feat(plan-selection)!: let the deployment's accuracy model decide outputs without a guarantee

- Move AccuracyEvidenceProvider and NoAccuracyEvidence to
  asap_plan_selection::accuracy, next to AccuracyModel; OperandDomain and
  PropagationStats stay in Stage 1.
- Rename DefaultAccuracyModel to BuiltinAccuracyModel. AccuracyModel::propagate
  gets a default body (the built-in rules), so a deployment model implements
  only satisfies.
- Add AccuracyModel::accepts_output_without_guarantee (default false). Stage 3
  asks it only when neither Stage 1 nor the evidence supplies a guarantee;
  an output it accepts is recorded with AcceptedAccuracy::accepted_without_guarantee,
  and one it does not is rejected with the new RejectionCause::NoAccuracyGuarantee
  (was AccuracyTargetMissed).
- Document accuracy::estimators::local_guarantee and
  accuracy::composition::propagate, and drop their duplicate re-exports.
- stage_pipeline writes accepted_without_guarantee; the dag-viewer accepts
  the new cause; the example fixture is regenerated.

BREAKING CHANGE: AccuracyEvidenceProvider/NoAccuracyEvidence move to
asap_plan_selection; DefaultAccuracyModel is now BuiltinAccuracyModel; a
candidate whose output has no guarantee is rejected as no_accuracy_guarantee
instead of accuracy_target_missed; AcceptedAccuracy gains a field.

Author: zzylol

crates/devtools/src/bin/stage_pipeline.rs

@@ -31,10 +31,12 @@
 //   - stage3_plan_selection: the selected candidate, chosen among all candidates;
 //     the shown candidates' costs and accepted accuracy (per query: the
 //     target's metric or null when not set, the accepted guarantee's
-//     metric or null when exact, the sketches read and a one-line
+//     metric or null when exact or accepted without a guarantee, whether
+//     the deployment's accuracy model accepted it without a guarantee
+//     (`accepted_without_guarantee`), the sketches read and a one-line
 //     summary), and every other shown candidate under `rejected` with
 //     its `cause`: a failed check (`failure_probability_resize_failed`,
-//     `accuracy_target_missed`, `raw_data_not_retained`,
+//     `accuracy_target_missed`, `no_accuracy_guarantee`, `raw_data_not_retained`,
 //     `latency_bound_exceeded`, `over_cluster_capacity`) or a loss under
 //     the cost model (`costlier`, `slower`, `more_memory`,
 //     `not_lowest_latency_on_pareto_front`, `dominated`,
@@ -617,6 +619,7 @@ fn plan_selection_json(
                     json!({
                         "target_metric": accepted.target_metric,
                         "accepted_metric": accepted.accepted_metric,
+                        "accepted_without_guarantee": accepted.accepted_without_guarantee,
                         "sketches": accepted.sketches,
                         "summary": accepted.to_string(),
                     })

crates/frontend-promql/tests/univmon_candidates.rs

@@ -1,6 +1,7 @@
 use std::rc::Rc;
 
-use asap_logical_asap_optimization::accuracy::{local_guarantee, satisfies};
+use asap_logical_asap_optimization::accuracy::estimators::local_guarantee;
+use asap_logical_asap_optimization::accuracy::satisfies;
 mod support;
 use asap_types::ir::cse::share_common_sub_dags;
 use asap_types::ir::properties::AccuracyMetric;

crates/integration-tests/tests/promql_to_post_asap.rs

@@ -11,8 +11,9 @@ use std::rc::Rc;
 use asap_integration_tests::fixtures::lower_promql;
 use asap_integration_tests::planning::logical_candidates;
 use asap_integration_tests::post_asap::{at_ingestion, at_ingestion_post_asap_dag, post_asap_dag};
-use asap_logical_asap_optimization::accuracy::{AccuracyEvidenceProvider, OperandDomain};
+use asap_logical_asap_optimization::accuracy::OperandDomain;
 use asap_physical_asap_optimization::PhysicalCandidate;
+use asap_plan_selection::AccuracyEvidenceProvider;
 use asap_plan_selection::PlanningModels;
 use asap_plan_selection::Selection;
 use asap_types::ir::operator::operator_properties::Reduction;

crates/logical-asap-optimization/src/accuracy/composition.rs

@@ -694,6 +694,12 @@ fn composed_provenance(
     provenance
 }
 
+/// The built-in composition rule: `inputs`' guarantees (in the parent's
+/// child order) composed with the parent's own `local` guarantee under `op`,
+/// given the statistics in `stats` (all unknown in Stage 1; plan selection
+/// binds some). `Err` is the fail-closed answer: no registered rule, or a
+/// missing input guarantee. It means "no rule", not "infeasible": Pass 1
+/// keeps the candidate with `guarantee = None`.
 pub fn propagate(
     op: &CompositionOperator,
     inputs: &[AccuracyGuarantee],

crates/logical-asap-optimization/src/accuracy/estimators/mod.rs

@@ -54,6 +54,14 @@ fn bounded_guarantee(
     )
 }
 
+/// The built-in guarantee of reading `query` out of a summary of family
+/// `family` built over an **exact** input, derived from the family's
+/// committed parameters by inverting the same sizing formulas
+/// [`crate::realization::default_size_params`] uses. Exact for a plain value
+/// or an exact aggregate. `None` when the family has no error model
+/// (`Sample`, `Wavelet`, `StatModel`, and sketch evaluations without a
+/// certified bound): Pass 1 then leaves the guarantee `None` and keeps the
+/// candidate for plan selection to decide.
 pub fn local_guarantee(
     family: &FieldDataType,
     query: &SketchStatistic,

crates/logical-asap-optimization/src/accuracy/evidence.rs

@@ -1,6 +1,5 @@
-//! Scoped source contracts and evidence required by accuracy rules.
+//! Scoped source contracts and statistics the accuracy rules consult.
 use super::*;
-use asap_types::ir::QueryRoot;
 
 /// An enforced domain for the true values of one operand of an exact
 /// arithmetic operation, in every evaluation: they are finite and lie in
@@ -59,31 +58,3 @@ pub struct PropagationStats {
     /// certificate.
     pub topk_interval_failure_probability: Option<f64>,
 }
-
-/// Supplies typed planning-time evidence required by propagation rules.
-pub trait AccuracyEvidenceProvider {
-    /// Enforced domain of `operand`'s true values ([`OperandDomain`]), scoped
-    /// to this complete expression, including its source, filters, grouping
-    /// and window: a quantile ratio's operands, or the operands of a
-    /// product or quotient of estimates. `None` means unknown, including
-    /// emptiness.
-    fn operand_domain(&self, _operand: &OperatorNode) -> Option<OperandDomain> {
-        None
-    }
-
-    /// The deployment's empirical accuracy for one candidate's whole query
-    /// output, as a guarantee. Plan selection (#509 Stage 3) accepts a
-    /// candidate whose output has no theoretical guarantee that meets the
-    /// target (e.g. a difference of two quantile estimates) only when this
-    /// shows the output meets it. Stage 1 composition never reads it: root
-    /// guarantees there come from the built-in theoretical model. `None`
-    /// means no evidence.
-    fn output_guarantee(&self, _output: &QueryRoot) -> Option<AccuracyGuarantee> {
-        None
-    }
-}
-
-#[derive(Debug, Default, Clone, Copy)]
-pub struct NoAccuracyEvidence;
-
-impl AccuracyEvidenceProvider for NoAccuracyEvidence {}

crates/logical-asap-optimization/src/accuracy/mod.rs

@@ -1,9 +1,10 @@
-//! Planner accuracy interfaces and model dispatch.
+//! The planner's built-in analytical accuracy rules: estimators, composition, budget split and target check.
 //!
 //! Estimator models derive local guarantees, composition propagates them,
 //! the budget split sizes each approximate input of a composition for an
-//! equal share of its target, and evidence supplies scoped contracts.
-//! Unknown evidence may retain a candidate but does not authorize selection.
+//! equal share of its target, and `evidence` holds the scoped contracts and
+//! statistics the rules consult. The deployment's evidence provider and
+//! accuracy model live in plan selection (`asap_plan_selection::accuracy`).
 //! See `docs/design_docs/concepts/accuracy-models.md` for the design.
 
 pub mod budget;
@@ -12,18 +13,14 @@ pub mod estimators;
 pub mod evidence;
 
 pub use budget::per_input_target;
-pub use evidence::{AccuracyEvidenceProvider, NoAccuracyEvidence, OperandDomain, PropagationStats};
+pub use evidence::{OperandDomain, PropagationStats};
 
 use asap_types::ir::properties::{
     AccuracyError, AccuracyGuarantee, AccuracyMetric, BoundExpr, CompositionOperator,
     GuaranteeSource, ProbabilityExpr,
 };
 use asap_types::ir::properties::{AccuracyScope, AccuracyTarget};
 use asap_types::ir::schema::{FieldDataType, SketchAlgorithm, SketchParams, SketchStatistic};
-use asap_types::ir::OperatorNode;
-
-pub use composition::propagate;
-pub use estimators::local_guarantee;
 
 /// Small relative tolerance for comparing an evaluated bound against a
 /// target, so a parameter sized by `⌈·⌉` to *exactly* meet ε is not rejected
@@ -38,7 +35,7 @@ const SATISFACTION_TOLERANCE: f64 = 1e-9;
 /// another metric does not satisfy, however small. When it sets none, a
 /// bound in any metric does, each compared in its own metric. Unknown
 /// required dimensions fail. Plan selection's default accuracy model
-/// (`asap_plan_selection::DefaultAccuracyModel`) delegates to it.
+/// (`asap_plan_selection::BuiltinAccuracyModel`) delegates to it.
 pub fn satisfies(guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool {
     let within = |value: Option<f64>, limit: f64| {
         value.is_some_and(|v| v <= limit * (1.0 + SATISFACTION_TOLERANCE) + f64::EPSILON)

crates/logical-asap-optimization/src/lib.rs

@@ -54,7 +54,7 @@ pub mod realization;
 #[cfg(any(test, feature = "test-support"))]
 pub mod test_support;
 
-pub use accuracy::{AccuracyEvidenceProvider, NoAccuracyEvidence, PropagationStats};
+pub use accuracy::PropagationStats;
 pub use deployment_capabilities::{
     DeploymentCapabilities, DeploymentCapabilitiesError, SupportedSummary,
 };

crates/logical-asap-optimization/src/per_computation_candidates.rs

@@ -113,13 +113,15 @@ use asap_types::ir::{
 use asap_types::physical::Materialization;
 use thiserror::Error;
 
+use crate::accuracy::composition::propagate;
 use crate::accuracy::composition::samples_sign_statistic;
 use crate::accuracy::composition::{
     additive_as_absolute, StreamNorm, DIVISION_OPERAND_DOMAINS, GROUP_ROW_COUNT,
     PRODUCT_OPERAND_DOMAINS, QUOTIENT_OPERAND_DOMAINS,
 };
+use crate::accuracy::estimators::local_guarantee;
 use crate::accuracy::estimators::{hll, univmon};
-use crate::accuracy::{local_guarantee, per_input_target, propagate, PropagationStats};
+use crate::accuracy::{per_input_target, PropagationStats};
 use crate::deployment_capabilities::DeploymentCapabilities;
 use crate::function_rules::approximate_input_composition;
 use crate::realization::{accuracy_budget, default_size_params, sizing_target, summary_candidates};

crates/plan-selection/src/accuracy.rs

@@ -4,32 +4,40 @@
 //! Stage 1 composes each candidate's guarantee with the planner's built-in
 //! analytical rules (`asap_logical_asap_optimization::accuracy`) and keeps a
 //! candidate it has no rule for with `guarantee = None`. This stage decides,
-//! with the model here, whether a guarantee meets its query's target and
-//! how guarantees compose once the data workload and the deployment's
-//! evidence bind the statistics Stage 1 left unknown.
+//! with the model here, whether a guarantee meets its query's target, how
+//! guarantees compose once the data workload and the deployment's evidence
+//! ([`AccuracyEvidenceProvider`]) bind the statistics Stage 1 left unknown,
+//! and whether an output with no guarantee at all is accepted.
 
-use asap_logical_asap_optimization::accuracy::{self as analytical, PropagationStats};
+use asap_logical_asap_optimization::accuracy::{
+    self as analytical, OperandDomain, PropagationStats,
+};
 use asap_types::ir::properties::{
     AccuracyError, AccuracyGuarantee, AccuracyTarget, CompositionOperator,
 };
+use asap_types::ir::{OperatorNode, QueryRoot};
 
 /// The deployment-extensible accuracy algebra plan selection uses. This
-/// crate ships [`DefaultAccuracyModel`]; a deployment with a proof for a
+/// crate ships [`BuiltinAccuracyModel`]; a deployment with a proof for a
 /// composition the default rejects (a registered cross-metric conversion,
 /// say) implements this trait and passes it in
 /// [`PlanningModels::accuracy`](crate::PlanningModels::accuracy).
 pub trait AccuracyModel {
     /// Compose `inputs`' guarantees (in the parent's child order) with the
     /// parent's own `local` guarantee under `op`, given the statistics
     /// plan selection bound (`stats`). `Err` is the fail-closed answer: no
-    /// registered rule, or a missing input guarantee.
+    /// registered rule, or a missing input guarantee. The default is the
+    /// built-in rules (`asap_logical_asap_optimization::accuracy::composition::propagate`);
+    /// a deployment overrides it only to add a rule.
     fn propagate(
         &self,
         op: &CompositionOperator,
         inputs: &[AccuracyGuarantee],
         local: Option<&AccuracyGuarantee>,
         stats: &PropagationStats,
-    ) -> Result<AccuracyGuarantee, AccuracyError>;
+    ) -> Result<AccuracyGuarantee, AccuracyError> {
+        analytical::composition::propagate(op, inputs, local, stats)
+    }
 
     /// Whether `guarantee` meets `target`: a bound within its ε, and within
     /// its δ when it states one, over the values the target's scope covers
@@ -40,26 +48,65 @@ pub trait AccuracyModel {
     /// compared in its own metric. Unknown required dimensions fail;
     /// selection separately excludes missing accuracy evidence.
     fn satisfies(&self, guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool;
+
+    /// Whether the deployment accepts `output`, one query's output in a
+    /// candidate, for `target` although the output has no guarantee: Stage 1
+    /// had no analytical rule for it and the deployment's evidence supplies
+    /// none ([`AccuracyEvidenceProvider::output_guarantee`]). Stage 3 asks only
+    /// then; a guarantee from either source is checked with
+    /// [`Self::satisfies`] instead. The default accepts none, and Stage 3
+    /// rejects such a candidate (`RejectionCause::NoAccuracyGuarantee`).
+    fn accepts_output_without_guarantee(
+        &self,
+        _output: &QueryRoot,
+        _target: &AccuracyTarget,
+    ) -> bool {
+        false
+    }
 }
 
 /// The planner's built-in analytical rules as an [`AccuracyModel`]: the
-/// same composition rules and conservative target check Stage 1 uses. The
-/// default in [`PlanningModels::builtin`](crate::PlanningModels::builtin).
+/// trait's default composition, the conservative target check Stage 1's
+/// `accuracy::satisfies` makes, and no output accepted without a guarantee.
+/// The default in [`PlanningModels::builtin`](crate::PlanningModels::builtin).
 #[derive(Debug, Default, Clone, Copy)]
-pub struct DefaultAccuracyModel;
-
-impl AccuracyModel for DefaultAccuracyModel {
-    fn propagate(
-        &self,
-        op: &CompositionOperator,
-        inputs: &[AccuracyGuarantee],
-        local: Option<&AccuracyGuarantee>,
-        stats: &PropagationStats,
-    ) -> Result<AccuracyGuarantee, AccuracyError> {
-        analytical::propagate(op, inputs, local, stats)
-    }
+pub struct BuiltinAccuracyModel;
 
+impl AccuracyModel for BuiltinAccuracyModel {
     fn satisfies(&self, guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool {
         analytical::satisfies(guarantee, target)
     }
 }
+
+/// The deployment's planning-time accuracy evidence, read only by plan
+/// selection: enforced operand domains the propagation rules need, and
+/// empirical guarantees for whole query outputs. Passed in
+/// [`PlanningModels::evidence`](crate::PlanningModels::evidence). The trait
+/// moved here from `asap_logical_asap_optimization::accuracy`.
+pub trait AccuracyEvidenceProvider {
+    /// Enforced domain of `operand`'s true values ([`OperandDomain`]), scoped
+    /// to this complete expression, including its source, filters, grouping
+    /// and window: a quantile ratio's operands, or the operands of a
+    /// product or quotient of estimates. `None` means unknown, including
+    /// emptiness.
+    fn operand_domain(&self, _operand: &OperatorNode) -> Option<OperandDomain> {
+        None
+    }
+
+    /// The deployment's empirical accuracy for one candidate's whole query
+    /// output, as a guarantee. Plan selection (#509 Stage 3) accepts a
+    /// candidate whose output has no theoretical guarantee that meets the
+    /// target (e.g. a difference of two quantile estimates) when this shows
+    /// the output meets it. Stage 1 never reads it: root guarantees there
+    /// come from the built-in analytical rules. `None` means no evidence.
+    fn output_guarantee(&self, _output: &QueryRoot) -> Option<AccuracyGuarantee> {
+        None
+    }
+}
+
+/// No deployment evidence: every operand domain and output guarantee is
+/// unknown. The default in [`PlanningModels::builtin`](crate::PlanningModels::builtin).
+#[derive(Debug, Default, Clone, Copy)]
+pub struct NoAccuracyEvidence;
+
+impl AccuracyEvidenceProvider for NoAccuracyEvidence {}