--- name: a-budget-inside-the-measured-tail-is-a-coin-flip description: "⚠ TITLE OVERCLAIMS, kept for its links: an EXPIRY is right-censored so the tail is UNKNOWN, and a success near a threshold does not prove the threshold wrong. What survives is the craft — instrument a retry wait's MARGIN on SUCCESS (a pass hides 392/400 as well as 16/400), and ask whether a threshold sits inside the distribution before pairing arms against an intermittent" metadata: node_type: memory type: project originSessionId: ae210c13-2317-4cc0-a12e-8860b2e2873f modified: 2026-09-10T14:32:33.104Z --- 2026-09-10, releases#294, how Finding 1 went from UNCLASSIFIED to PARTIALLY classified (boundary defect measured; failure MECHANISM still censored). `spt-daemon::sync two_tier_sync_lands_and_gate_refuses_server_side` failed on Windows in golden 34445961595 (verdict of record) and again in the r2 gate run 34481993681, at `crates/spt-daemon/tests/sync.rs:109`, `sync stream never appeared at the responder's broker`. The wait is `wait_for_stream_except`: `for _ in 0..400 { net_streams(); sleep(25ms) }`, commented "10s budget". **What closed it — hertz's IR95-SYNC instrumentation rows, which were already on disk:** rep1 first wait iterations=176/400 elapsed 4.448s ipc 0.53% PASS rep2 first wait iterations=392/400 elapsed 9.940s ipc 0.48% PASS (cell 76.558s, SLOW) instrumented CI iterations=400/400 CENSORED at 10.156-10.200s FAIL 2/2 bare Windows arms PASS but slow (cells 91.375s, 94.000s) record red + r2 FAIL (censored, no upper endpoint) same cell on Linux, same run PASS at 1.523s rep2 passed with EIGHT iterations of headroom — 200 ms on a 10,000 ms budget, 2%. IPC is under 1% of elapsed in every sample (sleep 99.4-99.5%), so the poll is not burning its budget on RPC overhead: it is genuinely waiting. **That makes the budget a MEASURING INSTRUMENT for the product's latency** — but only where it SUCCEEDS. ⚠ **CORRECTED BY hertz THE SAME HOUR, and the correction is the sharper half of this entry: THE FAILURES ARE RIGHT-CENSORED OBSERVATIONS, NOT SAMPLES.** I first wrote "the samples are the distribution: 4.4s, 9.9s, >10s, >10s" and ruled DELAYED PUBLICATION. Wrong, and wrong in the flattering direction. A 400/400 expiry establishes only that NO ELIGIBLE STREAM WAS OBSERVED BEFORE EXPIRY; it does NOT establish that one appeared later. It cannot distinguish delayed publication from ABSENT, RETIRED or FILTERED publication, and low IPC plus a 392/400 success do not distinguish them either. **The tail has no measured upper endpoint**, so "outside the measured tail" is not even a specifiable ceiling. WHAT SURVIVES: the observed SUCCESS latencies are 4.448s and 9.940s against a 10.0s threshold — one success at 99.4% of budget. WHAT DOES NOT: that any PARTICULAR red is boundary jitter (a second red reproduces the SIGNATURE, not the MECHANISM), and — **SECOND WITHDRAWAL, todlando, same hour** — that the BOUNDARY IS WRONG AT ALL. Proximity to a threshold is a RISK SIGNAL, not a verdict: if the 9.940s success is itself pathological then the 9.940s is the defect and the budget is innocent, and deciding which needs the intended distribution, which nobody has measured. So this entry's own title is an overclaim; it is kept under that name because other entries link it, and the surviving craft is points 1-3 below, not the verdict in the title. Full account of all three withdrawals: [[proximity-to-a-threshold-is-a-risk-signal-not-a-verdict]]. **Why:** when a threshold sits inside the distribution of what it waits for, pass/fail is decided by jitter, and the failure is therefore IRREDUCIBLE BY SINGLE-VARIABLE HUNTING. That is exactly how it presented, and it burned a day: 2-of-3 at ONE sha on ONE box with the GREEN sample sitting chronologically BETWEEN the two reds (06:52 red, 12:12 green, 13:36 red); 0/12 local reproductions, because the local reps land at 4.4-9.9s as NEAR-MISSES that score as passes; and a hunt that went looking for a configuration variable (twohost, event) when both were measurably INERT on the job. The near-miss passes are the tell and they are invisible unless the wait reports its own margin — a bare PASS hides 392/400 exactly as well as it hides 16/400. **How to apply:** 1. **A fixed-iteration wait states its budget in ITERATIONS; its real wall bound is `N x (work + sleep)`.** `sleep_sum` is the budget only if the work is free. Say what it actually bounds — sync.rs:99 called 400x25ms a "10s budget" and that is true only at ipc≈0. 2. **Instrument every retry wait to report its MARGIN on SUCCESS, not only on failure.** A pass at 98% of budget is a red that has not happened yet, and it is the only cheap warning you get. Graph/scan the margins; a cluster near the ceiling is a scheduled outage. 3. **Before hunting an intermittent for a configuration variable, ask whether the threshold is inside the distribution.** If it is, no single-variable pair will ever close, and pairing arms is wasted money — the answer is margin data, not another arm. Check this FIRST; it is cheaper than every arm we ran. 4. **Do not fix it by bare widening — and do not fix it by a "ceiling above the tail" either, which is what I first dispatched and which hertz correctly refused as UNSPECIFIABLE: a censored tail has no upper endpoint to sit above.** THE DESIGN THAT ACTUALLY ANSWERS IT (hertz, 2026-09-10, authorized): KEEP the original acceptance boundary, and on expiry run a SEPARATELY BOUNDED DIAGNOSTIC CONTINUATION with the same instrumentation — PRESERVE the failure even if the stream later appears, and report its id and first-observed elapsed. That measures eventual visibility WITHOUT converting a red into a pass, and it turns the censored observation into a real one. If a wider acceptance ceiling is ever wanted, it must be named as POLICY by whoever wants it, never smuggled in as a measurement conclusion. (My standing "no budget widened" ruling was grounded on masking an UNMEASURED delay; I declared that ground spent once I thought the delay was measured — it was not, so the original ruling was right for longer than my amendment to it. See [[an-identical-treatment-controls-the-input-not-the-effect]] on re-deriving a ruling's ground instead of reciting the ruling, and note the failure mode here was the opposite: I re-derived it from a conclusion that was itself unearned.) 5. **A platform split in the same measurement is a separate finding, not an explanation.** Linux 1.523s vs Windows 4.4-10+s on a hermetic loopback path (relay Disabled, discovery Off, scope Loopback) is a 3-7x product latency gap; it deserves its own recon rather than riding the test-budget fix, and a test fix must not be allowed to retire it silently. Related: [[a-detector-must-pass-a-control-built-from-what-motivated-it]], [[compare-at-one-layer-crlf-meter-class]] (its source-independence axis — a pass that cannot fail proves nothing, and a near-miss pass is the same defect in a budget).