core/docs/analysis/cmb-lookback-review-2026-06-08.md

CMB lookback review (CMB-a/b/c) — before CMB-d router wiring

As of: main @ 84d3456e (CMB-a #650 · CMB-b #653 · CMB-c #654 all merged). Trigger: the mandatory lookback before wiring a multi-rung substrate into shared infrastructure (CLAUDE.md Lookback Review Discipline — "before starting the next phase of a multi-phase ADR" and "after any 3+ PR sequence on the same surface"). CMB-d wires CMB into the shared route_setup + contemplation + failure-family registry, where any latent CMB-c classification mistake stops being local.

Method. A 5-dimension read-only fan-out audit (one agent per dimension, each reading the source and running live probes) over a 10-item checklist, plus a synthesis pass. 38 findings: 25 solid / 4 drift / 8 gap / 1 reader hazard (+ several CMB-d preconditions that are wiring, not CMB-c bugs).

Verdict: ready for CMB-d once (a) the one reader hazard is fixed [done in this PR] and (b) the registry preconditions below land in the CMB-d PR itself.

---

Provenance note (a false alarm, resolved)

The synthesis pass raised a "live main is CMB-a only; reader/solver are unmerged" alarm. This is a stale-local-checkout artifact, not a real finding. Merges land server-side via gh; the local main checkout was never pulled, so the synthesis agent's git saw an old tree. Verified: git cat-file -e origin/main:generate/combined_rate_comprehension/reader.py → present at 84d3456e; solver.py likewise. The per-dimension audit agents read the worktree (= the merged code) and their findings stand. Discount the provenance hazard.

---

Hazard (1) — fixed in this PR

H3 · single-agent-attribution over-claims combine_mode_ambiguous. Two same-unit rates with a query that attributes the answer to one agent — "Alice types 5 words per minute and Bob types 3 words per minute. How many words does Alice type in 3 minutes?" — is a single-rate question with a distractor rate, not a combined query. The reader claimed the substantive combine_mode_ambiguous; on the shared router (CMB-d) that is a substantive-refusal-on-foreign-text = a hygiene breach.

Fix (this PR): the combined-query gate now excludes a single-agent does <Agent> attribution (_SINGLE_AGENT_QUERY), so single-agent text steps aside as not_combined_rate_shaped. The genuinely-combined forms (… do they …, … are produced, does it) still yield combine_mode_ambiguous. Pinned by gold fixture cmb-16 + test_single_agent_attribution_steps_aside.

A reader that steps aside on ambiguity is safe (wrong=0 preserved); only over-reads to a wrong answer or substantive-refusals-on-foreign-text are hazards. H3 was the only one. The comparison-query, sequential-duration, decimal-rate, incidental-drain, and reciprocal step-asides are all correctly handled (confirmed) and are not hazards.

---

Solid (the substrate that holds)

• Division of labor (model/reader/solver). The reader parses every solver-boundary setup (eff ≤ 0, non-integer) and never intercepts a solver-owned refusal — non_positive_net_rate and non_integer_solution appear nowhere in reader.py. The model permits effective_rate ≤ 0 by construction; the solver owns it. run_reader 11/0/0 + (now) 8 refused-correct; run_solver 6/0 + 5/0. No reader-owned malformed setup reaches the solver (the unit-mismatch guard fires before RateUnit construction; the model has one unit slot).
• 2×2 domain-entry grid. All four cells correct; every substantive refusal is gated behind positive CMB-shaped evidence (the N6 over-proposing invariant) — three_or_more_rates / rate_unit_mismatch only after a cue; combine_mode_ambiguous only with a same-unit combined query; missing_second_rate only with a cooperative cue + two conjoined agents.
• Foreign-organ hygiene. 0 substantive refusals across all 36 R1/R2/R3 gold (every foreign fixture → not_combined_rate_shaped), and across fresh foreign probes (comparison questions, R1 arithmetic, R2 prose, R3 single-rate with incidental cue words).
• Reader correctness (the 3 adversarial-round classes hold). Difference subtraction is semantic-role based (fill = minuend, drain = subtrahend) not text-order; sequential segments step aside (incl. loose connectors); decimals don't partial-parse.
• Off-serving. No CMB file imports generate.derivation / core.reliability_gate (AST-checked).
• Cross-rung composition. The reader's setups round-trip through the oracle's combined_rate_setup_signature; the solver consumes exactly the reader's output type; the closed taxonomies are consistent across model/reader/solver/oracle.

Drift / gaps (no current wrong=0 risk; most are CMB-d's to resolve)

• empty refusal (blank input) is not in the oracle READER_REASONS — unreachable from prose routing; add only if a blank-input gold case is ever introduced.
• _AGENT_CONJ matches any word and word bigram (not just proper-noun pairs); _LEADIN = 25 is an undocumented bound. Both are conservative (a miss → safe step-aside), not hazards.
• The remaining items are CMB-d preconditions (below), not CMB-c defects.

---

CMB-d failure-family classification (the decision)

The load-bearing output. Reasons map to families as:

Family bucket	Reasons	Rationale
input_shape (no proposal)	not_combined_rate_shaped	the step-aside reason — the router-hygiene gate requires it be mapped, or every CMB foreign refusal fails the invariant
must_remain_refused (no proposal)	rate_unit_mismatch*, three_or_more_rates, clock_interval_deferred, reciprocal_work_rate_deferred, non_positive_net_rate (solver), non_integer_solution (solver)	correct wrong=0 boundaries / deferred-capability boundaries, not coverage gaps
proposal_allowed	combine_mode_ambiguous, missing_second_rate	genuine, semantically-coherent coverage gaps — fired only after positive CMB recognition, and before the solver, so neither can emit a wrong answer

* rate_unit_mismatch stays must_remain_refused for v1 — decisively. It fires for two structurally different sub-cases under one code: (A) dimensionally-incompatible units (rooms/hour vs liters/minute — no conversion exists) and (B) a duration-unit ≠ rate-denominator case. The reader has no dimension representation (units.py compares only (numerator, denominator) string equality) and cannot distinguish convertible (gallons/min vs gallons/hour) from incompatible. Marking it proposal_allowed would emit a "try conversion" proposal for the incompatible case = a wrong=0 hazard if ratified. Do not introduce a narrower rate_unit_mismatch_convertible family until the reader gains a dimension registry and the two sub-cases fire under distinct codes and a separate conversion gold lane exists.

Note on missing_second_rate: it is must_remain_refused-by-default and proposal_allowed in the sense above — it is an under-specified-input boundary (no reader enhancement can infer the missing rate), distinct in kind from the math-impossibility boundaries. The proposal it licenses is "what is the second agent's rate?", not a rule-learning proposal.

---

CMB-d risk list (preconditions, to land in the CMB-d PR itself)

These are live registry facts verified against main; each must be handled in the same PR that adds classify_cmb to route_setup:

1. not_combined_rate_shaped is unmapped in failure_family.py (family_for_reason → None). The moment CMB joins test_router_organ_hygiene.py, every CMB foreign refusal fails the "must map to input_shape" assertion. → add it to the input_shape family's refusal_reasons.
2. Shared rate_unit_mismatch string collision. R3 emits the same string → maps to R3's unsupported_rate_duration growth family (proposal_allowed, owner=r3). A CMB unit-mismatch (a hard boundary) would be mis-routed to a wrong-type R3 proposal. → CMB must emit a distinct string (e.g. cmb_rate_unit_mismatch) and register it must_remain_refused.
3. non_positive_net_rate is unmapped → ContemplationResult.family silently None on a CMB solver refusal. → add a cmb_non_positive_net family (must_remain_refused).
4. non_integer_solution owner mislabel. The CMB solver shares R2's string → family owner=r2. → emit a CMB-distinct string or extend the owner to credit CMB.
5. Organ Literal + ALL_REASONS lack CMB. → add r4_combined_rate (name TBD) to the Organ Literal and extend ALL_REASONS with every CMB reader+solver reason, or test_registry_covers_the_whole_refusal_surface won't catch an unregistered CMB reason.
6. Off-serving assertion. Add the per-module AST off-serving test for classify_cmb (substring scans false-negative on docstring mentions).
7. Exactly-one-setup_correct contract. Re-confirm route_setup still selects a unique organ when CMB joins — CMB must not make any R1/R2/R3 problem ambiguous, nor claim one (the hygiene audit shows it steps aside on all R1/R2/R3 gold, which protects this).

CMB-d's claim stays narrow: "CMB participates in routing + typed contemplation without corrupting R1/R2/R3 or serving." No new capability (that was CMB-c).

---

Net

The CMB-a/b/c substrate composes cleanly. One real reader hazard (H3) is fixed here with a ruler fixture + test. The remaining items are CMB-d wiring preconditions, now enumerated with the family classification resolved. Lane state after this PR: gold 19/19 (6/5/8), reader 11/0/0 + 8 refused-correct, solver 6/0 + 5/0, 0 hygiene breaches, serving + R1/R2/R3 unchanged.