Enrolment margin: a typed cost-debt reading just under the per-subject line is its own typed standing

[gunbai-bot]

Why

A typed cost-debt row asserts its claim costs more than the per-subject CPU line on a runner the measured envelope admits. The self-staling rule compared every reading against the line itself, and the line is the bound for a p90-slow runner. So a fast runner's reading of a genuine member staled the row that the slow runs needed.

Specimen: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test an_interrupted_attempts_dead_hold_is_recovered_by_the_next_one (it runs the real boot entry twice):

run	runner	CPU
PR floor 36765162766	srv1	523 ms
PR floor 36775473983	srv3	582 ms
PR floor 36783312538	srv3	543 ms
merge group 36793281217	srv4	466 ms → enrolment_roster_ground_stale, gunbc#12800 dequeued

No row stays valid on all three runners. Typed cost debt is stale on srv4. A dead-band row is the wrong ground on srv1/srv3.

This is the mirror at the line of #12752's margin repair. Ruling of eager-owl-205, 2026-10-01 (option 1, its own PR, the same discipline as #12752).

What

v2.workflow.floor_enrolment_margin floor_enrolment_roster_envelope_floor applies the same measured p90 envelope (floor_enrolment_margin_envelope_permille) to the line, through the same implied_clean_run_budget the margin uses (line 500 ms → floor 302 ms). No literal is added. With a typed cost-debt row:

• over the line: declared, unchanged;
• (floor, line]: EnrolmentRosterGroundWithinRunnerEnvelope, reported with both bounds; named roster_ground_within_runner_envelope; does not block;
• at or under the floor: EnrolmentRosterGroundStale, now carrying the floor; blocks and names the row's deletion.

Only a declared cost-debt row reaches the new arm:

• an undeclared reading over the margin still refuses (the discriminating red);
• a dead-band row reading over the line is still the wrong ground.

Seed mirror (required_floor_runner):

• gains the arm and the field;
• reads the floor out of the model beside the line, refusing with EnrolmentRosterFloorUngrounded unless 0 < floor < line;
• passes it to enrolment_margin_standing_for.

Claims re-homed (each encoded the old rule):

• a_roster_admission_at_325ms_is_stale_and_blocks (the Sizing becomes derived: unbundle NodeSizing, delete authored intricacy and volume, stub the deriver #10994 tripwire) → a_roster_admission_at_the_envelope_floor_is_stale_and_blocks;
• a_roster_admission_exactly_at_the_line_is_stale → …_is_within_the_runner_envelope.

Both keep a discriminating red at the new boundary.

Bookkeeping:

• seed growth rostered in gunbc.enrolment_dead_band_seed_growth;
• the straddle filed as the third form of gunbc.recurring_failure_mode enrolment_dead_band_has_no_representable_standing.

Evidence (local, release build)

• required_floor_runner unit tests: 110/110. The roster test pins 500/466/303 within the envelope, 302/200 stale, and an undeclared 466 refused as measured_over_margin.
• v2.test.floor_enrolment_margin: 44/44, including:
  • the_roster_envelope_floor_is_derived_from_the_line_and_the_envelope;
  • the_line_envelope_is_reachable_only_through_a_typed_cost_debt_row.
• test.claim.enrolment_margin_seed_mirror_witness_test: 2/2. Every model arm's name and cause is mirrored in the seed.
• tools.generated_artifact_gate main_wet: no drift.

After it lands

gunbc#12800 merges main and re-cites the interrupted-attempt row with merge-group run 36793281217, and the integration is requeued.

🤖 Generated with Claude Code

[briansrls]

APPROVE-MERGE — exact head 5a9bcb2f754cf3594758f00a218640c9dbc9aa49

No blocking findings.

The production floor is grounded rather than authored: floor_enrolment_roster_envelope_floor sends the per-subject line through the existing implied_clean_run_budget with floor_enrolment_margin_envelope_permille. The latter is the existing p90 runner policy, and integer division rounds downward. The host mirror evaluates that model projection and refuses unless the result is strictly positive and strictly below the line; there is no production 302 threshold literal.

The roster partition is total and bounded:

• exact observed > line: existing EnrolmentExpensivenessDeclared;
• exact observed (envelope floor, line]: named EnrolmentRosterGroundWithinRunnerEnvelope, nonblocking, paired to the declared row;
• exact observed <= envelope floor: EnrolmentRosterGroundStale, blocking and requiring deletion.

This is not an absorbing widen. The envelope is applied once to the line; the new arm neither recurses below its floor nor admits incomplete evidence. Absent readings, censored readings, and lower bounds retain their existing blocking/reporting arms. An undeclared exact reading is still classified by the ordinary enrolment margin, and a dead-band declaration above the line remains EnrolmentDeadBandWrongGround.

The re-homed controls still discriminate the policy boundaries:

• exactly at the derived floor is stale, while floor + 1 is within the runner envelope;
• exactly at the line is within the envelope, while line + 1 is the existing declared arm;
• the 466 ms specimen reaches the new arm only with the typed cost-debt row;
• the same 466 ms undeclared remains measured_over_margin;
• a dead-band row at line + 1 remains wrong-ground.

The Rust mirror carries the same partition, names, causes, pairing standing and blocking status; its unit controls cover 500/466/303, 302/200, and the undeclared 466 red. The seed mirror includes the new model arm, and the failure-mode row records the third specimen without changing the rung.

Source approval is bound to this exact head. Queue only after the exact-head and merge-group gates are green.

[briansrls]

APPROVE-MERGE — exact head 04b5b9adbf51efb469f5de10766ad2d2618fdcdc

No blocking findings in the successor delta.

The successor is one commit touching only required_floor_runner.rs. EnrolmentThresholds carries exactly the four prior scalar arguments. The production route reads the same four model values, constructs one carrier immediately, and passes it by reference; enrolment_margin_standing_for destructures it into the same local names before the unchanged decision body. The test callers likewise replace their repeated 302/182/500/302 argument sequence with one constant carrying those same fixtures. No lint allowance or alternate decision route was introduced.

The prior derivation, non-absorbing partition, undeclared-reading red, dead-band wrong-ground red, and re-homed boundary controls therefore remain approved. Queue after the exact-head checks and normal merge-group gate are green.