Repository navigation
File two failure-mode classes: first-touch reclaim billing, and increment-only enrolment gate - #11183
Merged
Merged
Conversation
…, and an increment-only enrolment gate. Both classes were measured today; the rows carry the uncertainties rather than rounding them into coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
…ew failure-mode rows. The list balanced as data; the combined projection renders one receipt per bullet, so the opener and closer became orphaned across bullets. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 12, 2026
Main landed #11183, which files two new recurring-failure-mode rows; one of them cites required_floor_claim_cpu_safety_limit_ms, the constant this branch deletes. The citation census on the PR merge ref found it — this branch's own tree never contained the file, which is why a branch-local grep read clean. The repair follows in the next commit.
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 12, 2026
…eletes #11183 landed on main while this branch was in flight and filed `admitted_reclaim_charged_by_first_touch`, whose INVALID STATE is stated over `required_floor_claim_cpu_safety_limit_ms` — the constant this branch deletes. The citation census on the PR merge ref caught it; a branch-local grep read clean, because the file was never in this tree. THE TWO LANES REACHED THE SAME PLACE FROM OPPOSITE ENDS, and the overlap is worth naming rather than merging away. That row's specimen is `affected_set_universe_gate_process` at a byte-identical eval_steps of 2884 whose CPU moves with the run's memory pressure; the evidence this branch was ruled on is the same identity at the same constant 2884 reading 34 / 192 / 433 / 455 / 511 ms across five heads of #11173 that changed no executable source. One lane filed the class; the other removed the ceiling it is a class of. WHAT THIS COMMIT DOES AND DELIBERATELY DOES NOT DO. It repairs the citation (evidence now names `required_floor_claim_eval_step_budget` and `claim_cost_basis_standing`), corrects the INVALID STATE sentence to say where a per-claim CPU ceiling still lives (the fast lane, and floor_enrolment_margin), and adds two receipts recording that the cited subject was deleted rather than repaired, with the re-derived figures. It does NOT move that row's rung, fire its trigger, or retire it. Its trigger asks that a first-touch refault cannot inhabit the claim's ceiling; for the required floor's ceiling it now cannot, because eval_steps is a property of the tree and not a quantity the kernel can bill a refault to — but that is discharge BY REMOVAL rather than by the attribution the trigger describes, and it is not corpus-wide. Whether that satisfies the trigger is the row owner's call, and the receipt says so in terms rather than leaving a successor citation to imply it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BRTesxTRxhRGKX1py2pHVC
briansrls
pushed a commit
that referenced
this pull request
Sep 12, 2026
#11199) * File the class: a change green in one repository breaks another that no gate compiles with it (#11100) * File the class: a change green in one repository breaks another that no gate compiles with it One row under dag/gunbc/recurring_failure_mode/. INVALID STATE: a merge admitted on a gate whose compiled closure is a strict subset of the closure its result governs. The specimen is gunbc#11057 (a correct public change, green on public CI) against gunbc-private, whose CI builds against public main: eleven private witnesses used a bare ExitFailure as their failure arm, so private_roster_main stopped resolving ENTIRELY -- 0 PASS, not a partial failure -- and every private PR plus private main went red at once. Repaired by hand in gunbc-private#82. The totality is part of the class: a zero reads as infrastructure, not as a semantic break, so the first hypothesis is "our CI is broken" rather than "an upstream change removed a construction we depend on". Bounded against three neighbours. NOT the same-repo jointly-incompatible class (gunbc.plans.ci_merge_freshness, instance 1 recorded by gunbc#10984; gunbc.plans.joint_incompatibility_claim_join, scoped by gunbc#11044): there the deficit is FRESHNESS and one gate can compile the union, which is why a merge queue is the ceiling; here the deficit is COVERAGE and no gate on either side has both repositories in scope. NOT a published-API break: B pins A's main branch, so there is no release boundary and no deprecation window. NOT the stale-merge-base class: both sides were current. RUNG mitigatable. CEILING argued at mechanically preventable, not asserted: the question is decidable (compile A+B), but the invalid state stays writable, and what stands between here and rung 3 is a COST -- doubling A's gate on a fleet at capacity -- which is not a decidability answer. TRIGGER named as the capability: a gate whose compiled closure includes every repository that builds against this one, with the dependent set DISCOVERED rather than hand-listed; a trigger naming one dependent would retire the class while a third stayed invisible. EVIDENCE, executed against a gunbc built from this tree: - GREEN: docs_projection_gate regen exits 0, writes docs/design-failure-modes.md (1752004 bytes) carrying the row's text. - RED: mutating the fifth receipt (the RUNG sentence) from its String to the Int 42 -- a consumed element of the List<String> that gunbc.recurring_failure_mode::authored folds -- refuses with a typed, located diagnostic at :26:5 (expected String, got Int), exits 1, and PRODUCES NO ARTIFACT AT ALL: with the projection deleted first, the run leaves docs/design-failure-modes.md absent. The text is removed, not stale. - RESTORED: the same regen exits 0 and is byte-identical to the first green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013YcKjgpfRzhjNJrjaNZjJG * Rewrite the class as a split between closure and merge authority; correct the repair provenance; migrate to the join separator Three blocking findings from quick-ibex-468, all verified against the tree before acting on them. 1. THE BOUNDARY CONTRADICTED ITS OWN MECHANISM. The row asserted both "B's gate compiles A+B, but it only ever runs for changes authored in B" and "no gate on either side ever had both repositories in scope". Those cannot both hold, and the second is both false and the weaker claim: B's gate has exactly the right closure. The invalid state is now stated as NO GATE ELIGIBLE TO BLOCK A'S MERGE COMPILES BOTH REPOSITORIES -- a split between two properties a gate normally holds together, (i) compiling the closure a merge governs and (ii) being able to refuse that merge. In a one-repository lane they are the same gate and the split is invisible. That is not a wording fix; it re-derives the ceiling and the trigger. The ceiling previously argued about the cost of building a second full compile of B inside A's gate. Under the corrected statement the compile ALREADY EXISTS AND ALREADY RUNS, so the repair is to BIND it to A's merge admission -- runner time on an existing job, not a new one. Rung 3 is still not claimed, and now for the right reason: not cost, but that the binding is ENROLLMENT and the invalid state stays writable. The trigger gains its missing conjunct and is now three: refusal authority over this repository's merges, closure covering every dependent, and a DISCOVERED dependent set -- each separately able to be satisfied while the class stays live. 2. THE REPAIR PROVENANCE WAS WRONG. The row cited gunbc-private#82 as the repair; #82 CLOSED UNMERGED at 21:03:18Z. The repair that landed is gunbc-private#81 (1b7f87e88f), merged 20:55:06Z -- eight minutes earlier. A failure-mode authority about merges was citing an unmerged branch as the event that restored main. Corrected with the genealogy kept rather than the number swapped, because two lanes independently building the same repair is itself a fact about this class: with no signal naming the origin, every observer starts from the symptom and duplicated repair effort is the default. The row now says so, and says that its own mis-citation was produced by the same condition. 3. #11047 CHANGED THE RENDERING CONTRACT AND THIS FILE MISSED IT. RecurringFailureMode.authored is now join(r.receipts, " "); the trailing-space convention is deleted. All eleven receipts still carried trailing spaces, which would have rendered TWO spaces at every boundary. Migrated: 0 trailing-space receipts, and 0 double-spaces in the rendered row, measured against a pre-existing row on the same page as control. Note the shape, because it is this row's own class applied to this row: the file is additive and imports nothing anyone changed, and was still incompatible -- the coupling is the RENDERER, not the import graph. Judging it safe because "a single additive file no module imports" is the same closure error the class describes. EVIDENCE RE-RUN ON A TREE CONTAINING #11047 (the prior evidence was real and proved the row against a producer that no longer exists): - GREEN: regen exit 0, writes docs/design-failure-modes.md (1786641 bytes); corrected invalid-state text and #81 provenance both render; 0 double-spaces. - RED: fifth receipt -> Int 42 refuses at :30:5 (expected String, got Int), exit 1, and with the projection deleted first NO ARTIFACT IS PRODUCED. - RESTORED: exit 0, byte-identical to the green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013YcKjgpfRzhjNJrjaNZjJG --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * File two failure-mode classes: first-touch reclaim billing, and increment-only enrolment gate (#11183) * File two failure-mode classes: admitted reclaim billed by first touch, and an increment-only enrolment gate. Both classes were measured today; the rows carry the uncertainties rather than rounding them into coverage. Co-authored-by: Cursor <cursoragent@cursor.com> * Close the wrapping parenthesis that spanned receipt bullets in both new failure-mode rows. The list balanced as data; the combined projection renders one receipt per bullet, so the opener and closer became orphaned across bullets. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Join fleet acquisitions and tax standing into one floor census. Completed purchases now have lots and typed tax arms (transcribed, derived, attested, unread) without publishing amounts, and srv1-srv4 are assemblies with dredge obligations rather than invented component receipts. Co-authored-by: Cursor <cursoragent@cursor.com> * Use std.measure Micro ratios and identity-join tax coverage. A product SalesTaxRateMillionthsOfUnity type was a third dimensionless-ratio nickname; coverage by equal list lengths still admitted swapped lots. Rates now inhabit Measure<Dimensionless, Micro, Nat>, and lot_tax_covers_ledgers joins ledger identities to tax rows. Co-authored-by: Cursor <cursoragent@cursor.com> * Land PartsPerMillion in std.measure and type statutory tax rates with it. A product sales_tax_rate constructor and bare Nat millionths rows were a third dimensionless-ratio nickname. The Micro-scale carrier now sits beside Percent/BasisPoint; NJ and NYC rates are that carrier, not a unit-in-the-identifier Nat. Co-authored-by: Cursor <cursoragent@cursor.com> * Bind cooler lots in the host assembly and stop claiming they were never acquired. Census already recorded Dynatron W1 purchases for srv3/srv4; the assembly had marked those components unrecorded, and the shared tax obligation said no acquisition existed. Coolers now bind the census lots, unread tax copy matches the DIMM row, and PartsPerMillion consumes the dimensionless ppm factor. Co-authored-by: Cursor <cursoragent@cursor.com> * Locate duplicate tax lots by first-seen ordinal and join standings by identity. first_ordinal was the current ledger length, so a duplicate of index 0 reported 5,5. Coverage and assembly checks also used length/count literals; they now join named lots, components, and containments. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop unconsumed tax prose rows; keep effective-date and composition as annotations. Those NonEmptyStr declarations had no fold and were commentary wearing semantic data. The cited effective date and NYC composition stay on the rate rows as //, which is the quarantine §4c requires. Co-authored-by: Cursor <cursoragent@cursor.com> * Author list membership, cover, and predicate folds once in std.list. Tax and assembly each minted contain/cover and six predicate folds that differed only by equality or standing. Those now consume list_any, list_member, list_cover, list_count_by, and list_select_by. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop std.list nicknames of builtin any/filter and bind census omission by identity. list_any/select_by/count_by re-minted substrate methods; keep only caller-eq membership/cover. Omit Mt. Collins by lot identity, and refuse assembly cover when a rostered component is dropped. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Sep 13, 2026
CI found one: `admitted_reclaim_charged_by_first_touch` cited `required_floor_claim_eval_step_budget`, which the two-tier fold replaced with `claim_eval_step_budget_for_identity`. I introduced that citation myself, when repairing that row after #11183 landed, and then renamed the symbol under it in the same PR. THE CENSUS FOUND ONE AND THERE WERE EIGHT. The declarations phase only refuses on a `DeclarationRef` — a structured citation it can resolve — so the seven PROSE mentions of the same dead symbol were invisible to it, across dag/std, witness_floor_workflow, floor_cost_debt, two recurring-failure-mode rows and four Rust files. Fixing only the reported one would have left the tree reading correctly to the gate and wrongly to a person. Swept by symbol, both file types, and verified to zero — along with the five other symbols this PR removed (required_floor_eval_step_budget_grounding, eval_step_budget_grounding_holds, GroundedWithinCalibrationBand, AboveCalibratedEnvelope, BelowCalibratedBand, EvalStepBudgetGrounding), none of which is cited anywhere. Two mentions are rewritten rather than renamed, because the sentence changed with the symbol: witness_floor_workflow's "is a single constant and is not keyed by identity" is now "is keyed by TIER and not by row", and the #11183 row's receipt names the tier selection beside the calibration. THE FLOOR ITSELF WAS CLEAN ON THE FAILING RUN — verdict=FloorClean over the whole corpus with the two-tier ceiling live and no over-budget refusal. The only finding was this citation. Projections regenerated; clippy --all-targets -D warnings clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BRTesxTRxhRGKX1py2pHVC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gunbc.recurring_failure_modeadmitted_reclaim_charged_by_first_touch: a per-claim CPU ceiling charged with page-refault cost that is a property of the run's admitted reclaim and of touch order.memory_stall_refusaladmitting pressure is not the defect; billing that admitted cost to the first-touching claim is. Recognition rule versus the memo-fill first-toucher: is anything built.gunbc.recurring_failure_modegate_population_covers_only_new_subjects:v2.workflow.floor_enrolment_marginexists to stop the 450ms-then-coin-flip cliff, and its population is newly enrolled declarations only, so an already-enrolled row that degrades (specimen ~371ms, 371×1.367=507>500 at the median runner) is never gated.Landing
The dag/ freeze until gunbc#10940 holds this merge. Push and green are allowed; do not merge.
Test plan
dag/testfiles (freeze)Made with Cursor