---
name: log-token-names-its-population-not-the-subsystem
description: "A diagnostic token's emit site fixes WHICH population it counts; a rate read off it says nothing about a neighbouring subsystem, in either direction."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: d02b1658-b94a-4d51-b1e2-d4f28251bdfe
  modified: 2026-08-18T07:20:43.289Z
---

A log token counts exactly the population its emit site is wired into. Read the emit site before
you attribute a rate — or an absence — to any subsystem other than that one.

Measured 2026-08-17 on releases#188. The twohost-a job log carries 28,900 `CONN_LIFECYCLE` lines,
10,790 conns over 923s = 11.7/s, which the lane brief had already turned into "~12 brain conns/s"
and then into a loaded probe arm "at ~12 conns/s". Every line is `role=brain`, and the token is
emitted at `conn.rs:270` from `BrokerConn` — a **broker-IPC** conn record. The pump's event
carrier is fed only by `register_conn` / `append_dial_failed` / the disconnect watcher in
`nethost.rs`. So that 11.7/s never reached the carrier the probe was loading, and the rate that
motivated the arm was a rate for a different wire.

It bit me in BOTH directions inside ten minutes, which is why this is a rule and not an anecdote:
having seen `role=` was only ever `brain`, I nearly reported "therefore zero net conns on A for
923s" — a confident negative the same token also cannot support, because a net conn emits no
`CONN_LIFECYCLE` line at all. Same token, one over-claim per polarity. A histogram is seductive
precisely because it looks like a census.

**Why:** a token is discovered by grepping the log, so you meet it as a *symptom name* with a
count attached, never as a claim scoped to a struct. The scope lives at the emit site, and the
count arrives without it.

Third face, same day: your EXTRACTION can narrow the population silently. Pairing dial targets to
addresses with `leg=([a-z]+)` dropped every `leg=failed-addr-skip-then-discovery` row, so "B dialled
A 3 times" went to doyle and to the issue when the real count was 5 — and the omitted leg was the
interesting one (the failed-address memory engaging). The tell was arithmetic: 159+3 did not reach
the 164 submits I had already counted. **Reconcile your extracted subtotals against the raw total
before reporting; a regex that cannot express the value space returns a clean, wrong census.** Same
day I also read two SEPARATE histograms (targets, addresses) side by side and concluded "B dials its
own IP for A" — pairing the two fields on one line refuted it: the 159 belonged to a third node.

**How to apply:** before a token's count enters an argument, grep its emit site and name the type
that emits it and the `role=`/kind vocabulary that type can produce. Then say out loud which
population it counts and which it cannot — the negative half is the one that gets skipped. Applies
identically to an ABSENCE: [[absence-needs-sibling-probe]] tells you to probe for a sibling, this
tells you the sibling has to be emitted by a site that would actually have fired.

Related: [[a-predicate-without-its-tool-is-not-evidence]] (population is the axis this sharpens),
[[announce-token-from-the-failing-frame-not-the-register]], [[verdict-from-probe-competence]],
[[precise-claim-is-falsifiable-vague-is-useless]].