Stop reconstructing a budget refusal from the prose it just printed

[briansrls]

std.observation models TimedOut { budget, elapsed } — but nothing could ever emit one.

Both budget arms held the typed {elapsed_ms, budget_ms} pair and immediately flattened it with format! into ClaimOutcome::RuntimeError. The floor then recovered the classification by substring-matching the very message the seed had just printed:

falsifier_failure_mode:  d.contains("eval budget exceeded")

One fact in two representations, the second guessed back from the first. And the classifier's fallback arm is WitnessRed — so rewording an error message silently demoted a budget refusal to a witness failure, two states whose remedies differ (re-basis a dated ceiling vs. fix the witness).

The change

ClaimOutcome::TimedOut { elapsed_ms, budget_ms, kind } keeps the pair as data.

BudgetKind keeps the two clocks apart. Cpu is thread CPU time (the stride-poll metric, so a witness slowed by cold I/O or governor time-slicing isn't misclassified); Wall is whole-receipt time, counting subprocess I/O. Collapsing them would relocate the state-space conflation rather than end it.

ClaimResult.budget_refusal carries the fact to the receipt — ok/detail are a lossy flattening of ClaimOutcome, which is precisely why the mode had to be sniffed out of prose. witness_cost_seed_timed_out_event then projects a real ObservationOutcome::TimedOut.

Why this matters beyond tidiness

A killed row's recorded wall is its ceiling, not its cost. resolution_divergence_silent_pick_gate_keystone_holds is killed at 900000ms and records a flat 900794ms — a censored measurement wearing the shape of a completed one.

That is why the witness row-cost basis (#7475) cannot seed the corpus's most expensive row: under the 2× comparator a basis of 900794 pins it WithinBasis below ~1.8M ms forever, enshrining a deadline ceiling as its normal cost. This PR is the prerequisite for seeding that row honestly.

Not done here, stated rather than hidden

BudgetKind is not a field on ObservationOutcome.TimedOut, which carries budget and elapsed only. Extending that sum changes load-bearing substrate (std.observation) that this lane has no mandate for, so the clock is surfaced in the seed-side detail and the batch failure mode instead.

The consequence, stated plainly: an ObservationEvent alone does not say which clock expired. Dissolve-on — a consumer that needs the clock from the event itself is the argument for taking the field to std.observation, not for widening it here.

Verified by execution

Rust

• budget_kill_classifies_structurally_not_by_message_text — a RED control whose detail string contains none of the substrings the string classifier looks for. It first asserts falsifier_failure_mode really would return WitnessRed for that text, so the control isn't vacuous; the batch nonetheless reports BudgetExceeded, and a plain witness red still reports WitnessRed.
• cpu_and_wall_kills_do_not_collapse_into_one_state — identical numbers on different clocks must not be equal values.
• Existing budget tests now assert the pair as data instead of matching a substring of the message — the coupling that caused the defect.
• claim_executor suite: 36 passed, 0 failed. All three bins build.

.dag — two new witnesses in witness_row_cost_projection_witness_test.dag, green by execution and each proven discriminating by perturbation:

perturbation	result
wrong budget value (900000 → 999999)	FAIL
TimedOut arm treated as anything else	FAIL
restored	PASS

Pure Bootstrap receipt (review 45226)

witness_cost_timed_out_seed_deferral_note records the hand-Rust deferral DESIGN §7 requires, matching the sibling shape in gunbc.floor_component_receipt:

• Added: a variant on the existing ClaimOutcome sum in the already-seed-retained cli_run module, the BudgetKind labels, the BudgetRefusal projection field, and the discovery lift. No new Rust file, no parallel authority.
• Replaced rather than accumulated: the two format!-into-RuntimeError sites and falsifier_failure_mode's substring recovery. The seed no longer decides what a budget message means by reading its own prose — so this is net-negative on the seed's judgment surface.
• Stays in .dag: the outcome vocabulary, the receipt shape, and the Millisecond carrier, which the seed obtains by calling millisecond(count:) through the interpreter rather than constructing.
• Deferred to: the v1 exit finish line ZeroHandMaintainedRust, roadmap node v1-zero-hand-maintained-rust (gunbc.v1_deletion_plan v1_exit_finish_lines) — verified present.
• Concrete dissolution: the transport deletes when witness execution is realized from .dag instead of interpreted in the seed bin (the witness-realization lane), at which point the deadline is enforced by the realized runner and the event is constructed directly.

The review correctly noted the existing dissolve-on did not cover the Rust realization: that trigger concerns widening std.observation.ObservationOutcome with the clock kind, this one deletes the seed transport, and neither implies the other. Both are now recorded separately.

Full claim_executor suite after all review fixes: 37 passed, 0 failed.

[gunbai-bot]

review 45220 — both findings verified against the code and fixed in 7c57a94. Finding 1 was a real regression I introduced, and it landed on the one path that matters most here.

Finding 1 — discovery batches missed the structural path

Confirmed exactly as described. discovery_claim_result hardcoded budget_refusal: None, so a discovery batch never carried the typed refusal even when summary.witness_outcomes held a ClaimOutcome::TimedOut.

The compounding part is what makes this bad rather than merely incomplete: this PR replaced the old budget prose, so the new detail ("killed at its wall budget: …") matches none of falsifier_failure_mode's substrings. Old code classified discovery budget kills correctly by accident of wording; my change removed the wording and gave discovery no structural path — so budget kills there fell through to WitnessRed. Same §5 misclassification the PR exists to remove, reintroduced in new prose, and squarely on the primary path: resolution_divergence_silent_pick_gate_keystone_holds IS a discovery row, so the very incident the PR cites would have stayed misclassified. You caught the PR defeating its own purpose.

The fact was available and I simply failed to read it — witness_outcomes carries the typed per-witness ClaimOutcome. discovery_budget_refusal now lifts the first kill out of it.

I fixed both arms, not only the one flagged. The Err arm (receipt projection refused) had the identical hole, and its own comment already stated the governing rule — a receipt refusal adds a cause, it never erases one already established. A batch that blew its budget and then failed to project its receipt is still a budget kill, and dropping it there would have handed it straight back to the substring classifier.

Finding 2 — missing TimedOut import

Confirmed: the std.observation import list in gunbc.witness_row_cost carried Done/Refused/Failed only. Imported explicitly, matching every other module that builds this outcome.

Worth noting why this slipped past me: it compiled and executed green — my .dag witnesses passed before the fix. It resolved via bare-reference resolution, which is precisely the accidental-coverage fragility the import-strip witness-discovery cascade thread documents (Class B: green by pool-membership coincidence, not by binding). A passing test was not evidence the reference was bound, so your read of it as "likely a compile failure" was the right instinct even though the symptom was silence rather than a red.

Verification

discovery_budget_kill_classifies_structurally_on_the_falsifier_path, proven discriminating rather than merely passing:

state	result
fix reverted (budget_refusal: None)	FAILED — "discovery batch must lift the budget kill out of witness_outcomes"
fix restored	ok

It also asserts up front that falsifier_failure_mode really would return WitnessRed for the new detail text, so the control cannot pass vacuously; exercises both projection arms (Ok and receipt-refused); and asserts an ordinary discovery red is not dragged into BudgetExceeded. .dag witnesses remain green by execution with the explicit import.

— sent from quiet-ferret-16

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

review 45226 — fair finding, fixed in 83660fb. You're right on the substance and it matches a precedent I set myself two PRs ago, so declining would have been inconsistent as well as wrong.

I considered arguing the grain — DESIGN §7's frontier is per-module ("each module is either self-emitted or seed-retained"), and cli_run/claim_executor are already seed-retained, so a variant added to an existing sum isn't a new scaffold. I don't think that argument survives contact with the actual rule: the receipt exists so hand-Rust growth stays countable, and "it grew inside a module that was already retained" is exactly how it stops being counted. review 45058 made the same point on gunbc.floor_component_receipt and I accepted it there; the sibling seed_transport_deferral_note is the shape this one now matches.

What landed

witness_cost_timed_out_seed_deferral_note in gunbc.witness_row_cost:

• Added — a variant on the existing ClaimOutcome sum, the BudgetKind labels, the BudgetRefusal projection field, the discovery lift. No new Rust file, no parallel authority.
• Replaced rather than accumulated — the two format!-into-RuntimeError sites and falsifier_failure_mode's substring recovery. The seed no longer decides what a budget message means by reading prose it printed, so the change is net-negative on the seed's judgment surface. That seemed worth stating explicitly, since a receipt that only counts lines added would read this as growth when the decision-making surface shrank.
• Stays in .dag — the outcome vocabulary, the receipt shape, and the Millisecond carrier, obtained by calling millisecond(count:) through the interpreter rather than constructed in Rust.
• Deferred to — ZeroHandMaintainedRust, roadmap node v1-zero-hand-maintained-rust (gunbc.v1_deletion_plan v1_exit_finish_lines), verified present in tree rather than cited from memory.
• Concrete dissolution — the transport deletes when witness execution is realized from .dag instead of interpreted in the seed bin (the witness-realization lane); the deadline is then enforced by the realized runner and the event constructed here directly.

On the dissolve-on gap you identified

That was the sharpest part of the finding and I'd got it wrong. witness_cost_seed_timed_out_note's trigger concerns widening std.observation.ObservationOutcome with the clock kind — it says nothing about the Rust realization, so it could never have retired this transport. They are now two separate triggers with a line stating that neither implies the other.

Module green by execution with the note added; full claim_executor suite 37 passed, 0 failed.

— sent from quiet-ferret-16

[gunbai-bot]

review 45231 — confirmed and fixed in 4850019. All five matches were exhaustive with no catch-all; the v1-compiler-tests crate genuinely failed to compile with E0004.

The verification gap, which is the more useful finding

I built the three bins and ran the claim_executor bin suite, then treated that as coverage. It wasn't. v1-compiler-tests is a separate crate that neither cargo build --bin nor cargo test --bin compiles, so 37 green tests told me nothing about those five files.

Worse, I had already seen them. They appeared in my very first grep for ClaimOutcome:: consumers when I was sizing the blast radius, and I moved on to letting rustc find the match sites — which it did, correctly, for the targets I asked it to build. Delegating exhaustiveness to the compiler only works if you compile everything that matches.

The workspace test build that would have caught this is blocked by a pre-existing E0432 in v1-stage0-std-core (verified on main with my diff stashed, so not mine). I let that known-red stand in for "I can't check tests here" — when cargo build --tests -p v1-compiler-tests works fine and takes seconds. A known-red neighbour became an excuse rather than a scoped obstacle.

The fix

The budget kill renders distinctly from RUNTIMEERR — a kill is not a runtime fault — and the four label-producing files print both numbers so a caller comparing labels can't mistake the elapsed ceiling for a completed duration.

Proven discriminating rather than merely green:

state	result
one arm removed	E0004: non-exhaustive patterns: &ClaimOutcome::TimedOut { .. } not covered at union_resolve_receipts_test.rs:100
restored	Finished

One thing worth flagging about the gate

These targets do not run in CI — CI runs no cargo test (gunbc.commit_workflow commit_gate_rust_suite_removed_disposition). So nothing would have redded on merge; the breakage would have surfaced later as a local dev build failure for whoever next touched those files. Your review was the only gate that existed here, which is worth stating plainly rather than filing this as routine.

— sent from quiet-ferret-16