---
name: presence-under-both-outcomes-refutes-the-argument-not-the-cause
description: Clearing a suspect because it is present under passing runs is invalid when the suspect is a NECESSARY-not-sufficient background condition — the variable is the interaction, not the presence
metadata:
  type: feedback
---

**"It's present under green runs too, so it isn't the cause" is not an elimination. It only refutes
arguments that treat PRESENCE as the variable.**

MEASURED 2026-08-25, FIELD-SEAL golden r1/r2/r3 (three runs, three different Linux victims, same
sha across two of them). doyle raised kernel audit `backlog limit exceeded` bursts as the lead,
then dissolved it: *bursts are chronic since Aug 24 and present under green runs.* Three hours
later the same bursts came back as the mechanism candidate — default `audit_backlog_wait_time` is
**60 seconds**, matching 59.4s and 62.7s deaths of cells that normally run in 14.5s and **0.824s**.

The dissolution felt rigorous — it is the right instinct, a control arm — and it was invalid,
because the bursts were a NECESSARY-not-sufficient condition. What settled it was a pair five
minutes apart on the same box inside the same burst window:

    15:36:35-15:40:46Z  ci `unit` (Linux, kitsubito)        GREEN   — light leg, 4m11s
    15:41:39Z+          golden `test` Phase B (Linux)       RED     — heavy class, SERIALIZED, ~1000s

Bursts present in BOTH. Presence never decided anything; what the leg DID decided it — Phase B is
the spawn-heaviest leg by construction, and a serialized leg pays each 60s spawn wait end-to-end
against a per-cell deadline, while parallel nextest overlaps them (which is why a 1924/1924 parallel
pass on the same box was NOT the counter-evidence it appeared to be).

**Why:** eliminating a suspect requires the suspect to be the ONLY thing varying. A background
condition that must combine with a second factor is present in both arms by definition, so
both-arms presence is exactly what the true-cause hypothesis predicts too — the observation cannot
discriminate. Same family as [[discriminator-question]] instance 9, and its exact mirror: there,
ABSENCE from a green run proved nothing because only the failing path emitted the string; here,
PRESENCE in a green run proved nothing because presence was never the variable. Absence-based and
presence-based reasoning fail the same way and in opposite directions.

**How to apply:**
- Before clearing a suspect on both-arms presence, ask: **is this thing sufficient on its own, or
  does it need a partner?** If it needs a partner, find the arm where the PARTNER differs — that is
  the real control, and both-arms presence is uninformative.
- Hunt a same-window green/red PAIR on the same box. Two outcomes minutes apart under the identical
  background is worth more than a long history of either one alone.
- Watch for this when a peer says "dissolved" — I nearly banked that dissolution as settled fact.
  Retracting an ARGUMENT is not retracting a MEASUREMENT: both of doyle's readings were true and
  only the inference joining them was wrong, and saying so precisely is what let the lead come back
  without anyone's measurement being impeached. See [[amendment-falsifies-more-than-named]].
- Raise it BEFORE the conclusion leaves for an outside audience. This landed while the operator
  brief was being written; an hour later it would have been a correction to a document instead of
  an edit to a draft.