@@ -4,42 +4,26 @@
 //! Stage 1 composes each candidate's guarantee with the planner's built-in
 //! analytical rules (`asap_logical_asap_optimization::accuracy`) and keeps a
 //! candidate it has no rule for with `guarantee = None`. This stage decides,
-//! with the model here, whether a guarantee meets its query's target, how
-//! guarantees compose once the data workload and the deployment's evidence
-//! ([`AccuracyEvidenceProvider`]) bind the statistics Stage 1 left unknown,
+//! with the model here, whether a guarantee meets its query's target (after
+//! the data workload and the deployment's evidence,
+//! [`AccuracyEvidenceProvider`], bind the statistics Stage 1 left unknown),
 //! and whether the deployment accepts an output directly, whatever its
 //! guarantee says.
 
-use asap_logical_asap_optimization::accuracy::{
-    self as analytical, OperandDomain, PropagationStats,
-};
-use asap_types::ir::properties::{
-    AccuracyError, AccuracyGuarantee, AccuracyTarget, CompositionOperator,
-};
+use asap_logical_asap_optimization::accuracy::{self as analytical, OperandDomain};
+use asap_types::ir::properties::{AccuracyGuarantee, AccuracyTarget};
 use asap_types::ir::{OperatorNode, QueryRoot};
 
-/// The deployment-extensible accuracy algebra plan selection uses. This
-/// crate ships [`BuiltinAccuracyModel`]; a deployment with a proof for a
-/// composition the default rejects (a registered cross-metric conversion,
-/// say) implements this trait and passes it in
+/// The deployment's accuracy decisions in plan selection: whether a
+/// guarantee meets a query's target, and whether the deployment accepts an
+/// output directly, whatever its guarantee. This crate ships
+/// [`BuiltinAccuracyModel`]; a deployment with its own target check (a
+/// registered cross-metric conversion, say) or its own measurements
+/// implements this trait and passes it in
 /// [`PlanningModels::accuracy`](crate::PlanningModels::accuracy).
+/// Guarantees are composed with the built-in rules only
+/// (`asap_logical_asap_optimization::accuracy::composition::propagate`).
 pub trait AccuracyModel {
-    /// Compose `inputs`' guarantees (in the parent's child order) with the
-    /// parent's own `local` guarantee under `op`, given the statistics
-    /// plan selection bound (`stats`). `Err` is the fail-closed answer: no
-    /// registered rule, or a missing input guarantee. The default is the
-    /// built-in rules (`asap_logical_asap_optimization::accuracy::composition::propagate`);
-    /// a deployment overrides it only to add a rule.
-    fn propagate(
-        &self,
-        op: &CompositionOperator,
-        inputs: &[AccuracyGuarantee],
-        local: Option<&AccuracyGuarantee>,
-        stats: &PropagationStats,
-    ) -> Result<AccuracyGuarantee, AccuracyError> {
-        analytical::composition::propagate(op, inputs, local, stats)
-    }
-
     /// Whether `guarantee` meets `target`: a bound within its ε, and within
     /// its δ when it states one, over the values the target's scope covers
     /// (a per-value δ does not meet a whole-result target). When the target
@@ -56,9 +40,11 @@ pub trait AccuracyModel {
     /// this for every query output before any guarantee check; when it
     /// returns `true`, no guarantee or evidence check runs for that output.
     /// It does not override the executability check before it: a plan that
-    /// reads Count-Min over update weights not proven non-negative is
-    /// rejected (`RejectionCause::CountMinWeightsNotProvenNonNegative`)
-    /// whatever this returns. The default accepts
+    /// reads Count-Min (plain, CmsWithHeap or Hydra Count-Min) over update
+    /// weights not proven non-negative is rejected
+    /// (`RejectionCause::CountMinWeightsNotProvenNonNegative`) whatever this
+    /// returns, because the executor refuses CmsWithHeap and HydraCms when it
+    /// builds the plan and plain Count-Min fails at the first negative weight. The default accepts
     /// none, so Stage 3 checks the Stage 1 guarantee, then the evidence
     /// ([`AccuracyEvidenceProvider::output_guarantee`]) with
     /// [`Self::satisfies`].
@@ -72,7 +58,7 @@ pub trait AccuracyModel {
 }
 
 /// The planner's built-in analytical rules as an [`AccuracyModel`]: the
-/// trait's default composition, the conservative target check Stage 1's
+/// conservative target check Stage 1's
 /// `accuracy::satisfies` makes, and no output accepted regardless of its
 /// guarantee.
 /// The default in [`PlanningModels::builtin`](crate::PlanningModels::builtin).
 
@@ -1475,9 +1475,12 @@ fn accuracy_check(
                     }
                     _ => String::new(),
                 };
-                // The executor cannot run Count-Min over weights not proven
-                // non-negative, so this rejects the plan whatever the
-                // deployment's accuracy model accepts.
+                // Count-Min (plain, CmsWithHeap or Hydra Count-Min) over
+                // weights not proven non-negative does not run: the executor
+                // refuses CmsWithHeap and HydraCms when it builds the plan,
+                // and plain Count-Min fails at the first negative weight. So
+                // this rejects the plan whatever the deployment's accuracy
+                // model accepts.
                 return Err((
                     RejectionCause::CountMinWeightsNotProvenNonNegative,
                     format!(
@@ -1895,13 +1898,16 @@ fn domain_bound(
             division_operand_domains: Some([dx, dy]),
             ..PropagationStats::default()
         };
-        return models
-            .accuracy
-            .propagate(&CompositionOperator::ExactDivision, &[gx, gy], None, &stats)
-            .ok()?
-            .spec
-            .error
-            .evaluate();
+        return asap_logical_asap_optimization::accuracy::composition::propagate(
+            &CompositionOperator::ExactDivision,
+            &[gx, gy],
+            None,
+            &stats,
+        )
+        .ok()?
+        .spec
+        .error
+        .evaluate();
     }
     let valid =
         |d: &OperandDomain| d.lower.is_finite() && d.upper.is_finite() && d.lower <= d.upper;
@@ -1940,6 +1946,10 @@ fn domain_bound(
 
 fn family_name(family: &FieldDataType) -> String {
     match family {
+        // A shared (Hydra) structure is named by its Hydra kind, e.g. `HydraCms`.
+        FieldDataType::Sketch(_, GroupingStrategy::SharedMultiSubpopulation { kind, .. }) => {
+            format!("{kind:?}")
+        }
         FieldDataType::Sketch(kind, _) => format!("{:?}", kind.algorithm()),
         FieldDataType::ExactAggregate(kind, _) => format!("exact {kind:?} accumulator"),
         other => format!("{other:?}"),
@@ -4337,6 +4347,60 @@ mod tests {
         }
     }
 
+    /// `node` with every CmsWithHeap summary build replaced by a Hydra
+    /// Count-Min over the same update.
+    fn with_hydra_count_min(node: &Rc<OperatorNode>) -> Rc<OperatorNode> {
+        use asap_types::ir::schema::{HydraKind, HydraParams, SketchParams};
+        let mut rebuilt = node.with_new_children(with_hydra_count_min).unwrap();
+        if let Operator::ASAP(ASAPOp::SummaryAgg { family, .. }) = &mut rebuilt.operator {
+            if let FieldDataType::Sketch(kind, _) = family {
+                if let SketchParams::CmsWithHeap { width, depth, .. } = kind.params() {
+                    let (width, depth) = (*width, *depth);
+                    *family = FieldDataType::Sketch(
+                        SketchKind::new(SketchAlgorithm::Cms, SketchParams::Cms { width, depth }),
+                        GroupingStrategy::SharedMultiSubpopulation {
+                            kind: HydraKind::HydraCms,
+                            params: HydraParams::HydraCms {
+                                width,
+                                depth,
+                                shared_rows: depth,
+                                shared_columns: width,
+                            },
+                        },
+                    );
+                }
+            }
+        }
+        Rc::new(rebuilt)
+    }
+
+    /// A Hydra Count-Min over unproven weights is rejected by its own name:
+    /// the reason says `HydraCms`, not `Cms`.
+    #[test]
+    fn unproven_hydra_count_min_weights_name_hydra_cms() {
+        let target = AccuracyTarget::max_error(0.01)
+            .failure_probability(0.001)
+            .accuracy_metric(AccuracyMetric::ABSOLUTE_STREAM_L1);
+        let gauge = with_metric_types(data(), &[("m", MetricType::Gauge)]);
+        let mut p2 = candidates().into_iter().find(|c| c.id == "P2").unwrap();
+        p2.roots = p2
+            .roots
+            .iter()
+            .map(|root| match root {
+                QueryRoot::Operator(node) => QueryRoot::Operator(with_hydra_count_min(node)),
+                other => other.clone(),
+            })
+            .collect();
+        let (cause, reason) =
+            accuracy_check(&p2, &[target], &gauge, &PlanningModels::builtin()).unwrap_err();
+        assert_eq!(cause, RejectionCause::CountMinWeightsNotProvenNonNegative);
+        assert!(
+            reason.contains("HydraCms needs non-negative update weights"),
+            "{reason}"
+        );
+        assert!(reason.contains("not declared a counter"), "{reason}");
+    }
+
     /// The model's hook has priority over every guarantee. The summary
     /// candidates of a difference of quantile estimates have no theoretical
     /// guarantee: with evidence that misses the target the built-in model
 
@@ -20,8 +20,7 @@ use asap_types::workload::{
 };
 
 /// A deployment that trusts no approximate estimate: only an exact
-/// guarantee meets a target. Composition is the trait's default (the
-/// built-in rules).
+/// guarantee meets a target.
 struct ExactOnlyAccuracyModel;
 
 impl AccuracyModel for ExactOnlyAccuracyModel {