FABLE OSI · GDBqFpKb (2026-07-06) · replayed & re-tested at current HEAD · 2026-07-09

Why authority never came back — and is Codex's fix the right one?

Codex's report (z_temp/GDBqFpKb_recovery_debug.html) diagnoses why the authority factor a stayed at 0.2 after the diagnostic gain returned to nominal, and proposes a "diagnostic gain edge" restore branch inside the authority law. This page re-derives its diagnosis from the raw record, replays the record through the current runtime, re-runs the 10-case suite fresh, and gives a verdict.

TLDR. Codex's diagnosis is correct — I reproduced it bit-for-bit. Two of its three fix layers (feasible-target clamp + blind probe-and-verify) are already committed at HEAD and do resolve the deadlock (recovery in ~21 s). Its headline proposal — wiring the test bench's gain signal into the production authority law — I would not adopt: same ~1 s restoration is available from the test harness side with zero production risk. And the fresh suite run exposes what its "no-regression" replay missed: the knob that was turned to make recovery fast (latch_decay_tau_s 200→1 on 07-03) broke the quiet-band defense (case 4, 51% violation). Restoring it to 120 s fixes case 4 while the blind probe still recovers this record.

0 · The signals, in one breath

b_osi: the published stability margin the law regulates — median of recent slow readings, hard-capped at 1/√2 ≈ 0.7071 by the chordal metric itself. NaN = no evidence right now.
b_st / b_res / b_fast: its ingredients: coherent-band (2–10 Hz) branch, quiet-band (30–80 Hz) residual branch (reads 0.7071 while disengaged), and the short-memory fast margin.
a (authority): the factor multiplying the displacement command; the law sheds it when b_osi < target and recovers it when evidence says healthy.
diagnostic gain: Results signal 21 — a test-bench knob that multiplies loop gain to emulate damage: 1 → 1.5 (50.2 s) → 2 (56.5 s) → 1 (75.469 s). The plant is genuinely healthy again after 75.469 s.

1 · What actually happened in the record

The test ran with target_outer_ncf = 0.8 and up_deadband = 0.10. When the gain hit 2×, the margin truly collapsed (0.27–0.40) — a burst trip at 64.402 s plus severe sheds took a to the 0.2 floor by 65.277 s. Correct behavior so far. The failure is what happens after the gain returns to 1 at 75.469 s:

Lock 1 — impossible arithmetic

Recovery requires the filtered margin ≥ target + up_deadband = 0.90. But the indicator is capped at 0.7071 by construction. No measurement could ever unlock recovery — the config asked for a margin that cannot exist.

Lock 2 — the evidence disappears

The margin does read healthy (at cap) from 77.777 s — 2.3 s after the gain return, the analysis-window flush; that delay is physics, not a bug. But the earthquake record ends right after: from 78.402 s the evidence gate blanks b_osi to NaN, and the law as of 07-06 had only one behavior for NaN: hold forever.

Either lock alone is fatal; this record had both. With a feasible threshold the healthy window was still only ~0.6–2.3 s long (and, in the production replay below, additionally blocked by the post-shed cooldown until 0.25 s after the gate blanked). So any real fix must handle Lock 2, not just Lock 1.

2 · Codex's solution, explained plainly

The report is dense, but its proposal is three separable layers:

A — decide against a feasible reference

Keep the requested target for reporting, but make authority decisions against b_ref = min(target, cap − up_deadband − 0.02), so the recovery threshold is always below the cap. Status: already committed — prepare_fable_runtime now clamps (with a warning), and the production config moved to target 0.55 / up_deadband 0.04 (threshold 0.59).

B — never fake the measurement

Leave b_st, b_res, b_fast, b_osi untouched: when evidence is gone, show NaN / WARMING, never synthesize a healthy 0.7071. Status: uncontroversial, matches the current design.

C — the actual proposal: a diagnostic-restore branch in the law

The test bench knows it flipped the gain back to nominal — that knowledge is external ground truth no measurement can match. So: feed the gain signal into the authority supervisor and add a small state machine:

1 · Arm on the edgegain returns to nominal (and diagnostic_restore_enable is on) → set restore_pending.

→

2 · Confirm 0.375 srequire 3 consecutive fast publications with no trip — a "nothing is on fire" check, not proof of health.

→

3 · Ramp 0.5 sraise a by 1.6/s (0.2→1 in four 0.125 s updates). Any trip or fresh deficit cancels within one update. Feature default-off.

Their fixed-record replay: full authority 0.81 s after the gain edge, zero false activations — versus 19.7–21.3 s for the committed blind fallback. They honestly flag that the 3-clean-fast check alone is weak (it also passes in 12 windows before the repair) — the safety rests entirely on the external edge. Status: proposal only — not implemented anywhere in the repo.

3 · Verifying it against the current runtime

I replayed the record's logged OSI tap (u_osi) and dm sample-by-sample through fable_osi_runtime at current HEAD. Fidelity check: the replayed margin matches the logged b_osi with median error 0 across all 30,720 published points (feeding dd instead errs by 0.37 — the runtime really consumes the force-echo-corrected tap). Then two configs, plus my candidate law on the same sequences:

Authority law / config	Recovery threshold	Blind (NaN) behavior	a ≥ 0.9 after gain return	Full authority
As run 07-06 (target 0.8, deadband 0.10) — logged	0.90 — above the 0.7071 cap	hold forever	never	never (a = 0.2 to end)
HEAD, clamp only (same overrides; clamp → target 0.587)	0.687 — feasible	hold forever	never	never — healthy window shorter than the 1 s hold gate
HEAD, production config (target 0.55; blind probe 5 s @ 0.06/s)	0.59	probe after 5 s	+21.4 s	+32.7 s
Candidate law (latch 120 s + healed-then-quiet probe; see §6)	0.59	probe after 1 s at 0.25/s when last evidence was healthy	+8.3 s	+11.3 s
Codex's proposal C (their fixed-record replay)	—	external gain edge + 3 fast checks + 0.5 s ramp	+0.81 s	+0.81 s

Two verified subtleties the clamp cannot fix. (i) In the production replay the margin sits at cap, valid, for 2.25 s (77.75–80.0 s) — yet the measured up-path never moves, because the preceding residual-path deficits re-arm the 2.5 s cooldown on every low update; it expires at 80.37 s, 0.25 s after the gate blanks. The healthy window is structurally wasted, and recovery rides entirely on the blind probe. (ii) The blind probe then stalls at a ≈ 0.98 for ~10 s: the latched ceiling decays only asymptotically to 1 while the commit gate waits for exact full authority — a small wart worth its own two-line fix.

4 · The ten cases, re-run fresh at HEAD

Codex replayed an archived suite result through a wrapper in which its feature can never activate — that check is true but vacuous (it says the default-off branch is default-off), and it admitted the archive predates HEAD. Running the real suite fresh (production config, target 0.55) gives 8/10 — and the two failures are not pre-existing noise; they are traceable regressions:

Config (all target 0.55)	Suite	Fails	GDB full recovery	Reading
Defaults as validated 07-02 (latch τ = 200 s, no blind probe)	10/10 (recorded then)	—	never (NaN = hold)	safe but cannot recover this record
HEAD defaults (latch τ = 1 s since 07-03)	8/10	4, 8	never (blind off by default)	caution lost, recovery still off
HEAD production override (latch τ = 1 s, blind 5 s)	8/10	4, 8	+32.7 s	recovers, but quiet-band defense broken
Production + latch τ = 120 s (stock law)	9/10	8	stalls (probe capped by the latch)	case 4 fixed — recovery sacrificed
Candidate law (latch 120 + healed-evidence release)	8/10	4, 8	+11.3 s	fast recovery — but re-breaks case 4

The real tension Codex's report never states. Case 4's damage lives where the command has no power: between residual-branch engagements the published margin reads healthy at cap. "Healthy readings, then quiet" after a genuine repair (this record) and "healthy readings, then quiet" with quiet-band damage still present (case 4) are observationally identical inside the law. Any rule that recovers fast on healthy-looking evidence re-probes known-bad territory in case 4 (my candidate: 51% violation); any rule cautious enough for case 4 is slow here (latch 120: stalls). That is the honest justification for using external ground truth in diagnostic tests — and simultaneously the reason it must not be a load-bearing production mechanism: real damage will not announce itself on a signal wire.

Case 8 (starts_damaged_improves) fails at HEAD in every config tried (regulation-quality criteria + recovery-time criterion trade off through the same latch knob); it passed on 07-02 and needs its own targeted look — it is a broadband case, where damage is coherently visible, so an observability-gated heal rule (§6.5) is a plausible fix for it, unlike case 4.

5 · Verdict on Codex's solution

What it gets right

· The diagnosis — both locks, exact timestamps, correct correction of its own first report (1/√2 is the metric's cap; 2.31 s measurement delay is physics).

· Layers A and B, which it (as an earlier session) had in fact already committed: the clamp guard, the feasible production config, the blind probe.

· Not resetting measurement branches; trips outrank restoration; feature-gated default-off; honest fine print about the weak fast-check and the vacuous harness.

Why I would not merge layer C

· Wrong side of the interface. It threads a test-bench signal through the Speedgoat model into a safety-critical, codegen, bitwise-equivalence-tested law — 3 new params + a state machine that is dead code in every real experiment.

· The confirmation is decorative. By its own count the 3-clean-fast condition also holds in 12 pre-repair windows; all safety hangs on one wire being correct.

· Validated with a replay that cannot fail. The no-regression evidence is an archive where the branch can't arm; meanwhile the fresh suite shows the surrounding recovery work already cost a real defense property (case 4).

· It solves a convenience problem with a permanent mechanism. 20 s of test-bench waiting does not justify production surface area.

6 · What I'd do instead

Do the fast diagnostic restore in the harness, not the law. The test script is the thing that knows the gain returned — let it act on its own knowledge: after commanding gain→nominal, watch the logged trip flag for ~0.5 s, then pulse the existing enable/pause path (osi_gain_enable_initial is already an ExportedGlobal) or re-initialize the OSI state so a restarts at a_init. Same ~1 s result as layer C, zero production code touched. This is Codex's idea, relocated to where the ground truth lives. (If a harness-side reset is truly impossible on the rig, layer C gated off-by-default is an acceptable second choice — its internal design is fine.)
Revert latch_decay_tau_s to ~120 s (defaults and main_ColumnSetup). The 200→1 change (smuggled into the 07-03 phase-lead commit) is what broke case 4: post-residual-shed caution is the only thing standing between the law and re-probing a hazard band it cannot see. Verified: stock law + τ=120 passes case 4 with 0% violation (9/10).
Keep the committed clamp + blind probe — they are the correct general fix for both locks. Verified here: production config recovers this record autonomously. Consider having prepare_fable_runtime error instead of warn on an unreachable target for physical runs — the warning scrolled by unnoticed on 07-06.
Fix the 0.98-stall wart. Snap the latch to a_max once it is within min_step/2 (or let the commit gate accept a_max − a_cont < min_step). Two lines; removes ~10 s of pointless creep at the top of every blind recovery.
Law-level fast recovery, if wanted, must be observability-gated — and validated against new suite cases. My tested "healed-then-quiet" probe (remember the last valid margins; if ≥ threshold for 3 hops, probe after 1 s at the model-verified rate) cuts this record to +11.3 s — but re-breaks case 4, because it trusts healthy-at-cap readings that quiet-band damage also produces. The viable refinement is Codex's own "future extension" sharpened: release caution fast only when the band that produced the shed is coherently observable now (st-binding provenance / a symmetric heal_reason from the fast FRF statistic), and add the missing suite cases first — a residual-only damage case that truly forces res_on, and a healed-then-quiet case shaped like this record. Until that exists, blind-probe patience is the price of quiet-band safety.

Evidence: saved_results/tests/tsting_osi/GDBqFpKb.mat (run 2026-07-06 17:32:58, pre-fix runtime) · bitwise replay via fable_osi_runtime at HEAD 4f5a07f (median |Δb_osi| = 0, n = 30720) · fresh fable_synthetic_suite runs (production config, τ=120 variant, candidate law) on 2026-07-09 via MATLAB · candidate law and analysis scripts alongside this report in z_temp (fable_recovery_analysis.m, fable_cand_run.m, fable_auth_cand.m) · Codex artifacts: z_temp/GDBqFpKb_recovery_debug.html, offline_replay_subagent_metrics.json, diagnostic_restore_validation.json. Replays are fixed-record counterfactuals (the replayed authority never acted on the plant); suite runs are closed-loop.