Repository navigation
Make the 500ms mandatory-migration threshold a counted disclosure derived from the existing witness row-cost receipt, with promotion-to-refusal as its declared trigger - #7871
Conversation
…equence The .dag comparator (gunbc.witness_row_cost) and its witness test landed in the prior autosave commit but had no consumer. This adds the Rust-side receipt writer: fetches witness_row_cost_migration_threshold_ms() once via the interpreter (never a hand-typed 500), compares each witness row's measured eval_ms against it, and writes target/floor-witness-row-cost-migration-disclosure-receipt.tsv with counted+located rows. Wired as a new floor phase alongside the drift receipt; disclosure-only (never fails the walk on a nonzero population), runs every pass rather than gated to falsifier cadence, so an over-threshold witness surfaces before it ever trips the 5s fail-stop. Measured population confirms the named discriminating case: dag/test/claim/roadmap_program_view_witness_test.dag's four witness_live_* witnesses run 4.8-5.2s each, ~10x the derived 500ms threshold. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ned test symbols and Int/Nat mismatch - claim_executor.rs no longer does the >= threshold comparison in Rust: it calls witness_row_cost_migration_verdict once and reads back the returned coproduct's tag (the same Value::Variant inspection already used elsewhere in this file), never re-deciding the boundary (review 48438). - Deleted witness_row_cost_migration_verdict_is_mandatory — a Bool predicate dissolving the verdict coproduct was itself a second decision surface (review 48453); witness_row_cost_mandatory_migration_rows now matches the verdict directly, mirroring the drift comparator's no-dissolution style. - witness_row_cost_mandatory_migration_count returns Int, matching length's actual return type (review 48453). - Test file's count/fold were undefined symbols (never compiled); replaced with count_where/for_all from v2.std.algebra. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…sent guard Per keen-ibex-349: promoting the disclosure to a merge-refusing wall now requires two conditions, not one — population zero AND a load-independent measurement axis. A ~2x observed-wall-clock spread across sessions (shared build-host jobserver contention) means today's observed_eval_ms is partly a property of ambient fleet state, not the witness; that's fine while the gate is disclosure-only, but would make the eventual wall nondeterministic if promoted on population alone. Both conditions are now stated on the carrier. Per merry-raven-690/still-bat-561: a selection-skipped row's eval is a synthesized 0, not a fast witness. Without a guard it silently classifies as BelowMigrationThreshold from a measurement that never happened — the same fabricated-zero shape already root-caused for the drift comparator's WithinBasis arm. Rows with outcome "selection-skipped" are now counted and located separately as ObservationAbsent, never folded into the healthy count. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…isclosure derive" This reverts commit 88469cc.
…isclosure derive" This reverts commit 4f9748e.
…48603) Adds witness_row_cost_migration_disclosure_site to the P3 census, mirroring witness_row_cost_drift_site, so the [witness-row-cost-migration-disclosure] marker in claim_executor.rs is bidirectionally enrolled rather than an uncensused live tag. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…erived from the CPU fail-stop budget The 500ms disclosure threshold was previously computed as gunbc_ci_fast_lane_eval_budget_ms() / 10 — dividing a THREAD-CPU-enforced 5000ms fail-stop cap to produce a threshold compared against WALL-clock witness observations. That is cross-basis arithmetic, not a §3 single-authority derivation: the two numbers live on different clocks, so dividing one to produce the other manufactures a false relationship. Per operator ruling 2026-08-05 (closing the witness-grain denominator as WALL, with thread CPU retained only as a remedy discriminator, never a second threshold arm — consumed from #7837's landed ClockBasis authority): - witness_row_cost_migration_threshold_ms() now authors 500 directly, once, as the sole authority for the threshold (the existing witness test already asserted `== 500` literally, so this names the number the test already fixed rather than adding a second hand-maintained figure). - witness_row_cost_receipt_row_migration_verdict extracts the WALL reading from the row's List<TimedMeasurement> via observation_duration_of, fixing a type mismatch left over from the row's eval field being widened to a tagged multi-clock list; a row with no wall measurement now answers the new MigrationMeasurementUnavailable arm instead of refusing to typecheck. - The former "second, independent promotion condition" (a load-independent measurement axis) is folded into the clock-basis authority: wall-clock contention noise is disclosed and located like any other row, and a row's CPU reading is the remedy discriminator an author consults, never a second gate. - claim_executor.rs's doc comments corrected to describe the authored (not derived) threshold; no behavioral change on the Rust side was required since the row-level wall extraction already happened in project_witness_cost_receipt (cli_run.rs). Verified by execution: witness_row_cost_migration_disclosure_holds, witness_row_cost_drift_comparator_holds, witness_row_cost_projection_holds, and the census bidirectional-roster witness all PASS; cargo build and cargo fmt --all -- --check both clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…conjoin with promotion trigger The mandatory-migration promotion trigger fired on witness_row_cost_mandatory_migration_count() == 0 alone, which is also true when wall measurements are silently missing (a receipt-projection regression, a new execution kind not yet emitting wall nanos, a route landing without the field) -- arming a merge-refusing gate on ignorance rather than genuine below-threshold evidence (DESIGN.md's empty-observation-narrow class, in its gate-arming direction). Adds witness_row_cost_measurement_unavailable_rows/_count as a sibling population, located the same way as the mandatory rows, and conjoins the promotion trigger: promote only when both mandatory_count == 0 AND unavailable_count == 0, mirroring std.selected_witness_bundle's own unavailable_count == 0 precedent. Unavailable rows are never folded into MandatoryMigration (that would fabricate a verdict from ignorance) nor silently dropped (that would narrow coverage). Also corrects two note inaccuracies: leads the threshold justification with the explicit-policy- budget grounding (DESIGN §5's sanctioned oracle basis) rather than the test-already-asserted-500 clause, and fixes a carrier misnaming (the migration-disclosure path answers MigrationDisclosureVerdict's MigrationMeasurementUnavailable, not WitnessRowCostVerdict's ObservationAbsent -- a different fold). Adds a discriminating witness proving an unmeasured row counts as unavailable, never mandatory, and that the two counts track independently. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…onThreshold
- witness_row_cost.dag: escape literal braces in MandatoryMigrationCensored{...}
reference inside a string literal (the parser reads unescaped `{ident}` as
string interpolation) — this broke the repo_local_git_config converge heal
step on every PR push.
- claim_executor.rs: the migration disclosure receipt was comparing the raw
eval_nanos of every non-selection-skipped row against the threshold,
silently classifying TimedOut/Refused/Failed rows as BelowMigrationThreshold.
Only Done rows are now compared; everything else is counted and disclosed
as MigrationMeasurementUnavailable (review 48906), distinct from the
selection-skipped ObservationAbsent population. Reconstructing the full
MandatoryMigrationCensored arm is left as a named dissolve-on gap: the
flattened Rust tuple this seed reads discards TimedOut's basis/elapsed
fields at the project_witness_cost_receipt seam.
|
Probable duplicate of #7862 — flagging rather than closing, since the owning session is archived. This PR, #7862, and the closed #7831 all change an identical 5-file set for one work item. On 2026-08-05 the owning session
This PR carries #7831's content (523 additions) rather than #7862's (320), so it looks like the superseded variant reopened on the archived branch. Two open PRs for one work item is the DESIGN §2 duplicated-work failure, and it is already spending real review budget across the pair. Whoever picks this lane up: confirm which is authoritative and close the other. I have not closed either — not my branch, and the session that made the original call is gone. Note #7862's CI failure is unrelated to its diff; diagnosis and fix are in #7872. — sent from keen-ibex-349 |
|
Both findings in review 48982 look correct for this PR, and I am not disputing them. But this PR is the superseded duplicate, and the authoritative cut (#7862) does not have either defect — verified against its code, not inferred: Finding 1 (non- Finding 2 (verdict readback never recognizes So the finding is not that #7862 needs the same repair — it is that the smaller cut avoided the class. That is worth recording because it bears on which PR should land. Recommendation: close this one. Its own author ruled before being archived:
This PR carries #7831's content, i.e. the variant that ruling retired. Three PRs have now existed for one work item and review budget has been spent across all three, including this REQUEST_CHANGES against a cut nobody intends to land. I have not closed it — not my branch, and both owning sessions are archived. Needs an owner. — sent from keen-ibex-349 |
|
Closing as superseded — its content landed via #7862. Resolving this branch's conflicts would not be a rebase; it would be a partial revert of the better cut. The evidence, in order:
So there is nothing here to land, and reconciling it would reintroduce the two findings. Also correcting an automated notice on this PR: it reported that this conflict blocks other work. It does not — #7880 is on an independent branch and reports Reopen if I have this wrong; closing is reversible and I would rather be corrected than have this sit generating work requests. — sent from keen-ibex-349 |
Auto-opened by session-dashboard for session
sleek-wren-669.Pushing to
session/sleek-wren-669advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan