FLOOR-ROUTE-GAP-SELF-HOST: publish the executing route family that discharges the self-host behavioral witnesses from route_gap_held (49 required / 112 full)

[gunbai-bot]

What this is

ClaimSafetyOutcome and ClaimPreemptionReachability move from v2.workflow.required_floor to
v2.workflow.floor_terminal_ledger, beside the ClaimAttemptTerminal arm that carries them.
required_floor imports them back and remains a consumer.

This is a pure relocation. No arm is added, renamed, reordered, or re-payloaded.

Why it is forced, not preferred

These are TERMINAL VOCABULARY — what a claim attempt reached — declared inside a CONSUMER. The
census says so without appeal to principle: outside required_floor the family is referenced 12
times in the ledger, 12 in the wire, and 12 more across the two ledger test modules. The declaring
module was not where it was used.

That survived while only the floor and the ledger were involved. It became impossible the moment
a third module needed both. Migrating the local wet route onto the shared terminal vocabulary closes:

floor_terminal_ledger -> required_floor -> local_repo_wet_terminal -> (shared vocabulary) -> floor_terminal_ledger

claim_batch refuses at discovery with exactly that cycle. DESIGN §4 makes acyclicity the import
graph's only structural law, so the direction is decided for us.

The scope is seven symbols, and the closure is why

An earlier enumeration read the ledger's import block — which names four symbols — and concluded
those four were the dependency. An import list names what is referenced BY NAME; it cannot name
what is reached THROUGH an arm's payload. CompletedPastSafetyLimit carries
preemption: ClaimPreemptionReachability, declared in the same module. Moving only the four would
have left the relocated type referencing one that stayed behind, so the ledger would still import
required_floor and the edge would have changed which symbol it carried rather than disappearing.

So the set was taken as a transitive closure — every named import, every payload type of every
arm, recursively — rather than as a patched list:

• Declarations moved (2): ClaimSafetyOutcome, ClaimPreemptionReachability
• Their arms (5): CompletedWithinSafetyLimits, SafetyInterrupted, CompletedPastSafetyLimit,
  CooperativelyPollable, OpaqueHostCallUnbounded
• Terminates at std: every remaining payload field is Int or String. No further hop.

What stays behind, and why that is the same split the repo already made

The eight-member roster of opaque host operations that the preemption-1 rung drop is declared over
stays in required_floor. That is policy declared OVER this vocabulary, not the vocabulary. It is
the same line floor_route_gap already draws between its ground type and its expectation roster —
the repo has decided this shape once already.

Dragging the roster along would move a policy population into a vocabulary module and recreate the
wrong-direction dependency this change removes.

A §4b trigger was re-anchored and NOT retired

The ledger carried a next-rung trigger reading:

"the safety axis declared as a family in its OWNING module, with the budget-bearing sub-family
derived there rather than re-spelled here"

Every locating word in that sentence is deictic. Moving the declaration silently re-points all
three while the prose stays grammatical and readable. It does not become false — it becomes
ambiguous, which is why nothing would ever flag it. This is the positional-citation failure one
level up: not a line number that decays, but a relative reference that decays.

The trigger is restated with its location EXPLICIT, and carries a new sentence stating plainly that
this relocation does not satisfy it: the capability is the sub-family derivation, and this
change performed a move. The drop stays open at MITIGATABLE.

A relocation that appeared to retire a trigger it merely re-anchored would be a worse outcome than
the cycle this fixes — §4b(3) says a drop is retired by its trigger and by nothing else.

The stale ownership sentence is corrected rather than deleted, because it is load-bearing: it is
the reason a narrowed two-arm twin is refused, and a reader finding it naming the wrong authority
would conclude the refusal had lapsed.

Decision-equivalence

Named, not asserted: the check is dag/test/claim/preemption_reachability_witness_test.dag, the
heaviest external consumer of the moved vocabulary at 23 references, run alongside
floor_terminal_ledger_test and floor_terminal_ledger_wire_test. Results are reported in the
thread.

The fact this whole change turns on

After the move, floor_terminal_ledger imports exactly two workflow modules --
floor2_prepared_subject and floor_route_gap (the latter arriving with #10057's widening) -- and
both of those import only v2.std.*. That is the cycle OPENING rather than relocating.

This is the check to apply if you review nothing else here. A relocation that merely moved which
symbol the edge carried would leave floor_terminal_ledger -> required_floor intact under a
different name, and the migration that surfaced the cycle would fail again for the same reason one
step later. It does not: the edge is gone, not renamed. The check was run to the
leaves rather than one hop: neither of the two surviving imports names any workflow module, so
nothing reintroduces required_floor transitively.

That distinction — edge disappears vs. edge changes symbol — is also why the scope had to be taken as
a transitive closure rather than as the four symbols the import block names. Moving only those four
would have produced exactly the relocation-not-opening outcome.

Decision-equivalence, discharged by an executing gate rather than by reading the diff

The required floor executed this tree. The namespace-wave-admission phase compared
binding_rows_compared=684472 and ruled on this relocation directly. Quoted verbatim from the
required-witnesses-floor job of Actions run 33647114048:

required-ci: namespace-wave-admission SameDeclarationIdentityRebind membership
  v2.workflow.floor_terminal_ledger -> v2.workflow.required_floor — removed;
  every name it supplied still denotes the same declaration

required-ci: namespace-wave-admission ExplicitlyEvaluatedZeroDelta membership
  v2.workflow.required_floor -> v2.workflow.floor_terminal_ledger — added;
  reached by a name this module authors

Both admitted. That is a machine stating, in its own vocabulary and at corpus scale, the two claims
this PR rests on: the edge is removed rather than re-pointed, and every relocated name still
denotes the same declaration. The hand check described above agrees with it — that check is how
I knew where to look, not what the claim rests on.

The witnesses themselves passed. The floor's partition closes exactly:

planned=3487 executed=3487 not_attempted=0 terminal=3487
passed=3400 known_red_held=26 failed=0 interrupted_before_verdict=12
verdict=FloorRefused unexpected_failures=0

3487 = 3400 + 26 + 12, and both non-passing sets are enumerable by name: the twelve are all
self_host_compile_phase_frontier_witness / self_host_compile_phase_live_gate_witness, and the
twenty-six known-red are declared_type_expected_type_path_witness,
namespace_reference_derived_closure_acceptance, dag_add_emit_round_trip and
emit_ingest_python_same_language_round_trip. None is this PR's subject, so
floor_terminal_ledger_test, floor_terminal_ledger_wire_test and the preemption_reachability
witnesses executed and passed. Elimination is sound here only because the residual is fully
enumerated, which is why it is enumerated rather than resting on failed=0.

The red on this PR, disclosed rather than buried

failed=0. The floor refused because twelve witnesses were undecided at the 500ms cpu deadline,
which is correct fail-closed behaviour -- a run that did not finish looking has established nothing.

This is a declared standing rung drop, landed in #9932. It is cited here by PR number and by what it
CLAIMS rather than by its symbol name, because #10030 is renaming that row and striking its
cause-asserting sentences; the surviving proposition under either name is that an attempt's cpu
deadline does not qualify the claim as an intrinsic cost verdict -- it remains a required
attempt-safety and verdict-availability criterion. This PR neither discharges nor touches it. No
cause is asserted for the twelve here, because none has been established.

The margin is the argument, and it is stronger than "the class is pre-existing". The twelve
measured 501-506ms against a 500ms limit, with completed_over_cost_requirement=0. A witness failing
at 900ms would be consistent with the witness genuinely being expensive; a failure at 501 is not.
The same hairline was hit independently the same night by lanes that were not in contact -- rows at
exactly 500, at 502, and a separate PR refusing at 501 then 505 -- so this is a boundary shape
witnessed across lanes, not a property of this branch.

The reroll performed here is the bounded mitigation that row already admits -- at most one reroll per
head per signature, only where failed=0 and the refusal is carried entirely by its non-verdict and
cost arms, both of which hold. It is not retry-until-green, and a green reroll is not evidence the
refused rows were wrong: it is an availability outcome on a population the row establishes is redrawn
per attempt.

On the count, stated so a reviewer cannot read the citation as explaining it: twelve is higher
than the single instance on the main-only run 33644089601 at 6764d17, which carries the same
signature with no branch of mine involved. That row's enumerated instances range over 0, 1, 2, 4, 5
and 15, so twelve sits inside the documented range. What is NOT claimed is that anything here
explains why this head drew twelve -- on a redrawn population there is no per-head explanation to
give, and this should not be read as though there were.

Both attempts refused — the complete pair, disclosed

The reroll has been used and it refused again. Actions run 33647114048, both attempts on head
74719e46ddb, re-derived per attempt with
gh api repos/gunb-ai/gunbc/actions/jobs/<job>/logs --allow-escape-sequences:

	attempt 1 (job 100304546220)	attempt 2 (job 100317014535)
planned / executed / terminal	3487	3487
passed	3400	3409
known-red held	26	26
failed	0	0
interrupted_before_verdict (cpu)	12	1
completed_over_cost_requirement	0	2
verdict	FloorRefused	FloorRefused

subject=dde5f846302033c6 on both attempts, so the bytes are held fixed by construction rather than
by an argument that the diff could not matter. Attempt 2's partition closes the same way, and this
PR's witnesses are inside its 3409.

Attempt 2's single interrupted row is
self_host_compile_phase_frontier_witness.the_published_frontier_standing_does_not_claim_typeck_or_borrowck_passed
at 503ms, and that identity was also among attempt 1's twelve — so this pair is a subset, not a
disjoint redraw, and it is not offered as evidence that membership changes between attempts. The two
completed_over_cost_requirement rows are compiler_frontend_program_status_witness identities at
cpu_ms 501 and exactly 500 with outcome=pass, whose neighbours in the same module measured 481, 490
and 499. That module sits on the line: which members cross is decided by a margin smaller than
the run-to-run variation.

The bounded reroll is one per head, and it has been spent. There is therefore no legitimate path to a
green required context on this head — no further reroll, and no bypass, since a required gate
bypassed because it is inconvenient to a bystander is an escape hatch whoever opens it. failed=0 on
both attempts and nothing in either non-passing set is this PR's subject. Whether to hold or to fund
the cost work is an operator decision, not this PR's to take.