RT 2026-08-03 - area 10 - opus (Opus 5) - yield 8

[ms609-agent]

opus (Opus 5) | effort: unrecorded | 2026-08-03

Migrated record. This round predates the move to Discussions; it is reproduced
verbatim below from dev/red-team/log.md, which is now closed to new entries. It is
posted here so this area has a round record whose createdAt orders correctly against
the other areas' — the backfill ran oldest-first for that reason. All fourteen posting
timestamps are later than the rounds they describe; the real date is in the title and
in the date: field.

---

area: 10 (Alternative scoring kernels: Profile/IW/HSJ/XFORM) -- ESCALATED OUT OF ROTATION on the 2026-07-28 high-severity signal
reviewed_by: opus finder a56b5789 + opus verifier a4880a32 (high-sev pair) + opus verifier a0e2802b (medium batch) + haiku verifier a7d86000 (4 low-sev) + orchestrator duplication check
date: 2026-08-03
tier: opus (Opus 5)
yield: 8 filed (T-392/393/394 P1, T-395/396 P2, T-397/398/399 P3) + 1 EXISTING ROW REOPENED (T-377) + 2 fixed inline, from 12 candidates; 2 refuted (A10-16, A10-17), 1 folded into T-377 rather than given a new ID
notes: Rotation pointed at area 11, but the 2026-07-28 round closed with "HIGH-SEVERITY SIGNAL -> area 10 escalates next round regardless of rotation", so area 10 ran and last_focus is deliberately left at 10 so area 11 is still next -- an out-of-rotation escalation must not consume a rotation slot (cf. RT12-01, the stale-pointer defect). Legend reconciled at round start: opus -> Opus 5 since 2026-07-27, unchanged, so no version-bump re-eligibility fired. Seam was still yielding emphatically (4 P1s last round) -> stayed at opus with a fresh agent, per the yielding-seam rule.

THE BRIEF DELIBERATELY DID NOT CHASE THE SIGNAL AS WRITTEN, AND THAT WAS RIGHT. All three sub-questions of the 2026-07-28 signal were explicitly not finder questions: (1) whether a rooted objective is intended for XFORM is a user design decision (raised with the user, still open); (2) the HSJ half was already settled from the paper that same round; (3) the TBR-coherence question needed an experiment, not a review. So the brief re-aimed at the two things a finder could actually move: ts_sankoff.*, which the previous round's own closing note flagged as having had "materially less attention" and which was unchanged while everything around it churned; and the +360-line HSJ fix stack that landed since (7 commits, 52a417cb..1da16f51, plus 0856748f), reviewed as new code rather than as settled fixes. Both halves paid, and the prior round's transferable rule held again: unchanged-and-unread beat changed-and-reviewed. But note the twist -- the biggest finding is in neither file. It is in ts_tbr.cpp, i.e. in the consumers of the criterion, which is where the finder says the live seam has now moved.

THE HEADLINE: MaximizeParsimony(inapplicable = "hsj" | "xform") can return a tree strictly WORSE than one it already held, on the shipped default path. T-392 -- try_root_edge_moves (ts_tbr.cpp:709-817) picks the reconnection minimising the Fitch join, applies it, and does best_score = actual; return true with no comparison against the pre-move score and no restore, so tbr_search is non-monotone. Observed directly, not reasoned: a scratch REprintf at :802 caught HSJ going 252 -> 253 and XFORM strictly worse in 6 of 10 firings, delta up to +5. For pure EW the additive identity forces improvement, which is why this never bit before. The finder's reachability route was wrong and the verifier replaced it with a stronger one -- strategy is not a formal of MaximizeParsimony, but .AutoRung() (R/MaximizeParsimony.R:501) returns rung 1 = sprint for every dataset of <=30 taxa and sprint sets tabuSize = 0L, so do_reroot is live at the main whole-tree TBR by default, no user opt-in. The finder's fuse-cleanup route was unconfirmed (0 firings at 40 tips). Symptom is lost reach, not a wrong report (attr(result, "score") matched TreeLength() every time; 8-tip oracle recovered 12/12).

THE FIX CHOICE IS A REAL TRADE-OFF, MEASURED BOTH WAYS -- do not let a future round assume the obvious gate is free. The finder's ScoringMode::EW gate is correct and complete (PROFILE already excluded via ds.concavity = 1.0, ts_data.cpp:478, verified in source not assumed) but costs 2.7x/2.9x wall. A guard-only variant (snapshot, restore-and-return-false when actual >= s0) removes the non-monotonicity at wall parity and is byte-identical for EW -- but buys no reach (p=1.0 / p=0.51). The gate's reach gain is real but not wall-matched (fixed maxReplicates, so its arm consumed ~2.8x the wall), so per [[completeness-secondary-to-wallclock]] and [[budget-regime-equal-wall-valid]] it is unproven, and the gain traces to exact root-edge enumeration -- i.e. to fixing T-377 at the root edge -- not to refusing the bad move.

T-377 REOPENED RATHER THAN RE-FILED, AND THIS IS THE ROUND'S PROCESS RESULT. Candidate A10-07 was a rediscovery of T-377 (hierarchy-blind TBR scan), a row marked "MEASURED, CLOSED (no adopted fix)" on 2026-07-29. I nearly filed it as a new ID; the duplication grep caught it. The row's own closing caveat had named its reopening condition -- "sampled on two small (7-8 tip) matrices only; a much larger/sparser hierarchy-heavy matrix ... would be the thread to reopen if this resurfaces" -- and the verifier's measurement fires it exactly: at 25 tips / 60 characters, returned HSJ trees are not even SPR-local optima under the accept-time objective (3/5 seeds total_words > 0, 2/5 all-hierarchy) against an EW control at 0/5 on the same matrix, while the 8-tip enumeration oracle still reached the optimum 12/12. So the 2026-07-29 close was correct at the size it was measured and is superseded at realistic size, not contradicted -- record it that way, because a future round that reads the old verdict as simply wrong will distrust a sound measurement. Lesson: a closed row that documents its own reopening condition is worth far more than a deleted one; the condition is what let a later round recognise the fire. Augmented in place; do not close again without a measurement at >=25 tips.

FOUR MORE CONFIRMED, TWO OF THEM DEMONSTRATED IN PURE R BEFORE ANY BUILD. T-393: RecodeHierarchy derives a secondary's state space from observed token strings (R/recode_hierarchy.R:103-106), so "{01}" becomes a novel third state at Hamming 1 from both "0" and "1" -- TreeLength(xform) = 6 where every concrete resolution gives 5 and HSJ gives 5, on data MatrixToPhyDat accepts and ValidateHierarchy passes; four such cells trip an 82 states (> 32) warning where the truth is 17. T-394: the same line can admit no levels, making the whole XFORM score Inf -- reachable by taxon-subsetting valid input (ValidateHierarchy runs before both subset sites), and the consequence was corrected upward during verification: MaximizeParsimony does not silently return Inf, it aborts at R/MaximizeParsimony.R:1717 because diff(range(c(Inf, Inf))) is NaN -- which will fire for any all-Inf pool and is worth fixing in the same patch. T-395: ValidateHierarchy rejects every nested hierarchy, so the documented roxygen example is unusable while R CMD check stays green (the constructor never validates, so the example constructs and is never scored) -- and verification found an independent second dead route, HierarchyFromNames's intersect(subIdx, supIdx) being provably empty, so fixing only the validator would leave nesting silently flattened. T-396: HSJ over-charges a "-" secondary by alpha/m wherever the primary is not certainly absent -- but the present-primary half is test-frozen at tests/testthat/test-ts-hsj.R:857 (expect_equal(..., c(0, 1, 1, 0)), with :837-838 rationalising it) in direct contradiction to the kernel's own comment at ts_hsj.cpp:135-145, so the tree holds two contradictory specifications and any fix breaks a shipped test. That is a maintainer adjudication, not a fixer's call, and is why it sits at P2.

THE RCPP BOUNDS-CHECKING PREMISE DECIDED A VERDICT FOR THE THIRD TIME -- treat it as settled and stop re-litigating it. Routing note first: A10-12 was deliberately withheld from haiku because a haiku verifier got this exact factual question wrong twice on 2026-07-28. The opus verifier confirmed in the installed headers: Rcpp/vector/Matrix.h:174 is the only offset overload (i + static_cast<R_xlen_t>(nrows) * j, no validation), and operator() -> Vector::operator[] -> cache.ref(i) -> check_index (Rcpp/vector/traits.h:55-61) warns and then reads anyway -- never errors, never checks negatives, and cannot see a linear index landing inside the vector at the wrong element. Empirically, a mis-shaped-but-same-length matrix reads garbage with no warning at all. That is T-397: unpack_xform never received the guards 0856748f added to ts_sankoff_test (T-380), so a 1x9 matrix makes the test binding error cleanly while the production bridge silently scores 8. Filing it is what stops T-380 reading as closed while half its class is open. One correction worse than the claim: an out-of-range tip_states yields the 1e18 pool sentinel, not Inf -- so it passes is.finite(), defeating the standard guard for this corruption class.

T-398 IS A PRIOR ROUND'S HYPOTHETICAL, NOW LIVE -- AND IT DID NOT NEED THE TRIGGER THAT ROUND PREDICTED. The 2026-07-28 round cleared an isfinite(concavity)/scoring_mode mismatch as unreachable from the public API but wrote: "R/ts-driven-compat.R builds the same configs without those guards -- check it if that wrapper is ever widened or promoted." It never was. unpack_hsj (ts_rcpp.cpp:1836-1864) sets scoring_mode = HSJ unconditionally but tip_labels only inside a branch that list(hsjTipLabels = NULL) skips (the name is present, so containsElementNamed passes while Rf_isNull short-circuits) -- segfault, exit 139, reproduced by two routes including the wrapper's own default signature. Held P3 only because every current caller happens to supply the argument. Process lesson: a conditional carry-forward ("check it IF ...") is weaker than it looks -- the condition was never met and the bug was live anyway. Prefer an unconditional queue entry.

FIXED INLINE (2). (a) src/ts_rcpp.cpp:2001-2006 -- the T-373 annealing warning claimed "The rest of the search (NNI, SPR, TBR, ratchet, drift) still runs and remains exact"; verified against the code's own comments that drift's incremental phase (ts_drift.cpp:381) and the ratchet's Fitch-block reweighting (ts_ratchet.cpp:148) are both inert at total_words == 0, so two of the five named phases reduce to repeated TBR. "Remains exact" was true, "still runs" was not; text now says which steps go inert and why. (b) R/CharacterHierarchy.R:124-127 -- removed a dead leafDeps local in print.CharacterHierarchy (computed, never used; grep confirms no reference anywhere in R/ or tests/). A10-15 was not filed: verified REAL but a misleading-comment-only defect, which is the inline-fix category, not the filing category.

REFUTED (2), both by the haiku batch and both correctly. A10-16 (build_canon_order's link lacks a negative-index guard, ts_hsj.cpp:68-71): the code fact is true but v == -1 requires a malformed TreeState, and the later DFS filters negatives anyway. A10-17 (ts_sankoff_test re-derives n_tip and silently drops a third child): unreachable because init_from_edge (ts_tree.cpp:11-34) carries the identical assumption and runs first on both TreeLength xform paths, so the Fitch bridge trips before the Sankoff one -- the finder had already hedged this itself, and the hedge was right. Note the asymmetry in routing that made this safe: these two were genuinely low-severity latent-reachability questions, which is what haiku is for; the Rcpp-premise claim in the same size class was routed to opus precisely because its verdict hinged on a library fact, not on severity.

TRAPS FOR THE NEXT ROUND -- two of these cost a verifier a wasted experiment. (1) strategy = "..." has no effect on MaximizeParsimony on cpp-search. It is not a formal; it falls into ..., is not on the .morphyParams hard-reject list, and draws only a generic "Unknown arguments ignored" warning (R/MaximizeParsimony.R:1091). The verifier's first sprint-vs-default arms were byte-identical for this reason. It warns rather than failing silently, so it is NOT a finding -- I checked before filing -- but any A/B that sets strategy= is comparing a preset against itself. Presets are now selected by effort through .AutoRung(). (2) Do not hand-build the weight vector for TreeSearch:::ts_hsj_score -- use .NonHierarchyWeights(). Skipping it fabricates a 3-step "rooting dependence", because a "-"-bearing pattern left at weight 1 lands in a BGS Fitch block; TreeLength(..., inapplicable = "hsj") is in fact rooting-invariant (spread 0 over 8 rootings x 12 topologies), consistent with PR ms609#281. (3) The 1e18 pool sentinel passes is.finite() -- see T-397.

REASONED GREENS -- documented so the next round need not pay to re-trace them. These are arguments, not budget exhaustion; where a green is only call-site-deep I say so. (1) The Sankoff cost-matrix orientation is correct on the asymmetric matrix -- the single most likely P1 on ts_sankoff.* and it is clean: R writes cm[from, to] (R/recode_hierarchy.R:136-143), unpack_xform copies row-major with row = from, and sankoff_score_char sets cm_row = base + s*ns with s the parent, indexing cm_row[t] with t the child -- cost[ancestor][descendant], no transposition, and the uppass uses the same orientation. (2) The Sankoff backtrace is a correct MPR (standard argmin(cm[parent][s] + downpass[child][s]); n_internal <= 0 guarded at both entry points since last round's inline fix). (3) The clip-level dominated screen is SOUND for HSJ/XFORM -- distinct from T-377's charge: best_candidate is the min Fitch-only length and the hierarchy term is non-negative, so no clip is wrongly skipped; the defect is incompleteness, not unsoundness. (4) exact_verify_sweep is exact for HSJ/XFORM (ev_incr_ok excludes them, ts_tbr.cpp:969-972), which is why has_na == true escapes T-392 -- a built-in A/B control. (5) T-330 is complete at both collapse kernels. (6) Sector and prune-reinsert are gated at entry, so no HSJ-labelled reduced dataset with empty hierarchy fields is ever built. (7) The a(n)/p(n) DP is rooting-invariant, but its proof depends on alpha <= 2 -- the degree-2 kernel root is transparent to the secondary labelling, so d(P,r) + d(r,C) == d(P,C); both public paths enforce alpha in [0,1]. The comment at ts_hsj.cpp:33-36 is correct but does not state this dependence -- worth adding if hsj_alpha's range is ever widened. (8) .NonHierarchyWeights cannot double-subtract or go negative, and ew_offset is built from the adjusted weights. (9) token_states is populated on every path reaching the kernel, and e2d3e0b1's translation is applied at all three comparison sites (grepped for residual raw-token comparisons: none). (10) All six T-373 bails present, and topology_independent() cannot mis-fire -- it requires total_words == 0 and empty hierarchy_blocks and sankoff_n_chars == 0, so an HSJ-configured dataset with empty blocks still bails and cannot spin. (11) Clipped-subtree homoplasy is restored in the IW/profile screen (add_clip_internal_steps); checked at call-site/gating level only, not re-derived from first principles. (12) RecodeHierarchy's primary handling is safe (ambiguous primaries rejected upstream) -- flip side: HSJ could handle a {01} primary but is blocked from it, a usability item. (13) hsj-paper-oracle.R check [3] is not a vacuous green in aggregate -- its data-dependence is already declared in a NOTE at :195-200 and the discriminating cases are routed to [3b] (mixed present/absent blocks, "?" primaries, multistate secondaries, all 2n-3 rootings). Gaps in [3b] worth oracle checks: m == 1, "?" in a secondary at a present primary, ambiguity codes in a secondary, and "-" in a secondary at a "?" primary (= T-396).

NOT REACHED -- named explicitly so none becomes a phantom. (i) The finder built nothing; every C++ candidate was a reading, and the two demonstrated ones (T-393, T-395) were pure R. All builds this round were the verifiers'. (ii) The Profile/IW static residuals were not re-derived -- the brief listed them CLEARED on 2026-07-28 and the finder took that at face value rather than spending budget; that half of the area remains as mature as its two dry rounds found it. (iii) ts_parallel.cpp's per-worker ds_local copy was not checked for carrying hierarchy_blocks/tip_labels/sankoff_* (plain DataSet members, so a copy-construct should, but unread). (iv) R/Resample.R:33's xform path, .HierarchicalResampleWeights, ts_successive_approx, ts_resample_search and ts_parallel_resample were not checked for HSJ/XFORM gating. (v) The XFORM MPT-set residue on T-374 (pool membership selected at R/MaximizeParsimony.R:1618 on scores taken at differing rootings) was deliberately out of scope and is still open. (vi) One unfiled true code fact, recorded here rather than as a row: ds_fingerprint (ts_tbr.cpp:870-875) hashes only n_tips, n_blocks and tip_states, not the hierarchy/Sankoff fields, and weight_fingerprint mixes scoring_mode but not the hierarchy config -- so two datasets differing only in hierarchy collide in evs_false_cache. Unreachable today because the config cannot change mid-search; becomes real the moment anything swaps a hierarchy in place. (vii) Open proof obligation the finder could not discharge: whether the two-stage objective (Fitch-label the secondaries, then run the a/p DP on fixed labels) can be strictly above the paper's joint minimum. It proved the labelling is a valid MPR and could not construct a witness at alpha <= 1 (every route needs >=2 primary changes, which the DP will not buy), but did not prove tightness. Obligation: "for alpha <= 1, no non-Fitch-minimal secondary labelling lowers the present-region-restricted mismatch sum."

HIGH-SEVERITY SIGNAL -> area 10 escalates again next round, but NOT as another finder round. The T-392/T-377 pair says something larger than either row: HSJ/XFORM search hill-climbs on the Fitch residue and uses the hierarchy/Sankoff term only as an accept filter, and at each convergence may take one root-edge move chosen on Fitch alone that raises the objective with no restore. On an all-hierarchy matrix -- the motivating case for both criteria -- the Fitch residue is constant, so guidance is nil and the per-clip choice reduces to scan order. The reach cost is now measured at 25 tips but the fix shape is undecided, and it is a design question (top-k rescore vs exact scan vs hierarchy-aware incremental screen, the last of which T-306 argued has no cheap form). Next area-10 visit should be an experiment, not a finder: a wall-matched A/B of the candidate fix shapes on a >=25-tip hierarchy-heavy matrix, Hamilton-class (cf. the area-13 precedent where the right next step was a bounded harness, not another finder). Seam status: STILL YIELDING -- but the live seam has moved out of the kernels and into the consumers (ts_tbr.cpp's scan/accept/reroot machinery under a non-Fitch objective, and the R-side recoding in R/recode_hierarchy.R / R/CharacterHierarchy.R, which had never been in this area's scope row and produced three findings).

Provenance / hygiene. Finder and all three verifiers worked at bbab0f7c; HEAD did not move during the round (re-checked at close). Verifier builds were tarball-into-private-library from isolated temp dirs; the high-sev verifier used a worktree at ../worktrees/TreeSearch/rt-a10-verify and removed it. Per [[concurrent-session-git-hazard]] only named files were staged. The one working-tree change at dispatch was this round's own inline fix (b), which the two later verifiers were told to leave alone and did.

---