Falsifier alert reports per-component state instead of one hardcoded story

[briansrls]

The defect, priced

falsifier-alert.yml read only run.conclusion and then hardcoded one causal story for every failure (old lines 36, 53-57):

falsifier is RED — affected-set cold control is dark … per-PR affected-set selection runs UNVERIFIED by its cold control, the Gate-1 emit receipts … do not execute anywhere, and the known-red probe un-quarantine accounting is dark.

On run 30509024051 all three clauses were false. Batch 1, the predict-only affected-set cold control, concluded Done over 5,217 witnesses; batches 2–3 produced their expect_red still-red OK receipts; batches 5–8 passed. Exactly one component failed: the silent-pick gate, killed at its whole-receipt wall budget (900001ms > 900000ms).

An overall-red composite that erases the green state of its completed children is a state-space conflation (DESIGN §5), and it misdirected triage every time it fired. It also had no data to do better: the falsifier job had no upload-artifact step at all, so every receipt written to target/ died on the runner, and the failure classification existed only as prose eprintln!.

What landed

• dag/gunbc/floor_component_receipt.dag — per-component receipt as a projection of std.observation.ObservationEvent, the record gunbc.witness_row_cost already names as THE record ("not a TSV schema"). A bespoke status schema would have been a second representation of it (§3). Refused stays distinct from Failed; a skipped batch is Skipped { reason }, never an absent row.
• Components are keyed by structural role, not batch index. gunbc_falsifier_batches composes conditionally on enrollment flags, so a flag flip shifts every later index — which is why the silent-pick gate reports as batch 4 while sitting fifth in source order. The cold control is identified by the property that defines it: node_frontier_selection = SelectionPredictOnly, reusing the std.realization_schedule authority. Zero matches → ControlAbsent; two or more → ControlAmbiguous. Never a guess.
• claim_executor writes target/floor-component-receipt.json on every exit path including red — the run where it matters most. A row that cannot be constructed is a typed refusal that fails the walk, never a component silently dropped.
• falsifier_workflow.dag gains the upload step with if: always(), plus falsifier.yml regenerated in this PR (it is drift-gated, so a direct .yml edit would red the gate). The +10 transfer term joins gunbc_falsifier_job_backstop_timeout_minutes (305 → 315) and the witness asserting the exact step-sum moved with it.
• falsifier-alert.yml downloads that artifact and reports real state. A missing or unparseable receipt is an explicit unknown that makes no claim about any component — it never re-widens into the old story.

Proven by execution

dag/test/claim/floor_component_receipt_witness_test.dag — 7 witnesses green, and the REDs discriminate in both directions (each perturbation run, then reverted):

perturbation	result
Done => false (reproduces "always dark")	fcr_real_run_reports_control_verified_and_names_silent_pick FAILS
Failed => true (reproduces "always green")	fcr_red_control_control_itself_failed_is_not_verified FAILS
absent control claims verified: true	fcr_red_control_absent_control_is_not_silently_verified FAILS

End-to-end, not just unit: claim_executor was run against gunbc_ci_regen_floor_batches, which went genuinely red, and wrote a receipt naming the failed component, reporting the cold control as absent (that plan has no predict-only batch — true), and recording the unreached batch as skipped. Those real bytes were then fed through the actual alert JS, which rendered the honest report. The JS has no .dag witness available, so it was executed directly against both the real receipt and a missing-receipt case.

Deliberately not in scope, with triggers

• TimedOut is modelled and projected but not yet emitted. InterpError::WitnessWallBudgetExceeded { elapsed_ms, budget_ms } carries the numbers structurally, but ClaimOutcome::RuntimeError flattens them to a String before the walk sees them. The floor emits Refused with the interpreter's own located diagnostic — correct on observation_refused_distinct_note's own terms for a deliberate stop at a declared ceiling. Fabricating 0/0 to reach the more specific arm would be the fabricated output §5 forbids. Dissolve-on is declared in-carrier; the projection side already handles the arm, proven today.
• No re-basis of the 900s ceiling. The budget note requires an appended dated re-basis, and the measurement is censored (killed at deadline), so the true cost is unknown — only that it exceeded 900s.

Findings from the investigation, not fixed here

1. The silent-pick witness's 900s is largely a duplicated whole-tree compile. It shells out to resolution_divergence_census --closure-scoped, a separate process that re-resolves ~1309 modules from cold — the same corpus batch 1 resolved in the same job (resolve_ms = 1,119,333). The subprocess shares none of the parent's 4.68M memo hits. Two cost-shape defects sit in the census walk itself: a per-module deep clone of SymbolIndex (cli_run.rs:23996) and import_chain_owner computed twice per site (:24009, :24038) across ~40.6k sites.
2. The witness-cost drift detector is vacuous. dag/gunbc/witness_row_cost_basis.tsv is a header plus two comments — zero data rows — so all 5,237 rows record BasisAbsent and drift_exceeded is pinned at 0. Because the file exists, the loud "basis file missing" diagnostic never fires either. This is the mechanism that would have warned as the row climbed 717s → 815s → 900s.
3. source_root_ingest_gate_passes returned Bool(false) on the 07-28/07-29 falsifier reds — a genuine witness failure, unrelated to hosts, and a different cause from the budget graze.

🤖 Generated with Claude Code

[gunbai-bot]

Thanks — review 45058. I verified all 7 findings against the tree. Two were real and are fixed in 18adcbd; five rest on a misreading of the seed-transport boundary, and I'm declining those with the in-tree precedent.

Fixed

Finding 7 (hand-Rust receipt) — valid, and verifying it found a defect of my own.

You're right that new hand-Rust owes a named deferral rather than a description, and there's an in-tree pattern for it (emit_on_demand_host_seed_deferral_note). Added floor_component_receipt_seed_transport_deferral_note, deferring to the ZeroHandMaintainedRust finish line, roadmap node v1-zero-hand-maintained-rust (gunbc.v1_deletion_plan v1_exit_finish_lines), with a concrete dissolution: the transport deletes when the receipt write is issued from .dag as a typed Filesystem.Write through host_effect_apply (shell→intent Phase 2 routing) instead of std::fs::write in the seed.

Chasing your "does transport actually justify this?" question surfaced a genuine §5 defect I'd introduced: the seed held the mode→outcome mapping with a _ => "failed" catch-all, which would have absorbed a newly added falsifier_failure_mode into failed with no diagnostic. That classification now lives in .dag as floor_component_outcome_of_failure_mode, under a witness, and refuses an unmodelled mode — the row cannot be built and the walk fails closed naming the mode. New RED control fcr_red_control_unmodelled_failure_mode_refuses_never_widens proves it (unknown mode → absent; BudgetExceeded → present). The seed now carries zero classification: it extracts the mode string and marshals. That's a real improvement your finding produced, so thank you.

Finding 6 (is_done re-matches the coproduct) — premise doesn't hold, but the locality now carries its reasoning.

I checked for the canonical fold/query surface. std.observation exposes observation_outcome_class and observation_outcome_is_anomaly, and both are themselves total hand-written matches over ObservationOutcome — there is no fold or query surface to consume, so sibling-style matching is the canonical shape at the authority.

It's also not a fork of is_anomaly, which answers a different question and disagrees on two arms:

outcome	is_anomaly	is_done
Skipped	false	false
Final	false	shown_failures == 0

So !observation_outcome_is_anomaly would report a skipped batch as successful — precisely the conflation this receipt exists to prevent. Routing through observation_outcome_class would trade 6 arms for 10 and still lose the Final reading. Kept local under second-consumer discipline (§6, model just-in-time — one consumer today), now with floor_component_is_done_locality_note recording that analysis and the dissolve-on (lift to std.observation beside is_anomaly on a second consumer). I did not add it to std/observation.dag unprompted: that's P0 of an operator-signed lane and my brief sets a higher bar there.

Declined, with the precedent

Findings 1–5 (budget_ms/elapsed_ms/wall_ms as Nat) — these are seed-transport parameters, not stored magnitudes.

The unit-modelling rule bites when a magnitude is modelled as a bare scalar. Nothing here stores one:

• TimedOut { budget: Millisecond, elapsed: Millisecond } — the std.measure carrier
• ObservationEvent.wall: Measured<Nanosecond> — the carrier
• every parameter is grounded on the first line it's used: millisecond(count: budget_ms), millisecond_to_nanosecond(m: millisecond(count: wall_ms))

Those _ms: Nat parameters exist only because Rust hands primitives across the interpreter boundary. The exact precedent is the sibling seam this module was modelled on — gunbc.observation_seed_render, called from the same bin (render_phase_concluded_line):

fn phase_concluded_line(phase: NonEmptyStr, elapsed_ms: Nat, overhead_ms: Nat, emoji: Bool) -> String {
  ... wall: MeasuredValue { value: millisecond_to_nanosecond(m: millisecond(count: elapsed_ms)) }

seed_heartbeat_line is the same (elapsed_ms: Nat, rss_bytes: Nat, …). That module's header states the contract explicitly: "primitive arguments in, a rendered line out." Note the deliberate contrast in the same file — scoped_run_*_measured takes wall: Nanosecond, a carrier, because those callers already hold one.

Taking Millisecond in these signatures would require the seed to construct Value::Record { type_name: "Millisecond", … } by hand, i.e. moving carrier construction into Rust and forking the constructor — worse on §3 and on the very hand-Rust discipline finding 7 raises. So this stays, matching the established boundary.

If you'd rather the boundary itself changed, that's a change to observation_seed_render's contract affecting every seed progress line, and belongs in its own PR against that lane — not smuggled in here.

State

9 witnesses green by execution, incl. 4 discriminating REDs; end-to-end re-verified after the refactor (claim_executor → real receipt → alert JS, on a genuinely red plan). cargo fmt clean, test build clean.

Two things flagged in the PR body that this PR does not fix, so they aren't missed: the 900s silent-pick row is largely a duplicated whole-tree resolve in a subprocess, and witness_row_cost_basis.tsv has zero data rows so the drift detector can never fire.

— sent from quiet-ferret-16

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

review 45074 — fixed in f4e0646, and I was wrong to decline this earlier. Recording the reversal properly since I argued the other way in my previous comment.

I was wrong, and why

I declined findings 1–5 of review 45058 on the grounds that _ms: Nat is the established seed-transport shape, citing gunbc.observation_seed_render:

fn phase_concluded_line(phase: NonEmptyStr, elapsed_ms: Nat, overhead_ms: Nat, emoji: Bool) -> String

That citation is factually true and argumentatively worthless. An existing instance is not a sanction — that seam is un-migrated debt on its own lane, and invoking debt as precedent is exactly the cementing this repo's brief warns against. review 45070 then made the point that broke my argument: "Immediate millisecond(count: …) wrapping does not discharge it without a typed parameter surface." That's correct. The parameter surface is what a caller can get wrong — a caller passing seconds into wall_ms would have typechecked cleanly. Wrapping in the body protects the body, not the API.

Three independent reviews converging (review 45058, review 45070, review 45074) against one precedent argument of mine should have moved me at the second, not the third.

The fix — the typed surface, not the 🟡 gate

Both remedies were offered; I took the real one rather than the marker. All seven parameters are now the std.measure carrier:

line	before	after
113, 114	budget_ms: Nat, elapsed_ms: Nat	budget: Millisecond, elapsed: Millisecond
182	wall_ms: Nat	wall: Millisecond
204, 205, 207	budget_ms/elapsed_ms/wall_ms: Nat	Millisecond
243	wall_ms: Nat	wall: Millisecond

Millisecond = Measure<Time, Milli, Nat> — the ratified Measure<Q,S,M> shape, consumed not forked. grep -nE "(budget_ms|elapsed_ms|wall_ms): Nat" over the module now returns nothing.

The seed constructs no carrier. It calls millisecond(count:) across the interpreter boundary and passes the resulting Millisecond back in, so the constructor remains the single authority. Building Value::Record { type_name: "Millisecond", … } in Rust — the other way to get a typed signature — would have forked the constructor and hardcoded the carrier's internal shape in the seed, trading a unit violation for a §3 one.

A simplification that fell out

Typing the surface let the seed collapse to one .dag entry point. floor_component_outcome_of_failure_mode gained not_reached → Skipped, so its mode vocabulary now covers every disposition the walk can report, and the generalised two-constructor marshaller I'd added is deleted. Fewer hand-Rust lines, one seam instead of two — which also improves the finding-7 posture from review 45058.

Verification

10 witnesses green by execution (up from 9), including two new ones: fcr_not_reached_mode_is_skipped_not_failed (a skipped batch must not read as failed) and fcr_red_control_unmodelled_failure_mode_refuses_never_widens (unknown mode → refuses; BudgetExceeded → present). End-to-end re-verified after the rewrite: claim_executor against a genuinely-red plan → real receipt → correct failed and skipped rows. cargo fmt clean, test build clean.

One note on review timing

review 45074 ran against the committed state of 5c7ff6fc5 while this fix was still in my working tree, so it flagged code that was already being replaced — no fault of the review, just worth noting so the line numbers aren't re-litigated. f4e0646 is the SHA to look at.

Still open and unfixed here, flagged in the PR body so they aren't lost: the 900s silent-pick row is largely a duplicated whole-tree resolve in a subprocess, and witness_row_cost_basis.tsv has zero data rows so the cost-drift detector can never fire.

— sent from quiet-ferret-16