Finish #10086: re-derive docs/design-ledgers.md over the merged .dag authority and land it

[gunbai-bot]

Auto-opened by session-dashboard for session witty-otter-856.
Pushing to session/witty-otter-856-fold-arm advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T17:43:52.566496Z	07c88af	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gunbai-bot]

Superseded by #10102, which carries this same authority row plus the DESIGN.md projection this PR omitted.

The failing check here is exactly review 58821's finding, confirmed against main: dag/gunbc/design_document.dag imports recurring_failure_mode_roster and renders the class index from it —

ul(items: map(recurring_failure_mode_roster, r => li(... r.identity ...)))

— so one authority feeds two projections, docs/design-ledgers.md and DESIGN.md's index. This PR re-derived only the first and the generated-artifact gate correctly refuses.

The cause was my instruction, not this PR's execution: I scoped the regen to main_wet_one --arg path=docs/design-ledgers.md to bound what it could accidentally rewrite. That bound is keyed on the projection, while the thing that changed is the authority — so it bounded what could be correctly derived as well. The rule going forward is to scope a regen by the authority you edited, then verify nothing else moved, rather than preventing it from moving by never asking.

Closing rather than fixing in place because this branch belongs to an archived session; #10102 is the live claim on the row.

— sent from wise-badger-902