diff --git a/DESIGN.md b/DESIGN.md index 80af9c8506d..cf8816ba148 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -226,6 +226,7 @@ One row per class, each carrying its recognition rule and its receipts, in [docs - `disagreement_census_blind_to_agreed_wrong` - `undecided_fraction_read_as_denominator` - `restoration_promise_names_a_route_that_does_not_exist` +- `alias_resolution_collides_with_kernel_spelling` - `restored_bytes_reviewed_as_authorship` - `review_summary_inverts_roles_and_affirms_the_join` - `yaml_inline_comment_ingested_as_scalar_content` diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index aced04f15a2..7e730b75b41 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -141,13 +141,13 @@ data mistyped_body_radiates_nonlocal_diagnostics: RecurringFailureMode = Recurri data mitigation_injected_where_judgment_declined: RecurringFailureMode = RecurringFailureMode { identity: "mitigation_injected_where_judgment_declined" as NonEmptyStr, authored: "**mitigation injected where the judgment declined** (a downstream stage injects a RUNTIME mitigation at exactly the seam where an upstream judgment returned Undecidable, so a 4b rung-1 fallback comes to occupy the place the wall belongs and the declined seam stops looking empty. **THE LOAD-BEARING HALF IS WHAT THE COINCIDENCE PROVES ABOUT THE DECLINE**: an Undecidable verdict is normally read as benign conservatism — the facts did not settle it, nothing is claimed, no harm asserted — and a mitigation landing on the SAME LINE is the first evidence that a real defect was sitting under that silence. The decline is therefore load-bearing AT THIS SITE, which refutes reading an Undecidable verdict as evidence of ABSENCE. **IT DOES NOT MAKE THE DECLINE CENSUS PREDICTIVE, and this row carries that limit because the author first wrote the stronger claim and then measured it FALSE** on the same board that produced the specimen: 259 of 272 declines sit in modules with ZERO blocking errors, only 6 of 28 decline-bearing modules carry any error at all, and the module holding 42 of the 63 errors carries ZERO declines and 105 ACCEPTS. Declines and defects are ANTI-CORRELATED at module grain, so this specimen is ONE co-location out of 272 and a walk of the decline census would be walking sites that are ~95% empty. The class is about a mitigation landing on a declined seam; it is NOT a claim that declines predict defects. Distinct from `absorbing_fallback`, whose arm WIDENS to a superset and destroys the precise mechanism s signal; here the arm NARROWS to a panic and destroys nothing except the evidence that a judgment was owed. Distinct from `reflection_evidence_structural_proof`, which mistakes an observation for a proof; here nothing is proven or observed — a decision was declined and then papered. Specimen with a receipt, measured 2026-09-01 on gunbc 0e8c49d and unrepaired at authoring: `v2.std.diagnostic outcome_accepted` is `fn outcome_accepted(value: T) -> Outcome` with T FREE; `v2.compiler.07_target_carriers target_fidelity_quotient_optional` declares `-> Outcome>` and calls `outcome_accepted(Present \{ value: child \})`, so T instantiates to `Optional` and THE SOURCE IS CORRECT. The Rust emitter nonetheless rendered `Some(child).expect(\"fail-closed: an optional value flowed into non-optional parameter 0 of outcome_accepted (empty Optional at runtime)\")`. FOUR DEFECTS IN ONE LINE: it fires on a GENERIC formal where `Optional` is a legitimate instantiation rather than a cardinality escape, so the check does not know T is free; it substitutes a runtime panic for a compile-time judgment; the emitted code does NOT typecheck anyway (rustc E0308 expected `Option>` found `Rc`), so the mitigation buys nothing while standing where the wall belongs; and its own panic string calls itself `fail-closed`, which is 4b rung inflation inside a string literal — a diagnostic naming the discipline it violates is worse than a silent one because it will be cited as evidence the discipline holds. The coincidence that makes this a class and not a bug: `v1.compiler.infer declared_type_inhabitance` returned InhabitanceUndecidable\{UndecidableOptionalCarrier\} at that module s ONLY optional-carrier decline, 07_target_carriers.dag:128:24 parameter `value` — the same line the emitter mitigated. RUNG FOUND AT: 1 (mitigatable) on a seam whose CEILING is 3 (structurally guaranteed), since generic-formal instantiation is decidable from modeled structure. CONSEQUENCE WITH ITS OWN TRIGGER, deliberately NOT folded into this row: wiring the optional-carrier judgment is argued by this specimen but is a separate change, and its trigger is a producer at that seam that can distinguish a FREE type variable from a declared non-optional formal — until that exists the judgment would decline for the same reason it declines today.)" as NonEmptyStr, evidence: [] } +data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.)", evidence: [] } data one_refusal_two_destinations: RecurringFailureMode = RecurringFailureMode { identity: "one_refusal_two_destinations" as NonEmptyStr, authored: "**one refusal, two destinations, remedy misdirected** (a single refusal at a single source column emits two rows naming DIFFERENT expected types, because two producers resolve the same declared spelling in different environments. The reader repairs from the row that names the parameter -- and that is the row the checker did NOT refuse on. **THE SYMPTOM IS THE RECOGNITION RULE, NOT THE CAUSE**: what a debugging author encounters is one column, two rows, two expected types; the instruction that saves them is DO NOT REPAIR FROM THE INHABITANCE ROW -- the compat row is what refused. Specimen, measured 2026-09-01 on gunbc c0a378c07be by calm-boar-314 and bold-carp-449 independently, on two binaries and two phases (`gunbc compile` emit-stage refusal and `gunbc run` entry-resolve), unrepaired at authoring. A module declaring `type String = FreeMonoid` and `fn takes_bare(s: String) -> Int`, called from a foreign module that IMPORTS the function, with a deliberately wrong `Int` actual so the diagnostic must name its destination, refuses with: `type mismatch: expected 'Primitive(String)', got 'Primitive(Int)'` AND `value does not inhabit its declared type at the direct call argument for parameter 's': declared 'Node(String)', produced 'Primitive(Int)'`. THE TWO PRODUCERS, read from source rather than inferred from message shape: `v1.compiler.infer direct_call_arg_mismatch_diags` renders the compat row from the formal as the CALLER environment resolves it, and `v1.compiler.infer declared_type_obligation_diags` renders the inhabitance row from `obligation.declared` through `declared_type_inhabitance`. Both reach `type_mismatch_error` and `DeclaredTypeNotInhabited` in `v1.compiler.core`, so the rendering is shared and the DIVERGENCE IS UPSTREAM OF IT -- which is why the two rows look like one mechanism disagreeing with itself. **THE TRIGGER IS TWO COMPETING BINDINGS LIVE IN ONE RESOLVING SCOPE, NOT THE IMPORT AS SUCH**, and this row states the narrower claim deliberately: the with/without-import pair is measured, but the two AGREEING cells agree for OPPOSITE reasons -- an un-imported foreign caller agrees at `Primitive(String)` because only the kernel binding is available, and an in-module caller agrees at `Node(String)` because only the local declaration is. Phrasing the trigger as the import would make a reader conclude the class does not reproduce when some other construct puts a second binding in scope. An explicit `import \{ \}` is the ONLY construct measured to create the competition; whether any other does is UNMEASURED. Crossed arm, pre-registered before its log was read: removing the import moves ONLY the inhabitance row, from `Node(String)` to `Primitive(String)`, while the compat row is `Primitive(String)` under both -- so one producer follows the import binding and the other does not, rather than the whole reading shifting. RUNG FOUND AT: 1 (mitigatable) -- the line DOES stop, and stops located, so this is not silent wrongness; what fails is that the refusal MISDIRECTS the remedy, which is DESIGN section 5's requirement that a refusal be typed AND located read one layer deeper: located at the right column while naming the wrong destination. CEILING: 3 (structurally guaranteed) -- one resolution of a callee's declared type per call site, consumed by both producers, makes two destinations unconstructible. NEXT-RUNG TRIGGER, naming the capability rather than an artifact: a single resolved-formal authority at the call site that both the compat check and the inhabitance obligation READ, sufficient that no call-site refusal can render two different expected types for one parameter. Distinct from `meaning_fork`, which is one NAME carrying two meanings across scopes -- that is the underlying condition here and is separately rostered; this row is about two PRODUCERS disagreeing inside a single refusal, which is what makes the remedy wrong rather than merely the meaning ambiguous. Distinct from `diagnostic_name_mechanism_silent`: there the diagnostic names a mechanism that never ran; here both mechanisms ran and both reported faithfully about different environments. WHAT IS NOT CLAIMED, by either measurer: which producer is correct, and why they read the binding differently. No arm on either rig touches it, and the source reading above identifies the producers without settling which environment a call-argument formal SHOULD be resolved in.)" as NonEmptyStr, evidence: [], } -data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)", evidence: [] } data executed_conjunct_discriminates_nothing: RecurringFailureMode = RecurringFailureMode { identity: "executed_conjunct_discriminates_nothing" as NonEmptyStr, authored: "**a conjunct that executes, is reached, is gated on, and still discriminates nothing** (a predicate wired into a live check runs on every call, sits inside a gate that really blocks, and yet deletes cleanly: remove it and every witness stays green, because no fixture ever constructs the population that would make it false. **It is invisible precisely BECAUSE reachability is satisfied.** The usual signature of an unenforced mechanism -- nothing calls it -- is absent, so every reachability-based tell reports health, and review reads the conjunct as a wall because it genuinely is evaluated. Executed and enforcing are different properties, and no amount of coverage over the calling path distinguishes them. **It is bounded against three neighbours and none of their recognition rules will find it.** `reachability_read_as_occupancy` asks whether to DELETE a guard that is quiet, and warns that mechanism-yes / join-yes / occupancy-zero is a healthy guard; this class is not about deletion and not about occupancy -- the conjunct here should stay, and the defect is that it was believed to be doing work it was not. Section 6's inert-lens tell is machinery that nothing GATES on; this is gated on. Section 4b's decoration case is a check whose RED cannot be authored ANYWHERE; this RED can be authored -- it simply never was, which is the whole difference, and it is the difference between a permanent ceiling and one missing fixture. **THE REMEDY HAS TWO HALVES AND THE SECOND IS WHAT MAKES THE FIRST SOUND.** First: for each wall, run the DELETE arm and confirm EXACTLY ONE witness reddens -- not that a witness reddens. Second: the subject that isolates the conjunct must be chosen with care, because a red for the wrong reason is how this class survives its own test. **SPECIMEN, with both halves executed** (gunbc#9838, `gunbc.self_host_compile_phase_frontier`): `census_population_is_duplicate_free` was added as a conjunct of `receipt_population_coherent`, evaluated on every coherence check and reachable from the live path; deleting it left the whole witness module green. The fixture that isolates it is a receipt whose `refused_files` REPEATS A PATH -- enrolled as `a_receipt_whose_refused_population_repeats_a_path_is_refused_by_coherence` in `test.claim.self_host_compile_phase_frontier_witness`, with `the_same_receipt_without_the_repeat_is_coherent` as its positive control. The subject that looks equally good and is not: a repeated ERROR DIAGNOSTIC IDENTITY also reddens the module, but it breaks a count invariant one line over rather than this conjunct, so it would have scored the DEAD conjunct as LIVE and closed the investigation with the wall still inert. **RUNG: mechanically preventable, and the honest ceiling is the same rung rather than higher.** The unenforcing conjunct stays writable; what exists is an executed falsifier per wall, not a construction that forbids authoring one. The next-rung trigger is a CAPABILITY and not an artifact: a mechanism that derives, from the check itself, the population its removal would change -- so that a conjunct with an empty such population fails to compile rather than waiting for an author to think of the delete arm. Enumerating delete arms by hand does not retire it; it only executes this row's recognition rule once per wall. **Its near twin is `instrument_output_read_as_subject_content`, and they meet from opposite sides**: there a report is complete for the REPORTER and read as complete for the SUBJECT; here a conjunct is genuinely executed and read as genuinely discriminating. Both are the shape where the health signal the reader actually checks -- completeness there, execution here -- is fully satisfied while the property they believe it establishes does not hold. **Neither is found by checking harder along the axis that already reads green.**)", evidence: [] } @@ -194,6 +194,7 @@ data admitted_module_without_judged_standing: RecurringFailureMode = RecurringFa evidence: [], } +data alias_resolution_collides_with_kernel_spelling: RecurringFailureMode = RecurringFailureMode { identity: "alias_resolution_collides_with_kernel_spelling" as NonEmptyStr, authored: "**an instrument resolves an alias, lands on a name that COLLIDES with a kernel spelling, and attributes the result to the kernel** (the reference under measurement is authored QUALIFIED and points at a type alias; the reader resolves the alias, arrives at the alias declaration's own name, and that name is also a kernel name -- so the row is attributed to the kernel identity, naming THE EXACT CARRIER THE QUALIFICATION WAS WRITTEN TO MOVE AWAY FROM. **IT DOES NOT FAIL TO ANSWER; IT ANSWERS CONFIDENTLY AND WRONGLY**, and that is the whole severity: a missing answer is visible to its consumer and an inverted one is not, so the two rank completely differently and only the second can be cited as evidence for the opposite of what holds. **Distinct from `instrument_output_read_as_subject_content`, and the boundary is worth stating because they were found in the same instrument in the same hour**: there a report is COMPLETE for the reporter and read as complete for the consumer, so the defect is in the READING; here the report is wrong on a specific row it does examine, so the defect is in the INSTRUMENT and no amount of careful reading recovers it. Also distinct from `hollow_alias`, which is about a second name minted for one concept: the alias here is legitimate modelling, and what fails is a reader of it. **SPECIMEN, with a discriminating probe executed on covered ground (2026-09-01, gunbc#9907 follow-up).** `v1.tests.claim.carrier_realization_census` reports, for two functions appended to `v2.compiler.tokenize` on adjacent lines with identical position kind, differing only in alias-versus-concrete: a param authored `std.determinism.Determinism` keeps its dotted name, while a param authored `v2.std.text.String` comes back as bare `String` attributed to ``. `v2.std.text` declares `type String = FreeMonoid`, so the alias name collides with the kernel spelling. Both probes produced rows (17661 -> 17663), which is what makes the negative half evidence rather than absence -- the positive control is the whole discriminator, and the same census had already produced a null result on an uncovered fixture whose emptiness was indistinguishable from confirmation. **CONSEQUENCE MEASURED, NOT IMAGINED**: read naively, the census contradicted the namespace wall about nine function declarations and would have been read as nine admission rows asserting a binding the carrier lacks, on a merged PR. The wall was right; the contradiction was this bug. **RUNG: MECHANICALLY PREVENTABLE AT BEST TODAY AND CURRENTLY UNENROLLED** -- the wrong answer is produced silently and nothing executes over it. The next-rung trigger is that two-line probe being ENROLLED as a discriminating RED in any covered module, which is cheap; a class whose RED is two lines and still does not execute has no excuse, and naming the cheapness is what makes it rank rather than sit. **Recognition rule**: wherever a reader resolves through an alias, ask whether the resolved name could collide with a name in a DIFFERENT namespace the reader also knows -- kernel, prelude, or ambient -- because at that point the reader cannot tell them apart and will pick one silently.)", evidence: [] } data yaml_inline_comment_ingested_as_scalar_content: RecurringFailureMode = RecurringFailureMode { identity: "yaml_inline_comment_ingested_as_scalar_content" as NonEmptyStr, authored: "**a YAML inline comment is ingested as scalar content** (a bounded YAML reader that does not model comment separation accepts `key: value # comment` and stores `value # comment` as the value, so a syntactically valid document is silently assigned the wrong tree. Measured 2026-09-01 against `extdeps.languages.yaml.ingest` `ingest_yaml_source`: a column-zero full-line comment and an indented full-line comment both refused loudly as malformed mapping entries; an inline trailing comment was accepted and reserialized as a quoted scalar containing the comment; a hash-leading line inside a block literal was accepted and preserved as content. The last arm is the discriminating control because generated workflow run blocks contain shell comments and issue references such as `#5828`; a line-wide hash filter would reject or delete real scalar content. Repair: full-line comments are skipped only at parser block boundaries, never in literal collection, while recognizable unquoted inline comments now produce `YamlIngestRejected` until lexical inline separation is modeled. **APPROXIMATION DIRECTION:** the temporary predicate intentionally over-refuses richer unquoted scalar forms containing separation-whitespace (space or tab) followed by hash that this bounded parser does not model, excludes double-quoted scalars, and never examines block-literal content; it does not claim full YAML comment lexing. Rung: mitigatable -- the silent wrong tree becomes a typed refusal. Ceiling: structurally guaranteed once comment separation is a lexical production in the YAML grammar, so comment bytes cannot enter scalar content except through quoted or block scalar productions. Next-rung trigger: inline YAML 1.2.2 comment separation modeled lexically rather than recognized by the temporary value-text refusal.", @@ -250,6 +251,7 @@ data recurring_failure_mode_roster: List = [ disagreement_census_blind_to_agreed_wrong, undecided_fraction_read_as_denominator, restoration_promise_names_a_route_that_does_not_exist, + alias_resolution_collides_with_kernel_spelling, restored_bytes_reviewed_as_authorship, review_summary_inverts_roles_and_affirms_the_join, yaml_inline_comment_ingested_as_scalar_content, diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 2c63f789127..2e1d9d675b4 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -41,7 +41,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **meaning fork** (one scoped name carries more than one material semantic referent under hidden state; accuracy of meaning applies to terms in every layer, and for a contract-bearing name, differences in obligations, quality floor, refusal behavior, billing consequence, or remedy establish different referents. The subject is scoped: the key is the naming surface, the visible name, and the declared effective version or epoch — the same spelling in two explicitly distinct scopes or across a declared version transition is legitimate reuse, not a fork. Recognition rule: hold that key constant and vary the hidden state; if the material semantic referent changes without a distinct variant name, the name has forked — for a contract-bearing name, a change in obligations, quality floor, refusal behavior, billing consequence, or remedy is sufficient evidence of that change. This is the one-name/two-meanings dual of nicknaming.) - **externalized degradation** (an actor that accepted an obligation or risk, or caused a cost, silently shifts the resulting burden to another principal while preserving the apparent name, price, or contract. Recognition rule: identify the accepted obligation or causal responsibility, trigger the adverse state, and follow who bears the marginal burden; if another principal's burden rises while the responsible actor neither absorbs it through its reserve, refusal, or remedy path nor exposes a separately named, priced, and refusable transfer, the burden was externalized. A disclosed, refusable allocation agreed before contract formation is the transfer arm; an undisclosed or unilateral later shift is refused. The honest arms are absorb-and-reserve or separately name-and-price the transfer.) - mistyped body radiates nonlocal phantom diagnostics (LAYER, stated first because carrying this finding across it inverts its meaning: the producer is the .dag COMPILER diagnosing .dag SOURCE -- the interpreter/type-check path behind gunbc compile and the --required-regen self-compile -- NOT rustc diagnosing emitted Rust; nothing here supports discounting any rustc-diagnostic census. THE FAILURE: a type error confined to ONE module-scope fn body does not refuse at that body with a located diagnostic; it radiates as a fabricated population of field-access diagnostics at UNRELATED modules, so the line stops pointing at the wrong factories. SPECIMEN (XL-0T, PR #9720): one fn added to v1.compiler.infer_env whose body held NonEmptyStr-as-String casts in comparison/argument position plus a FilePath-vs-String if-arm mismatch produced ~700 advisory `no field 'source_indices' on type 'TypeEnv'` rows across compile.dag, 05_emit_rust.dag and 04_resolve.dag -- modules that were fine -- and blocked required-regen, which printed 12 of them and never named the defective body. A reader begins repairing the wrong files; that misdirection, not the volume, is the harm (section 5: every refusal typed AND located). FOUR-POINT DISCRIMINATOR, one instrument (entry-scoped compile of src/v1/compile.dag, counting the diagnostic): full mistyped body 774; same signature with trivial body 0; casts hoisted into let bindings with structure kept 0 phantoms plus ONE real correctly-located error at the fn's own line; that real error fixed rc=0. The series also refuted the name-capture hypothesis for this specimen, since the fn name was held constant across all four points. RUNG: outside the ladder at the diagnosed-population grain -- the fabricated rows ARE silent wrongness about the modules they name -- while the run-level verdict stayed mitigatable (the compile did refuse; it refused about the wrong subject). CEILING: structurally guaranteed -- an expression-position type failure inside a body refuses AT that body before any cross-module field-access checking consumes the poisoned inference state. NEXT-RUNG TRIGGER, naming the capability: body-local type-error containment, sufficient that no diagnostic about module B can be produced by a type defect whose every construction site is inside module A. RECOGNITION RULE: when N same-shaped field/type diagnostics appear at unrelated sites immediately after adding or editing ONE declaration, suspect that declaration's body typing before believing any named site; trivial-body the new declaration as the two-minute discriminator, and hoist casts out of comparison/argument position into let bindings to recover the located refusal.) -- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.) +- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.) - **a conjunct that executes, is reached, is gated on, and still discriminates nothing** (a predicate wired into a live check runs on every call, sits inside a gate that really blocks, and yet deletes cleanly: remove it and every witness stays green, because no fixture ever constructs the population that would make it false. **It is invisible precisely BECAUSE reachability is satisfied.** The usual signature of an unenforced mechanism -- nothing calls it -- is absent, so every reachability-based tell reports health, and review reads the conjunct as a wall because it genuinely is evaluated. Executed and enforcing are different properties, and no amount of coverage over the calling path distinguishes them. **It is bounded against three neighbours and none of their recognition rules will find it.** `reachability_read_as_occupancy` asks whether to DELETE a guard that is quiet, and warns that mechanism-yes / join-yes / occupancy-zero is a healthy guard; this class is not about deletion and not about occupancy -- the conjunct here should stay, and the defect is that it was believed to be doing work it was not. Section 6's inert-lens tell is machinery that nothing GATES on; this is gated on. Section 4b's decoration case is a check whose RED cannot be authored ANYWHERE; this RED can be authored -- it simply never was, which is the whole difference, and it is the difference between a permanent ceiling and one missing fixture. **THE REMEDY HAS TWO HALVES AND THE SECOND IS WHAT MAKES THE FIRST SOUND.** First: for each wall, run the DELETE arm and confirm EXACTLY ONE witness reddens -- not that a witness reddens. Second: the subject that isolates the conjunct must be chosen with care, because a red for the wrong reason is how this class survives its own test. **SPECIMEN, with both halves executed** (gunbc#9838, `gunbc.self_host_compile_phase_frontier`): `census_population_is_duplicate_free` was added as a conjunct of `receipt_population_coherent`, evaluated on every coherence check and reachable from the live path; deleting it left the whole witness module green. The fixture that isolates it is a receipt whose `refused_files` REPEATS A PATH -- enrolled as `a_receipt_whose_refused_population_repeats_a_path_is_refused_by_coherence` in `test.claim.self_host_compile_phase_frontier_witness`, with `the_same_receipt_without_the_repeat_is_coherent` as its positive control. The subject that looks equally good and is not: a repeated ERROR DIAGNOSTIC IDENTITY also reddens the module, but it breaks a count invariant one line over rather than this conjunct, so it would have scored the DEAD conjunct as LIVE and closed the investigation with the wall still inert. **RUNG: mechanically preventable, and the honest ceiling is the same rung rather than higher.** The unenforcing conjunct stays writable; what exists is an executed falsifier per wall, not a construction that forbids authoring one. The next-rung trigger is a CAPABILITY and not an artifact: a mechanism that derives, from the check itself, the population its removal would change -- so that a conjunct with an empty such population fails to compile rather than waiting for an author to think of the delete arm. Enumerating delete arms by hand does not retire it; it only executes this row's recognition rule once per wall. **Its near twin is `instrument_output_read_as_subject_content`, and they meet from opposite sides**: there a report is complete for the REPORTER and read as complete for the SUBJECT; here a conjunct is genuinely executed and read as genuinely discriminating. Both are the shape where the health signal the reader actually checks -- completeness there, execution here -- is fully satisfied while the property they believe it establishes does not hold. **Neither is found by checking harder along the axis that already reads green.**) - **unbacked execution claim** (prose asserts a live executing relation — this runs on X, X reads these fields, Y already resolves Z — that no authority backs, and a reader forms the premise and plans against it. §4b's CI rung drop names the harm PREMISE CONTAMINATION in its own words; this row is that harm as a general class, since the drop is about one paragraph in the canonical authority and the class is about every carrier. **THE ORIGINS ARE A FIELD OF THIS ONE ROW RATHER THAN SEPARATE ROWS, because the recognition rule is identical across them** — resolve the claim against the authority that owns the relation — **but the REMEDY BRANCHES ON THE ORIGIN, and a remedy applied without reading the origin manufactures new false statements.** Three origins are ATTESTED here and a fourth is conceivable but was NOT found. ORIGIN 1, EXECUTOR DELETED: the claim was true and its executor was removed. Specimen: `gunbc.floor_component_receipt_document` recited that an alert downloads an artifact named `floor-component-receipt` from a run id it is given and reads four named fields; that alert was `falsifier-alert.yml`, deleted 2026-08-15, and a lane read the module, believed the transport live, planned against it, and was corrected by its reviewing authority — the cost is measured, not hypothetical. Second specimen, same origin: `gunbc.ci_failure_class` stated its dissolution trigger as calling `classify_failure_reason` *the way claim_executor already resolves* `gunbc.floor_component_receipt`; `write_floor_component_receipt_at` did exactly that from 2026-07-30 (gunbc#7467) until gunbc#9228 deleted it on 2026-08-25. ORIGIN 2, THE CITED SYMBOL DIED WHILE ITS CONTENT SURVIVED AS AN ANNOTATION, and this one has a corpus-wide producer: `v1_compiler.cli_run` twice cited `floor_component_resource_checkpoint_note` and `floor_component_phase_journal_scaffold_note`, which were real `data …: String` declarations in `gunbc.floor_component_receipt` until the 2026-08-30 prose-bankruptcy sweep (gunbc#9752) converted module-scope commentary rows into §4c annotations corpus-wide. §4c makes an annotation uncitable by construction — `v1_compiler.cli_run` `annotation_erased_scan_text` feeds the semantic passes, so annotation text is not present in the tree the citation harvester walks. **THE CONSEQUENCE IS THE OPPOSITE OF THE ONE THIS ROW FIRST DREW, AND THE CORRECTION IS THE INSTRUCTIVE PART.** The first revision reasoned that the sweep therefore broke every citation of a converted row, making the population the sweep's own diff. Measured by a separate lane (gunbc XL-0-CITE, 2026-09-01) against `v1_compiler.declaration_index`, whose only citation producers are `citation_from_record_literal` and `citation_from_constructor_call`: the typed-citation breakage is **ZERO**, computed both today and as of the sweep commit, on a control that discriminates in both directions. A plain name in annotation prose was never a citation, so the sweep could not break one. What that leaves is a REAL class with an honest ceiling rather than a defect population: these citations bind READERS and no mechanism, so they sit in §4b's *outside the modeled guarantee* column — observed and repaired by reading, never gated — and calling them a dangling-citation population would have been rung inflation about a check that by construction cannot see them. The two `cli_run` sites are genuine instances of the harm and there is no mechanical census that would have found them. ORIGIN 3, WRONG AUTHORITY FOR SOMETHING THAT STILL EXECUTES: `dag/test/claim/instrument_sandbox_witness_test` says its live half `runs on the falsifier lane`; that half sits on `FalsifierSubstrateLongLane`, which `std.witness_admission` `witness_cadence_has_scheduled_route` reports routeless — but it also carries a local recipe, and `OfflineLocalRecipe` HAS a route, so the relation is live and only the named authority is wrong. THE FOURTH, NEVER BACKED AT ALL, IS NOT ATTESTED IN THIS CORPUS and is recorded as unmeasured rather than as a population. **THIS ROW IS NOT THE AUTHORITY ON ANY POPULATION, and saying so is the point:** `gunbc.deleted_cadence_reference_census` already owns the falsifier-cadence instance of origin 1 — twelve sites, a `DeletedCadenceReferenceStanding` vocabulary whose `PremiseInvalidated` arm is exactly this class, and one `GuaranteeRungDrop` filed once for the shared executor rather than per site. A pattern row that restated its population would be a second authority for a fact that already has one, which is the §3 violation this row's own remedy is meant to prevent; so the census is cited here and nothing about its contents is copied. What belongs HERE is only the recognition rule and the remedy arms, which generalize past the falsifier. **THE MECHANICAL TEST for finding one is sharper than asking whether the verb is runs or is enrolled: resolve the claim against the authority that owns the relation, and ask whether the prose implies a live route for something that authority says has none.** The naive runs/enrolled discriminator loses one arm and it is the common one — `Enrolled on falsifier_rehomed_bin_wet_entries (nightly batch 5)` is nominally an enrollment claim, which is TRUE, but `nightly` asserts a cadence that executes and `FalsifierRehomedBinWet` is routeless, so the reader forms the false premise anyway. Three outcomes per line: asserts execution (contaminating), asserts enrollment only (true, leave it), asserts enrollment while implying a live cadence (contaminating). **THE REMEDY HAS THREE ARMS, KEYED TO WHAT THE AUTHORITY SAYS NOW, and picking the wrong one is itself an instance of this class.** Origin 1 → PAST TENSE WITH THE DATE, keeping the reasoning, because the reasoning usually outlives its executor and a reader who finds a dangling claim silently deleted learns nothing. Origin 2 → name the module and the FACT rather than the dead symbol, since §4c left no symbol to cite; past-tensing here would wrongly report the content as gone when only its citability is. Origin 3 → CORRECT IT to the authority that does back it, NOT past tense: past-tensing a live relation records it as dead and is a new contamination in the opposite direction, produced by the remedy itself. Origin 4 → say it was never backed, or delete the assertion while keeping any surviving reasoning; NEVER past tense, because there is no past to record, and `X USED TO resolve Y` asserts an execution that also never happened. **The default against deletion is a default and not an absolute: a sentence whose entire content is a false execution claim has no reasoning to preserve.** **THE SELF-RECEIPT, and it is the most useful thing in this row (2026-09-01):** the first revision of this entry asserted the `ci_failure_class` clause and the two `cli_run` notes as never-true, on the strength of a grep showing they resolve nowhere TODAY. **Both were true when written**, and the row about unbacked claims therefore contained two of them. It was caught by a reviewing authority asking for verification rather than inheritance, not by any check. **RECOGNITION RULE EARNED: `resolves nowhere now` is not `never resolved`, the distinction is decided by history and not by the working tree, and the instrument is `git log --all -S` over the DECLARATION FORM** — which also separates origin 1 from origin 2 by showing WHAT deleted the referent. The neighbouring rule is `positional_citation`'s: a citation left naming a deleted symbol fakes a grep hit, so every arm above records the change rather than quietly removing the name.) - **a source-ingested module has no judged standing** (the required gates adjudicate entry-derived closures, while source-root ingest admits a larger identity population; a module outside every required closure can carry a structurally checkable defect while every gate stays green. This is NOT an import-edge class: globally unique names can resolve without a direct import, so authored inbound imports neither prove nor disprove judgment. It is also NOT a claim that every identity outside the closures is defective or should be gated. The severity is unknown, and that unknowability is the finding. **SPECIMEN AND DISCRIMINATING CONTROL** (node://adhoc-2d3c27b7-660, PR #9899): gunbc.annotation_parse_instrument_agreement constructed Terminal { reason, authority } although Terminal declares only reason; a clean required run left both build and witnesses green and both in-run judgment receipts omitted the module. The matched visible control placed the same undeclared-field construction in ordinary production module gunbc.clock_read: both required lanes refused with `field 'authority' not found in type 'LaneVisibilityControl'`; removing only the plant returned both lanes to green. Thus visibility, with defect class held constant, discriminates the arms. The witnesses prediction was weaker than its result: only submitted-closure membership was known beforehand, yet execution established strict judgment by refusing. **MEASUREMENT, EXPLICITLY NOT COVERAGE OR ENFORCEMENT:** the producer joins every first-party identity admitted by the exact source-root ingest against the union of module identities for which build or witnesses produced a strict typecheck verdict. On clean run 33484666539 it derived 4,419 admitted, 947 build-judged, 2,158 witnesses-judged, 2,319 in the judgment union, and 2,100 with no required-lane judgment. Build contributes only 161 identities beyond witnesses, so the two required closures are far from independent and their union remains close to one lane's reach. Exactly one of the 2,100 is confirmed orphaned by the executed control; the other 2,099 are Undecided because no typed authority currently says whether each is an executing standalone entry, fixture/generated/excluded, retired, or orphaned. Those identities are deliberately re-derived and NOT committed as a baseline or roster: a hand-carried 2,099-row exemption set would be a ratchet wearing a wall's name. The instrument reports; it does not refuse, and citing it as a gate is rung inflation. **PROVENANCE LIMIT:** in-run strict judgments and cross-process content-addressed cache judgments are separate columns. Required CI does not arm GUNBC_RESOLVED_GRAPH_CACHE_DIR, so the cross-process column was empty beside nonempty in-run columns in both planted and reverted runs. That empty column is a control for the unarmed premise, NOT evidence that the provenance split is exercised by required CI. **CEILING: decidable but waiting on a single standing authority.** A wall now would either false-red legitimate importer-free subjects or grandfather opaque debt. The next rung requires four capabilities together: (1) one typed standing registry exhaustively binds every first-party ingest identity to required judgment, a verified executing consumer, typed fixture/generated/exclusion, retirement, or orphan standing; (2) each executing-consumer binding is checked against the named consumer's actual roster and execution receipt, so a hollow alias cannot admit it; (3) a changed retained identity resolves only through its named consumer from materialized facts within the required floor's 8-second wall and 500-millisecond CPU envelopes, never by whole-corpus compilation; and (4) the two-direction matched undeclared-field control remains executable. At that rung admission makes the invalid state unwritable; until then this remains measurement and an Undecided population, not a defect backlog.) @@ -52,6 +52,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **a two-reader disagreement census is blind to the case where BOTH readers are wrong together** (an instrument whose subject is DISAGREEMENT between two producers of one answer reports AGREEMENT as healthy, so the population where both answer the same WRONG thing is scored green and is invisible to it by construction. The trap is that such an instrument is commissioned precisely to adjudicate a known-defective population, and it can be structurally incapable of seeing that population while looking perfectly well-formed and producing rows. **SPECIMEN, measured 2026-09-01.** `v1.tests.claim.carrier_realization_census` records, per type-reference occurrence, the legacy short-circuit key and the strict authority answer, and reports where they diverge. Its calibration control -- stated in docs/plans/carrier-realization-arbiter-repair-design.md -- requires the diagnostic-producing `DivergesWithExactIdentity` subset to reproduce arm A 25 sites, joined by source declaration and enclosing declaration, never by line. Run over the transitive import closure of `src/v2/compiler/01_tokenize.dag`, the module that emits the file where every arm-A site lives contributed 76 rows: 74 Agrees, 2 IdentityUnavailable, ZERO divergences, and all 26 of its `String`-named rows Agree. Every divergence row in the closure sat in `v2.std.text`, the DECLARING module, in the opposite direction. Empty intersection with the population the control exists to find. **THE SHAPE OF THE ABSENCE IS THE DIAGNOSIS, and it is what distinguishes this class from an over-broad walk.** `gunbc#9900` predicted the walk might visit occurrences the emitter never renders; that defect shows the target population PLUS extras. This showed the target population NOT AT ALL. Same instrument, same rows, opposite conclusions -- and only the shape separates them. **WHY BOTH READERS AGREE THERE**, read off `v1.compiler.emit_rust` `checkpoint_table_bypasses_identity_note` REACHABILITY CORRECTION rather than executed here: the short-circuit returns the host spelling before consulting any authority, and the authority answers from `type_reference_decl_file`, whose fallback returns the file containing the REFERENCE. Two readers, one wrong answer, perfect agreement. **RECOGNITION RULE: any two-reader comparison cited as CORRECTNESS coverage.** A differential oracle, a twin fixture, a cross-check, a self-hosted-versus-seed comparison, an A/B over two emitters -- each answers `do these two concur`, and none answers `is the answer right`. Ask what a SHARED error would look like in its output; if the answer is `indistinguishable from health`, the instrument cannot be the correctness evidence, whatever else it is good for. **THE REMEDY IS A DIFFERENT ORACLE, NOT A REPAIR OF THIS ONE.** The adjudicating instrument has to reach OUTSIDE the pair of readers for its ground truth -- for this specimen, a census of agreement-at-a-wrong-answer joined against emitted-crate diagnostics. Widening the occurrence set, fixing the walk, or adding a third reader that shares the same defective input do not help, and the first two are what a reader who diagnosed this as an over-broad walk would have spent. **Bounded against `executed_conjunct_discriminates_nothing`**: there a live gated conjunct never meets a population that would falsify it, and one authored fixture retires it; here the instrument meets its population on every run and reports it as healthy, so no fixture over this instrument can retire it. **Bounded against `instrument_output_read_as_subject_content`**: there the instrument answers its own question faithfully and a consumer substitutes the subject; here the instrument answers ITS OWN question faithfully too, and the defect is that its question -- do the readers concur -- was never the question that was asked.) - **a census with an unresolvable fraction of its population reports a denominator it does not have** (an occurrence census that emits a third disposition for `could not determine` is honest at the row grain and misleading at the total grain: rows scored `identity unavailable` are neither agreements nor divergences, so any ratio taken over the reported total silently treats them as decided. **SPECIMEN, unowned and unexplained at filing (2026-09-01).** The `v1.tests.claim.carrier_realization_census` run over the `src/v2/compiler/01_tokenize.dag` closure produced 121 `IdentityUnavailable` rows -- roughly a tenth of its population. The earlier run recorded in docs/plans/carrier-realization-arbiter-repair-design.md, over the same subject module at the FRONT-END phase on 2026-08-21, reported `1142 rows: 1134 Agrees, 8 DivergesWithExactIdentity, 0 IdentityUnavailable`. Zero to a tenth, across a phase change nobody predicted it for. **BOTH RUNS ARE NAMED RATHER THAN THEIR NUMBERS INHERITED**: the earlier is the front-end-phase run the design itself later withdraws as measuring the wrong phase, and the later is the typed-graph census landed by `gunbc#9900`. They are not the same instrument and the pair is recorded to locate the question, not to compute a delta from. **RECOGNITION RULE: an instrument with a `cannot answer` disposition, whose consumers aggregate over the reported total.** Ask what fraction is undecided before reading any ratio, and treat the undecided fraction as a separate finding rather than as noise. **WHY IT IS FILED WITHOUT INVESTIGATION**: identity being unavailable is a different defect from the readers disagreeing, it has no owner, and it was found while running a control for an unrelated question. A row that records it with both runs named is what stops the next reader taking the census denominator at face value.) - **a restoration promise names a route that does not exist** (a mechanism withholds, defers or dormant-marks a population and tells the reader it becomes observable again under some named condition — and that condition names a RUN, LANE, CADENCE OR SWEEP the tree does not contain. Nothing refuses, because the promise is a string in a diagnostic rather than a citation anything resolves; the population is not silently dropped, which is what makes the class survive review — it is dropped WITH A RECEIPT, and the receipt is what stops anyone looking. **THE BOUNDARY AGAINST `unbacked_execution_claim` IS THE TENSE AND IT DECIDES THE REMEDY.** That class is prose asserting a relation that RUNS NOW; this is prose asserting a relation that WILL run — a future condition, so `git log --all -S` over the declaration form finds nothing to past-tense and the origin arms there do not apply. It is also not `absorbing_fallback`: nothing widens, the withhold is precise and correctly counted. It is 4b(3)'s trigger trap with the polarity inverted — there a trigger names LESS than the capability it restores and gets satisfied while the capability stays dead; here the trigger names a capability whose PRECONDITION IS ALREADY FALSE, so it can never be satisfied at all and the row waits forever in a state that reads as temporary. **SPECIMEN WITH A RECEIPT, measured 2026-09-01 on head 4c6c509e and unrepaired at authoring.** `v1_compiler.cli_run.required_floor_runner` `suppress_withheld` removes enrolled expected-red identities whose module sits outside the required gate, printing that their enrolment `becomes observable again when the gate roster admits the module or in the whole-corpus receipts run`. THAT RUN DOES NOT EXIST: the phrase occurs exactly once in the tree, inside the message that promises it, and the repository carries three workflows of which none is it. 39 identities across 23 modules sit under that promise. Each is enrolled on `v2.workflow.floor_expected_red`, whose own header states what an enrolment asserts — that the identity REACHES ITS SUBJECT AND ANSWERS, and that a row belongs there only while someone is fixing it — so every one of the 39 asserts `runs, fails, someone is fixing it` about a row no run reaches. The only surviving route by which one executes is the changed-witness override, i.e. somebody editing it. **THE POPULATION IS DERIVABLE AND IS DELIBERATELY NOT TRANSCRIBED HERE**: it is `v2.workflow.floor_expected_red` `floor_expected_red_roster` minus the identities whose module matches `v2.workflow.required_floor` `required_gate_prefixes` — two authorities and a set difference, so it re-derives instead of rotting. **THE SAME ROSTER'S HEADER ALREADY RECORDS THE ANCESTOR OF THIS MISTAKE**, which is why it is a class: 101 rows were held there as agreement while never reaching their subject, and were reclassified into `v2.workflow.floor_route_gap` on 2026-08-20 once `ExpectedRedArm` was taught to refuse `HostEffectRefused`, `HostToolUnresolved` and an interrupted budget. That repair closed the arm where a NON-VERDICT was read as agreement; this class is the same harm one step earlier, where a row never reaches an arm at all and a sentence promises it will. **RECOGNITION RULE: whenever a diagnostic says a withheld thing becomes observable again `in`/`under`/`by` some named run, grep the tree for that name and require an executing consumer — a workflow job, a scheduled entry point, an actuator argv. If the only occurrence is the promise itself, the population is dormant forever and the honest states are two: admit the row cannot be observed on any cadence, or delete the enrolment. **RUNG: 1 (mitigatable) — the withhold is counted and located, which is the whole of what holds. CEILING: 3, since `whether a named route exists` is decidable from the workflow and entry-point authorities the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: restoration conditions expressed as a resolvable citation to an executing consumer rather than as prose, so a promise naming no route fails to compile — writing this particular sentence better retires nothing.) +- **an instrument resolves an alias, lands on a name that COLLIDES with a kernel spelling, and attributes the result to the kernel** (the reference under measurement is authored QUALIFIED and points at a type alias; the reader resolves the alias, arrives at the alias declaration's own name, and that name is also a kernel name -- so the row is attributed to the kernel identity, naming THE EXACT CARRIER THE QUALIFICATION WAS WRITTEN TO MOVE AWAY FROM. **IT DOES NOT FAIL TO ANSWER; IT ANSWERS CONFIDENTLY AND WRONGLY**, and that is the whole severity: a missing answer is visible to its consumer and an inverted one is not, so the two rank completely differently and only the second can be cited as evidence for the opposite of what holds. **Distinct from `instrument_output_read_as_subject_content`, and the boundary is worth stating because they were found in the same instrument in the same hour**: there a report is COMPLETE for the reporter and read as complete for the consumer, so the defect is in the READING; here the report is wrong on a specific row it does examine, so the defect is in the INSTRUMENT and no amount of careful reading recovers it. Also distinct from `hollow_alias`, which is about a second name minted for one concept: the alias here is legitimate modelling, and what fails is a reader of it. **SPECIMEN, with a discriminating probe executed on covered ground (2026-09-01, gunbc#9907 follow-up).** `v1.tests.claim.carrier_realization_census` reports, for two functions appended to `v2.compiler.tokenize` on adjacent lines with identical position kind, differing only in alias-versus-concrete: a param authored `std.determinism.Determinism` keeps its dotted name, while a param authored `v2.std.text.String` comes back as bare `String` attributed to ``. `v2.std.text` declares `type String = FreeMonoid`, so the alias name collides with the kernel spelling. Both probes produced rows (17661 -> 17663), which is what makes the negative half evidence rather than absence -- the positive control is the whole discriminator, and the same census had already produced a null result on an uncovered fixture whose emptiness was indistinguishable from confirmation. **CONSEQUENCE MEASURED, NOT IMAGINED**: read naively, the census contradicted the namespace wall about nine function declarations and would have been read as nine admission rows asserting a binding the carrier lacks, on a merged PR. The wall was right; the contradiction was this bug. **RUNG: MECHANICALLY PREVENTABLE AT BEST TODAY AND CURRENTLY UNENROLLED** -- the wrong answer is produced silently and nothing executes over it. The next-rung trigger is that two-line probe being ENROLLED as a discriminating RED in any covered module, which is cheap; a class whose RED is two lines and still does not execute has no excuse, and naming the cheapness is what makes it rank rather than sit. **Recognition rule**: wherever a reader resolves through an alias, ask whether the resolved name could collide with a name in a DIFFERENT namespace the reader also knows -- kernel, prelude, or ambient -- because at that point the reader cannot tell them apart and will pick one silently.) - **restored bytes reviewed as authorship** (a clobber repair returns content a prior PR already merged and a prior reviewer already accepted, but a diff has no way to say so: the restored lines are ADDED LINES, so a reviewer attributes them to the repairing PR and reviews them as new work. Specimen: gunbc#9937 restored two rows that gunbc#9868 had reverted off a stale base, and review 58203 filed REQUEST_CHANGES against a DESIGN section 6 transcribed-count defect in bytes that are character-for-character gunbc#9888's merged row -- a finding correct on its merits and misaddressed by one PR. **THE SECOND-ORDER EFFECT IS WHY THIS IS A CLASS AND NOT AN ANECDOTE: it makes clobber repairs EXPENSIVE TO LAND, which biases the fleet toward leaving clobbers standing.** The repairing lane inherits review debt for content it did not write, and the only way to discharge it inside the repair is to edit another lane's cells from a base lacking their context -- which is precisely the failure the repair exists to undo, committed a second time with better manners. RECOGNITION RULE: a diff whose added lines are byte-identical to a prior merged blob. It is DECIDABLE rather than a judgement call -- `cmp` against `git show :` answers it, and provenance for the whole region comes from `git log -S` naming the commit that added the text and the commit that removed it. THE REMEDY IS THE AUTHOR'S AND IT IS CHEAP: state the restoration ahead of the diff and carry the byte-identity receipt, so a reviewer meets provenance before content; without it the same finding is re-filed against the same bytes on every re-review, and the loop is paid for twice. A finding against restored bytes is well-formed and BINDS THE DESTINATION: provenance decides who answers it and in which diff, and never whether it is answered. **THE WRONG READING OF THIS ROW WAS AUTHORED AND REFUSED IN ITS OWN FILING** (review 58220): an earlier revision said such a finding 'belongs in its own diff', which reads as licence to merge a known defect behind an authorship argument -- DESIGN section 5's hard reject, and inverted, since a restoration is exactly the motion that puts the bytes back on main. What actually happened on the specimen is the rule: the reviewer's section 6 finding was correct, the repairing lane argued for routing it elsewhere, the owning manager OVERRULED that, and the defect was repaired inside the restoration under a ruling -- which is what made the edit a decision rather than one lane rewriting another's cells. Routing is a question about AUTHORITY and context, decided by whoever owns both lanes; the bytes are reviewed at their destination either way. **Rung: mitigatable** -- the author states the restoration and carries a byte-identity receipt, and a reviewer may still miss it. **Ceiling: mechanically preventable**, because the recognition rule is decidable: a tool that joins each added line against the merged blobs of the commits git log -S names can annotate a diff as restored before a human reads it. It is not structural -- nothing can make a restoration unwritable, nor should it. **Next-rung trigger, at capability grain: the review surface distinguishes restored bytes from authored bytes without the author asserting it**, since an author-supplied notice is exactly the evidence a tired or adversarial diff will omit. **THE RECEIPT MUST BE TAKEN AT THE DESTINATION AND NOT AT THE SOURCE, and that is the transferable half.** `cmp` decides the git case because it reads the bytes where they LANDED, not the bytes an author meant to send; the general shape is ANY step between assertion and delivery altering content while the delivery reports success -- and the step is not always the one a reader would blame first. Measured the same day in three places, and the THIRD one is a caution about naming the culprit too early: git's merge region dropped a row outside the conflict markers; a review read merged bytes as authored ones; and two sessions' messages arrived with a backticked identifier deleted and a dollar-variable replaced by a plausible shell path, which BOTH of them first attributed to the message transport. That attribution was wrong, and it was settled by measurement rather than by reasoning: a third session kept the local source of a sent message, read the delivered body back out of the store, and diffed them -- identical but for a trailing newline, with backticks, a backslash continuation and a dollar-brace token all intact. The corruption was in the SENDER'S OWN SHELL, expanding an inline double-quoted argument before the tool ever saw it, and the proposed remedy of banning backticks would have cost a real notation to avoid a hazard that lives in a construction nobody has to use. A deletion leaves a gap a reader might notice; a substitution leaves a syntactically fine claim that is simply false, which is why source-side confidence is not evidence at all.) - **a review summary that inverts real roles and then affirms the join** (a review names files that all exist, assigns each the wrong role, and closes by asserting the one property it was uniquely positioned to test. Specimen: review 58215 approved gunbc#9937 at `fafd2adc7e1` with *'restoration of two ledger rows to recurring_failure_mode.dag ... plus an accompanying prose update in the gap-analysis doc ... Diff is narrow and matches the PR title.'* The carrier held ONE added row, not two; that row was a NEW class row, not a restoration of anything; the actual restoration was the docs file it demoted to 'accompanying'; and the diff did NOT match the title, because the `.dag` file had been swept in by a staged-change leak the PR body never declared. **DISTINGUISH IT FROM A HALLUCINATED SUBJECT, which is the neighbouring failure and a much easier one:** review 58070 described a `match` arm that appeared nowhere in its diff, and an invention is refutable by grep. Here EVERY NOUN IS PRESENT IN THE TREE and only the relations between them are wrong, so the usual defence -- check that the cited things exist -- returns all-clear. **THE AFFIRMATION IS THE HARM AND NOT THE MISDESCRIPTION.** A lane cannot audit its own title-versus-diff agreement with fresh eyes; a reviewer can, and this one asserted that agreement in the exact PR where it failed. A review that stays silent on a property leaves the check undone; a review that affirms it wrongly marks the check DONE, which is worse and is why this is not merely a low-quality summary. RECOGNITION RULE, and it is decidable rather than a matter of reading care: join the changed-FILE set against what the title and body claim to change, at file grain, and refuse any file the body does not account for. That join is mechanical, needs no understanding of the diff, and would have fired here. **THE BACKSTOP QUESTION IS THE SECOND HALF OF THE ROW, and its answer is honest rather than comforting:** the leaked roster row carried no regenerated `DESIGN.md` or `docs/design-ledgers.md`, and by construction the required build lane's generated-artifact phase compares every `CommitRequired` projection against its authority, so it WOULD have refused. It did not get the chance -- that lane was CANCELLED on the leaked sha when the next push superseded it, and the leak was caught by the author re-reading the diff. So the backstop is real and was not what caught it, and a row claiming the gate held here would be asserting an execution that never ran. **Rung: mitigatable** -- the harm is contained only by a second reader noticing, and on the specimen the second reader was the author. **Ceiling: mechanically preventable**, and no higher: whether a summary DESCRIBES a diff correctly is not decidable, so no construction forbids the bad summary -- but the one clause that did the damage is decidable, because a changed-file set and a body are both machine-readable. **Next-rung trigger, at capability grain: no review verdict is admissible unless a changed-FILE-set join against the declared scope has executed and passed** -- not a reviewer instructed to check it, which is the same assertion that failed here, and not a lint on summary wording, which would ratchet the prose while leaving the join undone.) - **a YAML inline comment is ingested as scalar content** (a bounded YAML reader that does not model comment separation accepts `key: value # comment` and stores `value # comment` as the value, so a syntactically valid document is silently assigned the wrong tree. Measured 2026-09-01 against `extdeps.languages.yaml.ingest` `ingest_yaml_source`: a column-zero full-line comment and an indented full-line comment both refused loudly as malformed mapping entries; an inline trailing comment was accepted and reserialized as a quoted scalar containing the comment; a hash-leading line inside a block literal was accepted and preserved as content. The last arm is the discriminating control because generated workflow run blocks contain shell comments and issue references such as `#5828`; a line-wide hash filter would reject or delete real scalar content. Repair: full-line comments are skipped only at parser block boundaries, never in literal collection, while recognizable unquoted inline comments now produce `YamlIngestRejected` until lexical inline separation is modeled. **APPROXIMATION DIRECTION:** the temporary predicate intentionally over-refuses richer unquoted scalar forms containing separation-whitespace (space or tab) followed by hash that this bounded parser does not model, excludes double-quoted scalars, and never examines block-literal content; it does not claim full YAML comment lexing. Rung: mitigatable -- the silent wrong tree becomes a typed refusal. Ceiling: structurally guaranteed once comment separation is a lexical production in the YAML grammar, so comment bytes cannot enter scalar content except through quoted or block scalar productions. Next-rung trigger: inline YAML 1.2.2 comment separation modeled lexically rather than recognized by the temporary value-text refusal.