feat(perf): #263-A — the measurement instrument (CALIBRATION_ONLY; no admissible baseline yet)

[PhysShell]

⚠️ Status: BLOCKED — there is no admissible calibration of record at this head

p022-263a-calibration.linux.json has been deleted, not replaced, and this head does not restore it.

Both pairs reproduced at the head they were recorded against. Across the six recorded pair attempts below, n=5 reads fail, pass, pass, pass, fail, pass — and the running tally counts more observations than the table does. Nothing in that sequence is a trend, and the ledger exists so that no revision of this description can quietly turn it into one.

attempt	n=5	n=15
pre-contract (quarantined)	failed — 1 of 40 cells, worst core-full-sarif|rust|cal-facts-medium|process-cold at 0.478	failed — 3 of 40, worst core-usage|rust|cal-facts-tiny|process-cold at 0.516
corrected identity procedure (388598e)	passed	failed — 1 cell, core-full-sarif|rust|cal-facts-medium|process-cold at 0.361
under the D7 §6 + reference-identity repair	passed	passed
under the anchor + protocol repair	passed	passed
under the N/A + completeness repair	failed — 1 cell, core-full-sarif|rust|cal-facts-tiny|process-cold at 0.508	passed
under the D7-vocabulary repair	passed	passed

That table is the six pair attempts recorded under successive identity procedures; it is not the whole ledger.

Running tally on this machine: n=5 has failed three times and passed seven times; n=15 has failed twice and passed six times. Neither count reproduces reliably, and which one "works" depends on when it was run.

No calibration of record is restored, and that is the whole point. Every re-record was forced by a provenance repair — a changed digest, a changed reference identity, a changed pair-identity contract — never sought for a better answer. Promoting whichever pair happened to pass would be selection on the outcome regardless of why the re-run happened. By now the coin has been watched land often enough to know it is a coin. No failing pair has ever been re-run to obtain a passing partner. That is the single move this instrument exists to make impossible to hide, and the permitted counts are still only 5 and 15 with nothing to escalate to. Both pairs ship as sizing evidence, pass and fail alike, and the report-of-record glob stays empty.

What the n=15 failure did and did not establish

This outcome is consistent with the pre-run alternative that increasing N need not restore reproducibility when the dominant variability is not sampling uncertainty of the median. It falsifies the narrower operational hypothesis tested by the preregistered escalation: that moving from n=5 to n=15 would reliably produce an admissible calibration on this setup. It does not establish the cause of the remaining variability, nor distinguish intrinsic workload spread from between-run environmental variation.

An earlier revision of this description called that outcome predicted. It was not, and the claim is withdrawn. Nothing stated in advance predicted that n=15 would fail on three cells, or fail worse than n=5. What was stated in advance was only the alternative above and the stop rule. A provenance claim about when a belief was formed is exactly the kind of claim this instrument exists to make checkable, so it does not get to be sloppy here.

No knob was turned in response. The permitted escalation was exactly one step, 5 → 15, with a mandatory stop on failure. There is no n=25, no n=45, --warmup stays at 2, and 0.35 has not moved. A tolerance adjusted after seeing which runs it rejects is a threshold fitted to a result, which is the single thing this instrument exists to prevent.

An observation offered as a finding. Every cell that has ever fallen outside tolerance is a rust cell with a median between 2.5 ms and 9.2 ms. No Python cell has ever fallen outside it. Of the 40 cells, the 16 with a median under 10 ms are all rust, and all five distinct failures to date sit in that group. The population spans roughly 1.8 ms to 3.2 s, and one relative tolerance is applied uniformly across all of it.

A variance characterisation was authorised to test whether that is a duration artefact. It came back formally inconclusive — see below. The magnitude-aware question remains a measurement-design decision for the owner, and nothing in this PR advances it.

Variance characterisation: formal outcome O3 (inconclusive)

(The owner calls this "Round 6". It is unrelated to review Round 6 below, which was the A/B pair defect. Two different numbering schemes met in one document; the collision is noted rather than silently renamed.)

Preregistered in docs/notes/p022-263a-round6-preregistration.md, committed before the first measurement existed, naming three outcomes and what each licenses. Amended once, also before any measurement and recorded with its reason: the helper had to be compiled rather than interpreted, because the timed interval includes process spawn and a Python floor of 11.8 ms sits above half the ladder.

A synthetic C helper — neither Rust nor Python product code — ran through the instrument's own timed interval (Harness._run_once, not a re-implementation) across 8 rungs from 1 to 128 ms, at n in {5, 15}, warmup 2, five independent A/B sessions each: 80 sessions, every raw observation kept.

An earlier revision of this description claimed outcome O2. That claim is withdrawn.

The owner rejected it on three counts and was right on all three.

1. The reading consulted 0.35, which the plan forbids in as many words — "No pass/fail tolerance is computed, applied, or reported ... 0.35 is not consulted." The withdrawn reading argued from the ladder never crossing it. The measurement driver never reads 0.35, so the dataset is uncontaminated; the interpretation failed, not the collection.
2. O1 and O2 were never operationalised as numbers. "Roughly constant" and "stable" were English. The quantities that ended up deciding were all chosen after seeing the data, so "read off the preregistered table" claimed more than the plan could support.
3. The A + R*t fit ran in a branch that did not license it. The plan permits deriving A and R only under O1; the reading selected O2 and reported the fit anyway.

The formal outcome is O3, inconclusive: the dataset is descriptively suggestive, but the preregistration did not operationalise the O1/O2 boundary tightly enough to support a formal verdict. The separation is retained as exploratory calibration evidence and may motivate a separately preregistered follow-up.

What the numbers descriptively show, licensing nothing

• Absolute drift is not constant across the ladder — 0.056 ms to 1.126 ms at n=5, roughly twentyfold — so O1's own written precondition does not hold. That much is a direct reading of the plan's text.
• A measurement-scale effect is visible: relative shift rises from ~0.006 at 8–16 ms to ~0.04–0.05 at 1–2 ms.
• In the 2–10 ms band, across 27 A/B sessions, the ladder's worst absolute drift was 0.3203 ms; the historical failures in that band implied 1.23 to 4.41 ms.

That separation is a reason to keep looking, not a verdict. The envelope fit is quarantined in the note under an explicit post-hoc, not part of the preregistered outcome, not policy input heading rather than deleted, because deleting an analysis that was actually performed is its own dishonesty.

The boundary, and a correction to it. The helper does pure arithmetic; own-cli is ~1.8 MB. The ladder isolates duration, not what a real invocation does. The original next-suspect list led with file I/O and should not have: core-usage|rust|cal-facts-tiny|process-cold is a witness and that rung never opens an OwnIR document. Input-document I/O is not a necessary condition. What survives: executable/library mapping and page faults, dynamic loader and runtime startup, scheduler context switches and CPU migration, CPU-time against wall-time, and the output/refusal path.

Nothing changed as a result: no floor, no envelope, 0.35 unmoved, no T_min/N_min/N_max, no threshold derived from any number in the dataset.

Follow-up work: the plan amended, the instrument extended, the round not run

docs/notes/p022-263a-round7-preregistration.md is now a RATIFIED DESIGN whose measurements are still not authorised. Two reviews. The first ruled CHANGES REQUIRED and decided four questions — full POSIX rusage yes, a statically linked fourth arm no, arms A/B/C kept, both regimes measured. The second ruled PASS WITH ONE MECHANICAL CORRECTION, ratified a narrower zero rule than the one proposed here, and authorised building the apparatus and running the structural preflight — nothing with a clock in it. Four corrections came out of the two, and they matter more than the decisions.

• The outcome table was not mutually exclusive. A=1, B=3, C=1.4 fires P1 and P4 at once. Ten review rounds spent insisting that a check must read the thing, and I preregistered the numbers and forgot to preregister the logic. The owner's ratified set replaces it, with P1 and P2 renamed to claim only what arm B can see.
• Then I got the replacement's algebra wrong too, in both directions. I claimed every remaining overlap reduced to A=0 or B=0. It does not. Overlap occurs only when A=0 and B=0 together, and P1 is disjoint from every other rule unconditionally — its C > 1.5A clause excludes P4 outright, and every other intersection forces B=0 and then C=0, contradicting that same clause. My proposed guard was correspondingly too wide: keying it on B would have refused A=1, B=0, C=4, a clean P2 where the padded arm shows no excess and the real binary does, which is one of the cleanest results this round can produce. The owner's ratified guard keys on A alone, and not for exclusivity — A is the multiplicative reference for 1.5A, 3A and 6A, and against a baseline of zero any positive drift is infinitely large. No epsilon: a tolerance like A < 0.01 ms would become an absolute threshold with no preregistered basis, which is the move this round forbids.
• Arm B claimed more than it can see. It said it isolated "image size, mapping and page-fault cost". Linux demand-pages an image, so padding that is mapped and never read need not fault in at all. B now claims the padded image footprint and its mapping metadata; D(B) − D(A) is stated as a lower bound; and a B that reproduces nothing reads as "a padding-only image effect is insufficient", never as "image mapping and page faults are excluded". A four-part structural preflight — padding survived linking, sits inside a PT_LOAD, matches arm C's mapped size to within a page, work bytes identical to arm A — is a stop condition, not a caveat written afterwards.
• A factual claim in the draft was false. It said every witness lives in process-cold. One of the five, core-full-sarif|rust|cal-facts-small|warm, does not. Both regimes are now measured and classified independently, and a cold/warm split is reported as a cache-sensitivity signal rather than collapsed into P5. The regimes are also stated as the instrument implements them — cold 0 discarded iterations, warm 2, both a fresh process per iteration — instead of the draft's own contradiction.
• _run_once now keeps the accounting wait4 was already handing back. It reaped every child through os.wait4, which returns the kernel's complete per-child rusage, and read one field of it. User CPU, system CPU, minor and major faults, and voluntary and involuntary context switches were fetched and dropped — and those six are exactly what separates "the work took longer" from "the scheduler moved it" from "the image cost more to map". The interval is unchanged in meaning: t0, Popen, wait4, elapsed, with the rusage parsed after the clock stops. The two pre-existing lines between wait4 and elapsed stay where they are, because moving them would tighten the interval and silently un-compare every future number against every recorded one. ru_utime/ru_stime are rounded to nanoseconds, since truncation biases every sample the same direction. Off POSIX all six are null with a reason, never 0.
• perf-child-accounting is the sixteenth control, and it checks the claim that would otherwise be invisible — that the parse sits outside the clock — by wrapping os.wait4 so every rusage field costs 10 ms to read, then asking whether elapsed_ns grew. Seven mutations, each caught by the check that owns it.
• The ownlang/ reference boundary is closed by observation, and perf-reference-boundary keeps it proven.
• The instrument is type-checked — perf_baseline.py is in mypy's file list and passes --strict, now alongside the Round 7 apparatus at 47 files.

The Round 7 apparatus, built and preflighted — still no measurement

scripts/round7/ is a classifier and a structural preflight. No clock appears anywhere in it, and the calibration pass itself remains unauthorised.

• One classifier. classify.py is the only implementation of P1–P5 and the zero-A guard; a second copy would be a second opinion and the reading could then choose between them. Being pure, it is exercised exhaustively before any measurement exists: 50,653 exact rational triples, in sixths so the ratified edges 3/2, 3, 2/3 and 2 land exactly on grid points, with Fraction arithmetic throughout because a binary-float 2/3 would decide the (2/3)B ≤ C edge by rounding direction rather than by the rule.
• The exclusivity claim is no longer asserted — it is measured. The census runs twice: against the real rules, which must overlap only at A=B=0; and against the previous draft's P1, which must be reported broken. A control that has only ever seen correct input is a control nobody has tested.
• Six mutations of the real classifier, each caught by the check that owns it: the old overlapping P1; the zero guard widened to A-or-B; the guard removed; ambiguity resolved by precedence instead of raising; P4's edge made strict; an epsilon smuggled into the zero comparison. The second is the guard the owner rejected, and the control now refuses to let it back in.
• The preflight reads the ELF, not a rendering of it. Program and section headers are parsed directly, and the padding is located through st_shndx, which names its section, rather than by matching addresses — an inference that finds nothing at all for a non-allocated section, whose address is zero. The four damage cases are built, not simulated: a real linker does drop an unreferenced non-volatile constant under --gc-sections, and a section emitted with empty flags really is absent from every PT_LOAD.
• B1–B4 all pass. Padding 1,626,024 bytes in .rodata inside the PT_LOAD at 0x2000; arm B maps 1,628,917 bytes against arm C's 1,628,892, +25 against a 4,096-byte allowance; main is 107 bytes and byte-identical in both arms, so B4 decided on raw bytes and the disassembly fallback was not needed. Arm A and arm B are linked from the same spin.o, which removes the compiler-determinism question rather than answering it.
• The apparatus is not the instrument, and the harness digest proves it: unchanged at 562a7f7232da across the whole addition.

All four committed sizing halves are stale. The digest moved to 6713e7300c7c when the instrument was typed and the reference environment pinned, and again to 562a7f7232da under the accounting change above. They are deliberately not re-recorded: re-recording is a measurement, and measurements are not authorised. Stale evidence that admits it beats fresh evidence nobody asked for.

What ships: all four halves of both pairs, each recorded on a clean tree, each run B naming its run A by path and sha256 so the verdicts can be recomputed rather than trusted. The four pre-contract artifacts — including both failing recordings — are preserved byte-identical under docs/evidence/historical/, outside the report-of-record glob. Nothing was deleted to make the record look better.

---

Что и зачем

#263-A: the frozen instrument for #263's P-022 performance baselines — how a number is produced, never what the number should be. It permits calibration and structurally refuses the decisive measurement, which is #263-B behind the D7 freeze.

No decisive numbers, no thresholds, no engine verdict on any decisive workload. No decisive N, no escalation ladder, no Rust-vs-Python comparison statistic, no D7 freeze payload.

Тип изменения

• feat — новая возможность
• fix — исправление бага
• docs — документация
• refactor / chore / test / ci — без изменения поведения

No production behaviour changes. rust/, frontend/ and ownlang/ are untouched by this branch.

Review rounds

Eleven review rounds. Nearly every finding was invisible to a passing CI. (The variance characterisation reported above is separately numbered by the owner and is not one of these.)

Round 1 — the C1/C2 verifier read a proxy. It armed on any JSON echoing three values anyone with the repository can compute, proving the instrument was the instrument and calling that a freeze. Also: core-usage claimed to be startup; it became a labelled lower bound.

Round 2 — four blockers. (1) The production freeze could never have armed: the verifier treated the payload's directory as the repository, so it asked git for a bare basename, while <rev>:<path> resolves from the tree root. Fixtures passed because they put both objects at the repository root, where the wrong model is accidentally right. (2) Signed ratification read git verify-commit --raw from stdout when git writes it to stderr; repairing it would still leave the accept direction untestable, so it is withdrawn. (3) .NET was installed but never on PATH, so 12 of 44 cells were rc127 command-not-found, timed and reported as reproduced; each rung now declares the exit codes that mean it did its job plus a post-condition, verified once, untimed. (4) launcher-extract claimed "no core runs" while --emit-facts lets Stage 2 run anyway; withdrawn.

Round 3 — the harness digest named the checkout. The same tree hashed differently under core.autocrlf. D7's C1 freezes that value and #263-B runs on both platforms, so a freeze would have armed on one and been refused on the other. Now content-addressed. Found by a control written in this PR, not by a reviewer.

Round 4 — a phase list that meant nothing. cli-argv-refusal bundled argv parsing with the usage-refusal message, so it appeared on three rungs that never write one; the report copied the taxonomy and the control confirmed the copy was faithful. Split into cli-argv-parse, cli-usage-refusal, ownir-door-refusal with equivalence rules in both directions. Reproducibility split into three axes — outcomes_reproduced, timings_reproduced, environment_valid — with reproduced still the conjunction rather than a renamed subset.

Round 5 — provenance of the calibration itself. (1) --warmup silently moved 2→3 alongside the authorised repetitions escalation, so two knobs were turned when one was permitted; warmup is now a policy default a control enforces. (2) Only run B of each pair was committed, so "reproduced" could not be recomputed from evidence; run B now records run A's path, sha256, tree, digest and both knobs, and a control requires A committed beside it. (3) reproduce()'s docstring and the note still taught the old false model of the tolerance while the implementation was already correct. (4) The rationale for n=15 was restated: a preregistered bounded escalation, not "a better-estimated median" — that argument picks 25, then 100.

Round 6 — an A/B pair that was two experiments. Both halves must be one experiment or their difference measures the wrong thing. PAIR_IDENTITY_FIELDS now pins ten axes — reference commit and tree, harness digest and version, workload manifest digest, interpreter, platform, both knobs, and the tag — and reproduce() raises rather than reporting a verdict when any of them differ. Fail-closed, because a pair that quietly compares across a source change is worse than no pair at all.

Round 7 — the C1/C2 implementation was not the frozen C1/C2. D7 §6 defines two git commits, not two sections of one file. The earlier scheme used the same two letters for something else, with c2 holding threshold values inside the payload; the word had quietly changed profession, and an equivalent-looking scheme is not the frozen scheme. It had no equivalent at all of payload_blob_sha, of exact-byte hashing, or of the ancestry requirement. Also in this round: python_reference_commit() was git rev-parse HEAD — it named the repository's position, not the reference source — and is now the last commit touching ownlang, with python_reference_tree recording its content-addressed tree object. Both joined pair identity, and they are distinct values from the repository's own position.

Round 8 — two checks that read something other than the thing. (1) instrument_tree_sha was git rev-parse HEAD, so C1 had to equal the current position. The lifecycle is S → C1 → C2 → #263-B, meaning HEAD is at least C2 by the decisive run and can never equal the accepted tree S; a freeze satisfying that check would have to name a future content-addressed commit inside the commit that determines it. The twin defect had been fixed one round earlier for python_reference_commit, with the argument spelled out in its own docstring, three lines away. The anchor is now declared by C1 and proved by content. The fixtures could not see any of it: they built a freeze in a throwaway repository while the gate observed the real one, so HEAD could never move past S. (2) C1's protocol was three key names checked for presence, and the fixture proving that check worked armed the gate with three copies of the string <frozen by D7, never read by the gate> — two immaculate commits, three celebratory strings, decisive firewall open. The gate still never reads a threshold; it now verifies that a preregistration is structurally there. Damaged freezes went 18 → 33. Also self-found in this round: load_manifest() hashed raw bytes while the harness digest normalized them, which is the Round 3 defect still alive in a sibling path, on a value C1 also freezes.

Round 9 — the protocol gate had a boolean escape hatch and no sense of scale. (1) not_applicable: true was accepted, and so was false. _present() ended in value is not None, and in Python a bool is an int. Both passed a check whose entire purpose was to demand a stated reason, and the previous revision of this description asserted that a bare true was refused — an untested claim about a guard, published, in the document that argues a green gate proves only what it was asked to prove. _present() now rejects bool outright, not_applicable must be a non-empty string, and a cell that is both not_applicable and carries a rule is refused. (2) The verifier checked every cell it was handed and never asked whether it had been handed them all, so one immaculate cell and three roll-up strings passed; the fixture demonstrated the hole rather than catching it. expected_d7_cells() now enumerates the universe and the gate refuses any cell missing, unknown, or named twice. Damaged freezes 33 → 39.

Round 10 — the completeness check proved the wrong set. Round 9's mechanism was sound and its universe was not: expected_d7_cells() enumerated sorted(PHASES), the attribution taxonomy that answers what a timed interval contains. Using it as D7's vocabulary was wrong in both directions at once. It demanded a preregistered rule for cli-argv-parse, cli-usage-refusal, ownir-door-refusal and frontend-extraction on every workload, platform and regime; and it omitted the end-to-end C# run entirely, one of the metrics the G3 verdict weighs most, because that is a rung rather than a part and appears nowhere in PHASES. The code had already said so and was ignored: the accept fixture keyed its not-applicable slice on frontend-extraction, auto-excusing all 48 of those cells — the instrument admitting they were never D7's while the universe went on requiring them. A check that manufactures an obligation and then ceremonially forgives it is paperwork. D7_PHASES is now separate, and the relationship between the two vocabularies is stored as data: D7_NON_METRIC_PHASES records each attribution component that is not a gate with its reason, and D7_METRICS_WITHOUT_PHASE records end-to-end-csharp as a metric no single phase names. d7_vocabulary_problems() requires every attribution phase to be promoted or excluded explicitly — neither is a default — and runs in --selftest as well as a control, because the failure mode is drift. Universe 528 → 384.

Round 11 — a preregistration whose numbers were arithmetic and whose logic was not. The Round 7 draft's five outcomes overlapped: A=1, B=3, C=1.4 satisfies P1 and P4 simultaneously, so the same dataset could have licensed "the padded image explains it" and "the phenomenon never reproduced" at once. Every earlier round in this list was about a check reading a proxy instead of the thing; this one is the same defect one level up, in a document written specifically to stop me choosing after seeing the data. Two more in the same round: arm B was advertised as isolating page-fault cost, which a demand-paged image whose padding is never touched cannot show, and the draft asserted that every witness lives in process-cold when core-full-sarif|rust|cal-facts-small|warm does not. The first was a claim the experiment could not support; the second was a claim the repository's own evidence contradicted, one table away. And the replacement had the same defect as the thing it replaced: my statement that the corrected rules overlapped only where A=0 or B=0 was asserted, not checked, and the owner's algebra showed both halves wrong — overlap needs A=0 and B=0, and P1 overlaps nothing at all. The fix this time is not a better assertion. A control evaluates the rules over fifty thousand exact triples and is itself tested against the broken version.

Three policy constants, one historical value

policy	bounds
NOISE_PROBE_MAX_RELATIVE_IQR	dispersion within one probe
NOISE_PROBE_MAX_DRIFT	opening probe against closing probe
REPRODUCIBILITY_MAX_MEDIAN_CHANGE	one cell's median, run A against run B

Three different statistical quantities that were one constant. All three are 0.35, deliberately unchanged. It is chosen; what makes it admissible is that it was chosen before the runs it judges.

The honest limit

rung	expected exit	interval contains
core-usage	2	core startup + argv parse + usage refusal — a lower bound on startup
core-parse-refused	2	startup + argv parse + read + parse + door refusal
core-full-human / core-full-sarif	0 or 1	startup + argv parse + parse + bridge + analysis + render
launcher-e2e	0	launcher startup + extraction + core startup + argv parse + core + render

bridge-lowering, analysis and launcher-scoped extraction isolation are marked not separately observable. Derived views are labelled derived bounds.

What the gate actually verifies

C1	the immutable payload commit — the preregistered cells and rollups, the instrument anchor, the Python reference commit and tree, harness digest and version, the workload manifest digest, and the owner's ratification
C2	a detached attestation in a descendant commit — the payload's commit sha, its blob sha, the sha256 of its exact bytes, the instrument/reference/workload bindings, and the ratification binding
anchor	C1 declares instrument_anchor_commit S; the gate proves the instrument at S hashes to the harness_digest C1 froze, and that S is an ancestor of C1. HEAD is never required to equal anything
protocol	each cell carries all four dimensions plus bound, pass/fail rule, inconclusive band, comparison statistic, RSS and allocation policy, and a ladder with initial_n, escalation_stages, transition_predicates, max_n, terminal_outcome — or an explicit not_applicable whose reason is a non-empty string, never a boolean, and never alongside a rule; roll-ups carry workload_class, phase, overall_g3
completeness	C1 must decide every cell D7 covers — 8 G3 metrics × 12 canonical decisive workloads × 2 platforms × 2 regimes = 384 — with none missing, none unknown, and no dimension tuple named twice. The metrics are D7_PHASES, not the instrument's attribution taxonomy, so cli-argv-parse and frontend-extraction are excluded with recorded reasons while end-to-end-csharp is included. large-solution-control resolves to oss-ShareX.sln, so the alias earns no second vote

Threshold values are checked for shape and never read. Because the workload manifest is one of the instrument sources, proving the harness digest at S also proves the manifest at S — there is no second anchor check to write and none to get wrong.

The four carried obligations

	how it is proved
(a) gate exists now, dormant	perf-gate-dormant: unarmed, fails closed on an unreadable file and a bare identity echo
(b) arming is data only	perf-gate-arms-by-data builds a real S → C1 → C2 → further-work lifecycle in a throwaway repository in the nested production layout, and asserts those four are four distinct commits. perf-gate-payload-identity damages one property at a time across 40 cases, each asserted against the phrase the check that owns it must produce — because without that, one broad refusal masquerades as forty working checks
(c) fail-closed before any interval	perf-notary-outside counts digest computations and git invocations inside a measured interval, requiring zero
(d) two identity domains	perf-session-drift: a changed candidate refuses the remainder and names how many cells preceded it

Как проверено

• ruff check . exit 0; mypy Success, 47 files (the instrument and the Round 7 apparatus included)
• python scripts/perf_baseline.py --selftest exit 0
• python tests/test_perf_instrument.py — 16/16, exit 0
• python tests/test_round7_apparatus.py — 5/5, exit 0; 6 classifier mutations caught
• python scripts/round7/preflight.py — B1–B4 all pass, recorded as committed evidence
• python tests/run_tests.py exit 0
• every gate's exit code read directly, after ruff check . >/dev/null && echo ok once turned a lint failure into silence that read as success

Связанные issue

Refs #263 (this is #263-A only), #262. Closes nothing.

Findings recorded rather than fixed

1. A green gate proves what it was asked to prove. Most blockers here were invisible to a passing CI: fixtures exercising a layout production never has, a signature branch nothing could test, an exit code nobody read, a phase list the report copied faithfully, and a digest that named the checkout.
2. §6 topology is confirmed; the protocol key names are not. The owner has read the frozen prompt-D7-preregistration-4.md and confirmed the two-commit structure against it, so the earlier "fidelity unverified" caveat is closed. The cell and roll-up key names come from the owner's review messages rather than from the frozen file, which is still not in the implementing session's possession.
3. The D7 metric names are RATIFIED. They were recorded as provisional when written, because leaving an implementation label to become a normative contract by default is exactly the defect Round 10 fixed. The owner has since ratified the eight metrics and the four exclusions against the frozen prompt-263A-measurement-design-4.md, the final D7 brief and live P-022 step 8: Rust-default cutover, rollback gate, and Python distribution removal #262, together with the 384-cell denominator. Ratifying 384 does not mean 384 numeric budgets — an explicit not_applicable with a reason remains a legitimate decision. The source comment still reads NAMES ARE PROVISIONAL deliberately, since editing it would move the harness digest and force another re-record for a change of wording; the ratification binds in the ledger and to the head it was given at.
4. A claim about a guard was published without being tested. Round 8's description said a bare not_applicable: true was refused. It was not — _present() accepted every boolean — and the owner found it by reading the code rather than the prose. The guard is fixed, with catchers for true, false, an empty reason, and N/A beside a rule. Recorded because it is the exact failure mode this PR exists to argue against: an assertion that sounded like a check.
5. Completeness was recorded as not implementable, and that was wrong. Round 8 argued the cell universe "needs the decisive cell population" and left the check out. The brief permits enumerating, hashing and availability-checking decisive workloads before D7 and forbids only performance exposure — and it must, because a population unknown before D7 could not be written into D7. The error was in the convenient direction.
6. The ownlang/ reference boundary is CLOSED, by observation. An audit hook recorded every file opened and process spawned on both render surfaces: zero repository files outside ownlang/, nothing spawned. Static imports are the standard library and itself; config.py has no auto-discovery and no environment variables, so there is no consulted-if-present file to slip past an audit that only sees opens; the fix_* subprocess pipeline never loads on the measured path. perf-reference-boundary keeps it proven and is mutation-verified both ways. The one residual found — OWNLANG_DEBUG, an ambient variable the reference reads — is now cleared for every measured invocation via REFERENCE_ENV_PINNED_UNSET.
7. One guard is defensive and untested, and is marked so in both source and note: a same-commit attestation cannot be constructed with ordinary git, because it would have to contain the sha of a commit whose sha depends on it.
8. Git object identity is not a signature. Arming costs two reviewed commits rather than one text editor, but anyone with write access could author both.
9. The instrument is type-checked now. scripts/perf_baseline.py was outside mypy's file list, so "Success, 43 files" never covered the file that produces the numbers. It is in the list and passes --strict. The 42 errors it exposed were almost entirely one root cause — JSON values typed object behind x or {} idioms with type: ignore codes that had drifted — replaced by four narrowing helpers that narrow fail-closed. Six were real Windows APIs absent from the Linux stubs and carry targeted ignores with reasons, not blanket suppression.
10. A GitHub-hosted Windows runner is not reliably measurement-grade. Two runs minutes apart on one commit disagreed about their own environment. The decisive Windows measurement needs a single-tenant machine.
11. /usr/bin/time is absent on the development container, hence os.wait4.
12. The original failing n=5 artifact is lost. It was reverted before the preservation rule existed. What survives of that first observation is narrative, and narrative is not evidence. Every failure since is committed.
13. Two commits (5d6dab4, 35befb2) show as Unverified and are deliberately not rewritten. Review verdicts bind to exact head SHAs.
14. A control that crashes before reporting is a traceback, not a finding — and it happened twice. First with perf-child-accounting: two structural checks recorded their findings in a list and then ran on into the code those very faults break, dying on KeyError inside measure_cell. Then again in round7-zero-guard, in a file written after that finding was recorded: removing the zero guard makes A=B=C=0 fire three rules, the classifier raises, and the control died before reporting. Both times the mutation scored as caught because the process exited non-zero; both times reading the output rather than the exit code is what exposed it. Twice in two rounds says the habit is to check that a mutation fails rather than that the check speaks.
15. The preregistered outcome rules were not checked for mutual exclusivity, and neither was the correction. The draft satisfied every other discipline this PR argues for — written before the data, quantitative boundaries, a named "neither" outcome, ratios rather than imported thresholds — and still admitted two contradictory verdicts on one dataset. The repair then repeated the defect one level up: "every remaining overlap reduces to A=0 or B=0" was hand-checked and wrong in both directions. Preregistration constrains the analyst only as far as its logic is checkable, and prose about logic is not checkable. The rules are now evaluated by a control, and the control is tested against the broken version.

STOP

Stopped, awaiting an owner ruling. No merge, no thresholds, no decisive corpus, no paired timed measurement, no D7 freeze payload or attestation committed to this repository, no #263-B, no Stage 3, no Stage 4. The variance characterisation was authorised, executed under its preregistration, and reported a formal O3 — inconclusive without changing a single policy value. The Round 7 design is ratified, its apparatus is built, and the B1–B4 structural preflight passes. No Round 7 measurement exists and none is authorised: the calibration pass is a separate decision, due after a short exact-head implementation review.

The D7 metric mapping and the 384-cell universe are ratified by the owner against the frozen briefs. The source comment still reads NAMES ARE PROVISIONAL, deliberately: it was true when written, and editing it would move the harness digest and force another re-record for a change of wording.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CYLNQy6tLXqsV1CbuNqsSb

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 77e28ee7-8b95-4e49-9008-2956369304d5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}