[Stepping] Correctness sweep across the optimization loop: measurement integrity, phase budgets, resume safety, and a large dead-code removal - #1188

…server

The bypass serving path hand-picked ROCR_VISIBLE_DEVICES out of benchmark.envs
and dropped the rest, so a candidate whose only difference from the baseline was
an env launched a byte-identical server: same argv, same environment. The
measured delta was run-to-run noise, the default 1% keep threshold promoted it,
and the env then landed in current_best and in the reference script handed to
the user. Kernel bundles and framework levers are activated by exactly such
switches, so their attribution was measuring nothing.

The scriptable path already exported the whole mapping. Converge both onto one
branchless helper that layers mappings over the parent env rather than adding a
third hand-picked key. _run_subprocess and the GEAK sweep share the same shape
and now go through it as well.

Behaviour change: every shipped config carries a static PATH under
benchmark.envs, which now reaches the server and wins over the caller's
inherited-and-prepended value. That is what the Magpie backend has always done,
and bypass documents itself as accepting the same environment contract.

Co-authored-by: Cursor <cursoragent@cursor.com>

unset_envs popped any name it was given, so a variant could drop TP, CONC, ISL,
RUN_EVAL or the GPU mask from the materialized config. That does not toggle a
knob, it retargets the benchmark: dropping TP also shrinks the Ray lease to a
single GPU, because the lease size is read back out of benchmark.envs.

Reuse BLOCKED_EXTERNAL_ENV_NAMES, the list that already says which names an
untrusted source may not set. Setting and unsetting are two directions of the
same change, so they answer to one list. Ordinary tuning knobs stay removable.

Co-authored-by: Cursor <cursoragent@cursor.com>

Both statements described the bypass backend as honouring a single hand-picked
key while Magpie re-exported the whole benchmark.envs mapping. Bypass now
exports the mapping too, so the only remaining difference is that it also uses
the interpreter to launch the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

…itial toolkit

Introduced in 9167263 (2026-04-30) as the self-validation driver for the
then-new kernel-agent, when no KERNEL phase existed to prove the toolkit on a
real model. Its purpose window closed in three steps: 068c667 dropped the
run_baseline.sh step so it stopped being end-to-end and required a trace
produced elsewhere, ca99ad7 removed the backend-drop logic and left
backends_dropped永 empty behind a misleading error string, and #840 emptied the
--backends default so a plain invocation only ever raised. What it was built to
prove is now covered by the orchestrator's own KERNEL phase and ci-e2e.yml.

No in-repo caller; operator confirmed no out-of-repo caller. Its artifacts
parallel_e2e_summary.{json,md} had no reader either -- the breakdown collector
reads reports/kernel_optimization_summary.json and reports/conc_sweep_summary.json
by exact relative path and no glob reaches them.

The deletion also closes an aggregation bug rather than fixing it: every
attempt's exception was flattened into a row-level failed, but the aggregate
printed "status": "succeeded" and returned 0 unconditionally, and never wrote a
status key into the summary on the success path at all. Measured with all
attempts failing: 2/2 failed, top-level succeeded, exit 0.

load_env_file was a second implementation of the credential-alias derivation in
tools/backends/ray_runtime.py:452-472 (same rule, verbatim the same comment).
That one stays and is pinned by seven tests in test_ray_runtime_env.py, four of
which cover the "GEAK aliases are never derived, forwarded verbatim" boundary
the deleted test file covered with three -- so the guardrail is preserved.

test_kernel_agent_live.py keeps its mirrored derivation and now points at
ray_runtime; whether that dormant opt-in harness should live is a separate call.
Coverage is unaffected: the module was already in [tool.coverage.run].omit, so
its tests contributed nothing to the gate; the dangling omit entry goes too.
_collective_names, _io_utils and _paths all keep other consumers.

Co-authored-by: Cursor <cursoragent@cursor.com>

… warnings

Aggregate the dropped-key warning into one line per variant rather than one per
key, collapse a comment that was duplicated verbatim at both unset sites, and
record the new filtering in the docstrings that still promised unconditional
behaviour.

Co-authored-by: Cursor <cursoragent@cursor.com>

Bare --resume scanned every model subtree under $USER_DATA_PATH and
attached to whichever session had the newest timestamp, then re-exported
that session's model as MODEL_PATH without a word. On a shared workspace
that silently continues someone else's run on a different model, which is
what SKILL.md already forbids under "never guess by timestamp".

--resume-from becomes the only way to resume, so the session is always
named by the operator. The flag it used to imply is gone; a stale
--resume now fails at argument parsing instead of picking a session.
Also retires the workspace-root fallback (unreachable: the sole
production make_session_dir call always passes a model, so no manifest
ever lands there) and the quantization resume guard (unreachable: the
prelude only runs on the fresh-launch path).

Co-authored-by: Cursor <cursoragent@cursor.com>

SKILL.md forbade guessing a session dir from timestamps in three places
while its own resume section documented exactly that, and described the
scan as model-scoped when it never was. Drop the contradiction and name
--resume-from as the only resume entry point across the skill files,
references, README, and the how-to/reference docs.

CHANGELOG and release notes keep their original wording; they record what
shipped at the time.

Co-authored-by: Cursor <cursoragent@cursor.com>

…d placeholder

The blank-id fallback mapped every empty task/session/kernel id onto a shared
"unknown" directory. Nothing could reach it: registry task ids are uuid4 hex,
and every other call site either substitutes its own placeholder or returns
early, so the bucket had no producer and no reader beyond three assertions.

Keeping it also forced an early return that skipped the traversal check, so a
containment helper carried a bypass branch. Blank is now refused alongside
path-like values, which is the only correct terminal behaviour here: pathlib
swallows an empty segment, so a blank id would resolve to the parent action
directory and collide with every sibling task.

Co-authored-by: Cursor <cursoragent@cursor.com>

…rate_patch

Each of these three sites substituted its own name for a blank task id, but
the id is a registry uuid4 hex that cannot be blank, so the substitutes were
unreachable. Three different placeholders for the same non-existent case only
obscured that the workspace is always keyed by the real task.

The path helper now refuses a blank component outright, so no local fallback
is needed to keep the workspace off the shared action directory.

Co-authored-by: Cursor <cursoragent@cursor.com>

argparse resolves --resume as a prefix of --resume-from rather than
rejecting it outright, so pin the guarantee that matters: every legacy
invocation, including the one already-deployed monitor copies send, exits
2 instead of choosing a session.

Co-authored-by: Cursor <cursoragent@cursor.com>

…used

RunnerContext.task is typed Task and task_id is a required field, so the
getattr default could never fire — it only implied the id might be absent.
The path helper refuses a blank component outright now, so nothing downstream
needs a guard of its own.

Also trims the two comments that grew with the previous change back to the
length they had before it.

Co-authored-by: Cursor <cursoragent@cursor.com>

Trim the duplicated pin comment and the session-discovery chain that the
skill docs already carry, and drop two tests that asserted a symbol was
absent or that argparse round-trips a string rather than any behaviour of
ours. Restores the blank line the quantization guard removal ate.

Co-authored-by: Cursor <cursoragent@cursor.com>

The per-launch dir name was a second-granular UTC timestamp, so two launches
of one model in the same second resolved to one session dir. That name is also
the de-facto session id (session_dir.name feeds KB fact writes, critic requests
and per-session sinks), so a collision merged two runs' identity as well as
their artifacts. Uniqueness now comes from a random suffix; the fixed-width
timestamp prefix keeps lexical order chronological.

Co-authored-by: Cursor <cursoragent@cursor.com>

Subprocesses are spawned with explicit cwds of their own, so a relative
$USER_DATA_PATH sent parent and child to different workspace roots while both
believed they agreed. Absolutising on read cannot fix that — each process
re-expands the relative value against its own cwd — so the launcher now rewrites
the env var once, before the parser defaults or any session path derive from it.

The manifest snapshot drops its own duplicate env read and goes through
workspace_root(), which is the same value with one less way to disagree.

Co-authored-by: Cursor <cursoragent@cursor.com>

…omments

The dir name gained a random suffix but four places still spelled the old
shape: two skeleton/layout comments and the layout tree plus literal session
path example in SKILL.md and references/paths.md, both of which ship as agent
instructions.

Also drops what the code already says: the whitespace-strip the authority
itself does not do, two assertions implied by their neighbours, and the
rationale paragraphs.

Co-authored-by: Cursor <cursoragent@cursor.com>

…ver source

The session-scoped endpoints were keyed off SharedState.session_id, which
build_session_id() generates locally as "{model}_{ts}_{uuid8}". Nothing ever
registers that id with the robustness server -- the client is GET-only and the
platform's claw_session_id is never forwarded to the agent -- so
/api/v1/sessions/{id}/{pods,events,summary} could only ever 404. Those 404s were
folded into empty results, which the source then returned as a successful tick.

Pod discovery already had a working route: the workload_uid hierarchy lookup,
whose rows were merged into session_pods anyway. That is now the only route.

Drops list_session_pods, list_session_events, get_session_summary,
_extract_session_id, the now-unused _to_iso helper and events_limit knob, and
the SourceData.session_events / session_metrics fields, which had no readers.
_merge_pods loses its session-side half and becomes _wrap_hierarchy_pods.

Co-authored-by: Cursor <cursoragent@cursor.com>

The snapshot carried a second, weaker copy of the session id: parsed out of the
prompt text while the authoritative one already arrives on the request and is
handed to build_reactor_components and the emit payload. Its only reader was the
server source's session lookup, removed in the previous commit.

The runtime CLI's fallback existed solely to backfill that field, and rebuilt the
context by hand-listing members. That list was complete when written (the
snapshot had exactly 7 fields) but the snapshot has since grown to 19, so a tick
taking the fallback silently lost stop_reason, the wall-clock budget, validated
gain, tick, macro_cycle and the rest -- muting postmortem finalization and the
deadline wind-down. Deleting the branch outright removes both the shadow field
and the field-loss bug.

Replaces the fallback's vacuous test (it asserted an emit key sourced from the
request, so it passed with the branch deleted) with one that pins the real
contract: every parsed shared-state field reaches the reactor.

Co-authored-by: Cursor <cursoragent@cursor.com>

The symptom read SourceData.session_summary, whose only producer was the session
summary endpoint removed earlier. With no producer left it could never fire, so
the rule, the field, and the HealthConfig slot that existed solely to tune it all
go. SignalSpec already allows a config-less row, so the classifier keeps calling
evaluate_health_signals for pod_not_running with no other change.

Co-authored-by: Cursor <cursoragent@cursor.com>

…othing

A tick that fetched no pods, no faults and no GPU metrics still returned a
SourceData, which the DegradeRouter counted as a healthy primary. The local probe
was then never consulted, so GPU leak, log-error, disk, ray and state-integrity
signals went silent alongside the cluster ones -- and silently, since sources_used
still named the server.

Failing the tick instead lets the router degrade after its usual threshold and
log the transition. Deployments with no workload uid configured will now fall
back to the local probe rather than reporting a clean bill of health.

Co-authored-by: Cursor <cursoragent@cursor.com>

The `failed -> running` retry edge was removed when retries moved to a fresh
idempotency key, but the hand-listed TERMINAL_STATES kept its old membership. A
failed row therefore has no outgoing transition at all yet reports as still
live, and every "is this row finished?" guard reads it wrong.

Three of them wedge. The watermark roofline gate never releases, so a roofline
reclaimed by the TTL watchdog -- which reports no result, leaving the release as
the only thing that could clear the marker -- gates every later refresh; the
marker is persisted state, so the next resume inherits the wedge. Resume
recovery never clears enablement_validation_pending for a failed revalidation.
And the FRAMEWORK authoring pump keeps re-selecting a candidate whose specialist
row is dead, logging a dispatch every tick while nothing runs.

Deriving the set from _TRANSITIONS instead of restating it means the two cannot
drift apart again. proposals.py had already worked around the stale constant
with a private copy that did include failed, so it now imports the shared one;
the import left unused in framework.py goes with it.

The gate's failed branch was never exercised -- the existing test only set up a
succeeded row -- so the two near-identical gate tests collapse into one
parametrized case that pins all five states.

Co-authored-by: Cursor <cursoragent@cursor.com>

…nt log

The pending-integrate recovery treated "no KEEP found" and "could not read
the event log" as the same outcome: a swallowed scan error left kept_res as
None, which fell through to reverse-applying every recorded patch and then
cleared the sentinel unconditionally, so a transient DB error during the
first resume after a hard crash would destroy a validated patch, discard the
attempt venv, report the loss as a fix, and leave nothing for a later resume
to retry.

Track whether the scan completed and bail out with a warning that retains the
sentinel when it did not, so the destructive branch runs only on evidence.

Co-authored-by: Cursor <cursoragent@cursor.com>

…ng it

The GEAK branch never measured anything: it derived a throughput as
baseline_tput * best_speedup and wrote that straight onto current_best, so a
GEMM speedup of 1.1 would overwrite a current_best already carrying an explore
win of 1.5x and rewrite the session's validated cumulative gain as the single
GEMM's speedup. Only forge results reached the per-tuner validator, which
already measures each candidate against current_best via integrate_handler.

Reduce both result shapes to a common candidate list, route every backend
through that validator, and delete the synthetic-throughput promoter. The
validator is no longer forge-specific, so it and its log lines lose the forge
name; stack entries and current_best now carry the backend that produced them.

Co-authored-by: Cursor <cursoragent@cursor.com>

integrate, geak_e2e, forge GEMM, fusion and warm_replay each hand-built their
own current_best and stack entry. Four of them replaced current_best outright,
so a KEEP could drop the cumulative server args or resurrect an env an earlier
ablation had removed, and only _lift_to_current_best merged onto the previous
config or applied unset_envs at all.

All five now build a winner dict and hand it to the lift, which gains an
entry_extra parameter for the artifact and provenance handles the breakdown
collectors join on, plus final_overlay so the active overlay survives a later
winner that carries none. current_best keeps only config; tuned_file, engine,
patch_path, geak_alignment and the rest move to the stack entry or go away
where nothing read them.

Two behaviour changes fall out. integrate and fusion had no anchor guard, so a
KEEP measured below the established recipe used to lower current_best; the
lift now refuses it. warm_replay hand-appended a rounded percentage to
gain_per_stack_entry instead of calling append_stack_gain_entry, so that list
was not computed the same way as every other entry's.

Baseline and profile still assign current_best directly, which stays correct:
baseline only writes it while the stack is empty, and profile copies the
existing config and re-stamps the measured tput.

Co-authored-by: Cursor <cursoragent@cursor.com>

Resume compared current_best against a config replayed from optimization_stack
and, on any disagreement, overwrote current_best with the replay. The replay
was a second implementation of a merge only the lift performs correctly: it
unioned every entry's extra_envs without applying unset_envs, so an env a later
ablation had deliberately removed came back, and resume "repaired" a correct
current_best into a wrong one.

With every config KEEP going through the lift, current_best and the stack are
written together and cannot drift, so the comparison has nothing left to fix.
The one shape still worth reporting is a config with no stack behind it.

Co-authored-by: Cursor <cursoragent@cursor.com>

…eplaying

_materialize_stack_config_for_resume walked optimization_stack to reconstruct
cumulative args and envs, which is the merge the lift already performed on the
way in. Its two remaining consumers -- the GEAK handoff's baseline_env_spec and
the post-resume full-stack rebench -- now read current_best directly, so the
GEAK baseline is built from the config that was actually measured rather than
a replay that unioned every entry's envs and lost ablations. Despite the name,
this ran on the normal path too, not just resume.

What survives is the launch normalization: a "-"-prefixed key under extra_envs
is a server arg, and exporting it as an env would silently drop it. That
routing also had the arg merged as the full replacement string rather than an
addition, so it discarded the args it was meant to extend; it now appends.

values._config_from stays: it slices entries per origin and applies the publish
allowlist, neither of which current_best can express.

Co-authored-by: Cursor <cursoragent@cursor.com>

monkeypatch.delenv(name, raising=False) records nothing when the name is
already absent, so it does not arm an undo. The resume pass under test then
exports INFERENCEX_PATH itself, and that value -- a tmp_path that pytest
deletes -- outlived the test and reached every later one in the same process.

The victim was test_profile_executor_extracts_vllm_capture_traces, which then
resolved a dead InferenceX checkout, failed inside the executor, and returned a
failure payload with no "framework" key. It only reproduced under full-suite
ordering, and only through this one predecessor (bisected).

setenv arms the undo whatever the prior state, and the assertion is unchanged.

Two notes for whoever reads that failure next:

- ``SubAgentResult.state`` is "succeeded" whenever the executor returns at all,
  including when its payload is {"status": "failed"}. Asserting state alone
  does not establish that the run worked.
- ``PROFILE_DEFAULT_CONFIG`` freezes ``asset_root()`` at import time, so an
  $INFERENCE_OPTIMIZER_ASSET_ROOT override that is live during the first import
  of profile.py sticks for the whole process. Benign in production, where the
  variable does not move; worth knowing when a path-shaped test goes strange.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Self-review of the two preceding commits. No behaviour change beyond removing
code and a result key that nothing reaches.

Orphaned by the decision.json / semantic_audit.json writer removal:

- artifacts.candidate_slug existed to build runs/framework_agent/<slug>/ for
  those writers and has no production caller left (the slug helper the pump
  still uses is framework_agent._candidate_slug, a different function). It goes
  with its __all__ entry and the test file that covered nothing else.
- The module logger went unused with the writers.

Orphaned by the kernel_sequence.json removal:

- bypass_trace_analysis still computed kernel_sequence_path and published it in
  the result, advertising a file that is never written and that no consumer
  reads.

Orphaned by the pending_seconds removal:

- A test double still implemented the method; nothing calls it.

Redundant:

- The collective promote kept an isinstance precondition on
  gain_per_stack_entry, which guarded a direct append the lift now owns.
- _warm_kernel_keep_threshold_pct had two near-identical warning branches for
  one "override is unusable" case, and a function-local machine_state import
  where the module already imports it at the top.
- Three imports left unused by the test deletions.

Prose:

- Comments that restated the docstring directly above them (GEMM routing) or a
  callee's own contract (the lift) are gone.
- Docstrings that narrated what was removed rather than describing live code
  now state the contract; that history belongs in these commit messages.
- _promote_collective_integrate_keep documents that it is a no-op on an
  already-stacked patch or a lift refusal, which its one-line summary implied
  did not happen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…explore-opt-17

Four conflicts, all where main's new work meets this branch's current_best
convergence and its de-duplication of the journal outcome helper.

Conflicts:

- derive_journal_outcome takes main's was_skipped -> OUTCOME_SKIP branch on top
  of this branch's hoisted `result` local, so the new branch reads the same
  local instead of re-deriving `result_dict or {}` a fourth time.
- The fusion promote keeps _lift_to_current_best and drops target_file from its
  stack entry: #1199 made the unified patch the sole target authority, resolved
  from diff headers at replay. Scoped to fusion, as main scoped it -- the
  collective entry keeps its target_file.
- The warm-replay promote keeps the lift and adopts main's framework_source_root
  spelling for the promoted checkout, and its new workload_compatibility param.
- test_breakdown_exporter_unit takes both sides' new tests.

Mirrored onto this branch:

- #1199 renamed the promoted-checkout keys and dropped the only writer of
  SharedState.active_inferencex_path, leaving its resume guard inert: the
  reader, the active_inferencex_checkout_missing warning, its entry in the
  terminal stop-reason registry, its operator-facing explanation in report.py
  and a test asserting the restore all survive. PRELUDE writes the field again
  so a resume re-points $INFERENCEX_PATH and stops when the checkout is gone.

Fixed here:

- last_roofline was removed as unread, but roofline is one of the five
  _AUDIT_ACTIONS and record_action_attempt sets `last_<action>` by name. On a
  plain dataclass that assignment silently created an undeclared attribute, so
  the row was written in memory and dropped by to_dict on every save while its
  sibling roofline_attempts persisted. Redeclared; the test now pins that both
  mirrors reach to_dict.

- The recorder's sweep fragment replaced the whole section with last_sweep
  verbatim, dropping all_variants -- the shaped variant points only the
  collector can scan off disk. Same defect main just fixed for `session` with
  _merge_session, and this branch fixed for `workload`. Here the fragment adds
  nothing at all: snapshot_state_sections runs immediately after state.save, so
  the collector always reads a last_sweep at least as fresh. Removed, with a
  regression test that fails without it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fd81233 removed _resolve_effective_concurrency for having no production
caller and deleted test_roofline_ceiling.py with it, but that file was the
module's coverage, not just that symbol's: roofline_ceiling fell to 43.50%
(352 of 623 statements), the worst in the tree, and took the repo under the
fail_under gate at 89.84%.

Two files, 55 cases, covering 243 of those statements. The module is pure
arithmetic over a config dir, so these assert the contracts rather than
recorded outputs -- a golden number cannot tell a corrected formula from a
broken one.

PerfModel and the HF metadata it reads:

- The op formulas against the arithmetic in their own docstrings: GEMM 2MNK,
  SDPA's two matmuls, causal halving that applies to prefill and not decode,
  K/V sized by the KV-head count so GQA is visible, and the MoE
  coupon-collector expert count saturating from topk at one token to every
  expert at a large batch.
- Activation and weight precision stay separable, which is what keeps an fp8
  checkpoint from reading its bf16 activations at the weight width.
- compute_roofline_from_perfmodel: the decode rate is the slower of its own two
  ceilings and bound_kind agrees with it, per-op shares normalise to 1, a MoE
  model routes through moe_fused instead of the three dense FFN GEMMs, the
  hardware scales with the GPU count, and every incomplete-input path declines.
- load_model_meta: the safetensors index outranks the shard sizes and a
  malformed one falls back, quant_method outranks torch_dtype, and the MoE
  decomposition charges a token only the experts it activates -- including
  fp4 experts under an fp8 model, whose bytes the global dtype would overstate
  enough to trip the safe-degrade and drop the MoE from the ceiling entirely.

The diffusion arm:

- VAE downscale, the latent-grid token count (FLUX's 2x2 pack, and the default
  when the channel ratio is not a square), and DiT geometry including
  dual-stream blocks counted twice and the sample_size-less path that takes its
  sequence length from the runtime resolution.
- Both ceilings: weights read once per denoising step, linear plus attention
  FLOPs per image, GPU-count scaling, and the degenerate inputs that yield 0.0.

Coverage: 89.90% -> 90.23% locally (7392 -> 7149 missed).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…explore-opt-17

#1194 rebuilds the optimization read model from what producers recorded rather
than re-inferring ownership from phase timestamps, and reaches the same
diagnosis this branch did about unmeasured gain -- from the other side. Five
conflicts, all where those two meet.

Conflicts:

- optimizations.py drops the phase-timestamp inference block for main's
  recorded ownership. phase_at stays in collectors/_common: attribution.py and
  decision.py still share it.
- exporter.py takes main's removal of the v4 canonical-stream integrity
  machinery, and test_breakdown_v4_core.py goes with it. This branch had
  touched neither; the conflict was adjacency to the alias removal above it.
- schema.py restores SCHEMA_VERSION_V2 / V3. This branch dropped them as
  unused, but #1194 gives them a stated job -- telling a recorder-aggregated
  archive apart from a collector fallback -- and documents them in SKILL.md,
  so the premise for removing them is gone.
- _promote_gemm_tuning_keep stays deleted. Main now labels what it produces
  measurement_basis="derived_speedup"; b4ff1b2 removed the path instead,
  because baseline * best_speedup is not a measurement. Every GEMM KEEP here
  goes through _validate_gemm_tuning_e2e, so what it stamps is an e2e_rebench.
  Main's new _journal_gemm_tuning_keep hook is wired into that validator, so
  the journalling survives the promoter it was written against.
- The geak_e2e, forge-GEMM and fusion promotes keep the lift and carry main's
  new source= label onto the validated stamp; cumulative_gain and
  cumulative_gain_provenance stay removed.

Mirrored onto this branch:

- The collective promote keeps main's record_collective_promotion and
  record_session_validation calls. That lane settles its own verdict outside
  the kernel integrate queue, so without them its gain reports as belonging to
  no step -- which is the defect #1194 exists to fix. Adapted to the lift:
  recorded only once the winner is actually lifted, target_file resolved from
  the result rather than a hand-built entry, and one ts minted for the
  validated stamp and both recorder writes so the promotion lands on a single
  instant.

The other paths need no wiring: #1194 put record_session_validation inside
_update_cumulative_gain_validated, which every lift-based promote here calls.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The #1194 merge landed the recorder rebuild, which brought ~154 newly missed
statements in with it (assembler 19 -> 86, instrument 126 -> 203, trace 10 new)
and put the repo back under the gate at 89.98% -- the earlier roofline work
holds, roofline_ceiling is 43.50% -> 82.66% in that same report, but a margin
that thin does not survive a merge this size.

roofline_ceiling, the state-level entry points the pure-function tests did not
reach:

- resolve_runtime_workload: the baseline yaml is the geometry of record and
  state attributes only fill its gaps, concurrency floors at 1, and an
  unreadable yaml still yields a usable workload. gpu_type comes from state or
  the benchmark runner_type, not from a benchmark key.
- compute_roofline_breakdown_from_state on both arms: a serving run reports the
  lower of its two projections, an xdit run routes to the images/sec ceiling,
  and an unreadable model yields the empty breakdown rather than a zero that
  reads as measured.
- The diffusion arm end to end: steps and resolution from XDIT_* with the
  CUSTOM_* aliases an operator workload uses, both ceilings binding together,
  and the memory-only degrade when the DiT transformer config is unreadable.
- select_peak_and_bound treats a zero projection as unknown rather than as
  infinitely slow, so it cannot win the min.

The assembler's fragment merge, which is what decides whether a recorded fact
survives to the archive. A producer writes partial fragments from inside its
own work and a second write of the same entity id merges into the first:

- Nested dicts merge key by key rather than wholesale -- whole-value
  replacement is what drops a sibling the update never mentioned.
- List rows merge on the first recognised nested id, including an id the
  update itself introduced; rows without one append at most once.
- Filling an absent field is not a conflict and says nothing; replacing an
  answer with a different one is reported at its full path, last writer wins.
- The versions and critic/robustness substreams fold into their sections, and
  a directly recorded section outranks the substreams that would rebuild it.

Coverage: 89.98% -> 90.20% (7344 -> 7189 missed of 73321), leaving roughly
150 statements of headroom over the gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The hard force-exit had two arms: the unspent fraction of EXPLORE's charge-back
budget, and an absolute floor on session hours remaining. The floor was there
from when a phase got a flat max_minutes*pct allotment and could therefore hold
budget the session no longer had. Charge-back rebuilt the allotment from the
time left when the phase starts, which made the floor redundant, and left it
firing on any run shorter than the leave-behind: remaining starts at max_hours,
so a 3h session was already at or under a 3h floor on the first tick.

Guarding the floor against that case keeps a second gate whose every firing the
budget arm reaches on its own, and which grades a phase on time other phases
spent. Removed instead: should_force_exit_explore now reads the phase fraction
alone, and reports fired_reasons unchanged so the evidence shape holds.

The cases the guard protected are still pinned, against the surviving
behaviour: a 3h session reaches EXPLORE with its budget intact both at entry
and after a slow PRELUDE, and the gate fires once the phase has spent its own
share.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Work the run itself stops carries one of two error classes, and the grid runner
already assigns them. integrate dropped the class when it flattened the variant
result, so a re-baseline the session clock or a cancel ended arrived looking
like a bench that simply produced no throughput -- and every ledger downstream
read that as a verdict on the patch.

The class now travels with the rest of the bench result, and the two places
that turn a bench into a verdict consult it first:

- The perf gate returns a stopped result, with the patch and its artifacts
  taken back out of the tree exactly as a REVERT would, but no decision.
- The kernel integrate handler no longer answers REVERT when the re-baseline
  produced nothing because the run ended it; the patch is reverted and the
  result says so without grading it.

The GEMM E2E validator is the ledger this was visible in: it walks tuners one
at a time and files anything that is not a KEEP as a REVERT, so a clock running
out mid-sweep taught the ledger that every remaining tuner had been tested and
rejected. It now stops on the first stopped round, since the cause ends the
batch either way, and records nothing for the tuners it never measured.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Self-review of the two preceding commits.

The stopped results carried fields that either nobody reads or that describe
work that did not happen: ends_the_batch has no consumer on either result (the
GEMM sweep stops on any cause, because it has no fit check to leave the rest
of the batch to), and base_tput / keep_threshold_pct name a grading the round
never reached.

Docstrings that still promised only a verdict now say a round can end without
one: the perf gate, and the GEMM sweep that stops with its remaining tuners
unrecorded.

The operator explanation for explore_force_exit_low_budget described the
session wall-clock, which is what the removed floor measured. It is the phase's
own budget that fires the gate now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Three CI failures, all tests carried in from main that name something no longer
there. None of them is about the behaviour it asserts.

- compute_next_phase no longer takes max_hours. Its only consumer was the
  FRAMEWORK hours force-exit, which went when the phase clock started charging
  back; the three SWEEP closeout cases pass it incidentally and assert nothing
  about it.
- _sweep_state names the validated gain, which is the only cumulative gain
  left.
- enablement_round_dir refuses a blank task id rather than mapping every round
  onto one directory. snapshot_round already skips a round that carries no id
  for that reason, so the fallback the test expected has no producer; the
  traversal case and the blank case are now the same parametrized refusal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…eady read

The stopped results introduced their own status. Two discriminators key on the
established one instead, and both read the new value the wrong way:
_is_integrate_fault treats "every unmeasured path returns failed" as the signal
that a result is a fault rather than a verdict, so a stopped round was counted
against the REVERT quota it was meant to be kept off; _is_promotable_result
holds anything that is not failed to be promotable, so the same round was
routed through promotion.

Both stop returns now carry status failed, which is what an unmeasured round
has always reported, and leave the cause to error_class -- the channel
stop_attribution exists to populate, and the one the ledgers carry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

It fabricated the status the production path no longer returns, and carried
setup the assertions never depend on: a warm-replay current_best, a baseline
runtime the timeout stub makes unreachable, a workspace, a precision, and two
micro-speedups. Verified by defeating the guard and watching it fail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>