The tier declaration is taken from the instrument, the return rule reads both lanes, and twenty-four names move

[Japabu]

Seven consecutive main push runs went red on durations. Every one named
sysret_ss_reload, and five of the seven also named a Fast name no pull
request had touched, priced over a line on the push lane that the nightly's
own partition prices the same name well under. From the durations job logs
of those five runs against the nightly 35072262489 partition this branch
commits (ms):

run	name	push	nightly	ratio
34773208611	boot_partition_identity	8,205	6,798	1.21x
34778832553	xhci_many_devices	11,102	4,944	2.25x
34834353873	boot_partition_identity	8,319	6,798	1.22x
34899157020	page_cache_partition_offset	8,503	4,559	1.87x
34899157020	so_cache_refusals	10,992	6,348	1.73x
34911665787	home_overwrite_reads_back	10,721	6,734	1.59x
34911665787	metal_sim_input	8,721	6,166	1.41x

Six name/nightly pairs, seven push prices, 1.2x–2.25x over the nightly. Two
things were wrong and this branch moves both. The committed tier declaration
had drifted from the instrument — tests/test-durations was last written from
a partition whose author replaced only the rows their own change had
registered — and the push lane rendered Enforced::Everything on a composition
the merge queue had just measured at Touched, so a disagreement the queue
printed as a warning landed and then reded main on names no pull request
could fix.

The return rule reads both lanes — read this first

A name is Fast only if it is at or under FAST_COMMIT_MS on the instrument
of record, the nightly, and on the gate it must then pass: the returning
landing's own hosted run. That sentence is FAST_COMMIT_MS's doc in
src/tiers.rs now, and this landing is placed by it.

This pull request's first hosted run (ci 35352795338, head 20b04cc1) was
red in durations on the UNMEASURED marker line alone — the marker's refusal
returns before any price verdict is computed. With the marker replaced, the
same twelve shards priced five names over the 8,000 ms line on the
pull-request lane:

name	nightly 35072262489	run 35352795338
screen_gop_firmware_mode	7,667	9,090	one of the 26 returns — not returned
fat_backing_revoked	6,719	8,333	one of the 26 returns — not returned
screen_console_scroll	7,513	8,235	one of the 26 returns — not returned
ftruncate_flush_race	5,844	8,111	one of the 26 returns — not returned
boot_partition_identity	6,798	9,527	an existing Fast name — relegated; main's push runs 34773208611 and 34834353873 priced it 8,205 and 8,319

These five were found because a landing that re-prices the whole profile
renders every re-priced name on its own runs — 433 names here — and that rule
stands as written.

Why the five rows are a new Why and not Why::Cost. The committed
profile is the nightly's, so it prices all five under the line — and a
Why::Cost row priced under the line is exactly what the return arm refuses.
Measured with the five written as Why::Cost:
cargo test -p toyos-build --lib tiers:: exits 101 with five belongs Fast lines, one per name; the nightly would say the same every night, and so
would this pull request's next run, which retains the nightly's row for a name
the fast tier does not run. ci_ms cannot carry the hold for every Why::Cost
row either — it is a hand-kept note (121,441 on desktop_audio_client against
a profile price of 8,401), and a rule that read it would hold every Cost row
for ever and end the nightly's invitation back. So the hold is declared:

Why::CostOnTheGate — priced with margin by the nightly and without it by
the gate a return has to pass. ci_ms is the hosted pull-request-lane
reading that refused the return, and on this variant alone it is checked: a
reading at or under FAST_COMMIT_MS holds nothing and is refused on every
run as a declaration verdict. No nightly price moves the row; it returns
through a landing that re-tiers it Fast and whose own run prices it under the
line.

Why::Cost rows keep the nightly's invitation exactly as it was. What this
does not close is a name that straddles on the nightly's own lane:
log_conservation_smp4 is 9 ms under the line there and 4,881 on the gate, so
both lanes put it Fast, and a nightly that prices it over 8,000 again is its
standing src/redlist.rs row.

The push lane

A push to main is a composition the merge queue already measured, so
.github/workflows/ci.yml's durations job passes
--tier-base ${{ github.event.before }} on push — the tip the push
replaced. The gate holds the order, not the set: src/ci.rs reads the
TIER_BASE: expression and asserts its operands in || order — the merge
group's base, the pull request's base, github.event.before. A pull_request
synchronize payload carries before too (the branch's previous head), so
before first would narrow every pull request to what its last push moved
with all three strings still in the file. Enforced::Everything's doc no
longer names a push to main; schedule and workflow_dispatch still name no
base and render the whole verdict.

One law for what is committed from a run

src/durations.rs's header states it once: the nightly is the instrument of
record, so a re-pricing of the profile is the nightly's whole artifact, landed
as its own change; a pull request replaces only the row its own UNMEASURED
marker holds, from its own hosted run, and that row stands priced by that run
until the next nightly re-prices it. #463's sentence in the same header ("a CI
run's merged durations are committed only for the rows this change's own
markers blocked") is the second half of that law and is folded into it in the
merge of origin/main.

This landing is the first kind: cargo run -- --merge-durations over the
twelve durations-shard-* artifacts of scheduled run 35072262489
(2026-09-16, main at 8261079e, twelve hosted shards under --nightly, all
twelve present) writes 448 measured rows — every row in the profile, none
carried — and its verdict on the base names 27. Its commit 3928e700 is the
second kind: one row, sysret_ss_reload 5908 shards=12, from this pull
request's own hosted run.

A name whose price a landing re-takes is judged by that landing

Before this, once a marker was replaced by a number, no gate a pull request or
a merge group runs rendered that name's verdict: the reviewer measured exit 0
with sysret_ss_reload sitting at 15,402 ms. The rendered name set gains a
fourth source — any name whose tests/test-durations row differs from the tier
base's — and the same experiment now exits 101:
sysret_ss_reload measured 15402 ms in CI, over the 10000 ms line, but sysret_ss_reload remains Fast [enforced on this run: …re-priced sysret_ss_reload]. UNMEASURED_MS, render_verdict, Enforced, both module
headers and the ci.yml comment now say the marker covers a re-taken price as
well as a new registration.

The consequence for a first-kind landing is deliberate and visible here: this
pull request re-prices every row, so its own runs render the verdict for 433
names rather than for the ones it re-tiers.

sysret_ss_reload — the test is fixed, judged, and priced Fast

15,402 ms on the nightly and 32,237 to 45,686 ms on the five push runs, against
a committed 6,453 — none of it the kernel's. The probe line lands before
===READY===, so boot_log() already held it and the 10 s drain_until
ceiling, scaled by width and host speed, could only time out. The test reads
the boot log for the line and drains only when it is not there.

Its judge: QemuInstance counts its drains, and the test refuses a run
whose boot log held the probe line and whose console was drained anyway.

Its price: ci run 35352795338 ran the fixed test on hosted shard 1 at
5,908 ms — under the commitment line, so the name stays Tier::Fast with no
RELEGATED row, and the marker is gone. Locally, cross-arch TCG:
cargo test sysret_ss_reload exit 0, 2,168 ms.

The redlist row about its price is retired against commit 20b04cc1 with
source at tests/toyos.rs.

Twenty-two returns, plus one rider; four held; one relegated

The nightly partition prices 26 Why::Cost rows at or under the 8,000 ms
commitment line. Twenty-two of them are also under it on this pull request's
own hosted run and return: RELEGATED entry removed, Tier::Nightly →
Tier::Fast. The four marked held stay Tier::Nightly as
Why::CostOnTheGate with ci_ms the gate's figure. Removed row's ci_ms /
nightly 35072262489 / run 35352795338, ms:

name	was	nightly	gate	name	was	nightly	gate
log_conservation_smp4	8248	7991	4881	wall_clock_zone	9347	4988	6756
screen_gop_firmware_mode held	12624	7667	9090	esp_filesystem	10123	4970	4791
screen_console_scroll held	13401	7513	8235	wall_clock_rtc_dead	8070	4929	6507
log_partition_identity	9516	6896	7854	wall_clock_century_register	9030	4866	5199
fat_backing_revoked held	8226	6719	8333	usb_short_read	8150	4751	4510
xhci_full_speed_device	8833	6695	7130	writeback_spawn	8820	4748	4658
writeback_durability	8888	6555	6803	idle_stack_guard	9601	4642	5560
dump_nmi_probe	8098	6023	6374	console_line_atomicity	8925	4608	4786
fs_rename_durable	9346	5999	5296	gpu_set_resolution	8610	4554	5626
locale_detect	9959	5961	5028	heap_ceiling_recovery	10371	4516	4431
ftruncate_flush_race held	9452	5844	8111	cache_eviction	8165	4515	4621
screen_survived_panic_not_blamed	8477	5794	6548	fsync_failed_commit	8386	4248	4394
xhci_slot_exhaustion	8149	5198	5260	double_panic_names_the_fault	9120	2735	2700

locale_detect_unrecognized (160 → 281 ms) is
Why::RidesTheBootOf("locale_detect") and returns with its carrier: one boot
cannot be in two tiers. boot_partition_identity (6,798 on the nightly; 9,527,
8,319 and 8,205 on the gate's lane) leaves the fast tier as
Why::CostOnTheGate; its guards says what goes dark — the
firmware-against-table agreement and the two-claimant arm — and what stays:
toyos-gpt's host suite and foreign_disk_untouched. Against main: 23 rows
leave RELEGATED, 4 stay with a new Why, 1 is new.

xhci_full_speed_device returning is
issues/build/xhci-full-speed-device-jumped-47-percent-over-its-commitment.md's
2026-08-22 ruling honoured; its standing redlist row about its own variance is
what a fast-tier price red on it is read against.

The two names the profile had never priced

audio_tone (smp=8) and audio_tone_load (smp=8) were labels the committed
profile did not hold. Priced here from CI's own artifact at 8,799 and
12,315 ms; both over the commitment line, both names stay Tier::Nightly.

Tracker

• issues/build/the-committed-profile-disagrees-with-the-nightly-on-28-names.md
  asked for exactly this landing and is closed by deletion; its one durable
  rule is in src/durations.rs's header (the nightly's artifact is committed whole, as
  its own change).
• issues/build/idle-stack-guard-price-nearly-doubled-since-its-return.md is
  closed by deletion: its whole evidence was idle_stack_guard 9,601 ms and
  dump_nmi_probe 8,098 ms, and this partition prices them 4,642 and 6,023.
  No citation to it existed.
• issues/build/the-return-rule-reads-one-sample.md was filed by this pull
  request and is closed by it, by deletion: the rule reads two lanes now. Its
  table is the one above and is in commit 08d700d3's message; no citation to
  it survives (git grep), and log_conservation_smp4's standing redlist row,
  which cited it, is re-sourced to tests/common/logread.rs with run
  35352795338's 4,881 ms added.
• issues/build/nothing-compares-a-committed-tier-row-to-the-artifact.md —
  filed: nothing compares a committed Relegated row or profile row to the
  artifact (ci.yml's git diff --quiet writes a summary bullet and no red),
  with the four partial fixes of this landing that every named gate stays green
  under as its evidence. The gate is not changed here.
• issues/build/a-timer-anchored-names-tier-is-decided-by-its-price.md loses
  the one paragraph this landing falsifies;
  issues/build/the-shard-split-prices-a-boot-and-not-the-image-behind-it.md
  loses the five run totals whose spread was this test's drain and keeps the
  figures net of it: about 41.7, 12.3, 8.3, 19.9 and 6.5 s, a spread of about
  35 s against a best case of about 31 s.

Risk, named

Negative controls, build exit before test exit.

mutation	build	test
ci.yml's TIER_BASE reordered before || merge_group || pull_request (the reviewer's)	0	101 — ci::tests::the_names_a_landing_is_judged_on…, left [before, merge_group, pull_request]
the profile dropped as a source of touched names (the old rule)	0	101 — durations::tests::a_repriced_name_is_rendered_by_the_landing_that_repriced_it, touched {} against {audio_tone, iommu_empty_domain}
sysret_ss_reload with no guard and a 1 ms ceiling (the reviewer's partial fix)	0	1 — the boot log already held the probe line and the console was drained 1 time(s) for it anyway
the hold reverted: the five Why::CostOnTheGate rows written Why::Cost	0	101 — tiers::tests::the_ci_profile_and_tiers_agree with five belongs Fast lines, and a_nightly_price_does_not_return_a_row_the_gate_holds with it
the whole landing reverted: --merge-durations over the nightly's twelve artifacts on a git archive of dc38a054	—	101, 27 lines: sysret_ss_reload 15,402 over the line and 26 Why::Cost rows that belong Fast

The independent oracle. The prices are CI's own durations-shard-*
artifacts from a scheduled hosted run of main and from this pull request's
own hosted run; the push-lane prices are the five push runs' own durations
job logs; --merge-durations refuses anything that is not one whole
twelve-shard partition.

What this does not claim. The 22 returned names are under the line on two
hosted partitions, one per lane, and no more than that; a name that straddles
on the nightly's own lane is still held nowhere (log_conservation_smp4,
first section). The shortened-ceiling half
of the reviewer's partial fix (guard kept, ceiling cut) is not reded by
anything: it breaks only a shard where iod's probe runs after ===READY===,
and no actuator stages that.

Checks run, on 08d700d3

gate	exit
cargo test -p toyos-build --lib	0 — 311 passed, 0 failed, 1 ignored
cargo test --test toyos-build -- --list (check_registration)	0
cargo run -- --merge-durations <run 35352795338's twelve artifacts> --tier-base 9f91b581 — the pull-request lane, with the base ci.yml passes (pull_request.base.sha)	0 — 433 names rendered, 0 warnings. With the five names' lines taken out of the shards, which is the shape of the next hosted run now that the fast tier does not run them: 0
cargo run -- --merge-durations <nightly 35072262489's twelve artifacts>, no base	101, one line — sysret_ss_reload measured 15402 ms in CI, over the 10000 ms line, but sysret_ss_reload remains Fast. That line is the nightly having run the test before 20b04cc1 fixed its drain; nothing else is named, and the written profile differs from the committed one in that row only
same nightly artifacts on a git archive of base dc38a054	101 — the 27 disagreements
cargo test sysret_ss_reload (guest, dev host TCG), on 84bfc3c5	0 — 2,168 ms

cargo run's QEMU path was not used; the guest boot above is the harness.

🤖 Generated with Claude Code

https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK

[Japabu]

Superseded by #475 (the test-governance cut, CTO ruling of 2026-09-21): the merge-health instrument is deleted and the duration verdict only warns, so this branch's subject no longer exists. Its measurements stay in its history.