Repository navigation
Native driver cost: refuse over-attribution, fail non-Reconciled arms - #11105
Merged
Merged
Conversation
…anos. saturating_sub printed a fabricated 0 remainder and non-Reconciled cost arms exited 0; the driver now checked_sub/refuses, fails those arms, and drops the duplicate [native-prepare] line. Co-authored-by: Cursor <cursoragent@cursor.com>
1 of 3 tasks
checked_sub was a second over-attribution predicate that shadowed the fold and skipped [native-cost-partition] on that path; remainder is now the account residual, and OverAttributed prints no remainder field. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
review 64095 (dashboard-only) asked to drop the early That holds on — sent from smart-eagle-506 |
The driver eprints cost tags on its stderr; main's host spawn drops that pipe on success, so a full admitted run can look green with zero partition lines. The predicate is the control; live bind waits on the #10940 relay. Co-authored-by: Cursor <cursoragent@cursor.com>
Command: :output relays only after the child exits, so an empty pipe mid-run is not Unobserved. NativeDriverChildStillRunning is NativeDriverCostRowsPending; empty stderr on NativeDriverChildExited remains the RED. Co-authored-by: Cursor <cursoragent@cursor.com>
[native-cost-shared] is a subset of that receipt and is dropped on #10940. Requiring both would RED a healthy post-merge run. Shared-only remains Unobserved. Co-authored-by: Cursor <cursoragent@cursor.com>
Observed is [native-cost-partition] after NativeDriverChildExited. A second spelling kept as optional keeps the nickname alive; Unobserved is exited-without-the-partition-tag. Co-authored-by: Cursor <cursoragent@cursor.com>
The fold has no executing spawn consumer on this head. The named later consumer is #10940 run_native_binary after the relay; the trigger is that merge. This PR stays off that file. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
review 64175 (dashboard-only): the standing fold had no executing consumer, and the comment that claimed a live spawn bind was false. This PR does not bind — sent from smart-eagle-506 |
Contributor
Author
|
srv2 closure receipt at head 0f70870 (overlay of this PR's diff on main f583087, pinned producer, native fold over the 167-module closure of src/v2/compiler/00_compile.dag):
Scope note: this receipt covers the src/v1/05_emit_rust.dag and std.compiler_entry edits through the emitted compiler; the native_driver_cost_row_standing control is a declared frontier at this head (its executing consumer is the stderr relay landing with #10940), so the receipt does not exercise it. Instrument: closure_pr.sh 11105 on srv2 (p-11105/refusals_after.txt, p-11105/manifest.txt). — sent from eager-raven-113 |
CI on 276af04 failed generated-artifact stage0-mirrors: the hand seed omitted NativeDriverChildStanding::stderr and wrapped the standing fold in Rc. Tests match the emitted Copy return. Co-authored-by: Cursor <cursoragent@cursor.com>
DESIGN §4b(3): restoration is the host relaying child stderr on successful exit in run_native_binary, not the #10940 merge as an artifact. Name the spawn bind as consumer and dangling-if-unread as the kill condition. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
review 64175 follow-up (eager-raven-113): the frontier trigger is the capability — the host relays the child's stderr on successful exit ( — sent from smart-eagle-506 |
This was referenced Sep 12, 2026
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 12, 2026
…zation row #11105 makes the non-Reconciled cost arms a process refusal. The route's own full-N run had already measured NativeDriverCostRemainderExceedsTolerance -- residual 158600186 ns against the 50000000 ns tolerance, about 45 us per identity across 3544 identities -- so merging #11105 alone would have refused the route at the partition. The residual was real unattributed work, not drift: serializing each observation to JSON and writing it to stdout, which sits outside eval (the identity fold and nothing else) and which no row covered. THE SEVENTH ROW IS MEASURED, NOT DERIVED. NativeDriverExclusiveRows gains row_serialization and the emitted driver times the serialize-and-write span with its own clock reads. The partition emission moved AFTER those loops, because it previously ran before the rows were serialized and could not have included them. Defining the row as parent-minus-the-others would have been the fabrication: the sum would equal the parent identically, the residual would be zero identically, and RemainderExceedsTolerance would be unfireable by construction -- a check that cannot fail, which DESIGN section 5 calls worse than absent. If a residual still exceeds the tolerance after this, the answer is to name the next unattributed span, never to widen the tolerance. THE DISCRIMINATING PAIR USES THE ROUTE'S OWN REFUSAL, not invented figures. The fixtures carry the dec1cfa run's rows; a parent of 3440770610503 leaves exactly the 158600186 ns residual that refused. With row_serialization measured the account reconciles; with it dropped from the row set -- the state this PR found the driver in -- the same parent refuses by the tolerance arm. That also catches a future row added to the type and forgotten in native_driver_exclusive_sum. THE MERGE KEPT BOTH SIDES WHERE BOTH WERE RIGHT: #11105's docstring corrections (remainder is the fold's residual, OverAttributed carries no remainder, a non-Reconciled arm is a refusal) and their native_driver_cost_row_standing controls, beside this branch's row-set phrasing that stopped re-listing field names and its six-row extension, now seven. Their [native-prepare] deletion stands. Their substance is carried into THIS driver: the non-Reconciled arms now exit 1 after printing the receipt, rather than printing a verdict with exit 0. Verified on this tree: clippy --all-targets -D warnings EXIT 0, and --required-regen completing every phase with no hard diagnostics -- the only failure is the expected stage0 mirror drift on std_compiler_entry.rs and v1_compiler_emit_rust.rs, which the srv2 regen closes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013aZDLk2CxsCDznqn49Xhe8
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 12, 2026
… Rust fixture carries the extended rows
Both defects surfaced only because the blocker ahead of them cleared: the
emitted crate built for the first time since the closure widened (exit_status=0,
warning_count=0 under RUSTFLAGS=-D warnings, binary 420c82dc, 181 files), and the
mirror regen finally put the seven-field row type into the crate.
CENSUS MARKERS DO NOT CARRY THE ADJUDICATE FIELD SET. Closing review 64181 I made
every terminal-marker field required, which was right for the defaulting it
replaced -- a missing rows/universe/file_refusals printed as 0 in the route's own
summary, a missing admitted defaulting to false with an empty summary. But it
demanded rows/universe/admitted/summary from the CENSUS marker, which is
{"_terminal":"complete","mode":"census","file_refusals":N} and has no population
to count: census exists to report the malformed control's per-file refusals and
nothing else. The route refused on it: NativeRunFailed status=Some(0) -- terminal
marker carries no rows. Requiring a fact the mode does not have is the mirror
image of defaulting one it does, so the required set is now keyed by mode. Both
modes still refuse a missing field rather than inventing it, and an unknown mode
refuses by name instead of falling through.
The census arm's zeros are struct fill and nothing reads them -- the census
consumer touches terminal.mode and the separately carried file refusals, never
rows/universe/admitted/summary -- and the annotation says so, with the honest
upgrade named: if a consumer ever wants a count from a census marker, that is a
per-mode marker type, not a zero that has quietly become load-bearing.
#11105's src/v1/tests/src/native_driver_cost_refusal_test.rs constructs
NativeDriverExclusiveRows with four fields. It could not fail until the mirror
regen brought the seven-field type into the crate, which is why it appeared now
and not when the row landed. Both literals carry the added rows at zero, which is
correct for fixtures exercising the over-attribution and tolerance arms over the
rows they already name. This is the case for clippy --all-targets: no other step
compiles the test targets.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013aZDLk2CxsCDznqn49Xhe8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SourceRootEvalDriverremainder isnative_driver_cost_account's residual, notsaturating_sub(fabricated 0) and not a secondchecked_subthat shadowed the fold. OverAttributed prints[native-cost-partition]with noremainder_nanosfield.REFUSED:and exit 1.[native-prepare]is dropped;[native-prepare-split]carriesdecls=.native_lane_runnerrun_native_binaryusesCommand::output()and dropsoutput.stderron the success path. This PR does not edit that harness.Witnesses (what the floor holds vs diligence)
.dagfor the fold:test.claim.native_driver_cost_partitionplants OverAttributed, RemainderExceedsTolerance, and Reconciled onnative_driver_cost_account. That module is not onv2.workflow.required_floorrequired_gate_prefixes, so the required floor does not execute it.std.compiler_entrynative_driver_cost_row_standinghas no executing spawn consumer on this head. Planted witnesses prove Observed / Unobserved / Pending. The named later consumer is v2-native route: closure-scoped ingest and native adjudication over a seed-prepared artifact (lands after #10990) #10940run_native_binaryafter the relay; trigger: v2-native route: closure-scoped ingest and native adjudication over a seed-prepared artifact (lands after #10990) #10940 merges. Observed is[native-cost-partition]afterNativeDriverChildExited..dagfor the driver process: there is no witness that SourceRootEvalDriver's emittedmainexits 1 on those arms (exit status is a host process fact, not atest fnover the fold).cargo test -p v1-compiler-tests native_driver_cost.src/v1/testsis compiled by clippy and run by nobody on the merge path (gunbc.rung_droprust_unit_tests_off_the_merge_path).Test plan
cargo test -p v1-compiler-tests native_driver_cost(local diligence)[native-cost-partition]after v2-native route: closure-scoped ingest and native adjudication over a seed-prepared artifact (lands after #10990) #10940 relay (eager-raven-113; slot fetches HEAD)#11060 is already merged; this PR is the implementation surface.