§5 — Launch gates landed (2026-07-18)
Evergreen: model-selection-and-global-refine §5. The two defects the pilot forensics exposed are fixed at root, validated live, and the four unit-defect quarantines are resolved. The stratified rotations are now unblocked pending the rotation-1 command.
Quick status
| Item | Status | Evidence |
|---|---|---|
| Gate (a): refine claim-race livelock | ✓ shipped | imas-codex af69e3e2 — per-node claim_seq + settle re-read in both winner verifiers; docs-pool replicas capped at ceil(scope/2) for scoped drains; paid-call-without-persist tripwire (warn > 2%); 17 new race tests |
| Gate (b): deterministic audit re-stamp | ✓ shipped | imas-codex fa503f83 — id-scoped LLM-free validation drain (drain_validation_for_ids) wired into every campaign batch; BatchOutcome carries audit re-quarantine/clear deltas; 95 tests |
| Pilot re-stamp (gate b live validation) | ✓ done | 25 pilot names re-stamped: 24 valid, perturbed_particle_energy correctly re-quarantined on its then-live unit defect — the stale-validated_at wash-through is closed |
| Unit defect 1–3 (root cause) | ✓ fixed | Derived parents inherited unit '1' from normalized_* children across the normalization peel — seeder exclusion e73331a9, scoped repair helper db261bca/fab5af85; particle_mass, effective_particle_energy, perturbed_particle_energy now unit-less, docs re-aligned via sn edit (all accepted), all three valid |
| Unit defect 4 (audit false positive) | ✓ fixed | name_unit_consistency_check lacked the grammar-canonical transport-velocity form: *_energy_velocity_due_to_convection at m·s⁻¹ is correct (the whole sibling family is valid). Exemption + guard tests b4e38135; name re-stamped valid |
| Pilot-scope smoke (both gates live) | ✓ converged | Fresh stratified 25-name rotation (run 9aa921c3): 24/25 accepted, 0 prose reintroduction, 0 drift, refine waste 0.0%, re-audit 25 cleared / 0 re-quarantined, $4.59 total = $0.18/name |
Gate (a) — the claim-race mechanism and its containment
Pilot forensics (LLMCost run 02313084): 39 of 59 refine calls ($5.55 of $7.55, 53% of pilot spend) were paid gpt-5.5 calls whose persist_refined_docs no-oped on token/stage mismatch, concentrated on two names racing 20 replicas. Each racer re-read the claim token immediately after its own commit and saw itself as the holder — every momentary holder paid, only the last persist landed, and the sub-threshold score kept the name eligible so the storm repeated.
- Deterministic close for small scopes: scoped drains size docs-pool replicas to min(configured, ceil(eligible/2)) — a 1–2-name set collapses to a single replica, zero concurrency.
- Verify-race close:
_claim_sn_atomicstamps a strictly-increasing per-nodeclaim_seq; both docs- and names-axis winner verifiers re-read committed state after a short settle (default 0.5 s) and keep an item only if token AND sequence still match — a superseded racer sees a strictly higher committed seq and stands down before paying. Falls back to token-only verification whenclaim_seqis absent (legacy data / mocks). - Honest accounting: per-(run, pool) persist-outcome ledger surfaces paid-calls / wasted-persists / waste ratio in the run summary, warning past 2%; the per-pool "completed" log line was relabelled "processed" (it counts attempts, not persisted work).
- Residual risk: the settle reduces rather than provably eliminates the race for large unscoped runs under adversarial commit spacing; the deterministic elimination for campaign batches is the replica cap. A seed-level compare-and-set under the write lock is the full close if the tripwire ever fires in production.
Gate (b) — deterministic audit re-stamp per batch
The campaign's revalidation confirmed lifted quarantines "valid" on the banned-prose grep alone; the deterministic ISN audit (latex, spelling, length, unit checks) never re-ran on refreshed docs, so all 25 pilot names kept validated_at stamps predating the drain and a genuine unit defect washed to valid. Now CampaignRunner.run step 5 clears validated_at on every touched batch id and routes the batch through the id-scoped LLM-free validation drain before the prose re-quarantine lands on top; audit deltas (re-quarantined / cleared) ride BatchOutcome into the run summary and the archive rows. The convergence gate still reads the fast prose grep.
The four unit-defect names — root causes, not paper-over
| Name | Defect | Mechanism | Fix | End state |
|---|---|---|---|---|
particle_mass | unit '1' on a mass | Derived family parents inherit units from children; a normalized_* child (correctly dimensionless) stamped '1' onto the physical parent it peels from. Docs described the child concept. | Seeder now excludes normalization-peel children from unit/cocos inheritance (e73331a9); tested repair helper cleared the mis-inherited unit on exactly the finding-bearing parents (db261bca, fab5af85) — genuinely dimensionless parents (e.g. electron_collisionality) untouched; docs re-aligned to the physical concepts via sn edit --axis docs, all accepted (~$0.4/edit) | unit-less, docs accepted, valid |
effective_particle_energy | unit '1' on an energy | unit-less, docs accepted, valid | ||
perturbed_particle_energy | unit '1' on an energy | unit-less, docs accepted, valid | ||
effective_thermal_ion_charge_state_energy_velocity_due_to_convection | audit flags m·s⁻¹ against 'energy' | False positive: the audit exempted _convection_velocity but not the grammar-canonical velocity … due_to_<process> ordering; the sibling family (energy_velocity_due_to_convection etc.) is accepted and valid at the same unit | Transport-velocity head-noun exemption mirroring the flux exemption, with an over-breadth guard test (b4e38135); re-stamped through the scoped drain | m·s⁻¹ kept, valid |
Residual observation (queued to the decomposition triage): 10 further derived parents share the normalized-child '1'-inheritance pattern without a name-unit finding (e.g. particle_charge, perturbed_gyrocenter_density) — some are genuinely dimensionless (collisionality), some deserve the same repair once judged per name.
Pilot-scope smoke (both gates, live)
A fresh stratified 25-name rotation of the docs-fixable spec (--campaign "prose,audit:latex,audit:spelling,audit:length" --campaign-pilot 25, run 9aa921c3, 34 min) exercised both fixes end-to-end on the live graph:
| Gate axis | Threshold | Measured | Verdict |
|---|---|---|---|
| Docs acceptance | ≥ 90% | 24/25 = 96% (the 1 remaining sits at drafted — drain budget ended before its last review cycle; the next drain completes it, same benign pattern as the pilot) | PASS |
| Banned prose reintroduced | 0 | 0 | PASS |
| Name-identity drift | 0 | 0 (25/25 campaign_docs_refine events on unchanged ids) | PASS |
| Refine claim-race waste (gate a) | < 5% | 0.0% — 15 paid refine calls, 0 wasted persists; tripwire line now in every run summary | PASS |
| Deterministic audit re-stamp (gate b) | no stale validated_at | 25 cleared + re-stamped in the batch loop, 0 re-quarantined; deltas on the batch outcome | PASS |
| Cost | ≈ $0.20/name projected | $4.59 / 25 = $0.18/name (generate $1.04, review $1.16, refine $2.39 — all persisted) | PASS |
Compared with the first pilot at the same scope size: spend $10.43 → $4.59 (−56%), refine calls 59 → 15, wasted refine spend $5.55 → $0.00. The healthy-path cost basis for the rotations ($0.20/name → ≈$300–380 for the 1,540-name docs-fixable spec) is confirmed by measurement.
Incidental fix while the smoke ran: docs prompts had silently lost the locus cross-link gloss (ISN registry field renamed description→definition; the context builder's lookup raised inside its catch-all) — repaired with a seam-pinning regression test, imas-codex e1bc6cb0.
What's next
Rotation 1 of the stratified docs campaign (200 names ≈ $40 at the healthy-path $0.20/name), orchestrator checkpoint, then ~450-name rotations until the selection empties — tracked as f-docs-campaign-rotations on the evergreen.