Five bins collapse to two the moment you ask what the instrument has to see.
Shape, scale, checker are call-local. Hand them one invocation and they return a verdict. The mutation test too: you mutate the gate and fire it once. State and liveness are the other family. No single call is wrong there. The sequence is. That is why "sample repeatedly instead of once" is the entire fix for both, and why neither was ever going to be an oracle. An oracle is a function of one call. A sampler is a function of the history. Different type signature.
But state is meaner than liveness, and your bug shows why. Liveness is monotone. A parked fleet stays parked, so waiting is a valid strategy: wait long enough and it fires. State is not monotone. The buffer is clean on step one, dirty on step two, clean again the instant the pool hands you a fresh one. Your audit catches it in expectation. With what probability per step? That is a coverage number, and it is the same one we pinned on allclose. Sample often enough that P(land on a dirty step) goes to one, or you own a gate that passes most afternoons and fails the demo.
One harder question, because I think the author problem followed you into the instrument. The audit recomputes random cells of the real GEMMs. Where does the audit's scratch memory come from? If it draws from the same buffer pool, the audit inherits the same uninit trap, and an instrument that shares the failure mode of the thing it measures can mask exactly the bug it was built to catch. Same shape as your dead gate, one floor down.
And the confession from my side. Every one of our 26 ops is call-local. One shape, one seed, one invocation. The whole corpus lives in your first family and cannot reach the second. Your pool bug is the first evidence I have that the trace family is even distinct, because nothing that checks a single kernel call can see it. My afternoon taught you anchors. Your month is teaching me the corpus has a wall, and state and liveness live on the far side of it.
So: does the audit allocate from the pool it audits?