@@ -31,9 +31,10 @@
 //   - stage3_plan_selection: the selected candidate, chosen among all candidates;
 //     the shown candidates' costs and accepted accuracy (per query: the
 //     target's metric or null when not set, the accepted guarantee's
-//     metric or null when exact or accepted without a guarantee, whether
-//     the deployment's accuracy model accepted it without a guarantee
-//     (`accepted_without_guarantee`), the sketches read and a one-line
+//     metric or null when exact or accepted regardless of guarantee,
+//     whether the deployment's accuracy model accepted it directly,
+//     whatever its guarantee says (`accepted_regardless_of_guarantee`),
+//     the sketches read and a one-line
 //     summary), and every other shown candidate under `rejected` with
 //     its `cause`: a failed check (`failure_probability_resize_failed`,
 //     `accuracy_target_missed`, `no_accuracy_guarantee`, `raw_data_not_retained`,
@@ -619,7 +620,7 @@ fn plan_selection_json(
                     json!({
                         "target_metric": accepted.target_metric,
                         "accepted_metric": accepted.accepted_metric,
-                        "accepted_without_guarantee": accepted.accepted_without_guarantee,
+                        "accepted_regardless_of_guarantee": accepted.accepted_regardless_of_guarantee,
                         "sketches": accepted.sketches,
                         "summary": accepted.to_string(),
                     })
 
@@ -7,7 +7,8 @@
 //! with the model here, whether a guarantee meets its query's target, how
 //! guarantees compose once the data workload and the deployment's evidence
 //! ([`AccuracyEvidenceProvider`]) bind the statistics Stage 1 left unknown,
-//! and whether an output with no guarantee at all is accepted.
+//! and whether the deployment accepts an output directly, whatever its
+//! guarantee says.
 
 use asap_logical_asap_optimization::accuracy::{
     self as analytical, OperandDomain, PropagationStats,
@@ -50,13 +51,14 @@ pub trait AccuracyModel {
     fn satisfies(&self, guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool;
 
     /// Whether the deployment accepts `output`, one query's output in a
-    /// candidate, for `target` although the output has no guarantee: Stage 1
-    /// had no analytical rule for it and the deployment's evidence supplies
-    /// none ([`AccuracyEvidenceProvider::output_guarantee`]). Stage 3 asks only
-    /// then; a guarantee from either source is checked with
-    /// [`Self::satisfies`] instead. The default accepts none, and Stage 3
-    /// rejects such a candidate (`RejectionCause::NoAccuracyGuarantee`).
-    fn accepts_output_without_guarantee(
+    /// candidate, for `target` directly, whatever its guarantee says:
+    /// missing (Stage 1 had no analytical rule), met or missed. Stage 3 asks
+    /// this first for every query output; when it returns `true`, no
+    /// guarantee or evidence check runs for that output. The default accepts
+    /// none, so Stage 3 checks the Stage 1 guarantee, then the evidence
+    /// ([`AccuracyEvidenceProvider::output_guarantee`]) with
+    /// [`Self::satisfies`].
+    fn accepts_output_regardless_of_guarantee(
         &self,
         _output: &QueryRoot,
         _target: &AccuracyTarget,
@@ -67,7 +69,8 @@ pub trait AccuracyModel {
 
 /// The planner's built-in analytical rules as an [`AccuracyModel`]: the
 /// trait's default composition, the conservative target check Stage 1's
-/// `accuracy::satisfies` makes, and no output accepted without a guarantee.
+/// `accuracy::satisfies` makes, and no output accepted regardless of its
+/// guarantee.
 /// The default in [`PlanningModels::builtin`](crate::PlanningModels::builtin).
 #[derive(Debug, Default, Clone, Copy)]
 pub struct BuiltinAccuracyModel;
 
@@ -7,9 +7,9 @@
 //! from the data workload and the deployment's operand-domain contracts),
 //! or when the deployment's empirical evidence shows this
 //! candidate's output does (`AccuracyEvidenceProvider::output_guarantee`,
-//! read only here). An output with no guarantee from either source is
-//! accepted only when the deployment's accuracy model accepts it without one
-//! (`AccuracyModel::accepts_output_without_guarantee`). For a query with a target, Count-Min is admitted only
+//! read only here). Before either, the deployment's accuracy model may accept
+//! the output directly, whatever its guarantee says
+//! (`AccuracyModel::accepts_output_regardless_of_guarantee`). For a query with a target, Count-Min is admitted only
 //! over weights proven non-negative; a query without one constrains nothing.
 //! A miss rejects the candidate as invalid, with a reason; only this stage
 //! discards valid candidates.
@@ -589,8 +589,8 @@ pub enum RejectionCause {
     AccuracyTargetMissed,
     /// A query's output has no accuracy guarantee (Stage 1 has no
     /// analytical rule for it and the deployment's evidence supplies none),
-    /// and the deployment's accuracy model does not accept it without one
-    /// ([`AccuracyModel::accepts_output_without_guarantee`]).
+    /// and the deployment's accuracy model did not accept it directly
+    /// ([`AccuracyModel::accepts_output_regardless_of_guarantee`]).
     NoAccuracyGuarantee,
     /// It scans raw data at query time in a deployment that does not
     /// retain raw data.
@@ -645,14 +645,14 @@ pub struct AcceptedAccuracy {
     /// The target's metric; `None` when the user did not set one.
     pub target_metric: Option<AccuracyMetric>,
     /// The metric the accepted guarantee is stated in; `None` for an exact
-    /// output, which meets every metric, and for one accepted without a
-    /// guarantee.
+    /// output, which meets every metric, and for one the deployment's model
+    /// accepted regardless of its guarantee (no guarantee was checked).
     pub accepted_metric: Option<AccuracyMetric>,
-    /// Whether the output has no guarantee and the deployment's accuracy
-    /// model accepted it anyway
-    /// ([`AccuracyModel::accepts_output_without_guarantee`]); `false`
-    /// otherwise.
-    pub accepted_without_guarantee: bool,
+    /// Whether the deployment's accuracy model accepted the output directly,
+    /// whatever its guarantee says
+    /// ([`AccuracyModel::accepts_output_regardless_of_guarantee`]); `false`
+    /// when a guarantee met the target.
+    pub accepted_regardless_of_guarantee: bool,
     /// The sketch algorithms the query's output reads, in plan order
     /// (e.g. `["Kll"]`); empty for an exact plan.
     pub sketches: Vec<String>,
@@ -661,7 +661,7 @@ pub struct AcceptedAccuracy {
 impl std::fmt::Display for AcceptedAccuracy {
     /// E.g. `metric not set; accepted rank (Kll)`, or
     /// `metric relative; accepted relative (DDSketch)`, or
-    /// `metric rank; accepted without a guarantee (Kll)`.
+    /// `metric rank; accepted by the deployment's accuracy model regardless of guarantee (Kll)`.
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         let name = |metric: AccuracyMetric| {
             serde_json::to_value(metric)
@@ -674,7 +674,10 @@ impl std::fmt::Display for AcceptedAccuracy {
             Some(metric) => write!(f, "metric {}; ", name(metric))?,
         }
         match self.accepted_metric {
-            _ if self.accepted_without_guarantee => write!(f, "accepted without a guarantee")?,
+            _ if self.accepted_regardless_of_guarantee => write!(
+                f,
+                "accepted by the deployment's accuracy model regardless of guarantee"
+            )?,
             None => write!(f, "accepted exact")?,
             Some(metric) => write!(f, "accepted {}", name(metric))?,
         }
@@ -1416,12 +1419,13 @@ pub fn resize_for_failure_probability(
 /// its ε, δ and scope ([`AccuracyModel::satisfies`]); one that sets a metric
 /// accepts only guarantees in it (or convertible to it).
 ///
-/// An output with no guarantee from either source (Stage 1 had no rule,
-/// and the evidence has none) is accepted only when the deployment's
-/// accuracy model accepts it without one
-/// ([`AccuracyModel::accepts_output_without_guarantee`]); otherwise the
-/// candidate is rejected as [`RejectionCause::NoAccuracyGuarantee`]. Any
-/// other miss is [`RejectionCause::AccuracyTargetMissed`].
+/// The deployment's accuracy model is asked first
+/// ([`AccuracyModel::accepts_output_regardless_of_guarantee`]): an output it
+/// accepts is accepted whatever its guarantee says, and none of the checks
+/// above runs for it. Otherwise, an output with no guarantee from either
+/// source (Stage 1 had no rule, and the evidence has none) is rejected as
+/// [`RejectionCause::NoAccuracyGuarantee`], and any other miss as
+/// [`RejectionCause::AccuracyTargetMissed`].
 fn accuracy_check(
     candidate: &PhysicalCandidate,
     targets: &[AccuracyTarget],
@@ -1432,6 +1436,9 @@ fn accuracy_check(
     for (query, (root, target)) in candidate.roots.iter().zip(targets).enumerate() {
         let query = query + 1;
         let mut sketches: Vec<String> = Vec::new();
+        // The first Count-Min whose update weights are not proven
+        // non-negative, which its bound assumes, as a rejection reason.
+        let mut unproven_weights: Option<String> = None;
         for node in root_operators(root)
             .iter()
             .flat_map(|node| OperatorNode::reachable(node))
@@ -1461,16 +1468,32 @@ fn accuracy_check(
                     }
                     _ => String::new(),
                 };
-                return Err((
-                    RejectionCause::AccuracyTargetMissed,
+                unproven_weights.get_or_insert_with(|| {
                     format!(
                         "q{query}: {} needs non-negative update weights, and these are not \
                          proven non-negative{unconfirmed}",
                         family_name(family)
-                    ),
-                ));
+                    )
+                });
             }
         }
+        // The deployment's model may accept the output directly, whatever
+        // its guarantee says; no guarantee or evidence check runs then.
+        if models
+            .accuracy
+            .accepts_output_regardless_of_guarantee(root, target)
+        {
+            accepted.push(AcceptedAccuracy {
+                target_metric: target.accuracy_metric,
+                accepted_metric: None,
+                accepted_regardless_of_guarantee: true,
+                sketches,
+            });
+            continue;
+        }
+        if let Some(reason) = unproven_weights {
+            return Err((RejectionCause::AccuracyTargetMissed, reason));
+        }
         // A guarantee per value is stated over the whole result's `G`
         // values for a whole-result target.
         let series = series_read(root, data);
@@ -1495,31 +1518,17 @@ fn accuracy_check(
             accepted.push(AcceptedAccuracy {
                 target_metric: target.accuracy_metric,
                 accepted_metric: (!met.is_exact()).then_some(met.spec.accuracy_metric),
-                accepted_without_guarantee: false,
+                accepted_regardless_of_guarantee: false,
                 sketches,
             });
             continue;
         }
-        // No guarantee from either source: the deployment's model decides.
         if guarantee.is_none() && evidence.is_none() {
-            if models
-                .accuracy
-                .accepts_output_without_guarantee(root, target)
-            {
-                accepted.push(AcceptedAccuracy {
-                    target_metric: target.accuracy_metric,
-                    accepted_metric: None,
-                    accepted_without_guarantee: true,
-                    sketches,
-                });
-                continue;
-            }
             return Err((
                 RejectionCause::NoAccuracyGuarantee,
                 format!(
-                    "q{query}: the output has no guarantee, the deployment has no evidence \
-                     for it, and its accuracy model does not accept it for target {target:?} \
-                     without one"
+                    "q{query}: the output has no guarantee, and the deployment has no evidence \
+                     for it, so it cannot meet target {target:?}"
                 ),
             ));
         }
@@ -4262,15 +4271,15 @@ mod tests {
         }
     }
 
-    /// A model that accepts every output that has no guarantee.
-    struct AcceptsEveryOutputWithoutGuarantee;
+    /// A model that accepts every output directly, whatever its guarantee.
+    struct AcceptsEveryOutput;
 
-    impl AccuracyModel for AcceptsEveryOutputWithoutGuarantee {
+    impl AccuracyModel for AcceptsEveryOutput {
         fn satisfies(&self, guarantee: &AccuracyGuarantee, target: &AccuracyTarget) -> bool {
             BuiltinAccuracyModel.satisfies(guarantee, target)
         }
 
-        fn accepts_output_without_guarantee(
+        fn accepts_output_regardless_of_guarantee(
             &self,
             _output: &QueryRoot,
             _target: &AccuracyTarget,
@@ -4279,12 +4288,14 @@ mod tests {
         }
     }
 
-    /// The model's hook decides only when there is no guarantee at all: an
-    /// output with no theoretical guarantee whose evidence guarantee misses
-    /// the target is rejected as `AccuracyTargetMissed`, though the hook
-    /// would accept it. Without that evidence the hook accepts it.
+    /// The model's hook has priority over every guarantee. The summary
+    /// candidates of a difference of quantile estimates have no theoretical
+    /// guarantee: with evidence that misses the target the built-in model
+    /// rejects them as `AccuracyTargetMissed`, and with no evidence as
+    /// `NoAccuracyGuarantee`; a model that accepts every output accepts them
+    /// in both cases, regardless of guarantee.
     #[test]
-    fn a_missed_evidence_guarantee_is_not_overridden_by_the_hook() {
+    fn the_accuracy_model_accepts_an_output_whatever_its_guarantee() {
         let target = AccuracyTarget::max_error(0.01).failure_probability(0.001);
         let candidates = all_candidates(
             "quantile_over_time(0.99, m[1m]) - quantile_over_time(0.5, m[1m])",
@@ -4296,7 +4307,7 @@ mod tests {
             .map(|c| c.id.as_str())
             .collect();
         assert!(!summaries.is_empty());
-        let select = |evidence: &dyn AccuracyEvidenceProvider| {
+        let select = |accuracy: &dyn AccuracyModel, evidence: &dyn AccuracyEvidenceProvider| {
             select_plan(
                 &candidates,
                 &[entry_with(
@@ -4305,27 +4316,29 @@ mod tests {
                 )],
                 &data(),
                 PlanningModels::builtin()
-                    .with_accuracy(&AcceptsEveryOutputWithoutGuarantee)
+                    .with_accuracy(accuracy)
                     .with_evidence(evidence),
             )
             .unwrap()
         };
-        let loose = select(&EveryOutputMeasuredLoose);
-        for id in &summaries {
-            let rejection = loose.rejected.iter().find(|r| r.id == *id).unwrap();
-            assert_eq!(
-                rejection.cause,
+        for (evidence, builtin_cause) in [
+            (
+                &EveryOutputMeasuredLoose as &dyn AccuracyEvidenceProvider,
                 RejectionCause::AccuracyTargetMissed,
-                "{}",
-                rejection.reason
-            );
-        }
-        let no_evidence = select(&NoAccuracyEvidence);
-        for id in &summaries {
-            assert!(
-                no_evidence.accepted[*id][0].accepted_without_guarantee,
-                "{id}"
-            );
+            ),
+            (&NoAccuracyEvidence, RejectionCause::NoAccuracyGuarantee),
+        ] {
+            let builtin = select(&BuiltinAccuracyModel, evidence);
+            let accepting = select(&AcceptsEveryOutput, evidence);
+            for id in &summaries {
+                let rejection = builtin.rejected.iter().find(|r| r.id == *id).unwrap();
+                assert_eq!(rejection.cause, builtin_cause, "{}", rejection.reason);
+                assert!(accepting.costs.contains_key(*id), "{id} is valid");
+                assert!(
+                    accepting.accepted[*id][0].accepted_regardless_of_guarantee,
+                    "{id}"
+                );
+            }
         }
     }