The wall deadline enforces the same figure the floor reports

[gunbai-bot]

The defect: one question, two answers, one already adjudicated

Shared-artifact fill is not the paying claim's marginal cost — the operator ruling of 2026-08-27,
which required_floor_runner states at length beside the subtraction it already performs on the
reported figure, and which budgeted_cpu_nanos implements on the CPU deadline.

The wall deadline did neither. It was armed on a raw Instant, so a claim that happened to fill a
shared memo was charged, on the enforcing clock, for work every later claim reads warm — while the
same run's receipt reported that claim's marginal wall as a small figure well under the line. Two
answers to has this claim spent its wall budget, and the repo had already decided which one is
right.

This is not a relaxation

• The 8000ms line is unchanged.
• What arms the deadline is unchanged.
• The CPU side is untouched.

What changes is who is charged. Both halves of the cost are still counted, still attributed and
still printed on the per-claim [floor-shared-fill] line — split, never dropped, which is what the
ruling requires.

It does mean the wall deadline fires less often, and that is the thing to be clear about. It
fires correctly rather than less: a claim is now refused when its own marginal wall exceeds the
line, and not when someone else's memo fill landed inside its interval. A claim that genuinely
spends 8s of its own wall time still refuses, and the positive control below is exactly that case.

The residue was declared, not discovered

The note above budgeted_cpu_nanos has said since the CPU-side repair:

WHAT THIS DOES NOT REACH: the WALL deadline (witness_wall_deadline) is still armed on a raw
Instant and still charges a fill to whichever claim paid it. Every interruption in the repaired
population was on the CPU clock — 44 of 44 Cpu on run 33185280160 — so the wall half is a real,
currently unexercised residue, not a fix silently omitted.

Required run 34097895230 exercised it. test.claim.long.carrier_reference_integrity_witness_test.carrier_ref_hand_authored_census_is_zero_refusals
is INTERRUPTED-BEFORE-VERDICT raised_by=wall_deadline while reporting cpu_at_least=179ms/500ms
and wall_at_least=184ms/8000ms — its own marginal figures two orders under both lines — because a
module_path_index fill of fill_ms=20579 landed inside its interval. A declared residue that
becomes reachable is a repair obligation, not new debt.

The mechanism

The fill nanos standing at arm time are carried in the deadline itself, so every poll subtracts what
accrued since. That is the same cancellation the CPU clock gets from reading one netted function at
both ends, and it means wall_deadline_remaining_ms and wall_deadline_exceeded_error — the read
used to bound subprocess waits and the one that refuses — cannot disagree with each other or with
the report. Monotone as a deadline requires: the fill counter only rises, and it rises inside the
interval being netted, so the subtraction can never make elapsed time run backwards.

The evidence

wall_deadline_charges_marginal_wall_and_still_refuses_without_a_fill, both arms over one budget and
one elapsed interval so the only variable is whether a fill happened inside it:

• RED: a fill wider than the interval must not be charged to the claim that paid it. Executed
  with the netting reverted, this assertion fails —
  a shared-artifact fill wider than the interval was charged to the claim that paid it — and the
  fix was restored afterwards.
• Positive control: the same overrun with no fill recorded must still refuse. Without it,
  deleting the deadline outright would satisfy the RED.

The RED is authorable here because the fill is a process-wide counter a test can move directly,
which is what makes this the level the check belongs at rather than a floor-run observation.

Scope

The netting and nothing else. This is held ahead of #10741 (the keyed declaration-index read), whose
change is what exercised the residue; that PR carries the measurement and this one carries the
enforcement repair, so neither review has to judge two unrelated things.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D8MN5JAQH477n6jXerQc6i