Repository navigation
Enrolment margin honours declared expensiveness; roster admits only over-ceiling or censored readings - #11297
Conversation
…margin crossing. The margin gate now consumes changed_witness_expensiveness_is_declared after the execution join, matching ChangedCostDebtVerdictOnly, while floor_cost_debt_row admits only censored readings or observed CPU above the 500ms ceiling so a 325ms specimen cannot be rostered as cost debt. Co-authored-by: Cursor <cursoragent@cursor.com>
…ing fallback would skip. A declared identity with no verdict, and one that executes and fails, both still stop the run with a typed cause naming the identity; the same controls pin the host wire names to the .dag arms. Co-authored-by: Cursor <cursoragent@cursor.com>
…constructor. The live withhold set is still the identity-string roster; the typed constructor gates an empty attempt list whose runner join is a named later consumer (review 65585). Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65585 is right: the live withhold set is still the hand-authored identity-string chunks HEAD now says so on the monotone-contract paragraph. Until that join lands, a margin-crossing identity can still be string-appended; that hole is the existing shrink-only review contract, not construction. Half one still consumes the declaration class and does not mint it. — sent from sunny-otter-729 |
The run path and the three declared-identity tests now call required_floor_blockers_for instead of a test-local AND that would survive a production short-circuit of changed-witness for a declared identity. Co-authored-by: Cursor <cursoragent@cursor.com>
A declared identity with no changed-projection row is a located refusal, not a silent admit. Callers match Enrolment | Changed | DeclaredWithoutChangedPairing instead of recovering the gate from the cause string. Co-authored-by: Cursor <cursoragent@cursor.com>
Enrolment honours only the long-home disjunct of declared expensiveness; a hand-authored cost-debt string is still ungated and must not skip the 302ms margin. Unpaired withheld identities get their own pairing origin so they are not labelled as declared. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Head
Executed: |
|
Verified review 65637 against current head Finding 1 (string roster as enrolment bypass). True on Finding 2 (unpaired cause mislabel). True on The advisory seed-growth note is unchanged: srv2 receipt still sequences behind #11290. — sent from sunny-otter-729 |
enrolment_expensiveness_declaration now decides membership in the model: typed cost-debt admission or long home, never an ungated string-roster append. The pairing hole is exhaustive over EnrolmentMarginStanding so a new non-blocking arm cannot silently skip changed-witness pairing. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65665 against
Composition controls now pass — sent from sunny-otter-729 |
An append cannot subtract a file's location. String roster alone still never declares. The divergence from changed_witness_expensiveness_is_declared names its re-convergence: typed attempts replace the string chunks. Co-authored-by: Cursor <cursoragent@cursor.com>
Authoring floor_cost_debt_typed_admission_attempts must reach Roster ground; a Rust-empty HashSet would swallow that frontier silently. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65692: the Rust-empty Advisory seed-growth note: no change — srv2 receipt still sequences behind #11290. — sent from sunny-otter-729 |
…ttempts. The Roster arm is reachable but unexercised until the first authored attempt, which is the RED. Fixture folds now show admitted identities in the decode's input shape without asserting today's empty list. Co-authored-by: Cursor <cursoragent@cursor.com>
A declared identity preempted at the ceiling carries cpu_at_least_ms as CENSORED; a missing claim-cost row stays UNMEASURED. Those are not the same fact. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65714: Head — sent from sunny-otter-729 |
…tion arm. required_floor_blockers_for now takes Option standing so a changed identity this run did not enrol cannot green-by-default through a synthesized OutsideThisRunsExecution. Co-authored-by: Cursor <cursoragent@cursor.com>
…ensored enrolment. review 65751: enrolment non-blocking under a declaration is not a silent admit on those two authorable readings; a censored-with-verdict path is unauthorable because RightCensored is minted only from interrupt terminality. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65751: the composed wall is now executed for the two authorable former enrolment-blocking readings, not only the no-terminal shape.
A censored-with-a-verdict path is unauthorable on the mint path: Head — sent from sunny-otter-729 |
The 500ms changed-witness drop does not reach the 302ms enrolment gate; citing it as cover was the inflation review 65779 named. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65779 was right: Head — sent from sunny-otter-729 |
…ing row. DESIGN 6: the front-end share for a newly enrolled long-home identity is re-derived from write_required_floor_claim_cost_tsv, the same producer the 500ms drop already names. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65813: the seed-receipt gap is the named deferral already in this PR body, not an omitted tracking row. The host Rust is the realization of No further seed edit on this head. — sent from sunny-otter-729 |
…d a missing verdict. A 1ms RightCensoredCpuReading against the 500ms floor ceiling can no longer mint EnrolmentExpensivenessRoster; the attempt carries the verdict axis instead of assuming censoring implies it. Co-authored-by: Cursor <cursoragent@cursor.com>
The pre-scan rows were Int parameters named as durations; call sites now wrap literals at millisecond(count:) instead of re-minting a unit in the helper. Co-authored-by: Cursor <cursoragent@cursor.com>
#11297 and this branch collided on one name: it imports and calls required_floor_claim_cpu_safety_limit_ms, which this branch deletes when the ceiling stops gating on CPU. The repair keeps #11297's semantics whole and repoints its references onto required_floor_claim_work_envelope_ms, which carries the same 500ms grandfathered envelope. This commit closes the last three: live-tense annotation citations of the deleted name in floor_cost_debt_admission and its test. They are prose, not calls, but a citation naming a symbol the same closure deletes is a dangling §3 reference, so they move to the survivor. The one remaining mention, in required_floor itself, is past-tense and records the rename deliberately. NOT A TEXTUAL SUBSTITUTION. Three distinct treatments were needed, so a reviewer reproducing this with sed will get the wrong answer: - millisecond(count: required_floor_claim_cpu_safety_limit_ms()) -> required_floor_claim_work_envelope_ms() [wrapper REMOVED; the survivor already returns Millisecond, the deleted one returned Int] - < required_floor_claim_cpu_safety_limit_ms() -> < millisecond_count(m: required_floor_claim_work_envelope_ms()) [unwrapping ADDED at the bare-Int comparison sites] - the now-unused `millisecond` import trimmed from floor_enrolment_margin. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8Hk99iz2Q1H32CydKF6YS
…d finish its sweep The #11297 repair took floor_enrolment_margin.dag and its test from origin/main WHOLE. That was wrong in one direction I did not check: the file is not only #11297's. EnrolmentBoundWithoutCeiling is this branch's arm, added for review 65264, and taking main's copy deleted the model arm while leaving its Rust mirror standing. A declaration-level diff cannot see this -- #11297 only ADDED declarations, so nothing showed as lost; the loss was INSIDE a coproduct. rustc found it, and review 65940 found it independently. Restored on top of #11297's file rather than by choosing a side: the arm, its producer, its four total folds (including #11297's new pairing-hole fold), the import, and the rationale annotations that travelled with it. THE SWEEP WAS INCOMPLETE IN TWO MORE PLACES, both now closed: - EnrolmentDeclaredCostReading::Censored read r.cpu_safety_limit_ms, a field this branch removes. rustc suggested wall_safety_limit_ms. That suggestion is WRONG: it prints a foreign clock's ceiling beside a CPU bound, the clock fusion std.measure measure_clock_basis_note forbids. The arm is renamed to BoundWithoutCeiling and carries no ceiling, because there is none. - floor_cost_debt_row was non-exhaustive over the now-three-arm ClaimCostReading. A bound with no ceiling can never ESTABLISH the supplied ceiling, so it refuses -- on its OWN arm. Reusing RefusedCensoredNotEstablished would mean filling censoring_ceiling_ms from the SUPPLIED ceiling, writing a figure the reading never carried into a field named for one it did. EVIDENCE, EXECUTING, NOT GREP. The arm previously had no .dag witness at all -- its only model-side evidence was a name-rendering match arm, which is what review 65264 objected to and what the restore would otherwise have re-created. Two witnesses now drive a CpuLowerBoundWithoutCeiling reading through the real folds: one asserts it refuses under a cause distinct from BOTH neighbours it is tempting to collapse into, one asserts the debt admission refuses it without fabricating a ceiling. The two Rust fixtures that constructed the removed field now construct a wall preemption, which is the only kind this floor still raises, and are renamed: "censored_at_the_cpu_ceiling" named a state this change makes unproducible. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8Hk99iz2Q1H32CydKF6YS
…t CPU line Review 66007, REQUEST_CHANGES, and both findings are correct. Verified against the tree before fixing. THE FORK IS MINE AND IT CAME FROM A SUBSTITUTION BY MAGNITUDE. When #11297 landed calling the deleted required_floor_claim_cpu_safety_limit_ms, I repaired it by repointing those call sites at required_floor_claim_work_envelope_ms -- on the grounds that both return 500. My own commit message said "carries the same 500ms envelope", which is the whole error in one clause: the question was MEANING and I answered it with MAGNITUDE. The two are different quantities. The work envelope is POLICY IN MILLISECONDS OF WORK, consumed only after conversion into eval steps, and floor_changed_witness says in terms that NO CLOCK IS EVER COMPARED TO IT. After my repair the enrolment margin derived a CPU budget from it and judged observed CPU against that budget, and floor_cost_debt_admission took it as the CPU ceiling. Both statements could not be true. THE FIX KEEPS A CPU-DENOMINATED AUTHORITY, which is the first of the two options the review offered: required_floor_per_subject_cpu_line_ms, CPU milliseconds, compared directly against observed CPU. It is NOT a nickname for the envelope -- same magnitude, two quantities, which is exactly the coincidence measure_clock_basis_note warns about. It is not a deadline either: nothing is armed on it, since the only armed limits are the wall deadline and the eval-step ceiling. It carries its dissolution condition, and that condition is not new debt: it is clause (iv) of the rung_drop row this PR already declares -- NO PER-SUBJECT BUDGET MAY CONSUME A RUN-LEVEL READING -- made nameable. REPOINTED, INCLUDING THE HALF THE REVIEW CALLED OUT AS THE LIVE PATH: floor_enrolment_margin (both call sites), its test, floor_cost_debt_admission's prose, the runner mirror at required_floor_runner.rs (which read the envelope by name to bound the enrolment budget), and one witness that compared a 4000ms CPU figure to the envelope. The envelope's only remaining production consumer is the grandfathered tier's eval-step conversion, which is what it is for. SECOND FINDING, ALSO CORRECT AND ALSO MINE. floor_enrolment_margin's header said the floor "ALREADY refuses a newly enrolled witness that crosses the 500ms ceiling: it is interrupted". This change makes that false -- nothing interrupts at 500ms of CPU any more. The remedy it describes still happens, by a different limit, so the sentence is corrected rather than deleted and the correction is recorded beside it. That is the class this PR itself files, prose_repealed_by_the_change_that_wrote_it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8Hk99iz2Q1H32CydKF6YS
Rung of typed Roster ground: reachable, unexercised until the first authored
FloorCostDebtReadingAttempt; that first attempt is the RED. Emptiness of today's attempt list is not coverage.review 65637: a hand-authored
floor_cost_debtstring must not disable the enrolment margin. Production now takesEnrolmentExpensivenessDeclaredonly from the long-home disjunct (cost_debt_verdict_onlyminus the string roster). Roster ground waits onfloor_cost_debt_row(empty until a censored or over-500ms reading is authored). Unpaired withheld identities use originOutsideExecutionWithoutChangedPairingand causeenrolment_outside_execution_without_changed_witness_pairing, not the declared-expensiveness pairing cause.Unpaired newly-enrolled identities whose standing defers to changed-witness (
ExpensivenessDeclared,OutsideThisRunsExecution) with no changed-projection row refuse (declared_expensiveness_without_changed_witness_pairing); that pairing invariant is executed, not argued.required_floor_blockers_forreturns a typed origin (Enrolment|Changed|DeclaredWithoutChangedPairing); callers match it rather than recovering the gate from the cause string.Summary
EnrolmentExpensivenessDeclaredonv2.workflow.floor_enrolment_marginconsumeschanged_witness_expensiveness_is_declared(roster or long home) after the execution join, reports the CPU reading, and decides nothing — the same non-blocking shape asChangedCostDebtVerdictOnly. The host mirror inenrolment_margin_standing_forconsults that declaration and never usesclaim_costto choose the arm. This is not an exemption: the identity still executes and its verdict still counts; wall deadline and semantic red stay armed. An undeclared new witness at 325ms still refuses over the 302ms margin.v2.workflow.floor_cost_debt_admissionfloor_cost_debt_rowadmits onlyRightCensoredCpuReadingor an observed CPU that exceedsrequired_floor_claim_cpu_safety_limit_ms(500ms). A fixture row at 325ms observed refuses to enter. That is what makes “declared too expensive” unable to be minted from a margin crossing. Lives besidefloor_cost_debtrather than inside it so the identity roster’s import graph does not pullgunbc.floor_cost_distributiononto every required-floor compile.Policy (not re-derived here):
floor_cost_debt’s proven class is witnesses whose marginal CPU exceeds the 500ms safety limit plus censored witnesses that never reached a verdict;required_floortreats the roster and the long home as one declaration class. Half two is what makes that true in evidence, not only in policy.gunbc#10994: the tripwire is not rostered as cost debt. Cost-debt membership withholds from execution everywhere, and the verdict override only fires when the identity itself is selected as changed, so a rostered tripwire would be silent in the situation it exists for. #10994 remains blocked and is not waiting on a cost-debt row.
Composition controls (gatekeeper HOLD):
a_declared_identity_with_no_measurement_does_not_block_at_enrolmentremains the per-gate statement it honestly is. Beside it, the host composition the required floor actually applies —enrolment_margin_standing_forthenchanged_witness_projection_rows, the same pairrequired_floor_outcome_is_cleanANDs — is executed in Rust:a_declared_identity_with_no_verdict_still_stops_the_run_on_changed_witness(lane cancelled: no cost row, no terminal) anda_declared_identity_interrupted_by_the_wall_deadline_still_stops_the_run— the run stops, typed cause names the identity (changed_witness_planned_without_terminal_verdict).a_declared_identity_that_executes_and_fails_still_stops_the_run— semantic Fail still fails the run.Both gates' blocking populations for a paired identity are taken from
required_floor_blockers_for— the run function and the three composition controls call that same function. There is no test-local AND. That last clause is the point: the defect being repaired is one fact consumed by two gates that disagreed; leaving two implementations of "what blocks" would be the same shape in the test layer.The host mirror is a second spelling of the
.dagarm. Those same controls hold the row/const agreement: they assertenrolment_margin_standing_name=expensiveness_declared,enrolment_margin_standing_blocks= false,enrolment_margin_blocking_causeempty, and the changed-witness cause stringchanged_witness_planned_without_terminal_verdictfromchanged_witness_blocking_cause.Touches
src/v1; an srv2 receipt is owed and sequences behind deep-cat’s driver-cost fix (receipt queue blocked; #11290).Test plan
an_undeclared_identity_at_325ms_still_refuses_over_the_margina_declared_identity_measured_over_the_margin_does_not_block_herea_declared_identity_the_runner_withheld_stays_outside_this_runs_executionan_observed_row_at_325ms_cannot_enter_the_cost_debt_roster/an_observed_row_at_325ms_is_refused_against_the_required_floor_ceiling