125 Gb/s encoded against a 50 Gb/s service rate, so re-fusing those fields or assigning a baud figure to a bits/s carrier stops the arithmetic from holding. The synthetic row's compliance code is deliberately 0 and says so: the real SFF-8024 assignment for 100GBASE-CR2 has not been read in this lane, and inventing the byte would be the fabricated citation this whole subject exists to catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W
… from an unread field Review found the central witness DETERMINISTICALLY FALSE. For the delivered leg, every attested mode is NRZ while the encoding byte says PAM4, so the assessor returned CodingContradictsEncoding -- while the test, the commit message and the PR body all said CodingInsufficientForRequestedMode. Behaviour was documented and never executed, in the PR whose thesis is that unexecuted claims are worthless. The floor had died earlier on generated-artifact drift, so nothing had contradicted it; the witness could not even compile, because it constructed a sole_constructor type outside its defining module. The repair is to the PRECONDITION, not the expectation. Widening the test to accept any refusal would have been the absorbing fallback. A contradiction is a claim that the WHOLE declared profile disagrees with the encoding byte, and byte 116 was never read on this cable, so that claim is unavailable: SecondaryNotObserved is now distinct from SecondaryObservedEmpty, and an unread field can no longer stand as evidence of absence. THE COMPLIANCE BYTE NOW DECIDES. ExtendedCompliance previously carried an author-supplied `attested_modes` beside `code`, and the assessor read only the former, so the byte was decorative -- the synthetic fixture passed code 0 with a hand-written CR2 list and was admitted on its own say-so. Interpretation is now a function of the byte, an unmodelled code interprets to UNKNOWN rather than to an empty attestation, and the discriminating control this enables -- mutate only the code, hold every other field fixed, require the unknown result -- was structurally unwritable before. 0x0B carries a third entry: 50GBASE-CR2 subject to Clause 91 FEC, found by an external standards cross-check rather than by anything in this repository. The condition is retained, not flattened: it yields CodingAttestsRequestedModeSubjectToFec, and a test asserts it is attested AND not attested outright, because promoting a conditional entry to unconditional support is the silent widening the qualification exists to prevent. The stage0 mirror for std_measure.rs is regenerated from its authority (first_generation_equal=true, 157/157 adjudicated); the candidate diff was exactly the 13-line SymbolRate addition and nothing else. EXECUTED, not asserted: claim_executor --required-floor built from this tree reports verdict=FloorClean, claims_failed=0, with all 14 cable-coding claims in the executed population. The prior run of the same instrument red on this file with three located errors, so the pair discriminates rather than a green standing alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 6, 2026
… reconciles against a reading The substrate that landed in #10614 models the cable. It would not have stopped this order, because nothing consumes its findings at purchase time. These are the gates that do. THE ORDER WAS CORRECTLY ADMITTED, and the witness says so out loud because the opposite is the intuitive and wrong belief -- one this lane already published once and had to retract. FS's listing promises 4x100G legs of 2x50G PAM4, which is exactly the requirement, so a pre-purchase gate reading it ADMITS. A gate that refused would be reasoning from EEPROM bytes nobody could have had before delivery. So the two gates consume different evidence and may never share a carrier. Order admission takes a VENDOR CLAIM and refuses a purchase whose per-leg coding is undeclared -- the loud failure the subject exists to produce, since a part number does not determine a link contract and the EEPROM is field-programmed. Receipt reconciliation takes an OBSERVATION and joins it against the admitted claim; that is the gate that catches this class, an hour after delivery rather than after installation. The second is what keeps the first honest: a gate treating a claim as a reading would have greened here. CableLegCodingEvidence makes the grade structural rather than a flag, following the LandedCost split in product.inventory -- the arm IS the grade, so no path can promote a claim to a reading by forgetting to check something. ReceiptNotYetObserved is its own arm because SILENCE IS NOT AGREEMENT. A delivered assembly nobody has read must not reconcile as matching; that is exactly the state this fleet sat in while the fabric ran at half rate, and a model scoring it clean would have certified the outage. What the NIC requires is DECLARED BY THE FLEET, not derived from firmware. The ConnectX-7 was observed refusing 100G_2X; that rule has never been read here, and modelling an inferred algorithm as NVIDIA authority would turn a diagnosis into an invented specification. NOT VERIFIED: the seven claims in this witness have NOT been observed to execute. Local --required-floor reports FloorClean with planned unchanged at 3525 and zero of them in the population -- the module compiles and resolves, and something in floor discovery still does not offer it. A module-path fix (gunbc/product/X.dag declares `product.X`, not `gunbc.product.X`) was necessary but not sufficient. Reporting the gap rather than the green: a verdict whose population excludes its subject is not evidence, and this branch has already shipped one claim that no execution had ever checked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W
6 tasks
briansrls
added a commit
that referenced
this pull request
Sep 6, 2026
* Model the Ethernet link mode and the SFF-8636 leg coding: a part number is not a link contract Two 400G QSFP-DD to 4x100G breakout cables (FS order FS260902769849, part QDD-400G-4QPC015) link and run stably at half their purchased rate between a MikroTik CRS812 and ConnectX-7 NICs. The legs' EEPROMs report extended compliance 0x0B, which attests 25G-per-lane modes; nothing in them attests 100GBASE-CR2, so the NIC refuses to enable 100G_2X. The corpus could not state any of that. "100G" was one Bandwidth, so 100GBASE-CR4 (4x25G NRZ) and 100GBASE-CR2 (2x50G PAM4) were indistinguishable -- one spelling, two contracts, DESIGN section 3's meaning fork. And a cable leg's coding, which is what actually decides the negotiated rate, was unmodelled entirely. extdeps.ethernet.link_mode makes the aggregate DERIVED and never authored, so "100G" is unsayable as a primitive fact. A lane carries three distinct numbers -- service rate, encoded rate, symbol rate -- and they are three fields, not one. std.measure gains SymbolRate for the baud axis, because the first draft of this work typed a baud field as Bandwidth: the module written to prevent the units conflation committed it. extdeps.transceiver.sff_8636 owns the EEPROM field layout, reading BOTH extended-compliance codes (bytes 192 and 116), because SFF-8024 lets a multi-application module report the encoding of its primary application -- a predicate over one code and one encoding byte is not a soundness proof. Its assessment is relative to a REQUESTED mode and splits three ways: contradictory under the observed profile, insufficient evidence for the requested mode, or not understood by this decoder. The delivered cable lands on the second, which is strictly weaker and strictly more defensible than calling its EEPROM self-contradictory. NOT ESTABLISHED, recorded rather than guessed: no clause attribution is carried on any mode row, since an unread clause number is a fabricated citation; the SFF-8024 code that attests 100GBASE-CR2 is not authored here for the same reason; byte 140 may hold the 0xFF escape rather than a rate, which needs the raw dump to settle; and stable 50G operation is evidence about 50G only -- it does not certify the 26.5625 GBd PAM4 path. NOT VERIFIED LOCALLY. Six attempts to typecheck this failed on the toolchain, never on the source: a pipeline-clobbered exit code, an installed gunbc that reds every section 4c annotation in the corpus, two memory-admission refusals, an OOM through the --entry path, and a dispatch that returned no output. CI is the instrument for this branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Enrol the cable-coding evidence: the discriminating RED is the real delivered leg The modules typechecked and executed nothing. hundred_gig_aggregate_collision and sff8636_assess_leg_coding had no consumer, which is specification-without-execution -- DESIGN section 5's deepest trap, and the shape that looks finished precisely because it type-checks. A scheduled review approved the diff without noting it; an approval reports no blocking defect, it does not establish that evidence exists. The discriminating subject is the real delivered part: the EEPROM reading from FS order FS260902769849 (part QDD-400G-4QPC015, leg SN S2630771509-4) is a fixture, and the central test asserts that this leg does NOT attest 100GBASE-CR2. That is the failure that shipped a half-rate fabric which links, pings clean at MTU 9000 and tests green everywhere else the fleet looks. Three arms keep it from being vacuous. The same leg IS admitted for 100GBASE-CR4, the mode it is actually coded for, so a decoder that refused everything would not pass. A synthetic correctly-coded leg is admitted for the requested mode -- and it is marked synthetic, because it validates the DECODER and establishes nothing about whether any physical cable works. A leg whose attestation arrives only via the byte-116 secondary code is still admitted, so a collapse back to reading only byte 192 reds here rather than being caught by inspection a second time. The units separation executes too: a PAM4 lane is asserted at 26.5625 GBd carrying 53.125 Gb/s encoded against a 50 Gb/s service rate, so re-fusing those fields or assigning a baud figure to a bits/s carrier stops the arithmetic from holding. The synthetic row's compliance code is deliberately 0 and says so: the real SFF-8024 assignment for 100GBASE-CR2 has not been read in this lane, and inventing the byte would be the fabricated citation this whole subject exists to catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Make the compliance byte the evidence, and stop proving contradiction from an unread field Review found the central witness DETERMINISTICALLY FALSE. For the delivered leg, every attested mode is NRZ while the encoding byte says PAM4, so the assessor returned CodingContradictsEncoding -- while the test, the commit message and the PR body all said CodingInsufficientForRequestedMode. Behaviour was documented and never executed, in the PR whose thesis is that unexecuted claims are worthless. The floor had died earlier on generated-artifact drift, so nothing had contradicted it; the witness could not even compile, because it constructed a sole_constructor type outside its defining module. The repair is to the PRECONDITION, not the expectation. Widening the test to accept any refusal would have been the absorbing fallback. A contradiction is a claim that the WHOLE declared profile disagrees with the encoding byte, and byte 116 was never read on this cable, so that claim is unavailable: SecondaryNotObserved is now distinct from SecondaryObservedEmpty, and an unread field can no longer stand as evidence of absence. THE COMPLIANCE BYTE NOW DECIDES. ExtendedCompliance previously carried an author-supplied `attested_modes` beside `code`, and the assessor read only the former, so the byte was decorative -- the synthetic fixture passed code 0 with a hand-written CR2 list and was admitted on its own say-so. Interpretation is now a function of the byte, an unmodelled code interprets to UNKNOWN rather than to an empty attestation, and the discriminating control this enables -- mutate only the code, hold every other field fixed, require the unknown result -- was structurally unwritable before. 0x0B carries a third entry: 50GBASE-CR2 subject to Clause 91 FEC, found by an external standards cross-check rather than by anything in this repository. The condition is retained, not flattened: it yields CodingAttestsRequestedModeSubjectToFec, and a test asserts it is attested AND not attested outright, because promoting a conditional entry to unconditional support is the silent widening the qualification exists to prevent. The stage0 mirror for std_measure.rs is regenerated from its authority (first_generation_equal=true, 157/157 adjudicated); the candidate diff was exactly the 13-line SymbolRate addition and nothing else. EXECUTED, not asserted: claim_executor --required-floor built from this tree reports verdict=FloorClean, claims_failed=0, with all 14 cable-coding claims in the executed population. The prior run of the same instrument red on this file with three located errors, so the pair discriminates rather than a green standing alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Remove the unconsumed helpers, and the two more the first removal killed A review noted render_link_mode has no in-tree consumer and judged it too small to flag. DESIGN section 6 disagrees: an artifact with no final consumer is a scaffold tell, and the reviewer's own stated test is whether the thing survives into the terminal architecture and is consumed by it. So this censuses every function the PR added rather than fixing the one item spotted -- which found a cascade the single fix would have left behind: modulation_label was consumed only by render_link_mode, and the String import only by modulation_label. sff8636_nominal_rate_from_byte222 also goes. It is CORRECT -- byte 222 is the escape target in units of 250 MBd -- but nothing reads it, because nobody has taken the raw dump yet. Writing a witness whose only purpose was to consume it would make the test its own justification rather than a final consumer. It returns with the ethtool raw reading that needs it. Verified by execution, and the verification earned its keep: the first attempt at this deletion cut at the match block's closing brace instead of the function's and left an orphaned brace, so the module did not parse and the floor refused with ZERO claims executed. A deletion needs the same evidence as an addition; "it only removed dead code" is how a file that cannot parse gets pushed. Floor now verdict=FloorClean, claims_failed=0, all 14 cable-coding claims in the executed population. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Two procurement gates: a purchase admits on a vendor claim, a receipt reconciles against a reading The substrate that landed in #10614 models the cable. It would not have stopped this order, because nothing consumes its findings at purchase time. These are the gates that do. THE ORDER WAS CORRECTLY ADMITTED, and the witness says so out loud because the opposite is the intuitive and wrong belief -- one this lane already published once and had to retract. FS's listing promises 4x100G legs of 2x50G PAM4, which is exactly the requirement, so a pre-purchase gate reading it ADMITS. A gate that refused would be reasoning from EEPROM bytes nobody could have had before delivery. So the two gates consume different evidence and may never share a carrier. Order admission takes a VENDOR CLAIM and refuses a purchase whose per-leg coding is undeclared -- the loud failure the subject exists to produce, since a part number does not determine a link contract and the EEPROM is field-programmed. Receipt reconciliation takes an OBSERVATION and joins it against the admitted claim; that is the gate that catches this class, an hour after delivery rather than after installation. The second is what keeps the first honest: a gate treating a claim as a reading would have greened here. CableLegCodingEvidence makes the grade structural rather than a flag, following the LandedCost split in product.inventory -- the arm IS the grade, so no path can promote a claim to a reading by forgetting to check something. ReceiptNotYetObserved is its own arm because SILENCE IS NOT AGREEMENT. A delivered assembly nobody has read must not reconcile as matching; that is exactly the state this fleet sat in while the fabric ran at half rate, and a model scoring it clean would have certified the outage. What the NIC requires is DECLARED BY THE FLEET, not derived from firmware. The ConnectX-7 was observed refusing 100G_2X; that rule has never been read here, and modelling an inferred algorithm as NVIDIA authority would turn a diagnosis into an invented specification. NOT VERIFIED: the seven claims in this witness have NOT been observed to execute. Local --required-floor reports FloorClean with planned unchanged at 3525 and zero of them in the population -- the module compiles and resolves, and something in floor discovery still does not offer it. A module-path fix (gunbc/product/X.dag declares `product.X`, not `gunbc.product.X`) was necessary but not sufficient. Reporting the gap rather than the green: a verdict whose population excludes its subject is not evidence, and this branch has already shipped one claim that no execution had ever checked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Sep 6, 2026
…tire the contradiction arm (#10671) * Model the Ethernet link mode and the SFF-8636 leg coding: a part number is not a link contract Two 400G QSFP-DD to 4x100G breakout cables (FS order FS260902769849, part QDD-400G-4QPC015) link and run stably at half their purchased rate between a MikroTik CRS812 and ConnectX-7 NICs. The legs' EEPROMs report extended compliance 0x0B, which attests 25G-per-lane modes; nothing in them attests 100GBASE-CR2, so the NIC refuses to enable 100G_2X. The corpus could not state any of that. "100G" was one Bandwidth, so 100GBASE-CR4 (4x25G NRZ) and 100GBASE-CR2 (2x50G PAM4) were indistinguishable -- one spelling, two contracts, DESIGN section 3's meaning fork. And a cable leg's coding, which is what actually decides the negotiated rate, was unmodelled entirely. extdeps.ethernet.link_mode makes the aggregate DERIVED and never authored, so "100G" is unsayable as a primitive fact. A lane carries three distinct numbers -- service rate, encoded rate, symbol rate -- and they are three fields, not one. std.measure gains SymbolRate for the baud axis, because the first draft of this work typed a baud field as Bandwidth: the module written to prevent the units conflation committed it. extdeps.transceiver.sff_8636 owns the EEPROM field layout, reading BOTH extended-compliance codes (bytes 192 and 116), because SFF-8024 lets a multi-application module report the encoding of its primary application -- a predicate over one code and one encoding byte is not a soundness proof. Its assessment is relative to a REQUESTED mode and splits three ways: contradictory under the observed profile, insufficient evidence for the requested mode, or not understood by this decoder. The delivered cable lands on the second, which is strictly weaker and strictly more defensible than calling its EEPROM self-contradictory. NOT ESTABLISHED, recorded rather than guessed: no clause attribution is carried on any mode row, since an unread clause number is a fabricated citation; the SFF-8024 code that attests 100GBASE-CR2 is not authored here for the same reason; byte 140 may hold the 0xFF escape rather than a rate, which needs the raw dump to settle; and stable 50G operation is evidence about 50G only -- it does not certify the 26.5625 GBd PAM4 path. NOT VERIFIED LOCALLY. Six attempts to typecheck this failed on the toolchain, never on the source: a pipeline-clobbered exit code, an installed gunbc that reds every section 4c annotation in the corpus, two memory-admission refusals, an OOM through the --entry path, and a dispatch that returned no output. CI is the instrument for this branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Enrol the cable-coding evidence: the discriminating RED is the real delivered leg The modules typechecked and executed nothing. hundred_gig_aggregate_collision and sff8636_assess_leg_coding had no consumer, which is specification-without-execution -- DESIGN section 5's deepest trap, and the shape that looks finished precisely because it type-checks. A scheduled review approved the diff without noting it; an approval reports no blocking defect, it does not establish that evidence exists. The discriminating subject is the real delivered part: the EEPROM reading from FS order FS260902769849 (part QDD-400G-4QPC015, leg SN S2630771509-4) is a fixture, and the central test asserts that this leg does NOT attest 100GBASE-CR2. That is the failure that shipped a half-rate fabric which links, pings clean at MTU 9000 and tests green everywhere else the fleet looks. Three arms keep it from being vacuous. The same leg IS admitted for 100GBASE-CR4, the mode it is actually coded for, so a decoder that refused everything would not pass. A synthetic correctly-coded leg is admitted for the requested mode -- and it is marked synthetic, because it validates the DECODER and establishes nothing about whether any physical cable works. A leg whose attestation arrives only via the byte-116 secondary code is still admitted, so a collapse back to reading only byte 192 reds here rather than being caught by inspection a second time. The units separation executes too: a PAM4 lane is asserted at 26.5625 GBd carrying 53.125 Gb/s encoded against a 50 Gb/s service rate, so re-fusing those fields or assigning a baud figure to a bits/s carrier stops the arithmetic from holding. The synthetic row's compliance code is deliberately 0 and says so: the real SFF-8024 assignment for 100GBASE-CR2 has not been read in this lane, and inventing the byte would be the fabricated citation this whole subject exists to catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Make the compliance byte the evidence, and stop proving contradiction from an unread field Review found the central witness DETERMINISTICALLY FALSE. For the delivered leg, every attested mode is NRZ while the encoding byte says PAM4, so the assessor returned CodingContradictsEncoding -- while the test, the commit message and the PR body all said CodingInsufficientForRequestedMode. Behaviour was documented and never executed, in the PR whose thesis is that unexecuted claims are worthless. The floor had died earlier on generated-artifact drift, so nothing had contradicted it; the witness could not even compile, because it constructed a sole_constructor type outside its defining module. The repair is to the PRECONDITION, not the expectation. Widening the test to accept any refusal would have been the absorbing fallback. A contradiction is a claim that the WHOLE declared profile disagrees with the encoding byte, and byte 116 was never read on this cable, so that claim is unavailable: SecondaryNotObserved is now distinct from SecondaryObservedEmpty, and an unread field can no longer stand as evidence of absence. THE COMPLIANCE BYTE NOW DECIDES. ExtendedCompliance previously carried an author-supplied `attested_modes` beside `code`, and the assessor read only the former, so the byte was decorative -- the synthetic fixture passed code 0 with a hand-written CR2 list and was admitted on its own say-so. Interpretation is now a function of the byte, an unmodelled code interprets to UNKNOWN rather than to an empty attestation, and the discriminating control this enables -- mutate only the code, hold every other field fixed, require the unknown result -- was structurally unwritable before. 0x0B carries a third entry: 50GBASE-CR2 subject to Clause 91 FEC, found by an external standards cross-check rather than by anything in this repository. The condition is retained, not flattened: it yields CodingAttestsRequestedModeSubjectToFec, and a test asserts it is attested AND not attested outright, because promoting a conditional entry to unconditional support is the silent widening the qualification exists to prevent. The stage0 mirror for std_measure.rs is regenerated from its authority (first_generation_equal=true, 157/157 adjudicated); the candidate diff was exactly the 13-line SymbolRate addition and nothing else. EXECUTED, not asserted: claim_executor --required-floor built from this tree reports verdict=FloorClean, claims_failed=0, with all 14 cable-coding claims in the executed population. The prior run of the same instrument red on this file with three located errors, so the pair discriminates rather than a green standing alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Remove the unconsumed helpers, and the two more the first removal killed A review noted render_link_mode has no in-tree consumer and judged it too small to flag. DESIGN section 6 disagrees: an artifact with no final consumer is a scaffold tell, and the reviewer's own stated test is whether the thing survives into the terminal architecture and is consumed by it. So this censuses every function the PR added rather than fixing the one item spotted -- which found a cascade the single fix would have left behind: modulation_label was consumed only by render_link_mode, and the String import only by modulation_label. sff8636_nominal_rate_from_byte222 also goes. It is CORRECT -- byte 222 is the escape target in units of 250 MBd -- but nothing reads it, because nobody has taken the raw dump yet. Writing a witness whose only purpose was to consume it would make the test its own justification rather than a final consumer. It returns with the ethtool raw reading that needs it. Verified by execution, and the verification earned its keep: the first attempt at this deletion cut at the match block's closing brace instead of the function's and left an orphaned brace, so the module did not parse and the floor refused with ZERO claims executed. A deletion needs the same evidence as an addition; "it only removed dead code" is how a file that cannot parse gets pushed. Floor now verdict=FloorClean, claims_failed=0, all 14 cable-coding claims in the executed population. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Two procurement gates: a purchase admits on a vendor claim, a receipt reconciles against a reading The substrate that landed in #10614 models the cable. It would not have stopped this order, because nothing consumes its findings at purchase time. These are the gates that do. THE ORDER WAS CORRECTLY ADMITTED, and the witness says so out loud because the opposite is the intuitive and wrong belief -- one this lane already published once and had to retract. FS's listing promises 4x100G legs of 2x50G PAM4, which is exactly the requirement, so a pre-purchase gate reading it ADMITS. A gate that refused would be reasoning from EEPROM bytes nobody could have had before delivery. So the two gates consume different evidence and may never share a carrier. Order admission takes a VENDOR CLAIM and refuses a purchase whose per-leg coding is undeclared -- the loud failure the subject exists to produce, since a part number does not determine a link contract and the EEPROM is field-programmed. Receipt reconciliation takes an OBSERVATION and joins it against the admitted claim; that is the gate that catches this class, an hour after delivery rather than after installation. The second is what keeps the first honest: a gate treating a claim as a reading would have greened here. CableLegCodingEvidence makes the grade structural rather than a flag, following the LandedCost split in product.inventory -- the arm IS the grade, so no path can promote a claim to a reading by forgetting to check something. ReceiptNotYetObserved is its own arm because SILENCE IS NOT AGREEMENT. A delivered assembly nobody has read must not reconcile as matching; that is exactly the state this fleet sat in while the fabric ran at half rate, and a model scoring it clean would have certified the outage. What the NIC requires is DECLARED BY THE FLEET, not derived from firmware. The ConnectX-7 was observed refusing 100G_2X; that rule has never been read here, and modelling an inferred algorithm as NVIDIA authority would turn a diagnosis into an invented specification. NOT VERIFIED: the seven claims in this witness have NOT been observed to execute. Local --required-floor reports FloorClean with planned unchanged at 3525 and zero of them in the population -- the module compiles and resolves, and something in floor discovery still does not offer it. A module-path fix (gunbc/product/X.dag declares `product.X`, not `gunbc.product.X`) was necessary but not sufficient. Reporting the gap rather than the green: a verdict whose population excludes its subject is not evidence, and this branch has already shipped one claim that no execution had ever checked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * Retire the contradiction arm rather than keep it unreachable; 00h is specified ignorance Three repairs to the merged substrate, all from external review against the primary SFF tables. BYTE 116 AT 00h MEANS "UNSPECIFIED", NOT "NO SECONDARY APPLICATION". The merged profile_is_complete treated SecondaryObservedEmpty as completing the profile, which licensed a verdict the bytes do not support -- the same defect as using an UNREAD field as evidence of absence, arrived at from the other side. Two axes were hiding inside that one boolean and are now separate: for 00h the field WAS observed (required_fields_observed) while its interpretation is still not exhaustive (interpretation_is_exhaustive). Collapsing them is what made the defect recur one level down. SELF-CONSISTENCY IS NOW A DIFFERENT FUNCTION FROM REQUESTED-MODE ASSESSMENT. The merged assessor reached its contradiction branch only when the requested mode was unattested, so whether a module was called self-contradictory depended on what the reader asked for. sff8636_profile_consistency takes no requested mode, so the law holds mechanically rather than by discipline. AND THE CONTRADICTION ARM IS RETIRED, NOT KEPT UNREACHABLE. Deciding one requires establishing that the encoding byte and the compliance codes describe the SAME INTERFACE. SFF-8024 says encoding primarily concerns the HOST interface while compliance codes concern the media application; those are one signal only for an unretimed passive assembly, and disagree BY DESIGN in a module converting NRZ host lanes to a PAM4 media channel (NVIDIA's MMS1V70-CM presents four 25G NRZ host lanes and one 100G PAM4 optical channel, both true at once). Nothing this decoder reads settles that scope: identifier 0x11 is carried by optical modules as readily as by copper, and the field that would settle it -- SFF-8636's transmitter-technology nibble -- has not been read here. Authoring its code values from memory would be the fabricated citation this subject exists to catch. A result variant belongs in the operational codomain only if some valid input can produce it under the stated evidence rules. So the concept survives as a typed undecidable naming its cause -- unread field, unspecified field, unmodelled code, or the standing interface-scope frontier -- and the next-rung trigger is written down: read the transmitter-technology field, then reintroduce the arm WITH a standards-supported positive fixture and its inverse control. 0x40 IS MODELLED WITH ITS PRIMARY CITATION (SFF-8024 Rev 4.14, Table 4-4, row 40h: 50GBASE-CR, 100GBASE-CR2, 200GBASE-CR4), which retires the placeholder code 0 the first head used as a stand-in for a byte it had not read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * One constructor, not two: the rewrite left a duplicate sff8636_leg_coding The previous commit's rewrite added a constructor while the original survived in a preserved section, and the compiler refused the whole floor rather than letting the second silently replace the first: "duplicate declaration 'sff8636_leg_coding' -- a second declaration of one name silently replaced the first". That is the single-authority rule enforced at the language level, and the diagnostic names the HARM rather than only the fact. It is also the fourth self-inflicted break in this lane from doing a structural edit with text slicing, and every one was caught by execution rather than by reading. The rule the lane keeps relearning: a change that feels mechanical -- removing a helper, splitting a function, renaming an arm -- earns the same verification as a new feature, and a dirty tree verifies nothing because the floor plans its changed set from COMMITTED state. Floor now verdict=FloorClean, claims_failed=0, with all six changed cable claims planned-and-passed: the delivered leg's consistency undecidable for want of a reading, the inverse control holding an unspecified secondary undecidable, the two completeness axes asserted separately, the fully-read profile undecidable only for interface scope, and the cited 0x40 row attesting the mode the primary does not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W * wip: rehome observation layer * wip: field census + exhaustive matches * wip: remaining exhaustive arms * Repoint the SFF-8636 model scope off the moved observation carrier; admit the four rehomed bindings cursor/composer-2.5 (review 61439) found that `extdeps_model_scope` still names `Sff8636LegCoding` — the observation carrier this branch moved to `product.cable_leg_observation`. The declarations phase of required CI agrees: CITED-DECLARATION-ABSENT, one finding, and it is the same symbol. Repointed the scope subject at `ComplianceInterpretation`, a byte-meaning declaration this module still declares, and deleted the orphaned annotation above it: that prose describes the observation carrier and already lives beside `SecondaryComplianceObservation` in the product module, so keeping a copy here was a §4c annotation about a type no longer in the file. The namespace wave-admission phase blocked on four `TargetChanged` bindings — the fixture constructors that spell `SecondaryNotObserved`, whose declarer moved between modules. Rostered with the layer-split reasoning and their own dissolution trigger. Touching that roster makes its consumed rows due, so the thirty gunbc#10639 rows are deleted here, adjudicated by the join they asked for rather than by their sentence: 8769167 is an ancestor of this base and main declares `SparkServingProbeCapture` in `gunbc.spark.training_ready`, so no run can produce those deltas. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two 400G QSFP-DD → 4×100G breakout cables (FS order
FS260902769849, partQDD-400G-4QPC015) link and run stably at half their purchased rate between a MikroTik CRS812 and ConnectX-7 NICs. The leg EEPROMs report extended compliance0x0B— which attests 25G-per-lane modes — and nothing in them attests 100GBASE-CR2, so the NIC refuses to enable100G_2X.The corpus could not state any of that:
100Gwas oneBandwidth, so 100GBASE-CR4 (4×25G NRZ) and 100GBASE-CR2 (2×50G PAM4) were indistinguishable. One spelling, two contracts — §3's meaning fork.extdeps.network.mikrotik_crs812already reserved this subject ("a separate orderable accessory … is a different subject with its own module").What lands
extdeps.ethernet.link_mode— aggregate is derived, never authored, so100Gis unsayable as a primitive. A lane carries three distinct numbers (service 50 Gb/s, encoded 53.125 Gb/s, symbol 26.5625 GBd) as three fields.std.measuregainsSymbolRatefor the baud axis.extdeps.transceiver.sff_8636— the EEPROM field layout, reading both extended-compliance codes (bytes 192 and 116). Assessment is relative to a requested mode and splits three ways: contradictory under the observed profile / insufficient evidence for the requested mode / not understood by this decoder. The delivered cable lands on the second.Corrections already applied from review
The first draft of this work got four things wrong, all corrected here:
Bandwidth— the module written to prevent the units conflation committed it. Byte 140 is 100 MBd, byte 222 is 250 MBd.Not established
No clause attribution on any mode row (an unread clause number is a fabricated citation); the SFF-8024 code attesting 100GBASE-CR2 is not authored here for the same reason; byte 140 may hold the
0xFFescape rather than a rate, which needsethtool -m raw onto settle; and the ConnectX-7's rule is our diagnosis of observed behavior, not NVIDIA's specification — it is not modelled as vendor authority.Six attempts to typecheck this failed on the toolchain, never on the source. Two are worth fixing independently of this PR:
/usr/local/bin/gunbcreds every §4c//annotation — 24,236 errors across the corpus. Any lane checking work with the installed binary gets a catastrophe unrelated to their diff.--entrypath appears to skip the whole-corpus memory admission gate. The gate refuses cleanly and recommends--entry;--entrythen OOM-killed atrc=137with zero diagnostics — the exact silent-kill its own message says it exists to prevent ("any count grepped from such a run is a memorial to a killed process").Please treat CI, not my say-so, as the verdict on whether this typechecks.
🤖 Generated with Claude Code
https://claude.ai/code/session_01AigrH3JpxgSJBmqHMBAr6W