Repository navigation
An enrolled row that was budget-refused is not an enrolled failure - #8423
Conversation
The expected-red roster records that a claim is expected to FAIL. Until now the join read `enrolled AND NOT Pass` and called the result held — so a row that hit its budget landed in the same arm as a row that failed for the reason someone enrolled it, and the comment above that arm claimed it "failed exactly as enrolled" when nothing had checked. A budget refusal is not a verdict. DESIGN states it directly: BudgetExceeded is an interruption plus a measured lower bound on cost, never a semantic verdict on a witness. So the enrolled claim was never decided at all, and reporting agreement about a failure nobody observed is the enrollment laundering the outcome. The specimen is not hypothetical. resolution_divergence_silent_pick_gate_- keystone_holds ran 526 seconds against a 500ms ceiling, returned false, was enrolled, and read as held for the entire life of the floor while being the single most expensive row in the corpus. The partition becomes three arms — held, now-passing, budget-refused — extracted as `expected_red_arm`, a total function over the outcome, so the three cases are a value rather than three `continue`s whose exhaustiveness holds only by reading the loop. The existing sum check already warned that "a later edit adds a third arm that quietly swallows rows"; the sum now includes it, so it cannot. NO RUST UNIT TEST ACCOMPANIES THIS, deliberately. `cargo test -p v1-compiler --lib` does not compile on main (two pre-existing E0532s in this same file), and the Rust suite was removed from CI by operator ruling on 2026-07-11. A #[test] here would be evidence that cannot execute, which is the failure this repository has spent a lot of effort deleting. The change instead reports its own blast radius: [floor-known-red] now names the budget-refused count, and each row is a typed, located, counted failure naming the kind and both numbers. EXPECT THIS TO RED ROWS ON ITS FIRST RUN. That is the point — those rows are undecided today and silently counted as agreement.
|
The failing check is this PR working. It reported its own blast radius on the first run, which is what it was built to do. Run 32095563011: 729 + 7 + 59 = 795. The partition is exact, so the third arm is covering the roster once and not swallowing rows. The measurement59 enrolled rows — 7.4% of the roster — were reading as agreement about a failure nobody had observed. Held drops 789 → 729. Failures rise 42 → 91, and every one of the new ones is a row that was previously counted as debt-held-as-expected while its claim was never decided. All 59 are So it is not diffuse — a third of it sits in four modules, which makes it tractable rather than a 59-row slog. What I am not doingNot pushing a fix, and not flipping this ready. The 59 rows are genuinely undecided and the correct response is to decide them — reduce their cost or move them to a lane declaring its own ceiling — not to widen the arm that was hiding them. The PR body predicted this would red rows on first run and said that was the point; the number is now measured rather than predicted. Still draft, still blocked on #8409 (deletes one of the rows this reclassifies) and #8412 (no completed main run exists to measure a delta against). — sent from sleek-moth-351 |
Two defects found by review, both real. expected_red_arm was DEAD CODE. I extracted it, wrote unit tests for it, discovered the lib test target does not compile on main, deleted the tests -- and left the function with no call site. So the diff held the partition twice: once as an uncalled enum whose doc comment claimed the loop had been replaced, and once as the inline if-let that actually ran. That is precisely the dual representation the extraction was supposed to remove, and it is the shape where the two silently drift. The loop now matches on it. And the three causes no longer share one count. std.witness_admission already rules that an unexpected green is a stale-quarantine refusal naming the row to delete, never an ordinary witness red, because otherwise an un-quarantine is indistinguishable from a regression in the alert signature. That ruling reads across to the budget arm: a defect to fix, a fix that already landed, and a cost to reduce are three remedies, so they get three counts and three prefixes. All three still stop the line -- the exit is nonzero if any is nonempty -- which is the factory model rather than a softening of it.
…RuntimeError
Review caught that the partition this PR adds does not catch the population it
was built for. A budget refusal reaches the claim seam TWO ways:
completion-side backstop -> ClaimOutcome::TimedOut
in-eval stride poll -> InterpError -> ClaimOutcome::RuntimeError
and the second spelling is the common one. Measured on run 32097006674: 10 rows
arrived as RuntimeError against 4 as TimedOut. Since RuntimeError maps to Held,
the three-arm split was catching roughly one in four of the rows it exists to
stop absorbing -- and for the ci_heal_skew_guard family that motivated the whole
change, 1 of 11.
The fix is not a fourth arm and is certainly not matching the message text: the
prose is a rendering of a typed pair the code already had, and recovering a type
by parsing its own output is the defect this file's own TimedOut comment
describes at length.
So both raised forms map onto TimedOut at the seam where the error is caught.
The outcome vocabulary becomes closed over the event, and a total match over
ClaimOutcome is then total in fact rather than only in shape.
DISCLOSED, because this changes a signal three text matchers read:
falsifier_failure_mode, walk_detail_is_semantic_batch_finding, and one arm in
main all .contains("eval budget exceeded") on a rendered detail string. Those
sit past the required-floor early return, on the plan/falsifier path whose
workflows the floor cut deleted, so they are unreachable today -- but they are
now unreachable for a second reason, and a later reader restoring that lane
needs to know the signal moved from prose into the variant rather than
disappearing.
Review caught the same defect this PR exists to remove, reproduced inside its own fix. The call site classified with expected_red_arm, DISCARDED the BudgetRefused answer, and then re-derived it below with a narrower `if let TimedOut`. Two dispatches over one value agree only while nobody adds a variant -- and the second test is always the narrower one, so a future variant mapping to BudgetRefused would fall through to known_red_held and be silently held. Which is exactly what RuntimeError was doing an hour ago. It would also have passed review, because the helper LOOKS like it classifies. Now there is one match with three working arms. The compiler forces the next variant to be classified in the one place or fail to build, and the partition-sum check is checking three counters produced by one mechanism rather than two. Also marks the falsifier's budget substring list as a STALE signal rather than leaving it to rot. It matched prose that no longer exists on this path. Left in place because the falsifier lane is a separate operator-agreed re-add and not this PR's to delete, but a dead `.contains` does not fail loudly on restore -- it reports no budget findings, saying "there are none" where it should say "I cannot tell" -- so the note tells a restorer to read the variant.
|
Two review rounds landed real defects. Recording both, plus a measurement principle that came out of them and outlasts this PR. The partition was catching 1 in 4 of the rows it exists forA budget refusal reaches the claim seam two ways: the completion-side backstop produces Fixed at the seam rather than with a fourth arm. Both raised forms now map onto The fix then reproduced the defect inside itselfThe call site classified with It would have passed review, because the helper looks like it classifies. Now it is one match with three working arms, so the compiler forces the next variant to be classified there or fail to build, and the partition-sum check verifies three counters produced by one mechanism instead of two. The measurement principleThe two-variant split was invisible in my run — those rows landed at 471–480ms and passed — and visible in another where they landed at 502–511ms. Same eleven rows, ~6% spread, straddling a hard 500ms ceiling. Neither log carried the mechanism alone. Generalized: for a threshold-decided subject, a single instrument on a single host cannot distinguish "does not occur" from "did not occur here" — and the remedy is not more runs on the same host, because repeating a biased instrument narrows the confidence interval around the wrong number. That directly cancels a measurement run I was about to propose (a raised-ceiling pass on whatever host it landed on); any ceiling set from these rows needs the cross-host distribution or it will be fitted to one machine's scheduling and cache state, wrong in the same direction that made the roster oscillate in the first place. Still draft pending #8409. — sent from sleek-moth-351 |
|
The seam fix changed the answer by a factor of four. Run 32103234099: 532 + 2 + 261 = 795. Partition exact. 261 of 795 enrolled rows — a third of the roster — were undecided, not failingBefore the seam fix this read as 59. The other 203 identities were budget refusals arriving as That is the measurement the PR existed to obtain, and it is four times what the first version could see. Worth stating plainly: the first version of this fix would have reported 59 and looked like it had closed the class. By kind: 193 Newly surfaced, by module: What this means for the roster as an instrumentA third of the enrolled population was recording an expectation that was never tested. The roster's contract — this row fails, and we agree it fails — held for 532 rows and was fiction for 261. That is not a rounding error in a debt ledger; it is the ledger being wrong about what kind of debt it holds. It also retires my earlier estimate that the budget class was "~250 rows within 1–20% of ceiling." Both halves were wrong: the count is 261 and the timings are truncations, not costs.
Still draft pending #8409. — sent from sleek-moth-351 |
Records dissolve-on toward #8423 typed per-witness receipt channels per tidy-pike-117 migration advice; Wave 6 keeps scalar transport for E1 only. Co-authored-by: Cursor <cursoragent@cursor.com>
…r a measurement
My own seam fix closed the partition hole and erased a distinction while doing
it, and review caught it. The two paths that reach TimedOut are not two spellings
of one event:
armed deadline fires -> the witness was INTERRUPTED and never finished.
elapsed_ms is right-censored: cost >= that, unknown
above it. A row that would take 2s and one that
would take 40s report the same number, because the
number is the ceiling plus poll granularity.
completion-side backstop -> the witness RAN TO COMPLETION and passed, then was
reclassified. elapsed_ms is exact.
Before the unification, RuntimeError vs TimedOut encoded that accidentally, on
the wrong axis -- which is why the partition was unsound. Merging them fixed the
partition and lost the censoring, because BudgetKind says WHICH CLOCK, never
WHETHER IT COMPLETED.
So the axis is added rather than the merge reverted: TimedOut carries
BudgetCompletion::Interrupted | CompletedOverBudget. The variant stays single, so
expected_red_arm stays exhaustive and the absorption hole stays closed, and every
elapsed figure now renders as "at least Nms" or "exactly Nms" instead of a bare
number a reader has to interpret.
WHY IT IS URGENT RATHER THAN TIDY: it decides a decision in flight. Of run 2's 14
budget failures, 4 are completion-side (exact: 504, 507, 516, 551) and 10 are
armed-deadline (censored at 501-511). So "the family sits at 501-511ms" was never
a cost measurement for ten of eleven rows, and the 6% cross-host spread both I
and the reviewer quoted is invalid -- it compares exact values against censored
ones, so the apparent spread is an artifact of where the ceiling sits. Raising
the ceiling to 600ms would tell us nothing, because we do not know whether the
true costs are 505ms or 5s.
This also satisfies a condition already written down elsewhere in the tree:
claim_executor.rs refuses to seed a cost basis from the corpus's most expensive
row, saying it must stay BasisAbsent "until ClaimOutcome::TimedOut can
distinguish killed from completed". It can now.
|
Correcting my own comment above. The measurement principle stands; the arithmetic I used to motivate it does not, and my seam fix had erased a distinction I then reasoned across. The seam merged two different events
Before the unification, Fixed at Adding the field produced seven What I got wrong aboveI wrote that the family shows "471–480ms on one host, 502–511ms on another, ~6% spread straddling the ceiling" and generalized it into a principle. That spread is not computable. The 471–480 values are exact (those rows completed); the 5xx values are censored. Comparing them measures where the ceiling sits, not how the rows differ. The principle survives on its own reasoning — for a threshold-decided subject, one instrument on one host cannot distinguish "does not occur" from "did not occur here" — but it should not rest on that example, and I am not leaving a good rule propped on a bad number. What we actually know about the budget classOf run 2's 14 budget failures: 4 are exact (504, 507, 516, 551ms) and 10 are censored at 501–511ms. So raising the ceiling to 600ms would tell us nothing, because the true costs could be 505ms or 5s. Four rows are the only costs we currently know. That is the whole state of knowledge after a day of measuring it. A condition already written down in the tree, now satisfied
— sent from sleek-moth-351 |
…w would re-erase the axis Two design-doc corrections, no code. The floor_component_receipt TimedOut frontier note declared its dissolve-on as ClaimOutcome carrying the typed budget pair through to ClaimResult. a9cccc2 did that, so the trigger has fired and the note is unwired work rather than a modelling frontier. It is amended rather than deleted, because wiring it as it stands would lose something. The seed now carries a third axis the .dag arm has no field for: whether the elapsed figure is a right-censored lower bound (an armed deadline aborted the witness) or an exact measurement (the completion-side backstop reclassified a witness that finished). Projecting both into one TimedOut with basis, budget and elapsed re-erases at the authority layer exactly what the seed was corrected to keep, and does it silently, because a bound and a measurement are the same shape. The precedent is that arm's own basis field, added by operator ruling for the identical reason one axis over, which makes this the second discriminating axis the arm has needed after the fact. That is the usual sign one arm is carrying two states. Prerequisite is a std change: std.observation TimedOut gains completion beside basis. And the C4 premise in discrete_cost_derivation is corrected rather than left to rot. It asserted that the measured corpus for calibration already exists and is populated, and built C4 on not needing to build a measurement pipeline. Those 1,173 rows predate the killed/completed distinction, so an unknown subset are deadline ceilings recorded as costs, and for those the 2x comparator returned WithinBasis against the ceiling: wrong in the fail-open direction. Whoever builds C4 would have inherited a dead premise and paid the archaeology.
… as the tell floor_component_outcome_of_tag reconstructs an outcome from a tag plus the fields the tag lost. That is lossy projection plus re-supply -- structurally the same defect the frontier note describes one layer down, where RuntimeError flattened the typed budget pair into prose the executor would have had to re-parse. The String form was deleted at the seam this morning; the tag form is its residue. basis became a parameter because the tag never carried it. completion would be the second axis threaded around the same tag, and two is the count at which how the function works starts being mistaken for a design. So the note says the terminal shape is the transport carrying the typed outcome, and a THIRD axis triggers the deletion rather than a third parameter. It also carries the fabrication trap at every axis: a caller that does not hold the fact passes whichever value compiles, and CompletedOverBudget is the one that reads as normal -- the same shape as fabricating 0 for budget and elapsed, which the existing note already forbids for the first pair.
…nd a receipt that said "killed" about a completed row Review found the axis I added being erased by the consumer that reads it, plus a durable receipt asserting a false fact. Both live at 0ac6233. THE LOAD-BEARING FACT I did not state when I added the field: both converters match only ClaimOutcome::Pass, so CompletedOverBudget IMPLIES THE WITNESS PASSED. It cannot occur for a failing witness. The arm means "passed, then reclassified on cost", not merely "completed". So the classifier was wrong. It matched TimedOut { .. } regardless of completion and answered BudgetRefused, whose message reads "a budget refusal produces no verdict, so the enrolled claim went undecided". For a passing row that sentence is false: the claim WAS decided, it passed, and the roster row is stale. Having just removed "a budget outcome is always held", I had shipped "a budget outcome is never stale" -- the same absorption one arm over, hiding the exact signal the roster exists to surface, which is that the debt was repaid. The row is true on two axes at once and the three existing arms each force a choice. Semantically it passed: remove the roster row. On cost it is over budget with an EXACT elapsed: a real debt remains. So PassedOverBudget reports BOTH -- stale_quarantine and budget_refused -- and the partition sum grows a fourth term rather than picking a winner. AND THE RECEIPT AT claim_executor.rs:2637 WAS FABRICATING. It bound completion: _ and rendered "killed at its {kind} budget ... elapsed is a ceiling, not a completed duration" unconditionally, defended by a comment reading "'ceiling' is deliberate: the row was killed AT the budget". True of an interrupted row, false of a completed one -- for which it asserts killed-and-censored about a row that ran to completion, passed, and has an exact number. That is fabricated plausible output in the durable receipt path, and the considered-looking justification is why it would pass review. It now renders per arm: "at least Nms (interrupted)" or "exactly Nms (ran to completion and passed, then reclassified on cost)". This is the third time today the same defect reappeared one layer out: String flattening at the seam, then the tag plus reconstructive parameters, now a field added and matched with `_`. The axis keeps being introduced where it is RAISED and dropped where it is CONSUMED.
…ing-side census closed
The unverified tail of the review held: BudgetRefusal { elapsed, budget, kind }
is where the erasure moves one layer down. It feeds the durable component and
alert path, so a completed-and-passed row arrived there indistinguishable from an
interrupted one and its exact elapsed would be read as a ceiling. It now carries
completion.
The batch tag was wrong in the same way and worse, because a tag is what
downstream classification reads rather than prose a human skims: "budget-killed"
was unconditional. A completed row was not killed. It is now budget-killed or
budget-exceeded-completed, with elapsed_is= naming the reading.
CONSUMING-SIDE CENSUS IS CLOSED. Zero `completion: _` remain in claim_executor,
one in cli_run -- and that one is a prerequisite, not an oversight: it constructs
std.observation TimedOut, which has { basis, budget, elapsed } and no completion
field to put it in. Fabricating a value to reach a more specific arm is precisely
what the floor component receipt note forbids for the first pair, so the drop is
deliberate, marked at the site, and dissolves when that std arm gains completion
beside basis.
…trade, and the std.observation drop's verdict Three recordings on the arm landed in 2d1a466, none of them behavioral: - The next-rung trigger is stated as a falsifiable condition (the next consuming site that drops the axis) rather than a site-count threshold, with the rate evidence from this PR written down beside it. - The field-versus-variant choice carries its trade: the wildcard hazard is real and is what made the erasure writable, and it is still a field because the variant split it replaced was on raise mechanism, which no consumer should act on. - The one remaining cli_run `completion: _` names its DESIGN 5 verdict as AcknowledgePreexistingDebt. std.observation TimedOut never carried the axis; this change made the gap visible rather than creating it, and filing it as new debt would price surfacing gaps. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
All three points from tidy-pike-117's verification pass are recorded at 80c1a6c. None are behavioral — the fix itself was 2d1a466 / 6ba9c4e.
|
|
Investigated run 32113571315. There is no fix to push — the check fails because of what this PR is for, and pushing one would mean narrowing the subject. Recording the measurement instead.
What the 253 actually are. 178 distinct rows, 120 Cpu and 58 Wall. 127 of them land within five milliseconds of the ceiling — 70 at 501ms, 31 at 502, 12 at 503, 11 at 504, 3 at 505. That band is the kill-at-first-poll signature, not a cost distribution. Two populations separate cleanly, and only one of them is a cost debt: Genuine cost. Unexplained. Joining the 178 against A 2ms row does not become a 503ms row. I do not have a mechanism for this and am not going to invent one — I tested position-in-run accumulation and it is refuted: the over-500ms rate across run-order quartiles is 58% / 16% / 13% / 42%, not monotonic, and RSS is already 10.16GB at the first sample rather than climbing into it. So this is a located, counted anomaly, and it stays that until it is measured on its own. The operator call this surfaces. 253 undecided rows will keep the fold red until either their cost comes down or the ceiling moves, and the ceiling is a standing 500ms ruling I am not going to change unilaterally. What I would not do is make the classifier quieter to get green — the rows are undecided and the fold should say so. |
…e discovery path review 53412 is right on all six sites it names, and there was a seventh it did not: I verified the completion axis with `cargo check --bin claim_executor` and that target does not cover claim_batch, the test targets, or the BudgetRefusal fixture. `--all-targets` does. The two remaining E0532s in the lib test are pre-existing on main, confirmed by stashing. Sites, none padded with `..`: - claim_batch.rs rendered "killed ... elapsed is a ceiling" unconditionally — the same fabricated receipt already fixed in the executor's renderer, in a second transport for one outcome. Split per arm so the two cannot disagree. - The two cli_run tests bind and ASSERT CompletedOverBudget rather than wildcarding it. These fns are its only producers; a `..` would have accepted an Interrupted result and silently turned an exact elapsed into a bound. - Four claim_executor fixtures name Interrupted explicitly, because a fixture that does not say which arm it builds asserts about whichever one it got. And the substantive finding: ExpectedRedDisposition::of mapped every TimedOut to BudgetFailure, so a row that ran to completion and PASSED read as "no verdict" — the conflation this PR removes on the required-floor path, left standing one function away. Split on completion. CompletedOverBudget maps to the existing stale-quarantine arm rather than a new one: that arm carries the verdict-bearing half, and minting StaleAndOverBudget would be growth on a surface the floor cut is retiring, since --required-floor returns before any caller of run_batch_unit. The cost half is unrepresented there and the comment says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
review 53412 is right on all six sites, and there was a seventh it did not name. Fixed at 63bfe48. How I missed them. I verified the completion axis with No site was padded with
The substantive finding is real and is fixed. I mapped — sent from sleek-moth-351 |
|
Run 32138686434 at No build error. Two rows fail here and not on main, and both are the straddler population, not regressions. Their full observed distributions across every run I have: Ceiling is 500. Eleven and ten observations respectively, crossing it on a minority of runs. Neither is reachable from anything in this diff. The new evidence. The two rows rendered differently, and correctly: exactly against at least — one row ran to completion and was reclassified on cost, the other was interrupted and its number is a bound. Before this PR both printed the same sentence, and the executor's renderer asserted "elapsed is a ceiling" about both. That is the censoring distinction surviving from the seam through to a live CI receipt, observed rather than argued. It also sharpens the earlier anomaly: — sent from sleek-moth-351 |
Combine main's BudgetCompletion partition with HostToolUnresolved on the witness boundary and the expected-red roster join. HostToolUnresolved counts as budget-refused for enrolled-row accounting (undecided, not held). Co-authored-by: Cursor <cursoragent@cursor.com>
* Wave 6: one witness presentation authority for Bazel-shaped floor output. Route per-witness claim lines through gunbc.observation_ci_render so the required floor and discovery paths share one //package:target PASSED-in-Xms formatter instead of ad-hoc Rust glyphs. Co-authored-by: Cursor <cursoragent@cursor.com> * Address review 53041: drop duplicate witnesses and legacy formatter fallback. Remove the pasted duplicate test declarations and make witness presentation fail closed with a typed ::error:: when the .dag authority cannot render, matching the existing ci_batch_summary_text seam. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix CI witnesses: mirror hot-path render, roster prune, Optional match. Route per-witness floor lines through a Rust mirror of ci_witness_claim_result_text instead of per-line interpreter eval (~800 anomaly rows were pushing marginal witnesses over the 500ms receipt budget). Fix host_network_diagnosis Optional Absent arm missed by #8400. Remove three expected-red rows the floor reported as now passing. Co-authored-by: Cursor <cursoragent@cursor.com> * Route E2 budget-warn lines and add mirror-oracle lockstep receipts. Land ci_witness_budget_warn_text with native hot-path mirror and fail-closed refusal; add byte-equal .dag oracle tests for both S1 and S2 mirrors (review 53082), minute-switch boundary witnesses, emit-census rows, and dedupe duration formatting through v1_rt::obs_human_elapsed. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix census witness string patterns: escape literal braces. The raw-shape-gone witnesses grep for legacy format strings containing `{subject}` and `{}` placeholders; escape them so the parser does not treat them as interpolation. Co-authored-by: Cursor <cursoragent@cursor.com> * Ground ci_witness_budget_warn_text on Millisecond carriers. Address review 53093 unit-modeling hard-blocker: wall, warn, and budget cross as std.measure Millisecond at the render seam; seed oracle test builds carriers via millisecond() at the boundary. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix floor_expected_red roster prune brace imbalance. Removing three expected-red identities in 538df9b dropped Cons nodes but left extra closing braces in chunk_00 and chunk_03, which made the module unparseable and cascaded into required-floor refusal. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix floor roster drift and qualified variant match on records. Remove seven expected-red identities the floor reported as passing, restore three that were pruned too early (altra budget + dissolution census), merge main, and teach match_pattern to accept record-shaped coproduct values under qualified variant patterns (fixes compute_board_admission witness runtime errors). Co-authored-by: Cursor <cursoragent@cursor.com> * Revert match_pattern record broadening from wave-6 PR. Per review 53137: qualified-leaf record matching is substrate-level and belongs in its own change with a discriminating witness, not folded into witness presentation routing. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix compute_board match failures and sync expected-red roster with main. Scope record-shaped coproduct reconciliation to parent_enum-stamped match arms (fixes non-exhaustive pattern match without the unscoped name_last broadening review 53137 rejected). Restore main's 795-entry floor_expected_red roster so PR-only roster drift stops failing witnesses that main still holds as expected-red. Co-authored-by: Cursor <cursoragent@cursor.com> * Revert interpreter match_pattern hunk; sync expected-red roster with CI. Remove the Record-arm leaf reconciliation from v1_interpreter (out of scope for Wave 6 per operator directive). Update floor_expected_red: drop dashboard_health (now passes), enroll compute_board admission PreparedSubject failures and marginal budget witnesses from run 32099904819. Co-authored-by: Cursor <cursoragent@cursor.com> * Document passed:Bool as interim display transport, not semantic seam. Records dissolve-on toward #8423 typed per-witness receipt channels per tidy-pike-117 migration advice; Wave 6 keeps scalar transport for E1 only. Co-authored-by: Cursor <cursoragent@cursor.com> * Sharpen interim Bool note with outcome×disposition receipt shape. Records sleek-moth-351 guidance: Bool blind spot (TimedOut collapse), per-witness receipt = outcome × disposition product (not reporting channels), held-row visibility obligation for follow-up. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix observation_ci_render parse error: escape braces in interim note. TimedOut{...} in the dissolve-on prose triggered string interpolation and broke the whole module; escape literal braces per dag string rules. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove five stale expected-red roster entries that now pass. CI reported these identities as no longer failing; keeping them would block the floor-known-red gate on PR #8399. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix parse error in expected-red roster after stale-entry removal. Surgical Cons-node removal left one extra closing brace per deleted identity; restore brace balance in chunks 08, 10, 13, and 15. Co-authored-by: Cursor <cursoragent@cursor.com> * Revert floor_expected_red.dag to main — roster edits are out of scope. The three net removals straddle the 500ms witness ceiling and are not decidable from pass/fail on this branch; presentation authority should not touch the roster. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix Record pattern matching for qualified constructor spellings. Mirror the Variant arm's last-segment fallback so refusal coproduct rows like DuplicateComponentIdentity match when the scrutinee carries the bare type name. Unblocks compute_board_admission floor witnesses (pre-existing substrate gap). Co-authored-by: Cursor <cursoragent@cursor.com> * Revert interpreter match_pattern Record fallback from wave-6 PR. Qualified-name matching belongs in #8416 at resolution time, not via last-segment coincidence matching at runtime. Co-authored-by: Cursor <cursoragent@cursor.com> * Land compute_board refusal matching in owning module (#8427 shape). Move refusal_matches_name into admission.dag so witness tests bind at runtime without the rejected interpreter last-segment fallback. floor_expected_red and required_floor budget unchanged. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop compute_board hunks from wave-6 PR (#8399). Presentation routing only; admission refusal matching belongs in #8416/#8427 (compiler/owning-module lanes), not this diff. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
The refusal preempts the content verdict, so the run learns cost and never learns correctness -- but the printed remedy told the reader to reduce the row's cost, asserting a diagnosis the run did not establish. A content defect behind a refused row is indistinguishable from the enrolled failure. Say that. Accounting unchanged: the four-arm partition, its exactness check and the nonzero exit were already correct (#8423). This is the wording only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…tate (#8446) * WIP: CI rework * Cite the budget authority symbol instead of transcribing its value The 5s-rule re-anchoring replaced one stale number with another: main's required_floor_claim_budget_ms has since ratcheted 500 -> 1552, so comments asserting '500ms hard / 100ms warn' would land false. Name the ruling and the authority symbol; the ceiling stays in one place (DESIGN 3, cite the symbol). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * A budget-refused row's remedy line said cost when the verdict is unknown The refusal preempts the content verdict, so the run learns cost and never learns correctness -- but the printed remedy told the reader to reduce the row's cost, asserting a diagnosis the run did not establish. A content defect behind a refused row is indistinguishable from the enrolled failure. Say that. Accounting unchanged: the four-arm partition, its exactness check and the nonzero exit were already correct (#8423). This is the wording only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * An empty expected-red roster is a read failure wearing success's face: refuse it Live on main since #8437. The prepared-floor scope flip to last-write-wins bare helper names made floor_expected_red_roster evaluate to the empty list, and the run printed 'roster carries 0 enrolled identity(ies)' then 469 ordinary FAILs. The immediately preceding commit (2b95d86) reported 661. So 661 enrolled rows became 469 re-labelled regressions plus a silent remainder, and every guard that exists to catch exactly this was vacuous at zero: the partition sum compares 0+0+0+0 against 0, and nothing is ever missing from an empty set. The loader already refused a duplicate identity and a non-string shape. It did not refuse the one shape that disables every downstream check. This does not fix #8437's binding regression -- that is a separate root cause and not mine -- it stops the roster's disappearance from reporting as ordinary red. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Reconnect floor_expected_red_chunks: 464 enrolled identities were stranded #8437 left the aggregation function returning Empty while chunk_00..19 still carry all 464 identities and the header still reads POPULATION: 464. So the roster evaluated empty, every enrolled row lost its enrollment, and 469 of them printed as ordinary FAILs. Main has been in this state since 13:42 EDT. The restored body is BYTE-IDENTICAL to the aggregator at 2b95d86, the last commit that reported 661 enrolled. Not proven by local execution: the pinned gunbc in this session is stale against the tree and refuses on unrelated std resolution, so CI is the oracle. Credit to clever-gull-11 for the sharper root cause: I had attributed the empty evaluation to #8437's bare-name binding flip, and it is a severed function in the file itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Restore the 5 enrollments #8437 dropped while they were still failing The reconnect fixed the aggregator; it did not undo the other half of #8437's roster damage. That commit also dropped 197 identities from the file. The drop decomposes exactly: 197 = 164 greened by its own first-write-wins fix + 28 decl_facts rows genuinely stale (greened by #8439) + 5 STILL FAILING -- wrongly dropped Run 32172125816 is the receipt, not a prediction: with the aggregator restored the floor reported roster=464, known_red_held=367, stale_quarantine=0 and failed=5, and the 5 are exactly the 5 identified. They were enrolled at 2b95d86, they still fail, and nothing decided to remove them. Restoring their enrollment is restoring the pre-#8437 state, not admitting new debt. THIS DOES NOT GREEN THE TREE, and it is not meant to. The same run reports budget_refused=97: 97 enrolled rows exceed the 1552ms ceiling and so go undecided, and any nonempty budget-refused population stops the line. That is pre-existing -- main carried ~102 of them before this incident -- and it is the slow-row work, not this repair. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…lace (#8500) * DESIGN: the floor fold executes; correct the falsified sentence in place The CI rung-drop paragraph said 'no witness has executed. The fold refuses during preparation (strict whole-corpus typecheck).' That was true when written and is now false: main runs planned=9008 executed=9008 passed=8702 failed=0, three consecutive green runs, ~30 min wall. Corrected in place rather than left standing until the whole paragraph can be rewritten. The paragraph's own restoration trigger asks for a one-pass rewrite when the re-add queue closes, and the queue has not closed -- but the same paragraph also states that a knowingly-false recital in the canonical authority is premise contamination, and that is direction-agnostic. It had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop is unaffected. The fold running green establishes that the replacement executes, not that the re-add queue has closed. Also carries one inherited drift the regen surfaced: docs/plans/ discrete-cost-derivation.md was not a fixed point of its authority on main (the authority was last edited by #8423; the projection was not regenerated). Committing DESIGN.md alone would leave the tree non-fixed-point, so the regen output goes in whole. This is the class the regen gate exists to catch, caught by hand because the gate is currently unguarded. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Restore the shrink-monotonicity thread to the AUTHORITY, so regen reproduces it The reviewer on #8500 read this PR as dropping the floor_expected_red shrink-monotonicity open-threads bullet. It did -- correctly, and for a reason worth recording rather than reverting. That bullet is in main's DESIGN.md and has NEVER been in dag/gunbc/design_document.dag. git log -S over the authority returns nothing; #8469 wrote the note into the generated projection and never touched the model that produces it. So main's DESIGN.md carries a row its own generator does not emit, and regenerating deleted it. The content is wanted. It was written in the wrong file. This commit adds it to the authority beside the other open-thread rows and regenerates, so DESIGN.md reproduces it byte-identically to what #8469 intended -- verified by diffing the regenerated line against main's. Note for anyone hand-inserting into this authority: .dag string literals need \{ for a literal brace. An unescaped one makes the file unparseable and for_each_parsed_module_binding panics, which is at least loud. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Regen DESIGN.md after the merge: the projection was one line behind its authority The merge with main took origin/main's authored shrink-monotonicity row (both sides had added the same bullet independently; theirs escapes the closing brace, mine was reconstructed from main's RENDERED DESIGN.md line, so theirs is the authored original and wins). Git merged design_document.dag and DESIGN.md as two independent files and left them at different versions -- no conflict markers, no complaint. Regen through main_wet corrects the projection to match the authority: one line. That is the same class this PR exists to fix, arriving during the PR's own merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
One file plus the executor's summary. Three arms where there were two, and three counts where there was one.
The defect
The roster records that a claim is expected to fail. The join read
enrolled AND NOT Passand called that held — so a row that hit its budget landed in the same arm as a row that failed for the reason it was enrolled. The comment above that arm asserted the row "failed exactly as enrolled"; nothing had checked.A budget refusal is not a verdict. DESIGN says it directly:
BudgetExceededis an interruption plus a measured lower bound on cost. The enrolled claim was never decided, so reporting agreement about a failure nobody observed is the enrollment laundering the outcome.The specimen was the most expensive row in the corpus:
resolution_divergence_silent_pick_gate_keystone_holdsran 526 seconds against a 500ms ceiling, returned false, was enrolled, and read as held for the entire life of the floor.Measured, not predicted
First run (32095563011), which is the change reporting its own blast radius:
729 + 7 + 59 = 795, so the partition is exact. 59 enrolled rows — 7.4% of the roster — were reading as agreement about a failure nobody observed. All 59 are
Cpu, noneWall, so this population is disjoint from the wall-clock escape route the 526s row used. A third of them sit in four modules.LANDING THIS TURNS ~69 SILENT ROWS LOUD, DELIBERATELY
Stated plainly because the first red should not read as a regression: 59 budget-refused plus the ~10 budget-marginal
ci_heal_skew_guardrows become reported rows on the next run. They are undecided today and counted as agreement. This is the factory model — the line stops and the deficit stops being free — and it is a declared stop, not a surprise.Three counts, not one
std.witness_admissionalready rules that an unexpected green is a stale-quarantine refusal naming the row to delete, never an ordinary witness red, because otherwise an un-quarantine is indistinguishable from a regression in the alert signature. That ruling reads across to the budget arm. So the summary now carriesfailed/stale_quarantine/budget_refusedseparately, with distinct line prefixes — a defect to fix, a fix that already landed, and a cost to reduce are three remedies. All three still stop the line: the exit is nonzero if any is nonempty.It kills an oscillator
Remove-on-pass assumes a verdict is stable. For a budget-marginal row it is not: the
ci_heal_skew_guardfamily measured 471–480ms on one host and 502–511ms on another, straddling a hard threshold, and went enrolled → passed → removed → failed. Under this change, enrollment silences such a row in neither direction (pass → stale-quarantine, refusal → budget-refused), so enrollment stops being a lever for budget outcomes and there is nothing left to oscillate between.No Rust unit test, deliberately
cargo test -p v1-compiler --libdoes not compile on main — two pre-existing E0532s in this same file — and the Rust suite was removed from CI by operator ruling on 2026-07-11. I wrote the controls, confirmed they could not execute, and deleted them rather than leave a green-looking test behind. Review then caught that I had also leftexpected_red_armwith no call site, holding the partition twice; the loop now matches on it.What it does to the gate, against main on the same instrument
The floor's verdict is decided by
failed+stale_quarantine+budget_refused;known_red_heldis the roster doing its job and cannot move the exit. Latest run (32113571315) beside main's (32097006674):failedhalves andknown_red_helddrops by 262, because before this change a budget error reachedRuntimeErrorand an enrolled row mapped it toHeld. main is currently absorbing ~262 undecided rows into the expected-red bucket and reporting them covered. They are not — a budget refusal produces no verdict. This moves them into channels that say what was actually observed.That matters beyond this PR because the gate's resolution is the thing under strain: the verdict rests on ~40 rows, of which roughly a third are budget kills, against a measured churn of ~21 rows between runs of trees differing by two documentation files. The check does discriminate; its noise floor is simply larger than the signal one new regression would produce. Removing the budget third from the verdict is what shrinks that floor.
Why this is worth landing before the rows are cheap
The misread this prevents has cost four sessions their decisions in a single day, every time by reading a PASS at the deadline as evidence about the claim:
One cause, and it is a message rather than a mechanism:
enrolled as expected-red and PASSEDnames the arm that fired, not what was observed. The fix is cheap once an undecided channel exists to name the alternative — which is what this PR adds.No longer held for #8409. The dependency was that #8409 deletes the 526s specimen this reclassifies — a measurement overlap, not a code one: it removes
resolution_divergence_silent_pick_gate_in_processwhile this changesrun_claim/ClaimOutcome, different regions of the same file. The specimen stays valid as historical evidence of the defect whichever order they land in, and holding a repair four sessions are currently paying for behind a cosmetic dependency is the wrong trade.🤖 Generated with Claude Code