kind-isolation:law0-base: a neutral cell that grew over the base is red, whatever slack its [[law0]] row has

[MattJackson]

The class

The brief's hypothesis was a combined-budget skew: hits that fit in slack at PR-check time, but rise once the merge-group entries ahead have used that slack up. For the five DENYs it is refuted. The per-cell numbers come from each run's turnstile gate-kind-isolation.log, base and head.

PR	PR check (base 9c0a394, pre-#725 code)	MG (vs the entry ahead, #725 code)
622	busbar × auth 51→53, row 46: already over its row; figure 18→18 findings	busbar × auth 51→53, row 51: 11→13
680	loader export 32→33 (row 31), plane 47→49 (row 53, slack): 18→18	export 32→33, plane 47→49, both at their rows (47 after #725): 13→16
673	busbar × plane 822→824 (row 798), busbar × transport 208→207: 18→18	plane 824→826, transport 208→207 (drain, slack +1): 16→19
665	busbar-kernel × plane 1175→1174 (row 1193): 18→18	busbar-kernel × plane 1173→1172 (drain, slack +1): 19→20, then 17→18

• The PR checks were stale. They ran at 05:01–05:49Z, before kind-isolation:law0: the figure is hits off the ceilings; the ledger re-arms at the SHA the row went live on #725 landed at 07:44Z, with the old figure (the finding count). Every hit went into a cell already off its row, so the figure stayed at 18. That is busbar-release $ DEL-BUDGET-R: busbar-kernel-budget is deleted whole (replaces #151) #317's class, and the MG runs (created 14:07Z and 14:46Z) came before $ DEL-BUDGET-R: busbar-kernel-budget is deleted whole (replaces #151) #317 merged (15:14Z).
• Each MG rise is the PR's own hits. No slack was consumed by the entries ahead.
• Two of the rises are drains. kind-isolation:law0: the figure is hits off the ceilings; the ledger re-arms at the SHA the row went live on #725 counts slack as off its row: 673 lowered a cell by 1, and 665's second DENY is nothing but busbar-kernel × plane 1173→1172.

The slack skew is real on predev today, though. At 4f36b97, busbar-kernel × plane measures 1173 under a row of 1175.

• Two hits written there read 11→9 at the PR check: an "improvement".
• The same two hits behind an entry that filled that slack read as a rise.
• Separately, a drain in one cell over its row pays for a rise in another, and the figure stays flat.

A sum over cells cannot see one cell grow. So this is a gate fix, not a stale-check rule.

The fix: (a), judge per cell against the base

There is a new row, kind-isolation:law0-base, on both twins.

What it measures. The base the turnstile hands the gate (XTASK_CEILING_BASE): the merge-base for a PR check, the entry ahead for a merge-group entry. The base is laid back over the tree, with this tree's code measuring the base's bytes and the pinned checkouts mounted the same way.

What it reds. Any neutral cell that grew, whatever slack its row has. It is PASS on a base that grew nothing, so a grown cell is a new red in both places. It is never a figure that another cell can offset.

What covers a rise. Only a [[law0]] row that this branch raised over the base's own row: the approved delta a ruled move between axes writes. Slack the base already carried, and a row minted on this branch, cover nothing.

Why (a) and not (b). Option (b) would ratchet the ledger rows to the measure. #725 did exactly that, and its own message shows the rows going stale within hours as predev moved. (b) also cannot close the cross-cell offset unless the held-RED rows are raised to their measure. The spec (BUSBAR-1.6.0.md l.1995–2006) and #725 both forbid that ("this row does not raise to cover it").

So :law0, its figure, and every ceiling stay unchanged. No ceiling is raised.

RED arms (unit tests in matrix.rs)

• one_hit_into_slack_is_red_against_any_base:
  • The kind-isolation:law0: the figure is hits off the ceilings; the ledger re-arms at the SHA the row went live on #725 figure falls 3→2, so the hit is admitted today.
  • The new row is red, with the same figure against the slack base and against a filled one.
• a_drain_is_green_on_the_per_cell_row:
  • A drain is green on the new row, whether or not the row is given back.
  • When the row is given back, the :law0 figure does not rise.
• a_ruled_move_between_axes_is_unchanged:
  • Lowering one row and raising the other gives the same :law0 status, and the new row is PASS ("1 moved").
  • The same move with no raise written is red. A minted row covers nothing.
• a_drain_elsewhere_does_not_pay_for_a_rise: the :law0 figure is flat, and the new row is red.
• an_unreadable_base_is_red.
• Self-test case: a plane noun planted in busbar-core-oauth2 reds :law0-base, naming law0-grown.

Note

A drain that does not give its row back still raises the :law0 figure, by #725's design ("lower the row in the commit that drained it"). 665's 17→18 was that case.

Proof

busbar-release dev refused: the RUN_CAP budget is spent (4000/4000). So this ships once, and PR CI judges it.

This is a gate-code change, so every older PR check into predev goes stale. busbar-release #317 will UPDATE them.

[github-actions]

promote into predev: BOARD @b15ddb524: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base 027d9a56e: 0 new red, 0 worse, 5 standing (excused).

tests passed: 11426, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38084915651 . Artifact verdict-b15ddb524bbc38a1e6c2ff9231b30213f6fdf3c8 (failures.json, junit.xml, raw.log; 90 days).