Native driver cost: refuse over-attribution, fail non-Reconciled arms

dag/std/compiler_entry.dag

@@ -49,12 +49,14 @@ import std.measure {
 // executes; its contract is that every universe member reaches exactly one terminal observation,
 // never a silent remainder. The process re-derives its own exclusive wall partition on stderr
 // as `[native-cost-partition]` (same receipt shape as claim_batch `[cost-partition]`: exclusive
-// load / context / prepare / eval over parent_span_nanos) plus one `[native-prepare]` line per
-// unique module and one `[native-prepare-split]` line that partitions prepare into resolve vs
-// infer (the two halves native_test_resolve_module / native_test_infer_resolved). The
+// load / context / prepare / eval over parent_span_nanos) plus one `[native-prepare-split]`
+// line per unique module that partitions prepare into resolve vs infer (the two halves
+// native_test_resolve_module / native_test_infer_resolved) and carries decls=. The
 // `[native-cost-partition]` verdict is native_driver_cost_account over NativeDriverExclusiveRows,
-// not a second copy of the reconcile law. Re-run the emitted binary over a universe file to
-// re-derive the numbers.
+// not a second copy of the reconcile law: remainder_nanos is that fold's residual, and
+// OverAttributed carries no remainder field (underflow is not a number). A non-Reconciled
+// arm is a process refusal, not a printed string with exit 0. Re-run the emitted binary over
+// a universe file to re-derive the numbers.
 
 type CompilerEntryDriver
   = RetainedHostCliKernel
@@ -118,3 +120,40 @@ fn native_driver_cost_account(
     }
   }
 }
+
+// DECLARED FRONTIER (DESIGN §3c) — not a live bind on this head.
+// native_driver_cost_row_standing has no executing consumer here: planted witnesses
+// prove the fold; they do not exercise the spawn. Consumer: native_lane_runner
+// run_native_binary. Route: after the child exits, that spawn reads the relayed
+// stderr into NativeDriverChildExited and folds native_driver_cost_row_standing,
+// refusing NativeDriverCostRowsUnobserved. Trigger (DESIGN §4b(3) capability, not
+// an artifact): the host relays the child's stderr on successful exit
+// (native_lane_runner run_native_binary as changed by #10940). Kill condition: if
+// that relay lands and this standing is still unread, the row is dangling. Until
+// the capability holds, this PR stays off native_lane_runner (deep-cat-655 owns
+// it). Observed is [native-cost-partition] after exit; Unobserved is exited
+// without that tag; Pending is the child still running. On main, Command::output
+// drops the pipe on success (eager-raven-113 #11060 universe receipt: 15508s
+// admitted, 3536 verdict rows, zero partition tags in host-captured stderr). The
+// relay is exit-gated, not streamed.
+
+type NativeDriverChildStanding
+  = NativeDriverChildExited { stderr: String }
+  | NativeDriverChildStillRunning
+
+type NativeDriverCostRowStanding
+  = NativeDriverCostRowsObserved
+  | NativeDriverCostRowsUnobserved
+  | NativeDriverCostRowsPending
+
+fn native_driver_cost_row_standing(child: NativeDriverChildStanding) -> NativeDriverCostRowStanding {
+  match child {
+    NativeDriverChildStillRunning => NativeDriverCostRowsPending
+    NativeDriverChildExited { stderr } =>
+      if string_contains(s: stderr, pattern: "[native-cost-partition] ") {
+        NativeDriverCostRowsObserved
+      } else {
+        NativeDriverCostRowsUnobserved
+      }
+  }
+}

dag/test/claim/native_driver_cost_partition_witness_test.dag

@@ -8,6 +8,12 @@ import std.compiler_entry {
   NativeDriverCostRemainderExceedsTolerance,
   native_driver_cost_account,
   native_driver_cost_remainder_tolerance_nanos,
+  native_driver_cost_row_standing,
+  NativeDriverChildExited,
+  NativeDriverChildStillRunning,
+  NativeDriverCostRowsObserved,
+  NativeDriverCostRowsUnobserved,
+  NativeDriverCostRowsPending,
   native_driver_exclusive_sum
 }
 
@@ -75,3 +81,31 @@ test fn a_remainder_past_tolerance_is_not_a_partition() -> Bool {
     NativeDriverCostOverAttributed { sum_exclusive: _, parent_span: _ } => false
   }
 }
+
+test fn a_completed_capture_with_no_cost_rows_is_unobserved() -> Bool {
+  match native_driver_cost_row_standing(child: NativeDriverChildExited { stderr: "" }) {
+    NativeDriverCostRowsUnobserved => true
+    NativeDriverCostRowsObserved => false
+    NativeDriverCostRowsPending => false
+  }
+}
+
+test fn a_planted_partition_line_is_observed() -> Bool {
+  match native_driver_cost_row_standing(
+    child: NativeDriverChildExited {
+      stderr: "[native-cost-partition] {\"verdict\":\"NativeDriverCostReconciled\"}\n"
+    }
+  ) {
+    NativeDriverCostRowsObserved => true
+    NativeDriverCostRowsUnobserved => false
+    NativeDriverCostRowsPending => false
+  }
+}
+
+test fn a_child_that_has_not_exited_is_pending_not_unobserved() -> Bool {
+  match native_driver_cost_row_standing(child: NativeDriverChildStillRunning) {
+    NativeDriverCostRowsPending => true
+    NativeDriverCostRowsObserved => false
+    NativeDriverCostRowsUnobserved => false
+  }
+}

src/v1/05_emit_rust.dag

@@ -16971,8 +16971,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "                        prepare_infer_nanos += this_infer;\n",
       "                        prepare_samples.push(this_prepare);\n",
       "                        prepare_ok += 1;\n",
-      "                        eprintln!(\"[native-prepare] module=\{dotted\} nanos=\{this_prepare\} decls=\{\} outcome=accepted\", declarations.len());\n",
-      "                        eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=\{this_infer\} prepare_nanos=\{this_prepare\} outcome=accepted\");\n",
+      "                        eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=\{this_infer\} prepare_nanos=\{this_prepare\} decls=\{\} outcome=accepted\", declarations.len());\n",
       "                        for declaration in declarations {\n",
       "                            let eval_start = Instant::now();\n",
       "                            let observation = native_test_eval_one(prepared.clone(), declaration.clone());\n",
@@ -16991,8 +16990,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "                        prepare_infer_nanos += this_infer;\n",
       "                        prepare_samples.push(this_prepare);\n",
       "                        prepare_refused += 1;\n",
-      "                        eprintln!(\"[native-prepare] module=\{dotted\} nanos=\{this_prepare\} decls=\{\} outcome=refused\", declarations.len());\n",
-      "                        eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=\{this_infer\} prepare_nanos=\{this_prepare\} outcome=infer_refused\");\n",
+      "                        eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=\{this_infer\} prepare_nanos=\{this_prepare\} decls=\{\} outcome=infer_refused\", declarations.len());\n",
       "                        let reason = diagnostics.tail.last().map(|d| d.reason.clone()).unwrap_or_else(|| diagnostics.head.reason.clone());\n",
       "                        for declaration in declarations {\n",
       "                            let observation = NativeTestObservation {\n",
@@ -17016,8 +17014,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "                prepare_resolve_nanos += this_resolve;\n",
       "                prepare_samples.push(this_prepare);\n",
       "                prepare_refused += 1;\n",
-      "                eprintln!(\"[native-prepare] module=\{dotted\} nanos=\{this_prepare\} decls=\{\} outcome=refused\", declarations.len());\n",
-      "                eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=0 prepare_nanos=\{this_prepare\} outcome=resolve_refused\");\n",
+      "                eprintln!(\"[native-prepare-split] module=\{dotted\} resolve_nanos=\{this_resolve\} infer_nanos=0 prepare_nanos=\{this_prepare\} decls=\{\} outcome=resolve_refused\", declarations.len());\n",
       "                let reason = diagnostics.tail.last().map(|d| d.reason.clone()).unwrap_or_else(|| diagnostics.head.reason.clone());\n",
       "                for declaration in declarations {\n",
       "                    let observation = NativeTestObservation {\n",
@@ -17048,7 +17045,6 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        eval: nanosecond(native_cost_i64(eval_nanos)),\n",
       "    });\n",
       "    let exclusive_sum = nanosecond_count(native_driver_exclusive_sum(exclusive.clone())) as u128;\n",
-      "    let remainder_nanos = parent_span_nanos.saturating_sub(exclusive_sum);\n",
       "    let shared_nanos = load_nanos + context_nanos;\n",
       "    let shared_per_identity = if identities == 0 { 0 } else { shared_nanos / identities as u128 };\n",
       "    let eval_mean = if eval_samples.is_empty() { 0 } else { eval_nanos / eval_samples.len() as u128 };\n",
@@ -17061,14 +17057,14 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        nanosecond(native_cost_i64(parent_span_nanos)),\n",
       "        exclusive,\n",
       "        native_driver_cost_remainder_tolerance_nanos(),\n",
-      "    );\n",
+      "    );\n    let remainder_nanos = match accounting.as_ref() { NativeDriverCostAccounting::NativeDriverCostOverAttributed \{ .. \} => None, NativeDriverCostAccounting::NativeDriverCostReconciled \{ residual, .. \} | NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance \{ residual, .. \} => Some(nanosecond_count(residual.clone()) as u128) };\n",
       "    let verdict = match accounting.as_ref() {\n",
       "        NativeDriverCostAccounting::NativeDriverCostOverAttributed \{ .. \} => r#\"NativeDriverCostOverAttributed\"#,\n",
       "        NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance \{ .. \} => r#\"NativeDriverCostRemainderExceedsTolerance\"#,\n",
       "        NativeDriverCostAccounting::NativeDriverCostReconciled \{ .. \} => r#\"NativeDriverCostReconciled\"#,\n",
       "    };\n",
-      "    eprintln!(\"[native-cost-partition] {}\", serde_json::json!(\{ \"basis\": \"native_driver_wall\", \"basis_note\": \"single-threaded SourceRootEvalDriver wall; exclusive rows partition parent_span_nanos\", \"producer\": \"std.compiler_entry.SourceRootEvalDriver\", \"verdict\": verdict, \"tolerance_nanos\": tolerance_nanos, \"parent_span_nanos\": parent_span_nanos, \"exclusive\": \{ \"load\": load_nanos, \"context\": context_nanos, \"prepare\": prepare_nanos, \"eval\": eval_nanos \}, \"sum_exclusive_nanos\": exclusive_sum, \"remainder_nanos\": remainder_nanos, \"source_files\": source_files, \"identities\": identities, \"unique_modules\": unique_modules, \"file_refusals\": file_refusals, \"prepare_ok\": prepare_ok, \"prepare_refused\": prepare_refused, \"shared_nanos\": shared_nanos, \"shared_per_identity_nanos\": shared_per_identity, \"prepare_mean_nanos\": prepare_mean, \"prepare_p50_nanos\": native_cost_quantile_nanos(&prepare_samples, 1, 2), \"prepare_p95_nanos\": native_cost_quantile_nanos(&prepare_samples, 19, 20), \"prepare_max_nanos\": prepare_samples.last().copied().unwrap_or(0), \"eval_mean_nanos\": eval_mean, \"eval_p50_nanos\": native_cost_quantile_nanos(&eval_samples, 1, 2), \"eval_p95_nanos\": native_cost_quantile_nanos(&eval_samples, 19, 20), \"eval_max_nanos\": eval_samples.last().copied().unwrap_or(0), \"prepare_share_per_identity_nanos\": prepare_share_per_identity, \"floor_per_identity_nanos\": floor_per_identity, \"mean_decls_per_module\": decls_per_module, \"prepare_resolve_nanos\": prepare_resolve_nanos, \"prepare_infer_nanos\": prepare_infer_nanos \}));\n",
-      "}\n")
+      "    let mut partition = serde_json::json!(\{ \"basis\": \"native_driver_wall\", \"basis_note\": \"single-threaded SourceRootEvalDriver wall; exclusive rows partition parent_span_nanos\", \"producer\": \"std.compiler_entry.SourceRootEvalDriver\", \"verdict\": verdict, \"tolerance_nanos\": tolerance_nanos, \"parent_span_nanos\": parent_span_nanos, \"exclusive\": \{ \"load\": load_nanos, \"context\": context_nanos, \"prepare\": prepare_nanos, \"eval\": eval_nanos \}, \"sum_exclusive_nanos\": exclusive_sum, \"source_files\": source_files, \"identities\": identities, \"unique_modules\": unique_modules, \"file_refusals\": file_refusals, \"prepare_ok\": prepare_ok, \"prepare_refused\": prepare_refused, \"shared_nanos\": shared_nanos, \"shared_per_identity_nanos\": shared_per_identity, \"prepare_mean_nanos\": prepare_mean, \"prepare_p50_nanos\": native_cost_quantile_nanos(&prepare_samples, 1, 2), \"prepare_p95_nanos\": native_cost_quantile_nanos(&prepare_samples, 19, 20), \"prepare_max_nanos\": prepare_samples.last().copied().unwrap_or(0), \"eval_mean_nanos\": eval_mean, \"eval_p50_nanos\": native_cost_quantile_nanos(&eval_samples, 1, 2), \"eval_p95_nanos\": native_cost_quantile_nanos(&eval_samples, 19, 20), \"eval_max_nanos\": eval_samples.last().copied().unwrap_or(0), \"prepare_share_per_identity_nanos\": prepare_share_per_identity, \"floor_per_identity_nanos\": floor_per_identity, \"mean_decls_per_module\": decls_per_module, \"prepare_resolve_nanos\": prepare_resolve_nanos, \"prepare_infer_nanos\": prepare_infer_nanos \});\n    if let Some(r) = remainder_nanos { partition[\"remainder_nanos\"] = serde_json::json!(r); }\n    eprintln!(\"[native-cost-partition] {}\", partition);\n",
+      "    match accounting.as_ref() { NativeDriverCostAccounting::NativeDriverCostOverAttributed \{ sum_exclusive, parent_span \} => { eprintln!(\"REFUSED: native driver cost OverAttributed \{\{ sum_exclusive_nanos: \{\}, parent_span_nanos: \{\} \}\}\", nanosecond_count(sum_exclusive.clone()) as u128, nanosecond_count(parent_span.clone()) as u128); std::process::exit(1); } NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance \{ residual, tolerance \} => { eprintln!(\"REFUSED: native driver cost RemainderExceedsTolerance \{\{ residual_nanos: \{\}, tolerance_nanos: \{\} \}\}\", nanosecond_count(residual.clone()) as u128, nanosecond_count(tolerance.clone()) as u128); std::process::exit(1); } NativeDriverCostAccounting::NativeDriverCostReconciled \{ .. \} => {} }\n}\n")
   }
 }
 

src/v1/stage0/src/std_compiler_entry.rs

@@ -2,7 +2,9 @@
 // Source module: std.compiler_entry
 
 use self::CompilerEntryDriver::*;
+use self::NativeDriverChildStanding::*;
 use self::NativeDriverCostAccounting::*;
+use self::NativeDriverCostRowStanding::*;
 pub use crate::std_measure::Nanosecond;
 pub use crate::std_measure::{
     millisecond, millisecond_to_nanosecond, nanosecond, nanosecond_count,
@@ -107,9 +109,61 @@ pub fn native_driver_cost_account(
     }
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeDriverChildStanding {
+    NativeDriverChildExited { stderr: String },
+    NativeDriverChildStillRunning,
+}
+impl NativeDriverChildStanding {
+    pub fn stderr(&self) -> String {
+        match self {
+            NativeDriverChildStanding::NativeDriverChildExited { stderr: __val, .. } => {
+                __val.clone()
+            }
+            NativeDriverChildStanding::NativeDriverChildStillRunning => {
+                panic!("no stderr on unit variant")
+            }
+        }
+    }
+}
+
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
+#[serde(tag = "_variant")]
+pub enum NativeDriverCostRowStanding {
+    NativeDriverCostRowsObserved,
+    NativeDriverCostRowsUnobserved,
+    NativeDriverCostRowsPending,
+}
+
+pub fn native_driver_cost_row_standing(
+    child: Rc<NativeDriverChildStanding>,
+) -> NativeDriverCostRowStanding {
+    match (*child.clone()).clone() {
+        NativeDriverChildStanding::NativeDriverChildStillRunning => {
+            NativeDriverCostRowStanding::NativeDriverCostRowsPending
+        }
+        NativeDriverChildStanding::NativeDriverChildExited { stderr: stderr, .. } => {
+            if v1_rt::string_contains(&stderr, "[native-cost-partition] ".to_string()) {
+                NativeDriverCostRowStanding::NativeDriverCostRowsObserved
+            } else {
+                NativeDriverCostRowStanding::NativeDriverCostRowsUnobserved
+            }
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RetainedHostCliKernel;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct DirectIngestDriver;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct SourceRootEvalDriver;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct NativeDriverCostRowsObserved;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct NativeDriverCostRowsUnobserved;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct NativeDriverCostRowsPending;

src/v1/tests/src/lib.rs

@@ -12,6 +12,9 @@ mod grounded_shared_carrier_wrap_test;
 #[cfg(test)]
 mod unknown_pipeline_driver_refusal_test;
 
+#[cfg(test)]
+mod native_driver_cost_refusal_test;
+
 #[cfg(test)]
 mod ambiguous_prefix_infix_newline_test;
 #[cfg(test)]