metrics: close the zero-baseline carve-outs (#1384, #1327)

[aaylward]

Closes #1384. Closes #1327. Closes #1452.

Every metric series the golf_hub, microgpt-serve, portrait, and one_d4_worker rails emit now has a zero baseline from process start; the histogram carve-outs are closed by redesign, not by synthesized observations. No production RecordDistribution caller remains in the repo.

• golf_hub stream_rejections counts a bounded kind (rate_limited/invalid/state/rules/unavailable/unknown), all six declared; the free-text reason still reaches the rejected player and never a label. Refusal flows stage a Refusal{kind, reason} pair, and a storage outage on the join paths' refresh read counts unavailable, not state — pinned by a failing-store e2e test with healthy-store controls.
• golf_hub stream_commands/stream_events declare every union case; StreamSeriesMatchTheModelUnions parses golf_hub.smithy and fails on drift in either direction. The literal roster is provisional: the generated unions already hold this list (case_name()'s kNames), and a smithy-cpp accessor would let it derive.
• chat_catch_up_rows (histogram) → chat_catch_up_drains (counter): its _sum was numerically chat_rows_delivered_total already, so rows-per-drain becomes a ratio of two declared counters — empty drains in the denominator on purpose.
• microgpt-serve: both histograms replaced by microgpt_inference_ms (f64 counter, declared per endpoint). Mean duration = rate(inference_ms)/rate(requests); a tokens/sec-of-inference tile derives from the counters. Tests pin: no non-sum aggregation, no declared units (http_server_* instrument units aren't pinned across the three rails #1294 class), full label sets swept.
• one_d4_worker (metrics: remaining first-observation gaps in RecordDistribution consumers (portrait, one_d4_worker) #1452): index_run_duration_micros becomes a counter recorded 1:1 beside index_runs{outcome}, so mean run length is their ratio; the games-per-month histogram is deleted outright — its mean was already games_indexed_total over index_months_total{result=~"indexed|degraded"}, both declared. The custom histogram bucket plumbing goes with it.
• portrait (metrics: remaining first-observation gaps in RecordDistribution consumers (portrait, one_d4_worker) #1452): the two scene histograms become scene_spheres/scene_lights sums over a shared trace_scenes denominator, labelled by cache_hit and declared at zero — requested sums across the label, rendered selects the misses on both factors.
• prom_proxy: all six windowed means are counter ratios; mean Trends charts window by latencyWindow(step) like avg_duration_us (with a scaled form for the ms conversion); closed-set instrument audits close over every series-shaped token, so a typo'd ratio factor cannot pass on the other factor.
• metrics: leftover #1323 residuals after the zero-baseline sweep (#1324) #1327 item 1 closed with no residue: every test-suite recorder — second instances in hub_e2e/chat-race/store-race/pg, and golf_hub_wire_test (the raw-frame suite, where an unknown decoded command name would first appear) — is capturing and swept.
• The working agreement gains "CI is cheaper than model tokens" under Verification before pushing.

Findings the review panel established, worth a reviewer's eye:

• The microgpt avg_duration_ms tile had been dead since birth: the deleted histogram declared unit "ms", the collector folds units into the Prometheus name (http_server_* instrument units aren't pinned across the three rails #1294, pinned by server_pal), so the old _sum/_count queries matched nothing and the tile read a hard 0. The unit-less counter revives it — the number appearing after this deploy is the tile working for the first time, not a regression.
• tokens/sec changed statistic: ratio-of-totals (duration-weighted) rather than the old histogram's unweighted per-request mean. The old histogram was read by nothing.
• stream_rejections{kind="rate_limited"} intentionally tracks stream_rate_limited_total's total (split by kind vs by budget).

Deliberately not covered: the standard http_server_request_duration_microseconds histogram keeps its per-route gap fleet-wide — its buckets feed p95, which is the boundary of the rule ("a histogram whose buckets nobody reads is two counters wearing a first-observation gap"). The Go audits' name sets are a hand-kept copy of the emitters' rosters; cross-language pinning is #1308's scope (commented there). The per-suite Instance destructor sweep is four small copies because the four structs genuinely differ (listener detach, gated stores). Stored histogram series age out of the query windows after deploy; tiles read 0 in the interim exactly as before.

Verified: bazel test green across golf_hub, microgpt_serve, prom_proxy, futility, server_pal, one_d4_worker, portrait (Postgres-gated suites skip without GOLF_HUB_TEST_DB_URL — CI runs them). scripts/mutation-check: 17/17 killed across the three rounds (kind remaps, drain guard, roster entry, reason-into-label leak, declaration drops, dropped-prefix and descoped ratio factors, declared unit, month-result vocabulary). buildifier/clang-format/gofmt/rustfmt clean. CI green on every head.

Review panel: four read-only agents (correctness/control-flow, metrics-pipeline/PromQL, tests/docs/CI, altitude) ran against 55fc4a9, each refuting its own findings; the surviving findings are the commits after that head plus the #1308 comment.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QpobmVK83r7n2poHcaqjPR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	1d4-web	70a4ed3	Commit Preview URL Branch Preview URL	Aug 26 2026, 10:04 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	iili	70a4ed3	Commit Preview URL Branch Preview URL	Aug 26 2026, 10:04 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ast-lol	70a4ed3	Commit Preview URL Branch Preview URL	Aug 26 2026, 10:04 AM

[cursor]

Review (panel + Bugbot)

Four read-only lenses (correctness/control-flow, tests/docs/CI, altitude) plus Bugbot against 3d6dfaf9. Metrics/PromQL lens still finishing; will follow up if it surfaces anything.

Verdict: LGTM with one fold-in. The counter-ratio redesign correctly closes the histogram zero-baseline hole; RejectKind/unavailable vs state mapping, Refusal staging, declaration sweeps (#1327), and smithy roster pin all hold. CI green.

Surviving finding (1): TestOneD4QueriesNameRealInstrumentsAndScopeThem was updated for the #1452 counter-ratio means but did not get the promSeriesToken closed-set sweep that golf_hub and microgpt audits gained in this PR — a typo'd ratio numerator can still hide behind a matching denominator. Line comment below.

[cursor]

Metrics/PromQL lens finished: no surviving findings. (It noted the one_d4 promSeriesToken asymmetry as defense-in-depth only — same fold-in as the line comment above.)

Panel complete: Bugbot + four lenses; one verified fold-in, otherwise LGTM.

[cursor]

Recheck at 70a4ed3

Fold-in closed.

• 7ac6495 — one_d4 audit now runs the same promSeriesToken sweep; matches the gap we reported.
• 70a4ed3 — TestPortraitQueriesNameRealInstruments closes the wider hole the author found (portrait had no closed-set audit at all). Name set matches the live entry (cache family + scene counters); reverse close and cache_hit vocabulary pin look right.

CI green on the new head. No new findings. LGTM.