diff --git a/DESIGN.md b/DESIGN.md index d7951f66872..4faf7936164 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -243,6 +243,8 @@ One row per class, each carrying its recognition rule and its receipts, in [docs - `predicate_vacuously_true_on_an_empty_domain` - `check_subject_narrower_than_its_declared_claim` - `recurrence_ledger_scoped_below_the_recurrence` +- `hedged_benefit_leaves_the_harm_axis_unexamined` +- `receipt_names_a_property_not_the_tree_it_holds_of` ## Building & checks diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index ac43fd6840d..a773f3151fe 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -109,7 +109,7 @@ data unmarked_workaround: RecurringFailureMode = RecurringFailureMode { identity data self_authorized_dissolution: RecurringFailureMode = RecurringFailureMode { identity: "self_authorized_dissolution" as NonEmptyStr, authored: "**self-authorized dissolution** (temporary work treated as admissible because the author named its future deletion — a trigger is a lifecycle fact, not permission; without an operator verdict, marked debt is rejected exactly like unmarked debt)", evidence: [] } -data positional_citation: RecurringFailureMode = RecurringFailureMode { identity: "positional_citation" as NonEmptyStr, authored: "positional citation (a `file:line` pointer where a symbol was available — see §3).", evidence: [] } +data positional_citation: RecurringFailureMode = RecurringFailureMode { identity: "positional_citation" as NonEmptyStr, authored: "positional citation (a `file:line` pointer where a symbol was available — see §3). **THE EDIT FORM IS THE SAME CLASS AND IT ALSO WRITES.** An edit anchored on NEIGHBOURING TEXT -- sed on a surrounding line, a string replace keyed on the adjacent entry, an insert before a named sibling -- is a positional handle by another spelling, and it decays for the identical reason: anything that changes above or beside the anchor invalidates it. The difference is the consequence. A stale citation misleads a reader who can still see the text; a stale ANCHOR silently does NOTHING, because a replace that matches zero times reports success. **RECEIPT (sunny-gull-270, 2026-09-02, this carrier).** Appending the row `hedged_benefit_leaves_the_harm_axis_unexamined` needed two edits: the declaration and the roster-list entry. The roster append was anchored on `one_refusal_two_destinations,` followed by the closing bracket. Between reading the file and writing it, main gained `liveness_probe_read_as_currency` as the new last entry, so the anchor stopped matching, the declaration landed and the roster entry did not, and NOTHING FAILED -- the result would have been a declared-but-unrostered class, exactly the half-applied state a roster cannot detect about itself. **WHAT CAUGHT IT IS THE TRANSFERABLE PART, and it is not vigilance: `grep -c` returning 1 where 2 was owed.** The instruction is to CHECK THE RESULT RATHER THAN THE ACTION, because a no-op edit and a successful one are indistinguishable at the actuator -- the same discipline that catches a stale citation by reading `git show origin/main:` rather than the working tree, which a manager on this same exchange used to avoid refuting a correct citation from a pinned checkout. Two instances, one root: a read and a write separated by someone else's push. **RECOGNITION RULE: any edit whose anchor is text the edit does not own. State the expected post-condition as a COUNT before applying it, and assert the count afterwards; if you cannot say what the count should become, the edit is not specified.**", evidence: [] } data bound_shaped_closure: RecurringFailureMode = RecurringFailureMode { identity: "bound_shaped_closure" as NonEmptyStr, authored: "**bound-shaped closure** (a requirement is satisfied by a number that is real, and the row it satisfies stops ranking for work. Distinct from prefix-of-the-truth, which is about what a PRODUCER reports: this is about what a CONSUMER concludes from a satisfied clause. Receipt (gunbc#9418): §4b(3) asks a declared drop for a bounded population; a whole-root emit census answers three; the emitter's first gate had returned ahead of every later check, and clearing it showed eight more that had been standing the whole time. Publishing three as THE population would have discharged 4b(3) with an honest measurement and left the class reading as closed — worse than the UNCOUNTED it replaced, because an unmet clause still ranks and a met one does not. The tell is that the satisfying figure comes from a mechanism that STOPS: a first match, an early return, a capped scan, a truncated list. **Recognition rule: before a number discharges a requirement, ask what the producer does AFTER it has enough to answer — if it returns, the number bounds the producer's patience and not the population.**)", evidence: [] } @@ -243,6 +243,10 @@ data check_subject_narrower_than_its_declared_claim: RecurringFailureMode = Recu } data recurrence_ledger_scoped_below_the_recurrence: RecurringFailureMode = RecurringFailureMode { identity: "recurrence_ledger_scoped_below_the_recurrence" as NonEmptyStr, authored: "**a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_contention_verdict` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.)", evidence: [] } +data hedged_benefit_leaves_the_harm_axis_unexamined: RecurringFailureMode = RecurringFailureMode { identity: "hedged_benefit_leaves_the_harm_axis_unexamined" as NonEmptyStr, authored: "**a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation.", evidence: [] } + +data receipt_names_a_property_not_the_tree_it_holds_of: RecurringFailureMode = RecurringFailureMode { identity: "receipt_names_a_property_not_the_tree_it_holds_of" as NonEmptyStr, authored: "**a receipt names a PROPERTY and never names the TREE it holds of, so it expires silently** (INVALID STATE: evidence of the form 'regenerating produces the committed bytes', 'the diff is zero', 'the census matches', 'the fixed point is reached' is a claim about A BASE, but is recorded and cited as a claim about A CHANGE. When the base moves the receipt keeps reading as valid while describing a tree that no longer exists. HARM: section 5 silent wrongness, and this is the WORST-SIGNALLING member of its family rather than merely another one -- a stale citation still shows the reader its text, an incompatible merge still conflicts, an absent observation still reports an absence; AN EXPIRED GREEN PRODUCES NOTHING AT ALL. Nothing goes red, no conflict is raised, and the author's own careful re-verification re-affirms it, because re-running the same command against the same stale working tree reproduces the same true-of-nothing answer. **DISTINCT FROM ITS TWO NEAREST NEIGHBOURS, and the repair law is what separates them.** `execution_provenance_loss` asks whether the observation RAN; here it ran and was valid, and then STOPPED being valid because its subject moved underneath it. `positional_citation` is a decaying HANDLE -- a pointer that no longer names what it named; here the handle is fine and it is the EVIDENCE BINDING that decayed. Different invalid states, different repairs. **SPECIMEN (sunny-gull-270, PR #10036, 2026-09-02).** The PR's entire acceptance test was that the emitted .github/workflows/witnesses.yml is byte-identical after regeneration -- a behaviour-identical refactor whose whole claim is that the bytes do not move. It was re-verified after each of three commits, and ALL THREE measurements were taken against a base main had already left: #10024 had landed and materially rewritten BOTH the authority the PR edits and the artifact under test -- re-derive the magnitudes with `git show --stat 7c310ed74c5 -- dag/gunbc/witness/witness_floor_workflow.dag .github/workflows/witnesses.yml`, which is an immutable commit and so answers the same forever. No signal at any point. The expiry was found by asking what had changed in main, not by any check. **RECOGNITION RULE, mechanical: before citing a zero-diff or byte-identity receipt as merge evidence, ask whether the base moved ON THE FILES THE RECEIPT IS ABOUT** -- `git diff --stat $(git merge-base HEAD origin/main) origin/main -- ` -- because a receipt about generated bytes is invalidated only by changes to the authorities that produce them, and a whole-repository is-my-branch-behind check is both too coarse to act on and too noisy to keep. **A SECOND, LESS OBVIOUS OBLIGATION: RE-DERIVE THE DISCRIMINATING CONTROL TOO, NOT ONLY THE RECEIPT.** A control taken before the merge proves the zero was readable on a tree that is not the one shipping, so a re-derived green beside a stale control is half a measurement. And rebuild the PRODUCER: the tree and the emitter are two inputs, and a regeneration with one of them stale proves nothing about the pair. **THE UPSIDE IS WORTH STATING BECAUSE IT CHANGES WHETHER PEOPLE DO IT: a receipt re-derived after a FOREIGN change to the same artifact is STRICTLY STRONGER than the original.** The first green only ever asks whether a projection reproduces its own base; the second asks whether it reproduces a base someone else moved -- which is where a projection that disagrees with the hand-kept form it replaced would actually surface. **RUNG FOUND AT: 1, mitigatable.** Today the only defence is an author remembering to re-derive before citing, which is exactly the defence that does not survive a tired hour. **CEILING: 2, mechanically preventable, and the reason it is not higher is that a receipt cannot make its subject stop moving -- what it can do is make the movement OBSERVABLE. NEXT TRIGGER, named as the capability and not as an artifact: a receipt CARRIES THE BASE IT WAS MEASURED ON, so a producer can compare that base against HEAD and refuse an expired receipt, rather than a person remembering to. THAT CAPABILITY IS NOT HYPOTHETICAL -- IT ALREADY EXISTS ONE SURFACE OVER, WHICH IS WHY THIS TRIGGER IS REACHABLE RATHER THAN ASPIRATIONAL: the review runner binds each review to the sha it was taken on and REFUSES on mismatch. On this row's own pull request, review 58587 failed with `worktree freshness check failed: HEAD is ad388184ac but PR #10036 head is c80c9d88db -- refusing to review a stale/wrong checkout`, and a refused review is exactly the signal an expired receipt does not produce. So reviews already carry their base and receipts do not; the gap is an UNAPPLIED mechanism rather than a missing one, and the trigger is discharged by giving regeneration receipts the binding reviews already have. **THIS CITATION CARRIES ITS OWN BASE, because a row about receipts that expire must not carry one that has.** What is DURABLE is review 58587 itself: it is retrievable from the reviews API with status=failed, sha c80c9d88db and that error text, and a completed review is a historical fact that does not decay. What is an OBSERVATION AT A TIME is the claim that the runner still behaves this way -- measured 2026-09-02, and NOT re-confirmed since, because the runner's source lives outside this repository and is not visible from a session container, so no gate here can check it and its absence from a local filesystem is not evidence either way. Sampling later pull requests for a freshness failure -- `dashboard-ops reviews `, reading each review's status and error -- found none, and that is EXPECTED RATHER THAN REASSURING: the check fires only when a head moves mid-checkout, so a sample drawn where the condition did not arise discriminates nothing and no count of it is worth carrying. **THAT UNCHECKABILITY IS ITSELF WHY THE TRIGGER NAMES A CAPABILITY AND NOT AN ARTIFACT** -- a trigger pointing at a file this repository cannot see would be satisfied or falsified by nothing observable here, which is the restoration-promise failure one row over. Until that exists this row is the mitigation and citing it as coverage is rung inflation.**", evidence: [] } + data recurring_failure_mode_roster: List = [ censored_estimator_drops_its_own_tail, selection_view_read_as_population, @@ -301,4 +305,7 @@ data recurring_failure_mode_roster: List = [ predicate_vacuously_true_on_an_empty_domain, check_subject_narrower_than_its_declared_claim, recurrence_ledger_scoped_below_the_recurrence, + + hedged_benefit_leaves_the_harm_axis_unexamined, + receipt_names_a_property_not_the_tree_it_holds_of, ] diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 76927bbff87..1d56d6c9687 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -26,7 +26,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - internal review finds missing tests, external review finds missing checks - unmarked workaround (an author-side absorbing fallback — routing around an obstacle with no dissolution trigger; the line-stop signal, never a landing state) - **self-authorized dissolution** (temporary work treated as admissible because the author named its future deletion — a trigger is a lifecycle fact, not permission; without an operator verdict, marked debt is rejected exactly like unmarked debt) -- positional citation (a `file:line` pointer where a symbol was available — see §3). +- positional citation (a `file:line` pointer where a symbol was available — see §3). **THE EDIT FORM IS THE SAME CLASS AND IT ALSO WRITES.** An edit anchored on NEIGHBOURING TEXT -- sed on a surrounding line, a string replace keyed on the adjacent entry, an insert before a named sibling -- is a positional handle by another spelling, and it decays for the identical reason: anything that changes above or beside the anchor invalidates it. The difference is the consequence. A stale citation misleads a reader who can still see the text; a stale ANCHOR silently does NOTHING, because a replace that matches zero times reports success. **RECEIPT (sunny-gull-270, 2026-09-02, this carrier).** Appending the row `hedged_benefit_leaves_the_harm_axis_unexamined` needed two edits: the declaration and the roster-list entry. The roster append was anchored on `one_refusal_two_destinations,` followed by the closing bracket. Between reading the file and writing it, main gained `liveness_probe_read_as_currency` as the new last entry, so the anchor stopped matching, the declaration landed and the roster entry did not, and NOTHING FAILED -- the result would have been a declared-but-unrostered class, exactly the half-applied state a roster cannot detect about itself. **WHAT CAUGHT IT IS THE TRANSFERABLE PART, and it is not vigilance: `grep -c` returning 1 where 2 was owed.** The instruction is to CHECK THE RESULT RATHER THAN THE ACTION, because a no-op edit and a successful one are indistinguishable at the actuator -- the same discipline that catches a stale citation by reading `git show origin/main:` rather than the working tree, which a manager on this same exchange used to avoid refuting a correct citation from a pinned checkout. Two instances, one root: a read and a write separated by someone else's push. **RECOGNITION RULE: any edit whose anchor is text the edit does not own. State the expected post-condition as a COUNT before applying it, and assert the count afterwards; if you cannot say what the count should become, the edit is not specified.** - **bound-shaped closure** (a requirement is satisfied by a number that is real, and the row it satisfies stops ranking for work. Distinct from prefix-of-the-truth, which is about what a PRODUCER reports: this is about what a CONSUMER concludes from a satisfied clause. Receipt (gunbc#9418): §4b(3) asks a declared drop for a bounded population; a whole-root emit census answers three; the emitter's first gate had returned ahead of every later check, and clearing it showed eight more that had been standing the whole time. Publishing three as THE population would have discharged 4b(3) with an honest measurement and left the class reading as closed — worse than the UNCOUNTED it replaced, because an unmet clause still ranks and a met one does not. The tell is that the satisfying figure comes from a mechanism that STOPS: a first match, an early return, a capped scan, a truncated list. **Recognition rule: before a number discharges a requirement, ask what the producer does AFTER it has enough to answer — if it returns, the number bounds the producer's patience and not the population.**) - **authority substitution** (fact F lives in carrier A; operation O is governed by carrier B; A is cited as the evidence that O changed; no A→B relation is claimed by either carrier. Nothing asserted is false — the *entailment* is invented, which is why review reads past it: both halves check out and only the arrow between them is missing. It is §3's single-authority rule read in the direction authors actually violate it — not two authorities for one fact, but one authority borrowed to answer for another's. Receipt (gunbc#8865): an expecting-red probe was enrolled in `gunbc.explicit_witness_admission`, which DOCUMENTS a known red, and the PR asserted the required floor therefore held it; the floor gates on `v2.workflow.floor_expected_red` and nothing relates the two, so CI went red on a row its author had recorded as expected. The general tell is a sentence of the form *I registered it in A, so B now does X* where B is never named — and its structural fix is never a broader guard joining every A row to B, since that manufactures exactly the entailment being invented; the guard must carry the narrow predicate, with its exceptions declared.) - **reachability read as occupancy** (a guard's arm, disposition or check is deleted because nothing currently lands in it. Three questions are in play and only the first two decide whether it should exist: *mechanism existence* — can any governing authority produce this state; *join reachability* — can that mechanism classify an element of THIS operation's denominator; *current occupancy* — does anything receive it today. **Yes / yes / zero is a healthy guard being quiet, not a dead one**, and deleting it removes a live wall while looking principled. The distinction is load-bearing because it borders a true rule pointing the other way: a check whose RED IS UNREACHABLE — no authorable input can produce it — is a decoration, permanently green and worse than absent, because it is cited as coverage. Unreachable means the red cannot be produced at all; empty means it can and nothing does. Two corollaries, each from a lane that got it wrong first. Reachability is judged against what a FIXTURE MAY AUTHOR, never what the accepted corpus contains — a regression probe is an invalid program by definition, so a state no `Accepted` program holds is usually still authorable as source, and scoping reachability to corpus-expressible is this same conflation one layer out. And an arm is reachable relative to ONE operation: `gunbc.scm`'s path-exclusion disposition is unreachable from the floor's own fold, which drops excluded subjects before inventory, yet reachable from a join over admission ROWS, which exclusion never removes — so *the arm's reachability is a property of the denominator of the operation that returns it, not of what some lower mechanism observes internally*. Both halves were found the same day by separate lanes, from opposite directions. **THE DISCRIMINATING COUNTER-SPECIMEN, which this row needed and did not have (gunbc XL-0-RECEIPT, 2026-09-01):** `gunbc.floor_component_receipt` and `gunbc.floor_component_receipt_document` were a well-built pair — schema, artifact name, path, a typed subject carrying workflow name / run id / head sha, a decoder with typed `ReceiptMemberAbsent` and `ReceiptMemberMalformed` causes, and an event-subject join refusing over three distinct mismatch arms. Read against the three questions the answer is not yes/yes/zero but **NO at the first**: nothing anywhere writes `target/floor-component-receipt.json`, no Rust carries the schema string, and `witnesses.yml` uploads four artifacts of which the receipt is not one. Their reader was the `falsifier-alert.yml` job, deleted in the 2026-08-15 CI cut. **The join is UNREACHABLE, not merely unoccupied, and that is the whole difference between retiring a dead model and deleting a live guard** — a quiet guard has a producer that could fill it, this had none. The census must be run per medium, since a survivor stops being reached silently: import graph (only its own witness test), `*_test.dag` discovery (that test is a PEER of the subject, not a guard over a survivor), workflow argv, Cargo `[[bin]]`, Rust (one string literal used as a test label, not a call), and roster rows (two `gunbc.non_fold_residue` frontier rows). **The second, costlier half — what the prose did while the model sat dead — is its own class and is rostered separately as `unbacked_execution_claim`;** what belongs HERE is only the consequence for this rule: a dead model is not harmless while it waits, because **a good model with no consumer is still residue (§6), and residue that describes itself in the present tense actively manufactures false premises.** Disposition landed: both modules and their witness test deleted, the two frontier rows removed, and every surviving citation of them rewritten to the past tense with the deletion and its date recorded — because a citation left naming a deleted symbol fakes a grep hit for the next reader.) @@ -69,6 +69,8 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. - **a check's subject is narrower than the claim it is cited for** (EVERY DEGREE OF FREEDOM IN A CHECK'S SUBJECT -- which call sites, which spellings, which lexical states, which domain, which files -- is a place its coverage can silently be narrower than the population it is read as covering. INVALID STATE: an executing, reached, green check whose declared subject is a strict superset of the population its implementation actually ranges over. RUNG: outside the ladder, because the gap is invisible from the check's own result -- a wall whose range is too narrow is green for the same reason a wall over a clean corpus is green, and DESIGN section 4b(1) reads a class's rung as the MINIMUM across its in-scope paths, so a check like this INFLATES the rung of everything it is cited for. THE ROUTE IS WHAT MAKES IT INVISIBLE: the narrowing is never a decision, it is the shape of the first implementation -- an author edits one file, so the scanner reads one file; the corpus spells the call one way, so the seed matches one spelling; the fixture has no raw strings, so the projection has no raw-string state; the window is never short, so the universal is never vacuous. Each is locally reasonable and none is written down, which is why the gap survives the review that reads the check's LOGIC and never asks what its INPUT was. SPECIMEN, and the reason this is a class rather than a bug: ONE guard in PR #10033 carried SIX instances -- (1) a body-local grep for the mutator, defeated by moving the call one helper deeper; (2) a seed matching only the fully-qualified path, defeated by `use std::env;`; (3) a lexical projection with no raw-string state, so an unbalanced brace in a fixture silently shifted every containment decision after it; (4) `take(n).all(..)`, vacuously true over a short remainder (rostered as predicate_vacuously_true_on_an_empty_domain); (5) a scan ranging over ONE FILE while the scope declaration claimed every test the required lane runs -- found by review, not by the author; and (6) after widening, cross-file call edges resolved by BARE NAME, which merges every declaration of a shared spelling (18 `main`s in that crate) and bridged one production seed into hundreds of unrelated tests. Four were found by the author, one by review, one by the widening itself, and the sixth is the mirror of the fifth: over-broad and under-broad are the same defect measured in opposite directions, and both are reported as coverage. RECOGNITION RULE: name the check's SUBJECT and the check's RANGE as two separate sentences, then ask what is in the first and not the second. If the answer is anything, the claim is the narrower one until the range is widened. The review-side tell is a scope comment that quantifies (`every test`, `all modules`, `any call site`) beside an implementation that names ONE input. BOUNDED AGAINST TWO NEIGHBOURS. selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population, arriving as the fix for a real objection; here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it. incidental_denominator_as_wall is a guard that holds by an upstream coincidence that genuinely holds; here the guard holds over a population it never read. CEILING 3, structurally guaranteed, and decidable: a check whose subject is a VALUE it receives rather than a scope its implementation re-derives cannot range over less than it claims, because the claim and the range are then one object. NEXT-RUNG TRIGGER, named as a capability: the guarded population is passed to the check as a constructed value carrying its own extent, sufficient that no check can name a subject its input does not contain. WHAT IS NOT CLAIMED: that widening always wins. Narrowing the DECLARATION to match the range is equally honest and is sometimes correct -- what is forbidden is leaving the two different, and the choice between them is a cost measurement, not a preference. On this specimen widening cost one change of input plus one linear-time rewrite of a quadratic edge builder, and the wider check ran FASTER than the narrow one, which is what settled it.) - **a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_contention_verdict` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.) +- **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation. +- **a receipt names a PROPERTY and never names the TREE it holds of, so it expires silently** (INVALID STATE: evidence of the form 'regenerating produces the committed bytes', 'the diff is zero', 'the census matches', 'the fixed point is reached' is a claim about A BASE, but is recorded and cited as a claim about A CHANGE. When the base moves the receipt keeps reading as valid while describing a tree that no longer exists. HARM: section 5 silent wrongness, and this is the WORST-SIGNALLING member of its family rather than merely another one -- a stale citation still shows the reader its text, an incompatible merge still conflicts, an absent observation still reports an absence; AN EXPIRED GREEN PRODUCES NOTHING AT ALL. Nothing goes red, no conflict is raised, and the author's own careful re-verification re-affirms it, because re-running the same command against the same stale working tree reproduces the same true-of-nothing answer. **DISTINCT FROM ITS TWO NEAREST NEIGHBOURS, and the repair law is what separates them.** `execution_provenance_loss` asks whether the observation RAN; here it ran and was valid, and then STOPPED being valid because its subject moved underneath it. `positional_citation` is a decaying HANDLE -- a pointer that no longer names what it named; here the handle is fine and it is the EVIDENCE BINDING that decayed. Different invalid states, different repairs. **SPECIMEN (sunny-gull-270, PR #10036, 2026-09-02).** The PR's entire acceptance test was that the emitted .github/workflows/witnesses.yml is byte-identical after regeneration -- a behaviour-identical refactor whose whole claim is that the bytes do not move. It was re-verified after each of three commits, and ALL THREE measurements were taken against a base main had already left: #10024 had landed and materially rewritten BOTH the authority the PR edits and the artifact under test -- re-derive the magnitudes with `git show --stat 7c310ed74c5 -- dag/gunbc/witness/witness_floor_workflow.dag .github/workflows/witnesses.yml`, which is an immutable commit and so answers the same forever. No signal at any point. The expiry was found by asking what had changed in main, not by any check. **RECOGNITION RULE, mechanical: before citing a zero-diff or byte-identity receipt as merge evidence, ask whether the base moved ON THE FILES THE RECEIPT IS ABOUT** -- `git diff --stat $(git merge-base HEAD origin/main) origin/main -- ` -- because a receipt about generated bytes is invalidated only by changes to the authorities that produce them, and a whole-repository is-my-branch-behind check is both too coarse to act on and too noisy to keep. **A SECOND, LESS OBVIOUS OBLIGATION: RE-DERIVE THE DISCRIMINATING CONTROL TOO, NOT ONLY THE RECEIPT.** A control taken before the merge proves the zero was readable on a tree that is not the one shipping, so a re-derived green beside a stale control is half a measurement. And rebuild the PRODUCER: the tree and the emitter are two inputs, and a regeneration with one of them stale proves nothing about the pair. **THE UPSIDE IS WORTH STATING BECAUSE IT CHANGES WHETHER PEOPLE DO IT: a receipt re-derived after a FOREIGN change to the same artifact is STRICTLY STRONGER than the original.** The first green only ever asks whether a projection reproduces its own base; the second asks whether it reproduces a base someone else moved -- which is where a projection that disagrees with the hand-kept form it replaced would actually surface. **RUNG FOUND AT: 1, mitigatable.** Today the only defence is an author remembering to re-derive before citing, which is exactly the defence that does not survive a tired hour. **CEILING: 2, mechanically preventable, and the reason it is not higher is that a receipt cannot make its subject stop moving -- what it can do is make the movement OBSERVABLE. NEXT TRIGGER, named as the capability and not as an artifact: a receipt CARRIES THE BASE IT WAS MEASURED ON, so a producer can compare that base against HEAD and refuse an expired receipt, rather than a person remembering to. THAT CAPABILITY IS NOT HYPOTHETICAL -- IT ALREADY EXISTS ONE SURFACE OVER, WHICH IS WHY THIS TRIGGER IS REACHABLE RATHER THAN ASPIRATIONAL: the review runner binds each review to the sha it was taken on and REFUSES on mismatch. On this row's own pull request, review 58587 failed with `worktree freshness check failed: HEAD is ad388184ac but PR #10036 head is c80c9d88db -- refusing to review a stale/wrong checkout`, and a refused review is exactly the signal an expired receipt does not produce. So reviews already carry their base and receipts do not; the gap is an UNAPPLIED mechanism rather than a missing one, and the trigger is discharged by giving regeneration receipts the binding reviews already have. **THIS CITATION CARRIES ITS OWN BASE, because a row about receipts that expire must not carry one that has.** What is DURABLE is review 58587 itself: it is retrievable from the reviews API with status=failed, sha c80c9d88db and that error text, and a completed review is a historical fact that does not decay. What is an OBSERVATION AT A TIME is the claim that the runner still behaves this way -- measured 2026-09-02, and NOT re-confirmed since, because the runner's source lives outside this repository and is not visible from a session container, so no gate here can check it and its absence from a local filesystem is not evidence either way. Sampling later pull requests for a freshness failure -- `dashboard-ops reviews `, reading each review's status and error -- found none, and that is EXPECTED RATHER THAN REASSURING: the check fires only when a head moves mid-checkout, so a sample drawn where the condition did not arise discriminates nothing and no count of it is worth carrying. **THAT UNCHECKABILITY IS ITSELF WHY THE TRIGGER NAMES A CAPABILITY AND NOT AN ARTIFACT** -- a trigger pointing at a file this repository cannot see would be satisfied or falsified by nothing observable here, which is the restoration-promise failure one row over. Until that exists this row is the mitigation and citing it as coverage is rung inflation.** ## Declared rung drops (§4b(3))