---
name: window-assertion-load-direction
description: "BINDING triage arm (doyle-ruled 2026-07-23, deployah-flagged): a printed assertion over a TIME WINDOW classifies by the direction load pushes its failure mode — two mechanical checks, no per-incident judgement."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: b83a2cd0-4a13-47e0-87eb-044629247618
  modified: 2026-07-23T17:35:12.829Z
---

Third arm of the printed-TIMEOUT / printed-ASSERTION triage table: **printed-assertion-over-a-time-window**. Deployah flagged the class honestly while it would have resolved in favor of their cut (attach_idempotent_replay leg 2, merge-run 29995900179); doyle ruled the mechanism so it never gets decided ad hoc — it is the arm most vulnerable to motivated reasoning.

**Why:** a negative assertion over a window ("nothing forbidden arrives for N ms") looks load-sensitive, so a red under load invites the convenient "the window drifted" story. Whether that story is even POSSIBLE is a structural property of the rig, decidable by reading it — not a judgement call per incident.

**How to apply — two checks, then the verdict is forced:**
1. **Anchor check:** is the window opened only after a consumed POSITIVE sentinel (e.g. `pump_until(needle)` drained the legitimate delivery before the window starts)?
2. **Source enumeration:** list every legitimate mint-source of the forbidden observable that could land inside the window.

⚠️⚠️ **THE RULING CASE WAS LATER REVERSED, AND THE REVERSAL IS THE MOST IMPORTANT THING ON THIS NODE.** Doyle originally enumerated FIRST bytes as mintable only by attach-time initial-batch synthesis (⇒ zero innocent sources ⇒ dig). Todlando then found an innocent source **both experienced readers missed: PTY double-echo** — `cat` under a real PTY emits FIRST twice (line discipline + writeback), `pump_until` anchors on the first substring hit *mid-pair*, and the delayed second copy is load-gated straight into the window. The observed payload (7 bytes, ONE copy) fits that innocent source and does NOT fit a replayed batch (which would carry the pair plus history). Verdict flipped: ambiguous ⇒ discriminate, not dig.

✅ **RESOLVED BY MEASUREMENT (todlando matrix, 2026-07-23):** control arm with THE REPLAY DELETED still red 93/120 loaded + 12/13 serial, logs carry exactly one SUBSCRIBE_DECISION ⇒ zero replays anywhere ⇒ the window catches the child's second PTY echo, confirmed. Not a defect. Fix = test-only anchor (drain the echo pair before the absence window). v0.41.0's attached-view claim never implicated; stands as written. ⭐⭐ **THE KEEPER, and it inverts the naive read: the leg's SERIAL-GREEN was the accident** (`read_outcome` incidentally swallowed echo #2), so the merge-run RED was the leg being HONEST FOR THE FIRST TIME, not CI flaking. The instinct "red under load = flake, green on rerun = truth" was exactly backwards here. Pairs with the corollary below: for a load-direction-analyzed oracle, do not assume which colour is the lie — derive it from the anchor + enumeration, then MEASURE.

**⇒ CHECK 2 IS ONLY AS SOUND AS THE ENUMERATION, AND THAT IS THE ARM'S LOAD-BEARING WEAKNESS.** An incomplete enumeration returns a false "zero innocent sources" and *forces* the dig verdict with full mechanical confidence — the arm cannot tell a complete enumeration from a lazy one. Two careful readers independently produced the same incomplete list. **Apply accordingly: treat "zero innocent sources" as a claim requiring positive evidence (name what you ruled out and why), never as a default reached by failing to think of anything; and prefer a second reader on the enumeration specifically, since that is the step the mechanism cannot check for you.**

Anchored + zero innocent sources ⇒ load can only push toward false-GREEN (guilty bytes delayed past the window — a MISSED detection), never false-RED ⇒ **a red is real regardless of box state → dig**. Unanchored, or an innocent source exists ⇒ the red is ambiguous → discriminate (A/B, loop-under-load) before digging.

⚠️ **A SECOND, INDEPENDENT TRAP IN THE SAME INCIDENT: the leg's PANIC LABEL lied.** Its message read `RED PRE-FIX: the replay re-synthesized the initial batch and re-delivered already-seen history` — claiming discriminating power the test's own header explicitly disclaims (the header is honest that leg 2 is a NON-REGRESSION GUARD which still passes with the discriminator disabled, because Brain's exactly-once cursor drops a re-sent range). Both readers escalated partly on the label's authority. **F-1 diagnostic-lie class, applied to a test's own assert message. Candidate rule (doyle-seeded, P3): a leg's failure message must not claim more discriminating power than its own header grants.** Practical guard: when a red drives an escalation, read the test's HEADER before trusting its panic string — the label is written by whoever last edited the assert, the header by whoever understood the rig.

⭐ **The instinct is the unreliable input.** Deployah's read of "1200ms window" reached for contention; the two checks read the anchor and reached the opposite verdict. Classify by the DIRECTION load pushes the failure — never by how timing-flavoured the assertion *looks*. That gap between instinct and mechanism is the whole reason this arm is mechanical rather than a judgement call.

Corollary paid the same hour: for such an oracle, "green when rerun serialized" is NOT a flake discharge — it is exactly what a load-triggered REAL race looks like, because the oracle can only under-report under load. Doyle retracted a same-day tally discharge on this basis.

⭐⭐ **THE FOUNDING CASE BECAME THE ARM'S FIRST COUNTEREXAMPLE — same day (kept deliberately, not rewritten tidy).** Doyle's ruling-case enumeration above was WRONG: todlando re-read the failure body and refuted it from artifacts (doyle re-verified both grounds). (a) The "anchor" was NOT consumed — the child is `cat` under a real PTY, so one input line mints "FIRST\r\n" TWICE (line-discipline echo + writeback); `pump_until` returns on the first substring hit, i.e. MID-LINE-PAIR, and the delayed second copy is an innocent, load-gated live-stream source that lands in the window. (b) The leg couldn't true-red anyway: the test's OWN HEADER records that it passes with the discriminator disabled (Brain's exactly-once cursor drops re-sent ranges) — a non-regression guard, with the discriminating oracle in the unit matrix. The observed payload (7 bytes, ONE copy) fit the innocent source and could not fit a replayed batch (pair + history). **Sharpenings now part of the checks:** anchor check = the anchor must drain the WHOLE legitimate delivery (substring-hit returns mid-delivery; drain to quiescence or count occurrences); source enumeration = MUST include live-stream multi-copy shapes (PTY echo pairs, writebacks) — and read the test's own header for what the leg can actually detect before trusting it as an oracle. **The checks are mechanical but only as complete as the enumeration — a second reader on the enumeration is part of the mechanism, not a courtesy.** Decisive rig shape when contested: a REMOVED-CAUSE control arm (run the rig with the suspected trigger deleted; if the forbidden observable still arrives, the innocent source is proven by measurement, not argument). ⭐ MEASURED CLOSE (2026-07-23, todlando matrix): the control arm redded 93/120 loaded AND 12/13 SERIAL — exposing that the shipped leg's serial-green was itself an accident: an unrelated event pump (`read_outcome`'s discard arm) incidentally swallowed the innocent bytes pre-window. **Third sharpening: a green absence window is only as trustworthy as an ACCOUNTED-FOR drain path — if you cannot say WHAT consumed the innocent source on the green path, the green is a coincidence waiting for load to break it.**

Related: [[verdict-from-exit-not-from-silence]] · [[absence-needs-sibling-probe]] · [[ground-dont-assume-on-incidents]] · [[lead-with-the-defect-that-needs-no-box]]