diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index ae037f03f68..becfe62f1f1 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -141,7 +141,7 @@ data mistyped_body_radiates_nonlocal_diagnostics: RecurringFailureMode = Recurri data mitigation_injected_where_judgment_declined: RecurringFailureMode = RecurringFailureMode { identity: "mitigation_injected_where_judgment_declined" as NonEmptyStr, authored: "**mitigation injected where the judgment declined** (a downstream stage injects a RUNTIME mitigation at exactly the seam where an upstream judgment returned Undecidable, so a 4b rung-1 fallback comes to occupy the place the wall belongs and the declined seam stops looking empty. **THE LOAD-BEARING HALF IS WHAT THE COINCIDENCE PROVES ABOUT THE DECLINE**: an Undecidable verdict is normally read as benign conservatism — the facts did not settle it, nothing is claimed, no harm asserted — and a mitigation landing on the SAME LINE is the first evidence that a real defect was sitting under that silence. The decline is therefore load-bearing AT THIS SITE, which refutes reading an Undecidable verdict as evidence of ABSENCE. **IT DOES NOT MAKE THE DECLINE CENSUS PREDICTIVE, and this row carries that limit because the author first wrote the stronger claim and then measured it FALSE** on the same board that produced the specimen: 259 of 272 declines sit in modules with ZERO blocking errors, only 6 of 28 decline-bearing modules carry any error at all, and the module holding 42 of the 63 errors carries ZERO declines and 105 ACCEPTS. Declines and defects are ANTI-CORRELATED at module grain, so this specimen is ONE co-location out of 272 and a walk of the decline census would be walking sites that are ~95% empty. The class is about a mitigation landing on a declined seam; it is NOT a claim that declines predict defects. Distinct from `absorbing_fallback`, whose arm WIDENS to a superset and destroys the precise mechanism s signal; here the arm NARROWS to a panic and destroys nothing except the evidence that a judgment was owed. Distinct from `reflection_evidence_structural_proof`, which mistakes an observation for a proof; here nothing is proven or observed — a decision was declined and then papered. Specimen with a receipt, measured 2026-09-01 on gunbc 0e8c49d and unrepaired at authoring: `v2.std.diagnostic outcome_accepted` is `fn outcome_accepted(value: T) -> Outcome` with T FREE; `v2.compiler.07_target_carriers target_fidelity_quotient_optional` declares `-> Outcome>` and calls `outcome_accepted(Present \{ value: child \})`, so T instantiates to `Optional` and THE SOURCE IS CORRECT. The Rust emitter nonetheless rendered `Some(child).expect(\"fail-closed: an optional value flowed into non-optional parameter 0 of outcome_accepted (empty Optional at runtime)\")`. FOUR DEFECTS IN ONE LINE: it fires on a GENERIC formal where `Optional` is a legitimate instantiation rather than a cardinality escape, so the check does not know T is free; it substitutes a runtime panic for a compile-time judgment; the emitted code does NOT typecheck anyway (rustc E0308 expected `Option>` found `Rc`), so the mitigation buys nothing while standing where the wall belongs; and its own panic string calls itself `fail-closed`, which is 4b rung inflation inside a string literal — a diagnostic naming the discipline it violates is worse than a silent one because it will be cited as evidence the discipline holds. The coincidence that makes this a class and not a bug: `v1.compiler.infer declared_type_inhabitance` returned InhabitanceUndecidable\{UndecidableOptionalCarrier\} at that module s ONLY optional-carrier decline, 07_target_carriers.dag:128:24 parameter `value` — the same line the emitter mitigated. RUNG FOUND AT: 1 (mitigatable) on a seam whose CEILING is 3 (structurally guaranteed), since generic-formal instantiation is decidable from modeled structure. CONSEQUENCE WITH ITS OWN TRIGGER, deliberately NOT folded into this row: wiring the optional-carrier judgment is argued by this specimen but is a separate change, and its trigger is a producer at that seam that can distinguish a FREE type variable from a declared non-optional formal — until that exists the judgment would decline for the same reason it declines today.)" as NonEmptyStr, evidence: [] } -data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.)", evidence: [] } +data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful. **THE RESOLUTION-AXIS FORM, MEASURED 2026-09-02 (bold-stag-665 specimen i, bold-carp-449 specimen ii): THE INSTRUMENT RESOLVED THE REFERENCE TO SOMETHING ADJACENT TO THE INTENDED SUBJECT AND REPORTED FAITHFULLY ABOUT WHAT IT RESOLVED TO.** The adjacency is a different VERSION or a different SPELLING; and NEITHER specimen here is temporal, which is the clearest statement of where the boundary against `stable_citation_mutable_referent` falls: the time axis went there with the attempt case. Specimen (i) reads one fixed branch against one fixed main, specimen (ii) one fixed tree against one fixed staged copy at one instant; both would answer identically tomorrow, and their adjacency is ANCESTRY and NAMING rather than time.** The forms above substitute WHAT the instrument covered for what the subject contains. Here the instrument resolves to a DIFFERENT VERSION or a DIFFERENT NAME for the same subject, and its answer carries no mark of having done so. **THE TEETH: EVERY RUNG RETURNS A WELL-FORMED PLAUSIBLE ANSWER RATHER THAN AN ERROR, SO THE WRONG ANSWER DOES NOT LOOK LIKE A FAILURE, IT LOOKS LIKE DATA.** `+76/-31` reads as a change; `five functions missing` reads as a deletion. Each arrives with a mechanism ready to explain it, which is what makes it persuasive rather than merely wrong. **THE LADDER, WHICH IS THE TRANSFERABLE PART -- EVERY RUNG BUT THE LAST IS POSITIONAL, AND EACH GOES RED FOR A DIFFERENT IRRELEVANT REASON:** line-diff is red on a REWRITE; identifier-diff is red on a RENAME; concept-mapping is the only test that decides. Identifier-absence is not the cure for line-absence, it is the SAME positional test one level up -- **absence of a NAME is not absence of a CAPABILITY, and only the second is a loss.** **SPECIMEN (i), the line rung -- an ancestry the merge destroyed.** Under SQUASH merge the squashed commit is not an ancestor of the branch, so `git diff --stat origin/main...origin/session/` re-renders ALREADY-LANDED work as unlanded: gunbc#10100 rendered 3 files, +76/-31, for content wholly present on main. The deciding test is content -- `git merge-tree --write-tree origin/main ` against `git rev-parse origin/main^\{tree\}`, identical shas meaning the merge is a no-op. A peer hit the same rendering on gunbc#9995 and reported a no-op as a 5313-line partial revert. **SPECIMEN (ii), the identifier rung -- a rename read as a deletion (bold-carp-449, whose session is archived, so this row is the specimen's only durable form).** A worktree held staged residue: `prose_citation_census.dag` staged at 576 lines against main's 802, with 56 lines staged-only; its witness test 245 against 461, 23 staged-only. The first read reasoned from SIZE to CONTENT -- main is 226 lines further along, so these must be earlier phrasings -- which is unsound because a file can grow 226 lines while independently dropping 56. The token test that replaced it pulled distinctive identifiers from each staged-only line and grepped main: 25 of 56 and 15 of 23 were ABSENT, INCLUDING FIVE WHOLE FUNCTIONS AND FOUR WHOLE TEST FNS, which reads as a substantial deletion. IT WAS ENTIRELY RENAMES. Every construct exists in main under different wording -- staged `cross_file: Bool` became main's `ProseCitationLocality = InRetiringFile | InAnotherFile | RetiringFileAmbiguous`; `prose_citation_baseline_row` became `prose_citation_baseline_reading`; `a_citation_in_the_retiring_file_is_not_cross_file` became `a_citation_in_the_retiring_file_is_local_to_it`. **TWO WERE STRICTLY STRONGER IN MAIN** -- the `Bool` became a three-arm coproduct expressing the several-paths case a `Bool` cannot, and main carried an entire second axis the staged copy lacked -- so the instrument reported a LOSS where the truth was a GAIN. What settled it was reading main's type and function definitions and asking which CONCEPT each staged construct maps onto. **RECOGNITION RULE, COVERING BOTH, AND IT MUST FIRE AT READING TIME RATHER THAN AT RETRACTION TIME:** before reading an ABSENCE or a DIFFERENCE as a fact about the subject, establish that the instrument resolved to the subject you meant -- the same version, the same concept -- because every cheap test available resolves to something adjacent and says nothing about having done so. **THE NEAR-MISSES ARE PART OF THE RECEIPT AND ARE WHY THIS IS FILED AT ALL.** Neither reached a wrong decision and each halted one step short: the no-op diffstat was settled by tree sha before anyone acted on reopening; the deletion was settled by concept-mapping before anything was restored. A class whose specimens each halt one step from harm names exactly what the recognition rule has to beat. **BOUNDED AGAINST THE FOUR NEAREST ROWS, and these boundaries are the justification for a form here rather than a fourth authority.** `receipt_names_a_property_not_the_tree_it_holds_of` is a RECEIPT that was valid and EXPIRED when its base moved, repaired by re-deriving against the new base; here nothing expires -- every reading is live and true of its own subject, and the defect is manufactured by JOINING two of them. `positional_citation` is an authored HANDLE that decays and fails by matching zero; here the handle keeps matching perfectly and returns a confident answer about something else -- and note the sharper relation, that specimen (ii) shows an identifier GREP is itself a positional test, so `positional_citation` names the decaying-pointer half while this row names the unsound-absence half. `execution_provenance_loss` asks whether the observation ran; here it ran and reported faithfully. `stable_citation_mutable_referent` is the boundary that decides what this form does NOT carry, and it is the sharpest of the four because the two look identical at the call site -- both are a confident well-formed answer about a subject the reader did not mean. **THE TEST THAT SEPARATES THEM IS NOT WHETHER THEY FEEL DIFFERENT BUT WHETHER THE REPAIRS TRANSFER: does a reader who correctly diagnoses one perform the RIGHT FIX for the other? No -- and each fix is actively wrong applied to the other, which is why this is a boundary rather than a framing.** There the identifier resolves to its own correct subject and the WORLD replaces the content served underneath it, so the reader's test was right and re-reading CONFIRMS the wrong answer; the repair is to pin the citation to something that cannot be replaced -- an attempt number, a sha, an immutable artifact. Here nothing is replaced and nothing moves: every reading is live and would be identical tomorrow, the reader's TEST is what resolved to the neighbouring question, and the repair is to change the test rather than the citation -- line-diff to identifier-diff to concept-mapping. Crossed over, both fixes fail: PIN a squash-merge two-dot and you have pinned a merge base that was always the wrong one, and CONCEPT-MAP two attempts and you conclude a migration is real without ever establishing the two readings share a subject. That is why the ATTEMPT axis is not in the list above and why the job-id receipt is filed there rather than here: an attempt genuinely was replaced, which is that class and not this one. All of them share provenance-intact subject substitution, which is why this is a FORM of this row and not a new one.)", evidence: [] } data one_refusal_two_destinations: RecurringFailureMode = RecurringFailureMode { identity: "one_refusal_two_destinations" as NonEmptyStr, authored: "**one refusal, two destinations, remedy misdirected** (a single refusal at a single source column emits two rows naming DIFFERENT expected types, because two producers resolve the same declared spelling in different environments. The reader repairs from the row that names the parameter -- and that is the row the checker did NOT refuse on. **THE SYMPTOM IS THE RECOGNITION RULE, NOT THE CAUSE**: what a debugging author encounters is one column, two rows, two expected types; the instruction that saves them is DO NOT REPAIR FROM THE INHABITANCE ROW -- the compat row is what refused. Specimen, measured 2026-09-01 on gunbc c0a378c07be by calm-boar-314 and bold-carp-449 independently, on two binaries and two phases (`gunbc compile` emit-stage refusal and `gunbc run` entry-resolve), unrepaired at authoring. A module declaring `type String = FreeMonoid` and `fn takes_bare(s: String) -> Int`, called from a foreign module that IMPORTS the function, with a deliberately wrong `Int` actual so the diagnostic must name its destination, refuses with: `type mismatch: expected 'Primitive(String)', got 'Primitive(Int)'` AND `value does not inhabit its declared type at the direct call argument for parameter 's': declared 'Node(String)', produced 'Primitive(Int)'`. THE TWO PRODUCERS, read from source rather than inferred from message shape: `v1.compiler.infer direct_call_arg_mismatch_diags` renders the compat row from the formal as the CALLER environment resolves it, and `v1.compiler.infer declared_type_obligation_diags` renders the inhabitance row from `obligation.declared` through `declared_type_inhabitance`. Both reach `type_mismatch_error` and `DeclaredTypeNotInhabited` in `v1.compiler.core`, so the rendering is shared and the DIVERGENCE IS UPSTREAM OF IT -- which is why the two rows look like one mechanism disagreeing with itself. **THE TRIGGER IS TWO COMPETING BINDINGS LIVE IN ONE RESOLVING SCOPE, NOT THE IMPORT AS SUCH**, and this row states the narrower claim deliberately: the with/without-import pair is measured, but the two AGREEING cells agree for OPPOSITE reasons -- an un-imported foreign caller agrees at `Primitive(String)` because only the kernel binding is available, and an in-module caller agrees at `Node(String)` because only the local declaration is. Phrasing the trigger as the import would make a reader conclude the class does not reproduce when some other construct puts a second binding in scope. An explicit `import \{ \}` is the ONLY construct measured to create the competition; whether any other does is UNMEASURED. Crossed arm, pre-registered before its log was read: removing the import moves ONLY the inhabitance row, from `Node(String)` to `Primitive(String)`, while the compat row is `Primitive(String)` under both -- so one producer follows the import binding and the other does not, rather than the whole reading shifting. RUNG FOUND AT: 1 (mitigatable) -- the line DOES stop, and stops located, so this is not silent wrongness; what fails is that the refusal MISDIRECTS the remedy, which is DESIGN section 5's requirement that a refusal be typed AND located read one layer deeper: located at the right column while naming the wrong destination. CEILING: 3 (structurally guaranteed) -- one resolution of a callee's declared type per call site, consumed by both producers, makes two destinations unconstructible. NEXT-RUNG TRIGGER, naming the capability rather than an artifact: a single resolved-formal authority at the call site that both the compat check and the inhabitance obligation READ, sufficient that no call-site refusal can render two different expected types for one parameter. Distinct from `meaning_fork`, which is one NAME carrying two meanings across scopes -- that is the underlying condition here and is separately rostered; this row is about two PRODUCERS disagreeing inside a single refusal, which is what makes the remedy wrong rather than merely the meaning ambiguous. Distinct from `diagnostic_name_mechanism_silent`: there the diagnostic names a mechanism that never ran; here both mechanisms ran and both reported faithfully about different environments. WHAT IS NOT CLAIMED, by either measurer: which producer is correct, and why they read the binding differently. No arm on either rig touches it, and the source reading above identifies the producers without settling which environment a call-argument formal SHOULD be resolved in.)" as NonEmptyStr, @@ -247,7 +247,7 @@ data check_subject_narrower_than_its_declared_claim: RecurringFailureMode = Recu evidence: [], } data recurrence_ledger_scoped_below_the_recurrence: RecurringFailureMode = RecurringFailureMode { identity: "recurrence_ledger_scoped_below_the_recurrence" as NonEmptyStr, authored: "**a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.)", evidence: [] } -data stable_citation_mutable_referent: RecurringFailureMode = RecurringFailureMode { identity: "stable_citation_mutable_referent" as NonEmptyStr, authored: "**stable citation, mutable referent** (an identifier that names a thing correctly and forever, while the CONTENT served for it is replaced underneath. Distinct from `positional_citation`, and the difference is what makes it worse: a `file:line` pointer goes stale under an edit above it, and re-reading the file EXPOSES that — the symbol is not there, or a different one is. Here re-reading the citation CONFIRMS the wrong answer, because the identifier still resolves, still returns content of the expected shape, and reports no error. There is no red anywhere. Receipt (2026-09-02, gunbc#10042): a GitHub Actions JOB ID was cited as the source of a floor measurement. A job id names the job; the logs API serves the LATEST ATTEMPT. A rerun replaces the attempt, so job 100217416636 served six budget-refused identities when first read and thirteen when read back, and the second reading was byte-identical to a DIFFERENT job id — two ids, one attempt. A cross-run comparison built on those readings appeared to compare two runs while one side had been replaced underneath, and the damage ran in BOTH directions: a near-disjointness claim that was simply false, and a real bucket migration that was retracted as unfounded because it could no longer be reproduced through the citation that found it. The second is the more expensive error — a true finding withdrawn, downstream prose rewritten in four places to remove it, and a merge rule changed — and it is the one a reader would not think to look for, because a retraction feels like the conservative move. THE DEFAULT CITATION IS THE TRAP AND THE PINNED ONE IS THE REMEDY, and both were measured rather than assumed: `gh run view --job --log` serves the latest attempt, but the attempt-pinned REST path — `/repos/OWNER/REPO/actions/runs/RUNID/attempts/N/logs` still serves attempt 1 in full. Recovering it confirmed the original six-row reading exactly, and confirmed that `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` is INTERRUPTED in attempt 1 and COMPLETED-OVER-COST in attempt 2 — a real migration across the two populations, not the artifact it was briefly retracted as. So the class is not that the earlier subject is destroyed; it is that the ORDINARY way of citing it silently resolves to a different one, and a reader who re-reads the same citation to check gets agreement instead of a contradiction. **Recognition rule: before comparing two readings of one producer, ask whether the producer serves a STABLE SUBJECT for a fixed citation — not whether the citation is well-formed. An identifier that addresses a CONTAINER (a job, a branch, a latest, a mutable tag, a rolling window) serves whatever currently occupies it, so two readings of one citation are two subjects and their DELTA is uninterpretable. Cite the thing that cannot be replaced — the attempt, the commit, the immutable artifact — or capture the content at read time and say when.** The receipt worth keeping is that this survived the diligence that should have caught it: the same author had, that morning, REFUSED to file a transcribed measurement on the §6 grounds that no producer owned the number, and then built a delta out of a producer that mutates what it serves for a fixed id. Naming the instrument is not sufficient if the instrument does not serve a stable subject.)", evidence: [] } +data stable_citation_mutable_referent: RecurringFailureMode = RecurringFailureMode { identity: "stable_citation_mutable_referent" as NonEmptyStr, authored: "**stable citation, mutable referent** (an identifier that names a thing correctly and forever, while the CONTENT served for it is replaced underneath. Distinct from `positional_citation`, and the difference is what makes it worse: a `file:line` pointer goes stale under an edit above it, and re-reading the file EXPOSES that — the symbol is not there, or a different one is. Here re-reading the citation CONFIRMS the wrong answer, because the identifier still resolves, still returns content of the expected shape, and reports no error. There is no red anywhere. Receipt (2026-09-02, gunbc#10042): a GitHub Actions JOB ID was cited as the source of a floor measurement. A job id names the job; the logs API serves the LATEST ATTEMPT. A rerun replaces the attempt, so job 100217416636 served six budget-refused identities when first read and thirteen when read back, and the second reading was byte-identical to a DIFFERENT job id — two ids, one attempt. A cross-run comparison built on those readings appeared to compare two runs while one side had been replaced underneath, and the damage ran in BOTH directions: a near-disjointness claim that was simply false, and a real bucket migration that was retracted as unfounded because it could no longer be reproduced through the citation that found it. The second is the more expensive error — a true finding withdrawn, downstream prose rewritten in four places to remove it, and a merge rule changed — and it is the one a reader would not think to look for, because a retraction feels like the conservative move. THE DEFAULT CITATION IS THE TRAP AND THE PINNED ONE IS THE REMEDY, and both were measured rather than assumed: `gh run view --job --log` serves the latest attempt, but the attempt-pinned REST path — `/repos/OWNER/REPO/actions/runs/RUNID/attempts/N/logs` still serves attempt 1 in full. Recovering it confirmed the original six-row reading exactly, and confirmed that `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` is INTERRUPTED in attempt 1 and COMPLETED-OVER-COST in attempt 2 — a real migration across the two populations, not the artifact it was briefly retracted as. So the class is not that the earlier subject is destroyed; it is that the ORDINARY way of citing it silently resolves to a different one, and a reader who re-reads the same citation to check gets agreement instead of a contradiction. **Recognition rule: before comparing two readings of one producer, ask whether the producer serves a STABLE SUBJECT for a fixed citation — not whether the citation is well-formed. An identifier that addresses a CONTAINER (a job, a branch, a latest, a mutable tag, a rolling window) serves whatever currently occupies it, so two readings of one citation are two subjects and their DELTA is uninterpretable. Cite the thing that cannot be replaced — the attempt, the commit, the immutable artifact — or capture the content at read time and say when.** The receipt worth keeping is that this survived the diligence that should have caught it: the same author had, that morning, REFUSED to file a transcribed measurement on the §6 grounds that no producer owned the number, and then built a delta out of a producer that mutates what it serves for a fixed id. Naming the instrument is not sufficient if the instrument does not serve a stable subject. One diagnostic tell for the delta itself, preserved here from gunbc#10130 where it was measured against this same receipt: the two readings were differenced into a `3 -> 6 -> 13` upward trend with a memory-pressure mechanism attached, the `3` having additionally come from a different head — and monotone growth is precisely what independent draws at a fixed distance from a budget do NOT produce. The shape that made the artifact persuasive was the evidence against it, so the tell is available BEFORE the referent is re-checked: a delta through a container-addressing citation that arrives already fitting a story is the reading to distrust first.)", evidence: [] } data hedged_benefit_leaves_the_harm_axis_unexamined: RecurringFailureMode = RecurringFailureMode { identity: "hedged_benefit_leaves_the_harm_axis_unexamined" as NonEmptyStr, authored: "**a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation.", evidence: [] } diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 9e47182c2a6..f4ccc795c3d 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -112,7 +112,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **meaning fork** (one scoped name carries more than one material semantic referent under hidden state; accuracy of meaning applies to terms in every layer, and for a contract-bearing name, differences in obligations, quality floor, refusal behavior, billing consequence, or remedy establish different referents. The subject is scoped: the key is the naming surface, the visible name, and the declared effective version or epoch — the same spelling in two explicitly distinct scopes or across a declared version transition is legitimate reuse, not a fork. Recognition rule: hold that key constant and vary the hidden state; if the material semantic referent changes without a distinct variant name, the name has forked — for a contract-bearing name, a change in obligations, quality floor, refusal behavior, billing consequence, or remedy is sufficient evidence of that change. This is the one-name/two-meanings dual of nicknaming.) - **externalized degradation** (an actor that accepted an obligation or risk, or caused a cost, silently shifts the resulting burden to another principal while preserving the apparent name, price, or contract. Recognition rule: identify the accepted obligation or causal responsibility, trigger the adverse state, and follow who bears the marginal burden; if another principal's burden rises while the responsible actor neither absorbs it through its reserve, refusal, or remedy path nor exposes a separately named, priced, and refusable transfer, the burden was externalized. A disclosed, refusable allocation agreed before contract formation is the transfer arm; an undisclosed or unilateral later shift is refused. The honest arms are absorb-and-reserve or separately name-and-price the transfer.) - mistyped body radiates nonlocal phantom diagnostics (LAYER, stated first because carrying this finding across it inverts its meaning: the producer is the .dag COMPILER diagnosing .dag SOURCE -- the interpreter/type-check path behind gunbc compile and the --required-regen self-compile -- NOT rustc diagnosing emitted Rust; nothing here supports discounting any rustc-diagnostic census. THE FAILURE: a type error confined to ONE module-scope fn body does not refuse at that body with a located diagnostic; it radiates as a fabricated population of field-access diagnostics at UNRELATED modules, so the line stops pointing at the wrong factories. SPECIMEN (XL-0T, PR #9720): one fn added to v1.compiler.infer_env whose body held NonEmptyStr-as-String casts in comparison/argument position plus a FilePath-vs-String if-arm mismatch produced ~700 advisory `no field 'source_indices' on type 'TypeEnv'` rows across compile.dag, 05_emit_rust.dag and 04_resolve.dag -- modules that were fine -- and blocked required-regen, which printed 12 of them and never named the defective body. A reader begins repairing the wrong files; that misdirection, not the volume, is the harm (section 5: every refusal typed AND located). FOUR-POINT DISCRIMINATOR, one instrument (entry-scoped compile of src/v1/compile.dag, counting the diagnostic): full mistyped body 774; same signature with trivial body 0; casts hoisted into let bindings with structure kept 0 phantoms plus ONE real correctly-located error at the fn's own line; that real error fixed rc=0. The series also refuted the name-capture hypothesis for this specimen, since the fn name was held constant across all four points. RUNG: outside the ladder at the diagnosed-population grain -- the fabricated rows ARE silent wrongness about the modules they name -- while the run-level verdict stayed mitigatable (the compile did refuse; it refused about the wrong subject). CEILING: structurally guaranteed -- an expression-position type failure inside a body refuses AT that body before any cross-module field-access checking consumes the poisoned inference state. NEXT-RUNG TRIGGER, naming the capability: body-local type-error containment, sufficient that no diagnostic about module B can be produced by a type defect whose every construction site is inside module A. RECOGNITION RULE: when N same-shaped field/type diagnostics appear at unrelated sites immediately after adding or editing ONE declaration, suspect that declaration's body typing before believing any named site; trivial-body the new declaration as the two-minute discriminator, and hoist casts out of comparison/argument position into let bindings to recover the located refusal.) -- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.) +- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 `) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful. **THE RESOLUTION-AXIS FORM, MEASURED 2026-09-02 (bold-stag-665 specimen i, bold-carp-449 specimen ii): THE INSTRUMENT RESOLVED THE REFERENCE TO SOMETHING ADJACENT TO THE INTENDED SUBJECT AND REPORTED FAITHFULLY ABOUT WHAT IT RESOLVED TO.** The adjacency is a different VERSION or a different SPELLING; and NEITHER specimen here is temporal, which is the clearest statement of where the boundary against `stable_citation_mutable_referent` falls: the time axis went there with the attempt case. Specimen (i) reads one fixed branch against one fixed main, specimen (ii) one fixed tree against one fixed staged copy at one instant; both would answer identically tomorrow, and their adjacency is ANCESTRY and NAMING rather than time.** The forms above substitute WHAT the instrument covered for what the subject contains. Here the instrument resolves to a DIFFERENT VERSION or a DIFFERENT NAME for the same subject, and its answer carries no mark of having done so. **THE TEETH: EVERY RUNG RETURNS A WELL-FORMED PLAUSIBLE ANSWER RATHER THAN AN ERROR, SO THE WRONG ANSWER DOES NOT LOOK LIKE A FAILURE, IT LOOKS LIKE DATA.** `+76/-31` reads as a change; `five functions missing` reads as a deletion. Each arrives with a mechanism ready to explain it, which is what makes it persuasive rather than merely wrong. **THE LADDER, WHICH IS THE TRANSFERABLE PART -- EVERY RUNG BUT THE LAST IS POSITIONAL, AND EACH GOES RED FOR A DIFFERENT IRRELEVANT REASON:** line-diff is red on a REWRITE; identifier-diff is red on a RENAME; concept-mapping is the only test that decides. Identifier-absence is not the cure for line-absence, it is the SAME positional test one level up -- **absence of a NAME is not absence of a CAPABILITY, and only the second is a loss.** **SPECIMEN (i), the line rung -- an ancestry the merge destroyed.** Under SQUASH merge the squashed commit is not an ancestor of the branch, so `git diff --stat origin/main...origin/session/` re-renders ALREADY-LANDED work as unlanded: gunbc#10100 rendered 3 files, +76/-31, for content wholly present on main. The deciding test is content -- `git merge-tree --write-tree origin/main ` against `git rev-parse origin/main^{tree}`, identical shas meaning the merge is a no-op. A peer hit the same rendering on gunbc#9995 and reported a no-op as a 5313-line partial revert. **SPECIMEN (ii), the identifier rung -- a rename read as a deletion (bold-carp-449, whose session is archived, so this row is the specimen's only durable form).** A worktree held staged residue: `prose_citation_census.dag` staged at 576 lines against main's 802, with 56 lines staged-only; its witness test 245 against 461, 23 staged-only. The first read reasoned from SIZE to CONTENT -- main is 226 lines further along, so these must be earlier phrasings -- which is unsound because a file can grow 226 lines while independently dropping 56. The token test that replaced it pulled distinctive identifiers from each staged-only line and grepped main: 25 of 56 and 15 of 23 were ABSENT, INCLUDING FIVE WHOLE FUNCTIONS AND FOUR WHOLE TEST FNS, which reads as a substantial deletion. IT WAS ENTIRELY RENAMES. Every construct exists in main under different wording -- staged `cross_file: Bool` became main's `ProseCitationLocality = InRetiringFile | InAnotherFile | RetiringFileAmbiguous`; `prose_citation_baseline_row` became `prose_citation_baseline_reading`; `a_citation_in_the_retiring_file_is_not_cross_file` became `a_citation_in_the_retiring_file_is_local_to_it`. **TWO WERE STRICTLY STRONGER IN MAIN** -- the `Bool` became a three-arm coproduct expressing the several-paths case a `Bool` cannot, and main carried an entire second axis the staged copy lacked -- so the instrument reported a LOSS where the truth was a GAIN. What settled it was reading main's type and function definitions and asking which CONCEPT each staged construct maps onto. **RECOGNITION RULE, COVERING BOTH, AND IT MUST FIRE AT READING TIME RATHER THAN AT RETRACTION TIME:** before reading an ABSENCE or a DIFFERENCE as a fact about the subject, establish that the instrument resolved to the subject you meant -- the same version, the same concept -- because every cheap test available resolves to something adjacent and says nothing about having done so. **THE NEAR-MISSES ARE PART OF THE RECEIPT AND ARE WHY THIS IS FILED AT ALL.** Neither reached a wrong decision and each halted one step short: the no-op diffstat was settled by tree sha before anyone acted on reopening; the deletion was settled by concept-mapping before anything was restored. A class whose specimens each halt one step from harm names exactly what the recognition rule has to beat. **BOUNDED AGAINST THE FOUR NEAREST ROWS, and these boundaries are the justification for a form here rather than a fourth authority.** `receipt_names_a_property_not_the_tree_it_holds_of` is a RECEIPT that was valid and EXPIRED when its base moved, repaired by re-deriving against the new base; here nothing expires -- every reading is live and true of its own subject, and the defect is manufactured by JOINING two of them. `positional_citation` is an authored HANDLE that decays and fails by matching zero; here the handle keeps matching perfectly and returns a confident answer about something else -- and note the sharper relation, that specimen (ii) shows an identifier GREP is itself a positional test, so `positional_citation` names the decaying-pointer half while this row names the unsound-absence half. `execution_provenance_loss` asks whether the observation ran; here it ran and reported faithfully. `stable_citation_mutable_referent` is the boundary that decides what this form does NOT carry, and it is the sharpest of the four because the two look identical at the call site -- both are a confident well-formed answer about a subject the reader did not mean. **THE TEST THAT SEPARATES THEM IS NOT WHETHER THEY FEEL DIFFERENT BUT WHETHER THE REPAIRS TRANSFER: does a reader who correctly diagnoses one perform the RIGHT FIX for the other? No -- and each fix is actively wrong applied to the other, which is why this is a boundary rather than a framing.** There the identifier resolves to its own correct subject and the WORLD replaces the content served underneath it, so the reader's test was right and re-reading CONFIRMS the wrong answer; the repair is to pin the citation to something that cannot be replaced -- an attempt number, a sha, an immutable artifact. Here nothing is replaced and nothing moves: every reading is live and would be identical tomorrow, the reader's TEST is what resolved to the neighbouring question, and the repair is to change the test rather than the citation -- line-diff to identifier-diff to concept-mapping. Crossed over, both fixes fail: PIN a squash-merge two-dot and you have pinned a merge base that was always the wrong one, and CONCEPT-MAP two attempts and you conclude a migration is real without ever establishing the two readings share a subject. That is why the ATTEMPT axis is not in the list above and why the job-id receipt is filed there rather than here: an attempt genuinely was replaced, which is that class and not this one. All of them share provenance-intact subject substitution, which is why this is a FORM of this row and not a new one.) - **a conjunct that executes, is reached, is gated on, and still discriminates nothing** (a predicate wired into a live check runs on every call, sits inside a gate that really blocks, and yet deletes cleanly: remove it and every witness stays green, because no fixture ever constructs the population that would make it false. **It is invisible precisely BECAUSE reachability is satisfied.** The usual signature of an unenforced mechanism -- nothing calls it -- is absent, so every reachability-based tell reports health, and review reads the conjunct as a wall because it genuinely is evaluated. Executed and enforcing are different properties, and no amount of coverage over the calling path distinguishes them. **It is bounded against three neighbours and none of their recognition rules will find it.** `reachability_read_as_occupancy` asks whether to DELETE a guard that is quiet, and warns that mechanism-yes / join-yes / occupancy-zero is a healthy guard; this class is not about deletion and not about occupancy -- the conjunct here should stay, and the defect is that it was believed to be doing work it was not. Section 6's inert-lens tell is machinery that nothing GATES on; this is gated on. Section 4b's decoration case is a check whose RED cannot be authored ANYWHERE; this RED can be authored -- it simply never was, which is the whole difference, and it is the difference between a permanent ceiling and one missing fixture. **THE REMEDY HAS TWO HALVES AND THE SECOND IS WHAT MAKES THE FIRST SOUND.** First: for each wall, run the DELETE arm and confirm EXACTLY ONE witness reddens -- not that a witness reddens. Second: the subject that isolates the conjunct must be chosen with care, because a red for the wrong reason is how this class survives its own test. **SPECIMEN, with both halves executed** (gunbc#9838, `gunbc.self_host_compile_phase_frontier`): `census_population_is_duplicate_free` was added as a conjunct of `receipt_population_coherent`, evaluated on every coherence check and reachable from the live path; deleting it left the whole witness module green. The fixture that isolates it is a receipt whose `refused_files` REPEATS A PATH -- enrolled as `a_receipt_whose_refused_population_repeats_a_path_is_refused_by_coherence` in `test.claim.self_host_compile_phase_frontier_witness`, with `the_same_receipt_without_the_repeat_is_coherent` as its positive control. The subject that looks equally good and is not: a repeated ERROR DIAGNOSTIC IDENTITY also reddens the module, but it breaks a count invariant one line over rather than this conjunct, so it would have scored the DEAD conjunct as LIVE and closed the investigation with the wall still inert. **RUNG: mechanically preventable, and the honest ceiling is the same rung rather than higher.** The unenforcing conjunct stays writable; what exists is an executed falsifier per wall, not a construction that forbids authoring one. The next-rung trigger is a CAPABILITY and not an artifact: a mechanism that derives, from the check itself, the population its removal would change -- so that a conjunct with an empty such population fails to compile rather than waiting for an author to think of the delete arm. Enumerating delete arms by hand does not retire it; it only executes this row's recognition rule once per wall. **Its near twin is `instrument_output_read_as_subject_content`, and they meet from opposite sides**: there a report is complete for the REPORTER and read as complete for the SUBJECT; here a conjunct is genuinely executed and read as genuinely discriminating. Both are the shape where the health signal the reader actually checks -- completeness there, execution here -- is fully satisfied while the property they believe it establishes does not hold. **Neither is found by checking harder along the axis that already reads green.** **SECOND SPECIMEN, 2026-09-02, the same shape one layer down and found by a different tell.** `v1.stage0.required_regen_host` `admit_stage_execution_from_model` built ONE identity list from the stage plan and passed it as BOTH the `planned` and the `executed` field of `RegenStageExecutionObservation`, so `v2.workflow.regen_convergence_transaction` `regen_identity_population_eq` evaluated x == x.clone() on every install of the self-host convergence transaction. The conjunct ran, the install boundary really blocked, and `StagePlannedExecutedMismatch` stayed authorable in `v2.test.claim.regen_convergence_transaction_witness_test` while being unreachable from the real acceptance path -- the exact split section 4b's authorable-RED rule exists to catch. **THE DELETE ARM IS NOT WHAT FOUND IT; THE PRODUCER COUNT IS**, and that is this specimen's addition to the row: reading the two sides of one population equality back to their PRODUCERS and finding a single producer is cheaper than removing the conjunct and re-running, and it needs no experiment -- any equality whose two arguments trace to one value is this class already. **THE REPAIR IS A SECOND PRODUCER, NEVER A SECOND READ OF THE FIRST**: a digest delta over the journalled generated roster, taken before the copy loop and again after the build, carried in its own Rust newtype `ObservedEffectPopulation` with no conversion from the plan, so a later refactor cannot re-collapse the two sides without deleting a type. Its discriminating red `stage_execution_joins_the_plan_to_independently_observed_effects` carries TWO arms because one-directional identity checking is how the loss survived: an effect on a path OUTSIDE the plan, which was green before because `allowed_after` blanket-permits every already-dirty stage0 path for the rest of the transaction; and a planned surface the stage left byte-identical, which did refuse before but as `InstalledDigestMismatch` -- a CONTENT verdict standing in for a POPULATION one, so the arm asserts the cause and not that it refused.) - **unbacked execution claim** (prose asserts a live executing relation — this runs on X, X reads these fields, Y already resolves Z — that no authority backs, and a reader forms the premise and plans against it. §4b's CI rung drop names the harm PREMISE CONTAMINATION in its own words; this row is that harm as a general class, since the drop is about one paragraph in the canonical authority and the class is about every carrier. **THE ORIGINS ARE A FIELD OF THIS ONE ROW RATHER THAN SEPARATE ROWS, because the recognition rule is identical across them** — resolve the claim against the authority that owns the relation — **but the REMEDY BRANCHES ON THE ORIGIN, and a remedy applied without reading the origin manufactures new false statements.** Three origins are ATTESTED here and a fourth is conceivable but was NOT found. ORIGIN 1, EXECUTOR DELETED: the claim was true and its executor was removed. Specimen: `gunbc.floor_component_receipt_document` recited that an alert downloads an artifact named `floor-component-receipt` from a run id it is given and reads four named fields; that alert was `falsifier-alert.yml`, deleted 2026-08-15, and a lane read the module, believed the transport live, planned against it, and was corrected by its reviewing authority — the cost is measured, not hypothetical. Second specimen, same origin: `gunbc.ci_failure_class` stated its dissolution trigger as calling `classify_failure_reason` *the way claim_executor already resolves* `gunbc.floor_component_receipt`; `write_floor_component_receipt_at` did exactly that from 2026-07-30 (gunbc#7467) until gunbc#9228 deleted it on 2026-08-25. ORIGIN 2, THE CITED SYMBOL DIED WHILE ITS CONTENT SURVIVED AS AN ANNOTATION, and this one has a corpus-wide producer: `v1_compiler.cli_run` twice cited `floor_component_resource_checkpoint_note` and `floor_component_phase_journal_scaffold_note`, which were real `data …: String` declarations in `gunbc.floor_component_receipt` until the 2026-08-30 prose-bankruptcy sweep (gunbc#9752) converted module-scope commentary rows into §4c annotations corpus-wide. §4c makes an annotation uncitable by construction — `v1_compiler.cli_run` `annotation_erased_scan_text` feeds the semantic passes, so annotation text is not present in the tree the citation harvester walks. **THE CONSEQUENCE IS THE OPPOSITE OF THE ONE THIS ROW FIRST DREW, AND THE CORRECTION IS THE INSTRUCTIVE PART.** The first revision reasoned that the sweep therefore broke every citation of a converted row, making the population the sweep's own diff. Measured by a separate lane (gunbc XL-0-CITE, 2026-09-01) against `v1_compiler.declaration_index`, whose only citation producers are `citation_from_record_literal` and `citation_from_constructor_call`: the typed-citation breakage is **ZERO**, computed both today and as of the sweep commit, on a control that discriminates in both directions. A plain name in annotation prose was never a citation, so the sweep could not break one. What that leaves is a REAL class with an honest ceiling rather than a defect population: these citations bind READERS and no mechanism, so they sit in §4b's *outside the modeled guarantee* column — observed and repaired by reading, never gated — and calling them a dangling-citation population would have been rung inflation about a check that by construction cannot see them. The two `cli_run` sites are genuine instances of the harm and there is no mechanical census that would have found them. ORIGIN 3, WRONG AUTHORITY FOR SOMETHING THAT STILL EXECUTES: `dag/test/claim/instrument_sandbox_witness_test` says its live half `runs on the falsifier lane`; that half sits on `FalsifierSubstrateLongLane`, which `std.witness_admission` `witness_cadence_has_scheduled_route` reports routeless — but it also carries a local recipe, and `OfflineLocalRecipe` HAS a route, so the relation is live and only the named authority is wrong. THE FOURTH, NEVER BACKED AT ALL, IS NOT ATTESTED IN THIS CORPUS and is recorded as unmeasured rather than as a population. **THIS ROW IS NOT THE AUTHORITY ON ANY POPULATION, and saying so is the point:** `gunbc.deleted_cadence_reference_census` already owns the falsifier-cadence instance of origin 1 — twelve sites, a `DeletedCadenceReferenceStanding` vocabulary whose `PremiseInvalidated` arm is exactly this class, and one `GuaranteeRungDrop` filed once for the shared executor rather than per site. A pattern row that restated its population would be a second authority for a fact that already has one, which is the §3 violation this row's own remedy is meant to prevent; so the census is cited here and nothing about its contents is copied. What belongs HERE is only the recognition rule and the remedy arms, which generalize past the falsifier. **THE MECHANICAL TEST for finding one is sharper than asking whether the verb is runs or is enrolled: resolve the claim against the authority that owns the relation, and ask whether the prose implies a live route for something that authority says has none.** The naive runs/enrolled discriminator loses one arm and it is the common one — `Enrolled on falsifier_rehomed_bin_wet_entries (nightly batch 5)` is nominally an enrollment claim, which is TRUE, but `nightly` asserts a cadence that executes and `FalsifierRehomedBinWet` is routeless, so the reader forms the false premise anyway. Three outcomes per line: asserts execution (contaminating), asserts enrollment only (true, leave it), asserts enrollment while implying a live cadence (contaminating). **THE REMEDY HAS THREE ARMS, KEYED TO WHAT THE AUTHORITY SAYS NOW, and picking the wrong one is itself an instance of this class.** Origin 1 → PAST TENSE WITH THE DATE, keeping the reasoning, because the reasoning usually outlives its executor and a reader who finds a dangling claim silently deleted learns nothing. Origin 2 → name the module and the FACT rather than the dead symbol, since §4c left no symbol to cite; past-tensing here would wrongly report the content as gone when only its citability is. Origin 3 → CORRECT IT to the authority that does back it, NOT past tense: past-tensing a live relation records it as dead and is a new contamination in the opposite direction, produced by the remedy itself. Origin 4 → say it was never backed, or delete the assertion while keeping any surviving reasoning; NEVER past tense, because there is no past to record, and `X USED TO resolve Y` asserts an execution that also never happened. **The default against deletion is a default and not an absolute: a sentence whose entire content is a false execution claim has no reasoning to preserve.** **THE SELF-RECEIPT, and it is the most useful thing in this row (2026-09-01):** the first revision of this entry asserted the `ci_failure_class` clause and the two `cli_run` notes as never-true, on the strength of a grep showing they resolve nowhere TODAY. **Both were true when written**, and the row about unbacked claims therefore contained two of them. It was caught by a reviewing authority asking for verification rather than inheritance, not by any check. **RECOGNITION RULE EARNED: `resolves nowhere now` is not `never resolved`, the distinction is decided by history and not by the working tree, and the instrument is `git log --all -S` over the DECLARATION FORM** — which also separates origin 1 from origin 2 by showing WHAT deleted the referent. The neighbouring rule is `positional_citation`'s: a citation left naming a deleted symbol fakes a grep hit, so every arm above records the change rather than quietly removing the name.) - **a source-ingested module has no judged standing** (the required gates adjudicate entry-derived closures, while source-root ingest admits a larger identity population; a module outside every required closure can carry a structurally checkable defect while every gate stays green. This is NOT an import-edge class: globally unique names can resolve without a direct import, so authored inbound imports neither prove nor disprove judgment. It is also NOT a claim that every identity outside the closures is defective or should be gated. The severity is unknown, and that unknowability is the finding. **SPECIMEN AND DISCRIMINATING CONTROL** (node://adhoc-2d3c27b7-660, PR #9899): gunbc.annotation_parse_instrument_agreement constructed Terminal { reason, authority } although Terminal declares only reason; a clean required run left both build and witnesses green and both in-run judgment receipts omitted the module. The matched visible control placed the same undeclared-field construction in ordinary production module gunbc.clock_read: both required lanes refused with `field 'authority' not found in type 'LaneVisibilityControl'`; removing only the plant returned both lanes to green. Thus visibility, with defect class held constant, discriminates the arms. The witnesses prediction was weaker than its result: only submitted-closure membership was known beforehand, yet execution established strict judgment by refusing. **MEASUREMENT, EXPLICITLY NOT COVERAGE OR ENFORCEMENT:** the producer joins every first-party identity admitted by the exact source-root ingest against the union of module identities for which build or witnesses produced a strict typecheck verdict. On clean run 33484666539 it derived 4,419 admitted, 947 build-judged, 2,158 witnesses-judged, 2,319 in the judgment union, and 2,100 with no required-lane judgment. Build contributes only 161 identities beyond witnesses, so the two required closures are far from independent and their union remains close to one lane's reach. Exactly one of the 2,100 is confirmed orphaned by the executed control; the other 2,099 are Undecided because no typed authority currently says whether each is an executing standalone entry, fixture/generated/excluded, retired, or orphaned. Those identities are deliberately re-derived and NOT committed as a baseline or roster: a hand-carried 2,099-row exemption set would be a ratchet wearing a wall's name. The instrument reports; it does not refuse, and citing it as a gate is rung inflation. **PROVENANCE LIMIT:** in-run strict judgments and cross-process content-addressed cache judgments are separate columns. Required CI does not arm GUNBC_RESOLVED_GRAPH_CACHE_DIR, so the cross-process column was empty beside nonempty in-run columns in both planted and reverted runs. That empty column is a control for the unarmed premise, NOT evidence that the provenance split is exercised by required CI. **CEILING: decidable but waiting on a single standing authority.** A wall now would either false-red legitimate importer-free subjects or grandfather opaque debt. The next rung requires four capabilities together: (1) one typed standing registry exhaustively binds every first-party ingest identity to required judgment, a verified executing consumer, typed fixture/generated/exclusion, retirement, or orphan standing; (2) each executing-consumer binding is checked against the named consumer's actual roster and execution receipt, so a hollow alias cannot admit it; (3) a changed retained identity resolves only through its named consumer from materialized facts within the required floor's 8-second wall and 500-millisecond CPU envelopes, never by whole-corpus compilation; and (4) the two-direction matched undeclared-field control remains executable. At that rung admission makes the invalid state unwritable; until then this remains measurement and an Undecided population, not a defect backlog.) @@ -148,6 +148,6 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation. - **a receipt names a PROPERTY and never names the TREE it holds of, so it expires silently** (INVALID STATE: evidence of the form 'regenerating produces the committed bytes', 'the diff is zero', 'the census matches', 'the fixed point is reached' is a claim about A BASE, but is recorded and cited as a claim about A CHANGE. When the base moves the receipt keeps reading as valid while describing a tree that no longer exists. HARM: section 5 silent wrongness, and this is the WORST-SIGNALLING member of its family rather than merely another one -- a stale citation still shows the reader its text, an incompatible merge still conflicts, an absent observation still reports an absence; AN EXPIRED GREEN PRODUCES NOTHING AT ALL. Nothing goes red, no conflict is raised, and the author's own careful re-verification re-affirms it, because re-running the same command against the same stale working tree reproduces the same true-of-nothing answer. **DISTINCT FROM ITS TWO NEAREST NEIGHBOURS, and the repair law is what separates them.** `execution_provenance_loss` asks whether the observation RAN; here it ran and was valid, and then STOPPED being valid because its subject moved underneath it. `positional_citation` is a decaying HANDLE -- a pointer that no longer names what it named; here the handle is fine and it is the EVIDENCE BINDING that decayed. Different invalid states, different repairs. **SPECIMEN (sunny-gull-270, PR #10036, 2026-09-02).** The PR's entire acceptance test was that the emitted .github/workflows/witnesses.yml is byte-identical after regeneration -- a behaviour-identical refactor whose whole claim is that the bytes do not move. It was re-verified after each of three commits, and ALL THREE measurements were taken against a base main had already left: #10024 had landed and materially rewritten BOTH the authority the PR edits and the artifact under test -- re-derive the magnitudes with `git show --stat 7c310ed74c5 -- dag/gunbc/witness/witness_floor_workflow.dag .github/workflows/witnesses.yml`, which is an immutable commit and so answers the same forever. No signal at any point. The expiry was found by asking what had changed in main, not by any check. **RECOGNITION RULE, mechanical: before citing a zero-diff or byte-identity receipt as merge evidence, ask whether the base moved ON THE FILES THE RECEIPT IS ABOUT** -- `git diff --stat $(git merge-base HEAD origin/main) origin/main -- ` -- because a receipt about generated bytes is invalidated only by changes to the authorities that produce them, and a whole-repository is-my-branch-behind check is both too coarse to act on and too noisy to keep. **A SECOND, LESS OBVIOUS OBLIGATION: RE-DERIVE THE DISCRIMINATING CONTROL TOO, NOT ONLY THE RECEIPT.** A control taken before the merge proves the zero was readable on a tree that is not the one shipping, so a re-derived green beside a stale control is half a measurement. And rebuild the PRODUCER: the tree and the emitter are two inputs, and a regeneration with one of them stale proves nothing about the pair. **THE UPSIDE IS WORTH STATING BECAUSE IT CHANGES WHETHER PEOPLE DO IT: a receipt re-derived after a FOREIGN change to the same artifact is STRICTLY STRONGER than the original.** The first green only ever asks whether a projection reproduces its own base; the second asks whether it reproduces a base someone else moved -- which is where a projection that disagrees with the hand-kept form it replaced would actually surface. **RUNG FOUND AT: 1, mitigatable.** Today the only defence is an author remembering to re-derive before citing, which is exactly the defence that does not survive a tired hour. **CEILING: 2, mechanically preventable, and the reason it is not higher is that a receipt cannot make its subject stop moving -- what it can do is make the movement OBSERVABLE. NEXT TRIGGER, named as the capability and not as an artifact: a receipt CARRIES THE BASE IT WAS MEASURED ON, so a producer can compare that base against HEAD and refuse an expired receipt, rather than a person remembering to. THAT CAPABILITY IS NOT HYPOTHETICAL -- IT ALREADY EXISTS ONE SURFACE OVER, WHICH IS WHY THIS TRIGGER IS REACHABLE RATHER THAN ASPIRATIONAL: the review runner binds each review to the sha it was taken on and REFUSES on mismatch. On this row's own pull request, review 58587 failed with `worktree freshness check failed: HEAD is ad388184ac but PR #10036 head is c80c9d88db -- refusing to review a stale/wrong checkout`, and a refused review is exactly the signal an expired receipt does not produce. So reviews already carry their base and receipts do not; the gap is an UNAPPLIED mechanism rather than a missing one, and the trigger is discharged by giving regeneration receipts the binding reviews already have. **THIS CITATION CARRIES ITS OWN BASE, because a row about receipts that expire must not carry one that has.** What is DURABLE is review 58587 itself: it is retrievable from the reviews API with status=failed, sha c80c9d88db and that error text, and a completed review is a historical fact that does not decay. What is an OBSERVATION AT A TIME is the claim that the runner still behaves this way -- measured 2026-09-02, and NOT re-confirmed since, because the runner's source lives outside this repository and is not visible from a session container, so no gate here can check it and its absence from a local filesystem is not evidence either way. Sampling later pull requests for a freshness failure -- `dashboard-ops reviews `, reading each review's status and error -- found none, and that is EXPECTED RATHER THAN REASSURING: the check fires only when a head moves mid-checkout, so a sample drawn where the condition did not arise discriminates nothing and no count of it is worth carrying. **THAT UNCHECKABILITY IS ITSELF WHY THE TRIGGER NAMES A CAPABILITY AND NOT AN ARTIFACT** -- a trigger pointing at a file this repository cannot see would be satisfied or falsified by nothing observable here, which is the restoration-promise failure one row over. Until that exists this row is the mitigation and citing it as coverage is rung inflation.** - **a destructive action is judged by a PROXY observation, never by the action's own semantics** (INVALID STATE: an actor destroys something -- deletes an edge, a file, a roster row, an authority -- and reads the verdict off an observation that stands in a PROXY relation to what the destruction MEANS. 'Strip the imports and see whether the compile exits 0' is the canonical shape. The proxy is only ever as strong as the checking path that produces it, and the semantic question -- does every occurrence that crossed the destroyed edge still bind to exactly one accepted declaration identity, and does that identity project a provider the closure reaches -- is never asked. **HARM: DESIGN section 5 silent wrongness, and directionally the worst member of its family, because the proxy and the semantics agree EXACTLY WHERE THE CHECKER IS SOUND AND DIVERGE EXACTLY WHERE IT FAILS OPEN.** The green is therefore densest on the population the destruction actually damages, and a count of green subjects reads as coverage while being a census of the checker's absorbing arm. **RECOGNITION RULE, and it is mechanical rather than a matter of judgement: name the acceptance path that produced the observation, and ask what that path does when the property under test is ABSENT -- refuse, or substitute.** If any arm on it fabricates, widens, defaults or falls back, the observation is a proxy and its green is a statement about that arm. **DISTINCT FROM ITS THREE NEIGHBOURS, and the repairs differ.** `absorbing_fallback` is the fail-open arm itself; here the arm may be long known, correctly filed and owned by somebody else -- the defect is the READING of a destruction's green taken across it. `instrument_output_read_as_subject_content` is a report complete for its own promise and read past it; here the observation is not incomplete at all, it answers a DIFFERENT QUESTION than the actor's. `executed_conjunct_discriminates_nothing` cannot discriminate anywhere; a proxy discriminates perfectly on the sound half of its population, which is what makes it credible. **SPECIMEN, ALREADY MEASURED AND ON THE RECORD IN THIS REPOSITORY, which is why the class is filed rather than the instance re-investigated: the import strip, `docs/plans/import-strip-witness-discovery-cascade-diagnosis.md` section 15.4.** 1,773 of the 2,574 stripped files produced no diagnostic, and that 69% was available to be read as 'these files' references are independently resolvable'. Section 14 of the same document had ALREADY established by execution that a type present in the pool but not structurally bound is FABRICATED AS AN ANONYMOUS PRODUCT rather than refused, and that the production type-reference discriminator is measurement-only -- normal compile, resolve, run and emit stay on the legacy fail-open path unless measurement mode is armed. So the 69% is a joint statement about which providers happened to be in the pool and which failures the fabrication arm absorbed, and the document says so in its own words: a clean file may be clean because its provider happened to be loaded. **THE SUBSTITUTE, STATED SO THIS ROW NAMES A TEST AND NOT ONLY A DEFECT, and it is section 15.4's own terminal test: not 'delete imports, compile exits 0', but every cross-module occurrence has exactly one accepted declaration identity; every accepted identity projects its provider file; the loader closure equals that provider projection; adding or removing an unrelated loaded module changes neither binding nor closure; type, value, callee and emitter consumers all consume the accepted edge; no fallback or fabrication arm is reachable; and compile AND execution are green.** **THE STANDING OBLIGATION THIS CLASS CREATES, AND IT LANDS ON THIS PROJECT'S OWN CENSUS METHOD: THE DESTRUCTION-WITNESS PRECONDITION.** DESIGN section 3 grounds delete-first on 'the deletion is the census -- every real dependent refuses loudly'. That sentence is CONDITIONAL on the substrate being fail-closed ON THE AXIS DESTROYED, and it is the conditional, not the sentence, that a destruction witness must discharge: before a deletion's green may be read as 'nothing depended on it', exhibit BY EXECUTION, on the SAME acceptance path the green will be read from, one case where the destroyed edge is genuinely required and the path goes RED. Absent that red the green is a property of the path's failure arm rather than of the corpus, and no number of green subjects repairs it -- a vacuous check does not become discriminating by being run more times. The precondition is carried by `docs/plans/replacement-migration-doctrine.md`, filed beside the sibling already recorded there in which the census is empty because the referent is NAMED rather than imported: same conclusion by a different mechanism, and the pair is the point -- there nothing refuses because nothing was ever an edge, here the edge exists and the checker declines to judge it. **RUNG FOUND AT: 1, mitigatable.** The divergence was caught by a reader holding the observation up against the checker that produced it, after a wave had already been sized on the proxy. **CEILING: 3, structurally guaranteed, and reachable rather than aspirational, because the disqualifying fact is decidable from the substrate:** whether the acceptance path a witness reads has a reachable fabrication or fallback arm on the axis under test is a property of that path's own graph, not of the world. **NEXT TRIGGER, NAMED AS THE CAPABILITY AND NOT AS AN ARTIFACT: a destruction witness declares the axis it destroys and the acceptance path it reads, and the executor REFUSES the witness when that path carries a reachable fail-open arm on that axis** -- so the precondition is discharged by the runner rather than remembered by an author. Until that capability exists this row and the doctrine section are the mitigation, and citing either as coverage is the rung inflation DESIGN section 4b(1) names. -- **stable citation, mutable referent** (an identifier that names a thing correctly and forever, while the CONTENT served for it is replaced underneath. Distinct from `positional_citation`, and the difference is what makes it worse: a `file:line` pointer goes stale under an edit above it, and re-reading the file EXPOSES that — the symbol is not there, or a different one is. Here re-reading the citation CONFIRMS the wrong answer, because the identifier still resolves, still returns content of the expected shape, and reports no error. There is no red anywhere. Receipt (2026-09-02, gunbc#10042): a GitHub Actions JOB ID was cited as the source of a floor measurement. A job id names the job; the logs API serves the LATEST ATTEMPT. A rerun replaces the attempt, so job 100217416636 served six budget-refused identities when first read and thirteen when read back, and the second reading was byte-identical to a DIFFERENT job id — two ids, one attempt. A cross-run comparison built on those readings appeared to compare two runs while one side had been replaced underneath, and the damage ran in BOTH directions: a near-disjointness claim that was simply false, and a real bucket migration that was retracted as unfounded because it could no longer be reproduced through the citation that found it. The second is the more expensive error — a true finding withdrawn, downstream prose rewritten in four places to remove it, and a merge rule changed — and it is the one a reader would not think to look for, because a retraction feels like the conservative move. THE DEFAULT CITATION IS THE TRAP AND THE PINNED ONE IS THE REMEDY, and both were measured rather than assumed: `gh run view --job --log` serves the latest attempt, but the attempt-pinned REST path — `/repos/OWNER/REPO/actions/runs/RUNID/attempts/N/logs` still serves attempt 1 in full. Recovering it confirmed the original six-row reading exactly, and confirmed that `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` is INTERRUPTED in attempt 1 and COMPLETED-OVER-COST in attempt 2 — a real migration across the two populations, not the artifact it was briefly retracted as. So the class is not that the earlier subject is destroyed; it is that the ORDINARY way of citing it silently resolves to a different one, and a reader who re-reads the same citation to check gets agreement instead of a contradiction. **Recognition rule: before comparing two readings of one producer, ask whether the producer serves a STABLE SUBJECT for a fixed citation — not whether the citation is well-formed. An identifier that addresses a CONTAINER (a job, a branch, a latest, a mutable tag, a rolling window) serves whatever currently occupies it, so two readings of one citation are two subjects and their DELTA is uninterpretable. Cite the thing that cannot be replaced — the attempt, the commit, the immutable artifact — or capture the content at read time and say when.** The receipt worth keeping is that this survived the diligence that should have caught it: the same author had, that morning, REFUSED to file a transcribed measurement on the §6 grounds that no producer owned the number, and then built a delta out of a producer that mutates what it serves for a fixed id. Naming the instrument is not sufficient if the instrument does not serve a stable subject.) +- **stable citation, mutable referent** (an identifier that names a thing correctly and forever, while the CONTENT served for it is replaced underneath. Distinct from `positional_citation`, and the difference is what makes it worse: a `file:line` pointer goes stale under an edit above it, and re-reading the file EXPOSES that — the symbol is not there, or a different one is. Here re-reading the citation CONFIRMS the wrong answer, because the identifier still resolves, still returns content of the expected shape, and reports no error. There is no red anywhere. Receipt (2026-09-02, gunbc#10042): a GitHub Actions JOB ID was cited as the source of a floor measurement. A job id names the job; the logs API serves the LATEST ATTEMPT. A rerun replaces the attempt, so job 100217416636 served six budget-refused identities when first read and thirteen when read back, and the second reading was byte-identical to a DIFFERENT job id — two ids, one attempt. A cross-run comparison built on those readings appeared to compare two runs while one side had been replaced underneath, and the damage ran in BOTH directions: a near-disjointness claim that was simply false, and a real bucket migration that was retracted as unfounded because it could no longer be reproduced through the citation that found it. The second is the more expensive error — a true finding withdrawn, downstream prose rewritten in four places to remove it, and a merge rule changed — and it is the one a reader would not think to look for, because a retraction feels like the conservative move. THE DEFAULT CITATION IS THE TRAP AND THE PINNED ONE IS THE REMEDY, and both were measured rather than assumed: `gh run view --job --log` serves the latest attempt, but the attempt-pinned REST path — `/repos/OWNER/REPO/actions/runs/RUNID/attempts/N/logs` still serves attempt 1 in full. Recovering it confirmed the original six-row reading exactly, and confirmed that `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` is INTERRUPTED in attempt 1 and COMPLETED-OVER-COST in attempt 2 — a real migration across the two populations, not the artifact it was briefly retracted as. So the class is not that the earlier subject is destroyed; it is that the ORDINARY way of citing it silently resolves to a different one, and a reader who re-reads the same citation to check gets agreement instead of a contradiction. **Recognition rule: before comparing two readings of one producer, ask whether the producer serves a STABLE SUBJECT for a fixed citation — not whether the citation is well-formed. An identifier that addresses a CONTAINER (a job, a branch, a latest, a mutable tag, a rolling window) serves whatever currently occupies it, so two readings of one citation are two subjects and their DELTA is uninterpretable. Cite the thing that cannot be replaced — the attempt, the commit, the immutable artifact — or capture the content at read time and say when.** The receipt worth keeping is that this survived the diligence that should have caught it: the same author had, that morning, REFUSED to file a transcribed measurement on the §6 grounds that no producer owned the number, and then built a delta out of a producer that mutates what it serves for a fixed id. Naming the instrument is not sufficient if the instrument does not serve a stable subject. One diagnostic tell for the delta itself, preserved here from gunbc#10130 where it was measured against this same receipt: the two readings were differenced into a `3 -> 6 -> 13` upward trend with a memory-pressure mechanism attached, the `3` having additionally come from a different head — and monotone growth is precisely what independent draws at a fixed distance from a budget do NOT produce. The shape that made the artifact persuasive was the evidence against it, so the tell is available BEFORE the referent is re-checked: a delta through a container-addressing citation that arrives already fitting a story is the reading to distrust first.) - realization arms diverge on WHETHER THE PROGRAM REFUSES (two realizations of one accepted program agree on the returned value and disagree on whether an evaluation-time refusal fires, because the fact that decides it -- evaluation order -- is modeled nowhere and each arm improvises). INVALID STATE: a connective whose operand evaluation strategy is unmodeled, realized strictly by one arm and lazily by another. gunbc v1 today: v1.compiler.interpreter eval_expr_inner's ExprBinOp arm evaluates BOTH operands through `?` before dispatching. eval_binop DOES carry And and Or arms -- `Value::Bool(left.is_truthy() && right.is_truthy())` -- and they are irrelevant to this class and worth naming precisely because they look like the repair: they run on operands ALREADY EVALUATED at the call site, so their Rust && is over two bools and short-circuits nothing. A reader grepping eval_binop for And finds a hit and concludes the case is handled, while std.operator_realization maps BinOp::And and BinOp::Or to OperatorRealization::HostOperator, rendered as Rust && and ||, which short-circuit. HARM: the guard idiom -- a cheap precondition guarding an expression that can refuse -- means two different programs. The interpreter runs the guarded expression when the guard is FALSE and refuses; emitted Rust never runs it and returns a value. Silent in both directions and invisible to any oracle comparing returned values on guard-true inputs, which is every value-comparison oracle we have. DISCRIMINATING RED, executed 2026-09-02, not asserted: `fn guarded_division(n: Int) -> Bool { n != 0 && (100 / n) > 1 }`. At n=0 the interpreter refuses DivisionByZero and the emitted Rust returns false; at n=5 both return true. Division by zero was chosen deliberately because BOTH realizations abort identically IF the expression is evaluated, so evaluation order is the only variable in the pair. CONTROLS, because a false from a harness that cannot observe an abort is a vacuous green: the same function with the guard forced true and n=0 PANICKED with 'attempt to divide by zero' and was caught and reported, so the harness can see the abort; and the guard-true positive control agrees across both arms. HONESTY BOUND ON THE EVIDENCE: the interpreter arm ran on the real acceptance path via `gunbc run`; the emitted arm executed the emitted function bodies extracted VERBATIM into a rustc harness, not the whole emitted crate. WHY IT IS NOT refusal_deferred_to_emitted_runtime: that class is a compiler writing a refusal construct INTO the artifact while reporting success. Here no refusal is written anywhere and the compile is honest; the two arms simply disagree at run time about whether one fires. Same neighbourhood, different invalid state, different repair. THE POPULATION IS SURVIVORSHIP-FILTERED AND A GREP UNDERSTATES IT BY CONSTRUCTION. The interpreter is the STRICTER arm, so any author who wrote the guard idiom over a refusing right operand hit the refusal while authoring and rewrote it -- most likely into a nested if or match. So the sites matching `cheap_guard && expensive` are the SURVIVORS, the cases where the right operand happens not to refuse; the cases carrying the correctness consequence were already edited away. A LOW COUNT IS THEREFORE NOT EVIDENCE THE CLASS IS MINOR AND MUST NOT BE REPORTED AS ONE. The honest population is sites where an author WANTED the guard idiom, which lives in the rewrites and is not reachable by the same needle. RECOGNITION RULE, stated to generalise past this operator: wherever a construct is realized independently by the interpreter and by an emission target, ask what fact decides its behaviour and where that fact is DECLARED. If the deciding fact is absent from the authority both arms are supposed to consult, the arms are not implementing one semantics, they are each inventing one, and agreement on the values you happened to test is not evidence they agree. The tell is a realization shape -- HostOperator -- that names WHO evaluates without naming WHAT is evaluated. RUNG: mitigatable at best, and only because one arm refuses loudly; against a source-to-emission path this is silent wrongness, which DESIGN section 4b places outside the ladder. NEXT-RUNG TRIGGER, named as a capability and not an artifact: EVALUATION ORDER MODELED AS A PROPERTY OF A CONNECTIVE IN THE .dag AUTHORITY AND CONSULTED BY BOTH REALIZATIONS -- sufficient for the interpreter's binop arm to derive its strictness from the same row the emitter derives its rendering from, so that a connective's operand strategy cannot be stated twice or left unstated. A grep across dag/, src/v2/ and src/v1/*.dag on 2026-09-02 found no such fact: every short-circuit hit is prose in a comment or a witness name. NOT REPAIRED HERE: changing the interpreter to short-circuit is a corpus-wide evaluation-semantics change and needs its own subject, population and review; filing it against the missing carrier is the point of this row. - **a declared return type disagrees with the type its body actually produces, because the body's type comes from a GENERIC CALL'S INSTANTIATION** (INVALID STATE: a function declares `-> F` and returns the result of `g(...)` instantiated at `T = B`, so the produced type is `F`. The declaration is authored independently of the body and nothing joins them, so `A` and `B` never meet. Every consumer then reads the DECLARATION, passes the value into a parameter typed `A`, and the mismatch surfaces -- if it surfaces at all -- as a runtime type error inside a callee that names neither the declaration nor the drift. HARM: this is the loud-but-hidden corner of section 5 rather than silent wrongness. The abort is honest when it happens; what is silent is the CLASS, because the drifted arm is commonly the one that is rarely reached, so the function reads as working while one of its inhabitants is unwritable-through. **DISTINCT FROM ITS NEIGHBOURS.** `state_space_conflation` is a domain modelled with too few constructors; here the domain is right and the CARRIER's parameter is wrong. `hollow_alias` is a second name for one concept; here there is one name and two types. **SPECIMEN (keen-ferret-172, gunbc#10109, 2026-09-02), and the two halves of it carry different warrants.** VERIFIED BY SOURCE, independently by two readers: `v2.std.runtime` `RuntimePrimitiveValue.bytes` is `List`; `v2.std.collection` `list_at_optional(xs: List, index: Int) -> Optional` therefore yields `Optional`; `v2.std.native_agreement` `runtime_value_discriminant_octet` declares `-> Optional` and returns exactly that call; its `Present` arm feeds the value to `octet_display(octet: Int)`. VERIFIED BY EXECUTION, by one reader: `runtime_value_octet_label` over a `RuntimePrimitive` carrying two bytes aborts with `TypeError { msg: "cannot apply Lt to Record and Int" }`, while the same call over a zero-byte primitive returns `"?"` -- re-derive with the enrolled pair `label_of_a_two_byte_primitive` and `label_of_an_empty_primitive_is_unknown`, the first of which aborts against the pre-repair generation and the second of which passes in BOTH states and is therefore not a presence-detector for the repair. **WHY IT SURVIVED: THE ONLY REACHED ARM WAS THE ABSENT ONE.** `list_at_optional` at index 1 returns `Absent` for the short primitives the live paths carry, and `Absent` answers `"?"` without ever constructing the drifted value. So the formatter whose carrier note exists BECAUSE a revert once reported member and values unknown could itself abort exactly when a divergence was being reported. **RECOGNITION RULE, mechanical and cheap: for any function whose declared return is a GENERIC APPLICATION, name the call that produces the returned value and instantiate its type parameters from its ARGUMENTS, not from the enclosing declaration.** If the argument is a `List` and the declaration says `F` with `A` != `B`, the drift is there to read. The tell that makes it worth checking at all is a declared parameter of a primitive type -- `Int`, `String`, `Bool` -- reached from a container whose element type is a record. **A SECOND TELL, and it is the one that generalises past types: THE FUNCTION WAS UNWITNESSABLE.** This drift was found only after a fold's parameter was narrowed from a whole `TestClaimRun` to the `Verdict` it actually read, because the wide parameter required a cache receipt no witness could construct. Unwitnessable-by-construction is the precise condition under which an arm ships on a typecheck, so `a parameter wider than what the body reads` is a standing prompt to narrow it and then execute -- reading cannot find this class, since the declaration says `Int`. **RUNG FOUND AT: 1, mitigatable.** The failure is a typed runtime abort with containment but no locality: it names an operator and two shapes, not the declaration that lied. **CEILING: 3, structurally guaranteed, and not 4.** A declared return is authored independently of the body, so a source file can always SPELL the disagreement; what is attainable is that no `Accepted` program contains one, by deriving the body's type and refusing the mismatch. It is decidable and fully modelled -- both types are in hand at the same grain -- so anything below 3 is a correctness gap rather than a ceiling. **NEXT TRIGGER, named as the CAPABILITY: return-type agreement checked at the declaration boundary, comparing a declared return against the body's inferred type THROUGH A GENERIC CALL'S INSTANTIATION.** The qualifier is the whole trigger and not decoration: a checker that compares only concrete returns is satisfied by this specimen while the class stays alive, because the drift enters through `T`. Until that capability exists this row is a review discipline, and citing it as coverage is rung inflation.