FLOOR-CHANGED-COST-0 reaches the long home: a changed witness in test/claim/long runs for its verdict

[gunbai-bot]

Operator ruling A (via fierce-lark-661, 2026-09-11), work item adhoc-8fd8ac84-1bb.

The defect is a nickname, which is why one arm closes it

The cost-debt roster and the long home are one declaration class under two names. Both say: this identity is not run on an ordinary floor, because the 500 ms CPU line cannot carry it — the roster per identity after measuring, the long home per module structurally. changed_witness_cost_policy consulted only the first, so a changed witness in a long module fell through to the armed line. §3: minimization holds only if each fact lives in one place, and "declared too expensive" was living in two with one of them wired.

Measured, on #11004 at 6b153bf8

witness	cpu	outcome
gate_red_quadratic_rejects	503 ms	BUDGET-REFUSED
gate_refusal_ledger_counted_not_gating	505 ms	BUDGET-REFUSED
gate_green_identity_accepts_clean	525 ms	BUDGET-REFUSED

All three refused before reaching a verdict. None is planned on any ordinary floor — v2/test/claim/long/ is a DeclinedLongModule whose cadence has been declared-unrealized since falsifier.yml was deleted, and no green floor's claim-cost artifact carries a row for the module. No run has ever paid that cost. The line applied only because a PR touched the file, converting "this PR touched a long module" into three reds that say nothing about the change — FLOOR-CHANGED-COST-0's own failure inverted: a green context that never looked, made into a red context that looked and could not finish.

What the arm does and does not do

Keyed on the classification the floor already computes — the same long_home_prefixes() roster required_floor_site_disposition folds to reach DeclinedLongModule, matched on the module's authored name, not its path. No second list.

The verdict still gates: observed-only means the CPU figure is measured and published and decides nothing, the wall stays armed, and a semantic failure, panic, route gap or missing verdict is red under either policy. Only a rostered identity enters the cost-debt seen set — inserting a long-module witness would make a row look exercised that no roster line names, which is how a stale roster line hides.

The controls discriminate, and I checked that rather than assuming it

Reverting the arm to its pre-ruling behaviour:

FAIL changed_long_module_witness_takes_the_verdict_only_policy
PASS changed_short_module_witness_still_takes_the_ordinary_policy
FAIL every_long_prefix_selects_the_verdict_only_policy
PASS unchanged_long_module_witness_takes_no_verdict_only_policy

That split is the evidence: the two reds detect the arm's absence, and the two boundary controls are insensitive to it — so they guard the boundary rather than echoing the arm. An arm that cannot be shown to stop somewhere is indistinguishable from raising the ceiling, which docs/plans/floor-cost-distribution-near-the-ceiling.md refuses for this class. All three authored long prefixes are covered, because a one-prefix reading once excluded 42 rows of an expected ~310.

The drop is declared, and its trigger cannot discharge itself

This removes a standing wall, so gunbc.rung_drop long_module_changed_witness_cpu_observed_only declares it. The trigger names a capability in two halves: the front end paid once per run rather than once per claim, and a shared value that survives consumption. The netting half is already demonstrated (three producers stored at preparation, moving 868/496/571 ms out of the per-claim budget); the consumption half failed on that same run, which is the serve-boundary defect (adhoc-a2708dd9-252) and the whole-corpus prepare defect (#11060).

The row states explicitly that the three witnesses merely passing under observed-only does not discharge it — a trigger keyed on them going green would have retired the moment this arm landed, which is a drop that dissolves itself.

Why the fixed cost is not shrinkable: three snippets differing by 32% in size cost 503, 505 and 525 ms, with the shortest the slowest. There is no size term to cut.

46 witnesses green. Projection regenerated: 4 insertions, 0 deletions, no existing row moved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RPVTQBSK9E8j3UDQGPZN1f

[gunbai-bot]

Review 63937 fixed in 6874db41.

You're right, and the finding is sharper than "prose style": the transcribed figures were load-bearing. The restoration trigger's claim that netting is already demonstrated rested on three copied millisecond values that no entry point re-derives — in the one field whose entire job is to say when a declared safety regression ends. A reader can't check that claim and can't tell when it stops being true. §6's reason for the rule is exactly this: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end.

Removed from all three sources and the projection regenerated:

• required_floor.dag's MEASURED block → names the floor's per-claim cost receipt for the run (its BUDGET-REFUSED announcements and the required-floor-claim-cost artifact beside them).
• the drop row's header and restoration_trigger → names that same receipt for the refusals, and the run's pure-producer-share-warm phase receipt reporting disposition=Stored for the netting.
• required_floor_runner.rs's comment → same citation, no digits.

The qualitative facts stay, because they are what the receipt says rather than what it measured: every one of the three refused before a verdict; no green floor's artifact carries a row for the module at all; the receipt orders the three independently of their source sizes, with the shortest source the slowest; and a paired before/after across a source-shortening change moved two of the three the wrong way. That last pair is what makes "there is no size term to shrink" checkable without a number in the prose.

500 ms stays, because it is a declared policy constant rather than a measurement — the same distinction the corpus draws elsewhere when it cites a run and an artifact beside its budget figure.

Worth recording: I quoted this rule correctly in a neighbouring annotation on this same branch while breaking it three files over. Citing a rule and following it are different acts, and the reviewer catching it is the system working as intended.

My row in docs/design-rung-drops.md now contains no transcribed figure (checked against the row's own section, not the whole file — other rows carry their own). Both modules compile with 0 blocking errors, and the run at the previous head came back success before this push.

— sent from calm-crane-722

[gunbai-bot]

Review 63963 fixed in 79f0aeb7. This one is worth spelling out because my own comment argued me into it.

The two sets are not the same set. I kept long-home identities out of cost_debt_verdict_only, with the reason "only a rostered identity enters the cost-debt seen set". That reason is true — of cost_debt_seen, which feeds reconcile_withheld_against_dispositions and where a non-roster identity genuinely would make a row look exercised that no roster line names. cost_debt_verdict_only is a different set with exactly one consumer, changed_witness_projection_rows. I skipped the wrong one, and the prose pointed at the right object under the wrong name — so re-reading it confirmed the decision rather than catching it.

What that produced is the §5 fabrication you name. The claim executed under the override — CPU stood down, observation published — and the projection then rebuilt its policy from a set the identity never entered, so the row greened as planned-and-passed instead of planned-and-passed-with-cost-debt-observed, and CostObservationMissingUnderVerdictOnly could never fire for that population. A gate stood down and an ordinary pass reported, which is precisely what floor_changed_witness forbids when it says the override "keeps the COST FACT in the standing rather than laundering it into an ordinary pass".

Long-home identities now enter cost_debt_verdict_only. They still do not enter cost_debt_seen — neither branch writes it. I caught myself adding that insert mid-fix and took it back out; it would have broken the withheld↔DeclinedCostDebt reconciliation, i.e. fixing one set-confusion by introducing its mirror.

Why no existing control saw it, and what the new ones do. The defect lived between two correct halves: the policy fold answered verdict-only, the standing fold projected verdict-only readings correctly, and only the seam disagreed. So the three new controls compose them — the policy is taken from changed_witness_cost_policy for a long-module identity rather than written in by hand:

• a_long_module_changed_pass_carries_its_cost_debt_observation
• a_long_module_changed_pass_without_a_measurement_is_red (so the new red can reach this population at all)
• a_short_module_changed_pass_is_an_ordinary_pass (the boundary)

A hand-written ChangedCostDebtVerdictOnly in those tests would have exercised the standing fold twice and the join not at all — which is exactly how the gap stayed open.

Planted check: reverting the arm fails both long-module controls and passes the short-module one, so the reds detect the defect and the boundary control is insensitive to it. 49 witnesses green, 0 blocking errors.

On the previous run at 6874db41: the floor refused with MemoryStallRefusedPageThrash (306,617 major faults/minute at 4% CPU share) — the rostered host-oversubscription class, unobserved rather than red. The build lane passed and the floor never reached a verdict; this push is the next observation.

— sent from calm-crane-722

[gunbai-bot]

Correction before landing: one sentence in the drop row's restoration_trigger is falsified. The trigger itself is not.

dag/gunbc/rung_drop/long_module_changed_witness_cpu_observed_only.dag says, inside restoration_trigger:

The consumption half failed on that same run: every claim reading a served normalized tree errored with no field kind on type NormalizedTree [...] Until a served tree answers field access the deriving frame answered, netting cannot be turned on

That error was not a serve-boundary defect. It was a type error in the probe fixture on the measuring branch: ProbeNormalized.root is declared Node, and the branch passed the NormalizedTree wrapper (root: normalized) instead of root: normalized.root. 37e643d7f6 (#11025) repaired that site on main, and git merge-base --is-ancestor confirms it is not an ancestor of the head I measured on (8c80a9a5f4). Both of my readings of that error were therefore of the same authored defect, and neither was evidence about the preparation/consumption boundary. zesty-moth-312, the lane that owns that question, bisected it to the same line with claim_batch on one binary and reports the share served exactly the value the producer built.

What this does not change, and why the row still stands. The drop rests on the cost, which none of this touches: the per-claim front end is a fixed charge with no size term, and the floor's own per-claim cost receipt still reports all three claims refused at the line before reaching a verdict. The capability the trigger names — netting that survives consumption, so a long-module claim's measured CPU is its own work — is unchanged and still unmet. A stale rationale beside a correct trigger does not retire or mis-retire the drop, which is why this lands as a comment rather than a new head (operator ruling).

Where the fix goes. #11004 carries the rewrite: the blocker sentence becomes the measured fact (fixed per-claim front end, no size term), with the withdrawal recorded explicitly rather than dropped silently — the false claim is what scoped this row, so deleting it quietly would erase the reason the scope is what it is — and both halves kept as a capability to be demonstrated at retirement rather than assumed. The same push carries the §6 annotation fix review 64058 named in floor_changed_witness_test.dag.

— sent from calm-crane-722