feat(plan-selection)!: let the deployment's accuracy model decide outputs without a guarantee

- Move AccuracyEvidenceProvider and NoAccuracyEvidence to
  asap_plan_selection::accuracy, next to AccuracyModel; OperandDomain and
  PropagationStats stay in Stage 1.
- Rename DefaultAccuracyModel to BuiltinAccuracyModel. AccuracyModel::propagate
  gets a default body (the built-in rules), so a deployment model implements
  only satisfies.
- Add AccuracyModel::accepts_output_without_guarantee (default false). Stage 3
  asks it only when neither Stage 1 nor the evidence supplies a guarantee;
  an output it accepts is recorded with AcceptedAccuracy::accepted_without_guarantee,
  and one it does not is rejected with the new RejectionCause::NoAccuracyGuarantee
  (was AccuracyTargetMissed).
- Document accuracy::estimators::local_guarantee and
  accuracy::composition::propagate, and drop their duplicate re-exports.
- stage_pipeline writes accepted_without_guarantee; the dag-viewer accepts
  the new cause; the example fixture is regenerated.

BREAKING CHANGE: AccuracyEvidenceProvider/NoAccuracyEvidence move to
asap_plan_selection; DefaultAccuracyModel is now BuiltinAccuracyModel; a
candidate whose output has no guarantee is rejected as no_accuracy_guarantee
instead of accuracy_target_missed; AcceptedAccuracy gains a field.

Author: zzylol

crates/devtools/src/bin/stage_pipeline.rs

@@ -31,10 +31,12 @@
 //   - stage3_plan_selection: the selected candidate, chosen among all candidates;
 //     the shown candidates' costs and accepted accuracy (per query: the
 //     target's metric or null when not set, the accepted guarantee's
-//     metric or null when exact, the sketches read and a one-line
+//     metric or null when exact or accepted without a guarantee, whether
+//     the deployment's accuracy model accepted it without a guarantee
+//     (`accepted_without_guarantee`), the sketches read and a one-line
 //     summary), and every other shown candidate under `rejected` with
 //     its `cause`: a failed check (`failure_probability_resize_failed`,
-//     `accuracy_target_missed`, `raw_data_not_retained`,
+//     `accuracy_target_missed`, `no_accuracy_guarantee`, `raw_data_not_retained`,
 //     `latency_bound_exceeded`, `over_cluster_capacity`) or a loss under
 //     the cost model (`costlier`, `slower`, `more_memory`,
 //     `not_lowest_latency_on_pareto_front`, `dominated`,
@@ -617,6 +619,7 @@ fn plan_selection_json(
                     json!({
                         "target_metric": accepted.target_metric,
                         "accepted_metric": accepted.accepted_metric,
+                        "accepted_without_guarantee": accepted.accepted_without_guarantee,
                         "sketches": accepted.sketches,
                         "summary": accepted.to_string(),
                     })

crates/devtools/tests/stage_pipeline.rs

@@ -138,6 +138,7 @@ fn example1_document_is_valid_and_committed_fixture_is_current() {
         let failed_a_check = [
             "failure_probability_resize_failed",
             "accuracy_target_missed",
+            "no_accuracy_guarantee",
             "raw_data_not_retained",
             "latency_bound_exceeded",
             "over_cluster_capacity",

crates/frontend-promql/tests/univmon_candidates.rs

@@ -1,6 +1,7 @@
 use std::rc::Rc;
 
-use asap_logical_asap_optimization::accuracy::{local_guarantee, satisfies};
+use asap_logical_asap_optimization::accuracy::estimators::local_guarantee;
+use asap_logical_asap_optimization::accuracy::satisfies;
 mod support;
 use asap_types::ir::cse::share_common_sub_dags;
 use asap_types::ir::properties::AccuracyMetric;

crates/integration-tests/tests/promql_to_post_asap.rs

@@ -11,8 +11,9 @@ use std::rc::Rc;
 use asap_integration_tests::fixtures::lower_promql;
 use asap_integration_tests::planning::logical_candidates;
 use asap_integration_tests::post_asap::{at_ingestion, at_ingestion_post_asap_dag, post_asap_dag};
-use asap_logical_asap_optimization::accuracy::{AccuracyEvidenceProvider, OperandDomain};
+use asap_logical_asap_optimization::accuracy::OperandDomain;
 use asap_physical_asap_optimization::PhysicalCandidate;
+use asap_plan_selection::AccuracyEvidenceProvider;
 use asap_plan_selection::PlanningModels;
 use asap_plan_selection::Selection;
 use asap_types::ir::operator::operator_properties::Reduction;

crates/logical-asap-optimization/src/accuracy/composition.rs

@@ -694,6 +694,12 @@ fn composed_provenance(
     provenance
 }
 
+/// The built-in composition rule: `inputs`' guarantees (in the parent's
+/// child order) composed with the parent's own `local` guarantee under `op`,
+/// given the statistics in `stats` (all unknown in Stage 1; plan selection
+/// binds some). `Err` is the fail-closed answer: no registered rule, or a
+/// missing input guarantee. It means "no rule", not "infeasible": Pass 1
+/// keeps the candidate with `guarantee = None`.
 pub fn propagate(
     op: &CompositionOperator,
     inputs: &[AccuracyGuarantee],

crates/logical-asap-optimization/src/accuracy/estimators/mod.rs

@@ -54,6 +54,14 @@ fn bounded_guarantee(
     )
 }
 
+/// The built-in guarantee of reading `query` out of a summary of family
+/// `family` built over an **exact** input, derived from the family's
+/// committed parameters by inverting the same sizing formulas
+/// [`crate::realization::default_size_params`] uses. Exact for a plain value
+/// or an exact aggregate. `None` when the family has no error model
+/// (`Sample`, `Wavelet`, `StatModel`, and sketch evaluations without a
+/// certified bound): Pass 1 then leaves the guarantee `None` and keeps the
+/// candidate for plan selection to decide.
 pub fn local_guarantee(
     family: &FieldDataType,
     query: &SketchStatistic,

crates/logical-asap-optimization/src/accuracy/evidence.rs

@@ -1,6 +1,5 @@
-//! Scoped source contracts and evidence required by accuracy rules.
+//! Scoped source contracts and statistics the accuracy rules consult.
 use super::*;
-use asap_types::ir::QueryRoot;
 
 /// An enforced domain for the true values of one operand of an exact
 /// arithmetic operation, in every evaluation: they are finite and lie in
@@ -59,31 +58,3 @@ pub struct PropagationStats {
     /// certificate.
     pub topk_interval_failure_probability: Option<f64>,
 }
-
-/// Supplies typed planning-time evidence required by propagation rules.
-pub trait AccuracyEvidenceProvider {
-    /// Enforced domain of `operand`'s true values ([`OperandDomain`]), scoped
-    /// to this complete expression, including its source, filters, grouping
-    /// and window: a quantile ratio's operands, or the operands of a
-    /// product or quotient of estimates. `None` means unknown, including
-    /// emptiness.
-    fn operand_domain(&self, _operand: &OperatorNode) -> Option<OperandDomain> {
-        None
-    }
-
-    /// The deployment's empirical accuracy for one candidate's whole query
-    /// output, as a guarantee. Plan selection (#509 Stage 3) accepts a
-    /// candidate whose output has no theoretical guarantee that meets the
-    /// target (e.g. a difference of two quantile estimates) only when this
-    /// shows the output meets it. Stage 1 composition never reads it: root
-    /// guarantees there come from the built-in theoretical model. `None`
-    /// means no evidence.
-    fn output_guarantee(&self, _output: &QueryRoot) -> Option<AccuracyGuarantee> {
-        None
-    }
-}
-
-#[derive(Debug, Default, Clone, Copy)]
-pub struct NoAccuracyEvidence;
-
-impl AccuracyEvidenceProvider for NoAccuracyEvidence {}

crates/logical-asap-optimization/src/accuracy/mod.rs

@@ -1,9 +1,10 @@
-//! Planner accuracy interfaces and model dispatch.
+//! The planner's built-in analytical accuracy rules: estimators, composition, budget split and target check.
 //!
 //! Estimator models derive local guarantees, composition propagates them,
 //! the budget split sizes each approximate input of a composition for an
-//! equal share of its target, and evidence supplies scoped contracts.
-//! Unknown evidence may retain a candidate but does not authorize selection.
+//! equal share of its target, and `evidence` holds the scoped contracts and
+//! statistics the rules consult. The deployment's evidence provider and
+//! accuracy model live in plan selection (`asap_plan_selection::accuracy`).
 //! See `docs/design_docs/concepts/accuracy-models.md` for the design.
 
 pub mod budget;
@@ -12,18 +13,14 @@ pub mod estimators;
 pub mod evidence;
 
 pub use budget::per_input_target;
-pub use evidence::{AccuracyEvidenceProvider, NoAccuracyEvidence, OperandDomain, PropagationStats};
+pub use evidence::{OperandDomain, PropagationStats};
 
 use asap_types::ir::properties::{
     AccuracyError, AccuracyGuarantee, AccuracyMetric, BoundExpr, CompositionOperator,
     GuaranteeSource, ProbabilityExpr,
 };
 use asap_types::ir::properties::{AccuracyScope, AccuracyTarget};
 use asap_types::ir::schema::{FieldDataType, SketchAlgorithm, SketchParams, SketchStatistic};
-use asap_types::ir::OperatorNode;
-
-pub use composition::propagate;
-pub use estimators::local_guarantee;
 
 /// Small relative tolerance for comparing an evaluated bound against a
 /// target, so a parameter sized by `⌈·⌉` to *exactly* meet ε is not rejected
@@ -38,7 +35,7 @@ const SATISFACTION_TOLERANCE: f64 = 1e-9;
 /// another metric does not satisfy, however small. When it sets none, a
 /// bound in any metric does, each compared in its own metric. Unknown
 /// required dimensions fail. Plan selection's default accuracy model
-/// (`asap_plan_selection::DefaultAccuracyModel`) delegates to it.
+/// (`asap_plan_selection::BuiltinAccuracyModel`) delegates to it.
 pub fn satisfies(guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool {
     let within = |value: Option<f64>, limit: f64| {
         value.is_some_and(|v| v <= limit * (1.0 + SATISFACTION_TOLERANCE) + f64::EPSILON)

crates/logical-asap-optimization/src/lib.rs

@@ -51,7 +51,7 @@ pub mod realization;
 #[cfg(any(test, feature = "test-support"))]
 pub mod test_support;
 
-pub use accuracy::{AccuracyEvidenceProvider, NoAccuracyEvidence, PropagationStats};
+pub use accuracy::PropagationStats;
 pub use deployment_capabilities::{
     DeploymentCapabilities, DeploymentCapabilitiesError, SupportedSummary,
 };

crates/logical-asap-optimization/src/per_computation_candidates.rs

@@ -113,13 +113,15 @@ use asap_types::ir::{
 use asap_types::physical::Materialization;
 use thiserror::Error;
 
+use crate::accuracy::composition::propagate;
 use crate::accuracy::composition::samples_sign_statistic;
 use crate::accuracy::composition::{
     additive_as_absolute, StreamNorm, DIVISION_OPERAND_DOMAINS, GROUP_ROW_COUNT,
     PRODUCT_OPERAND_DOMAINS, QUOTIENT_OPERAND_DOMAINS,
 };
+use crate::accuracy::estimators::local_guarantee;
 use crate::accuracy::estimators::{hll, univmon};
-use crate::accuracy::{local_guarantee, per_input_target, propagate, PropagationStats};
+use crate::accuracy::{per_input_target, PropagationStats};
 use crate::deployment_capabilities::DeploymentCapabilities;
 use crate::function_rules::approximate_input_composition;
 use crate::realization::{accuracy_budget, default_size_params, sizing_target, summary_candidates};