Conversation
The three findings on this pull request all said the same thing in different places: the evidence for the fix was weaker than it looked. The end-of-file budget now starts before the kill. The two-second measurement began only after the kill call and the process wait had both returned, so time spent reaping, or descheduled between engine death and the helper, was excluded. The pump could take longer than the promised two seconds while the assertion still saw a short interval and passed. The clock now starts immediately before the kill, in both the live and the replay case, so the budget covers the whole interval the promise is about. A guard now fails when the production block is removed. None of the registered guards invoked the production isolation block in `engine.main()`. The live simulant called the helpers by hand and the production-entry guard covered replay only, so deleting that block left every listed guard green. A guard that has only ever been seen passing is not enforcement. A dedicated guard is now registered against that block, and it was proven by removing the block and watching the guard go red, then restoring the block and watching it pass. The coverage escape has its own prevention. The failure after the descriptor duplication was a deterministic defect found after the original suite had gone green. Folding its new guards into the existing record left no independent false-green identifier or baseline entry for the escape, which the repository's two-obligation rule requires. It now has its own record and baseline entry. Written with AI assistance.
…r-20260827 # Conflicts: # docs/CLAIM_CORRECTIONS.md # docs/architecture-montana-important.svg # docs/current_candidate_metrics.md # governance/agent_preventions.yaml # governance/agent_preventions_baseline.json
…ation Fix Ubuntu launcher stderr inheritance
…control
The owner ruled on 2026-08-28: "nothing should disable start button. source may
be turned off if operator forgot, or if there is misbehaving, but not disable
the button".
Measured before this change: the end-to-end thermal run timed out because the
Source panel's Start action never became available. The cause was not the panel
wiring but `detector_warmup` holding `stop_source` at 77.5 K against a 10 K
threshold, which made Safety not-ready, which greyed out Start and the P/V/I
spin boxes and showed "Управление заблокировано".
The defect was never that the guard fired. It is that a guard could reach the
button at all.
`_safety_ready` carried two different meanings that a boolean cannot separate:
Safety authority is present and reports a current condition, and no
authoritative Safety state exists at all. Only the first is a guard judging the
operator. The second is the software being blind, which is a different question
and is still open with the owner.
So the cause is now explicit, as `SafetyGateCause`, and the two are treated
differently:
AUTHORITATIVE_NOT_READY - a condition. Start and the parameter controls stay
available, and the panel shows a WARNING naming the
condition and saying it may stop a running source.
AUTHORITY_UNAVAILABLE - blindness. Everything except emergency-off stays
disabled, exactly as before.
Nothing suppresses the guard itself. A `stop_source` interlock still stops a
source that is running; the operator may start it, be told why that is
questionable, and be stopped by the guard if the condition holds. His remedy is
to disable that interlock, which is the sibling change.
The decision is structural, not textual: no code branches on the wording of a
Safety reason, because that text is operator-facing prose that will be reworded.
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
The operator pressed Start on the automatic sweep and nothing happened, and nothing was said. The end-to-end thermal run reached that point and stopped there. The conductivity panel is built only when it is first opened. The authoritative descriptor-qualified readings arrive before that. The shell forwards readings only when the panel already exists, and lazy construction replays connection state but not those readings -- so the panel came up knowing no channel identities, its Start button was enabled anyway, and the sweep's identity guard refused. The guard is right and is untouched. An automatic sweep must not persist readings whose channel identity is unconfirmed; that is the data-misrepresented failure this project exists to prevent. What was missing is the replay. This is the same defect already repaired for the source panel, one panel over: a lazily opened panel missing state that was published once, before it existed. The replay carries freshness with it. A snapshot from a superseded bridge instance or experiment generation is not replayed, because handing the panel an identity it has no right to trust would be the same defect wearing the opposite coat. There is a regression for exactly that, and it is the control on this change rather than a demonstration of it. The second half is the four early returns that said nothing at all. Pressing Start with no Engine connection, during an active sweep, after an unknown command outcome, or while a power command is in flight each produced silence. Each now states what is wrong and what the operator can do about it. A control that neither acts nor explains is worse than one that refuses out loud.
|
@codex review Head under review: The useful review here is adversarial about the freshness half, not the replay:
Stated openly rather than left to be found: one documentation node is RED on this |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4862df2af4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if new_exp_id != previous_exp_id: | ||
| self._conductivity_snapshot.clear() | ||
| self._conductivity_snapshot_binding = None |
There was a problem hiding this comment.
When the conductivity overlay is lazily opened during experiment A, replay installs its descriptors into the panel's _latest_channel_descriptors; an A→B status transition here clears only the shell cache, leaving the connected panel's descriptor generation unchanged. _snapshot_auto_selection() therefore still accepts experiment A's replayed identities, so pressing Start can begin a sweep for experiment B before any B-qualified reading arrives. Revoke the open panel's descriptor authority at this boundary as well as clearing the cache.
AGENTS.md reference: AGENTS.md:L468-L469
Useful? React with 👍 / 👎.
| self._conductivity_snapshot.clear() | ||
| self._conductivity_snapshot_binding = None |
There was a problem hiding this comment.
After a lazily opened panel has received the replayed descriptors, a watchdog restart calls this method but clears only the shell cache. The open panel remains connected with those descriptors in its current _auto_connection_generation until a later _tick_status() changes its connection state; if the replacement bridge starts during that interval, Start can snapshot the superseded bridge's identities and send the first target through the new bridge. Invalidate the open conductivity panel synchronously at the same transport boundary.
AGENTS.md reference: AGENTS.md:L468-L471
Useful? React with 👍 / 👎.
| if not self._connected: | ||
| self.show_warning("Автоизмерение не запущено: нет связи с Engine. Дождитесь восстановления связи.") | ||
| return |
There was a problem hiding this comment.
All four refusal states still disable _auto_start_btn through _update_control_enablement() (start_ok requires connected, inactive, known outcome, and no pending token), and a disabled Qt button does not emit clicked. Consequently an operator pressing Start cannot enter this handler and will see none of the four new explanations; the new tests miss this because they invoke _on_auto_start() directly rather than clicking the button. Keep a clickable refusal affordance or otherwise route attempted activation to these messages.
AGENTS.md reference: AGENTS.md:L540-L542
Useful? React with 👍 / 👎.
| if self._auto_pending_token is not None: | ||
| self.show_warning( | ||
| "Автоизмерение не запущено: выполняется команда управления мощностью. Дождитесь подтверждения." | ||
| ) |
There was a problem hiding this comment.
_auto_pending_token is also set while experiment_attach_run_record is pending, including the initial RUNNING attachment before any power target is sent and the terminal metadata attachment after OFF. In those states this branch tells the operator that a power-control command is running, so the newly added message is displayed for the wrong condition and obscures whether the sweep is waiting for experiment binding or result publication. Track the pending command kind or use wording that accurately covers every command represented by the token.
Useful? React with 👍 / 👎.
| binding = self._current_conductivity_snapshot_binding() | ||
| metadata = reading.metadata | ||
| if binding is None or type(metadata) is not dict or metadata.get("bridge_instance_id") != binding[0]: | ||
| return |
There was a problem hiding this comment.
This assigns the cache binding from the shell's latest experiment status rather than from evidence carried by the reading; the only source check is the bridge ID. Because experiment-status replies and the reading queue are drained independently, an experiment-A reading already in flight can arrive after the A→B status callback clears the cache, be stored under (current_bridge, B), and then pass the lazy-open equality check as if it belonged to B. Carry and verify the reading's experiment generation, or enforce an ingress epoch barrier that prevents pre-boundary readings from repopulating the new experiment's snapshot.
AGENTS.md reference: AGENTS.md:L468-L469
Useful? React with 👍 / 👎.
…ranch #111 and #114 both edit the shell's Keithley safety wiring, for different reasons, and conflicted in main_window_v2.py. Resolved by intent rather than by hunk, keeping both properties: #111 - the panel must LEARN the source's confirmed state when it is opened lazily, after the state was already published. #114 - a current, authoritative Safety condition WARNS and leaves Start available; a missing Safety authority still disables it. They are not in tension: one is about what the panel knows, the other about what it permits. But they touch adjacent lines, and taking either side wholesale would have compiled, passed most tests, and silently deleted a property. Each conflicted hunk kept both sides. Where #114 sets a typed gate cause on invalidation, #111's typed snapshot reset is kept alongside it: taking #114 alone would have retained invalid typed replay evidence, and taking #111 alone would have lost the explicit fail-closed cause reset. The three properties are pinned by named nodes, all passing: a current authoritative condition leaves Start enabled; missing Safety authority leaves Start disabled; a lazily opened panel reaches confirmed OFF.
… file The integration combines both branches' edits to tests/gui/shell/overlays/test_conductivity_panel.py, so the blob the four receipts bind moved again. No recorded guard node was touched by either side. Each red was RE-RUN at the merge commit before its hash moved, with the merged guard file in place and each receipt's own defective source blob restored: auto_evidence_authority 3 passed fixed / 3 failed defective channel_identity_false_green 1 passed fixed / 1 failed defective runtime_authority 1 passed fixed / 1 failed defective unusable_feed_false_green 4 passed fixed / 4 failed defective Every guard still catches the defect it records. No hash was copied across.
|
@codex review Head under review: The interlock-severing branch has been taken in by merge, and that branch The conflict ledger, in short: both replay helper families were kept. Their
Please check that distinction is right. If conductivity identity survived an Three properties must all hold, and I would rather you tried to break them than The four conductivity red-reproduction receipts were REBOUND, not bumped: the The changed-Python count was re-derived at the merged index and read out of the Docs gate green at this head; derived pair regenerated as the last commit. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6e4f326389
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # The negative observation revokes readiness, not the | ||
| # still-current bridge/experiment identity binding. | ||
| self._typed_safety_ready = False | ||
| self._last_safety_gate_cause = SafetyGateCause.AUTHORITATIVE_NOT_READY |
There was a problem hiding this comment.
At 6e4f3263893bb601135802d5766cba9977173003, when a current typed UNKNOWN or transport-unavailable snapshot has already left matching bridge/experiment bindings, a subsequent legacy SAFE_OFF telemetry packet enters this branch and changes the gate from AUTHORITY_UNAVAILABLE to AUTHORITATIVE_NOT_READY. The panel consequently re-enables Start despite the typed Safety authority still being unavailable; legacy telemetry should be allowed to revoke typed authority but must not restore warning-permissive control authority merely because the bindings match.
AGENTS.md reference: AGENTS.md:L20-L22
Useful? React with 👍 / 👎.
| and not self._replay_mode | ||
| and cut.mode is SnapshotMode.LIVE | ||
| and experiment_matches | ||
| and (ready or cause is SafetyGateCause.AUTHORITY_UNAVAILABLE) |
There was a problem hiding this comment.
When the best-effort source-state ON publication is dropped, a later current typed snapshot with lifecycle RUNNING is classified as AUTHORITATIVE_NOT_READY and is excluded by this condition. The previously cached OFF therefore remains displayed, and because the warning-permissive gate enables controls, Start remains available for a channel whose authoritative Safety lifecycle says a source is active. Periodic cuts should revoke retained per-channel OFF for non-OFF lifecycles, while preserving it only for conditions that are compatible with verified OFF.
AGENTS.md reference: AGENTS.md:L533-L536
Useful? React with 👍 / 👎.
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
|
@codex review Head under review: This round fixes a regression the COORDINATOR introduced when integrating this Measured: the node passes on master, failed at the previous head, and passes now. The thing worth pressing: the guard must not have turned the clear into a no-op. Docs gate green at this head; derived pair regenerated as the last commit. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…and not only the plumbing Integrates #107. Zero product conflicts with the candidate and zero with the warning-choice rework in flight -- it touches only tools/thermal_conductivity_simulator.py and its test. This is the owner's ONE named feature. His words: "стараться делать минимум новых фич (я бы сказал что симулятор теплопроводности это единственная нужная фича)". The campaign handoff listed #107 under "unrelated backlog"; that reading was rejected, and the consultants agreed it was wrong. A rehearsal against a simulated specimen exercises the measurement path -- power applied, temperatures responding, a point accepted and durably recorded -- rather than only the transport and the panels. Reversion control on this candidate: 38 passed with the change; the simulator reverted, 7 fail, including test_external_simulator_answers_invalid_channels_with_explicit_error. WHAT THIS DOES NOT ESTABLISH, and must never be reported as establishing: a simulator run is not hardware qualification. Mock, simulator and software-only evidence never qualify the physical instrument. It makes the end-to-end rehearsal meaningful; it does not make it a physical acceptance. Block B, simulator half. The persistence half (#110's run-record-before-power-advance and #118's identity replay) follows the warning-choice rework, because both touch engine.py. Semantic delta only; the merge's generated metrics were reverted to master and reconcile once at freeze.
1 participant
The operator pressed Start on the automatic sweep and nothing happened, and
nothing was said. The end-to-end thermal run reached that point and stopped.
Stacked on #110 — it depends on the identity guard that branch introduces.
What was wrong
The conductivity panel is built only when first opened. The authoritative
descriptor-qualified readings arrive before that. The shell forwards readings
only when the panel already exists, and lazy construction replays connection
state but not those readings. So the panel came up knowing no channel
identities, its Start button was enabled anyway, and the sweep's identity guard
refused.
The guard is right and is untouched. An automatic sweep must not persist
readings whose channel identity is unconfirmed — that is the data-misrepresented
failure this project exists to prevent. What was missing is the replay.
This is the same defect already repaired for the source panel in #111, one panel
over: a lazily opened panel missing state that was published once, before it
existed.
Freshness is the hard half
A snapshot from a superseded bridge instance or experiment generation is not
replayed. Handing the panel an identity it has no right to trust would be the
same defect wearing the opposite coat. The regression for that is the control
on this change rather than a demonstration of it — if it did not fail without
the change, the freshness claim would be unproven.
The four silent controls
Pressing Start with no Engine connection, during an active sweep, after an
unknown command outcome, or while a power command was in flight each produced
silence. Each now says what is wrong and what to do:
A control that neither acts nor explains is worse than one that refuses out loud.
Verification
Reversion control, run independently by the coordinator: 8 nodes red without
the production change, 113 green with it. The lane additionally showed that
selectively weakening the missing-descriptor refusal makes its guard test fail,
which is what proves the guard still has teeth.
No existing test was modified — assertions added 21, deleted 0.
An inherited red, stated deliberately
test_release_whole_tree_artifact_gate_is_reachable_and_pr_excludedfails onthis branch. It is not caused by this change — it fails identically on the
#110 base this is stacked on, where a governance receipt binds a guard file #110
edited. A separate lane is re-deriving that receipt on #110, and it must
re-reproduce the recorded red rather than copy a hash across. This branch goes
green when that lands and this rebases.
What would make accepting this red wrong: if the receipt turns out to be
invalidated by this branch rather than by #110. It is not — this branch
touches neither the governance registry nor the guard file the receipt binds.
Not determined
coordinator's end-to-end run in the merged configuration.
sandbox refuses, so no whole-file green is claimed.
Disclosure
Written by an AI lane (
gpt-5.6-sol) under an agent brief; root-caused by aseparate diagnosis lane; verified and landed by the coordinating agent. An
earlier attempt at this task was briefed against master by coordinator error and
correctly refused to edit anything, because master contains no identity guard at
all and adding replay there would have let a sweep start unguarded.