diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag
index 1657613764e..ac1838d0856 100644
--- a/dag/gunbc/recurring_failure_mode.dag
+++ b/dag/gunbc/recurring_failure_mode.dag
@@ -141,7 +141,7 @@ data mistyped_body_radiates_nonlocal_diagnostics: RecurringFailureMode = Recurri
 
 data mitigation_injected_where_judgment_declined: RecurringFailureMode = RecurringFailureMode { identity: "mitigation_injected_where_judgment_declined" as NonEmptyStr, authored: "**mitigation injected where the judgment declined** (a downstream stage injects a RUNTIME mitigation at exactly the seam where an upstream judgment returned Undecidable, so a 4b rung-1 fallback comes to occupy the place the wall belongs and the declined seam stops looking empty. **THE LOAD-BEARING HALF IS WHAT THE COINCIDENCE PROVES ABOUT THE DECLINE**: an Undecidable verdict is normally read as benign conservatism — the facts did not settle it, nothing is claimed, no harm asserted — and a mitigation landing on the SAME LINE is the first evidence that a real defect was sitting under that silence. The decline is therefore load-bearing AT THIS SITE, which refutes reading an Undecidable verdict as evidence of ABSENCE. **IT DOES NOT MAKE THE DECLINE CENSUS PREDICTIVE, and this row carries that limit because the author first wrote the stronger claim and then measured it FALSE** on the same board that produced the specimen: 259 of 272 declines sit in modules with ZERO blocking errors, only 6 of 28 decline-bearing modules carry any error at all, and the module holding 42 of the 63 errors carries ZERO declines and 105 ACCEPTS. Declines and defects are ANTI-CORRELATED at module grain, so this specimen is ONE co-location out of 272 and a walk of the decline census would be walking sites that are ~95% empty. The class is about a mitigation landing on a declined seam; it is NOT a claim that declines predict defects. Distinct from `absorbing_fallback`, whose arm WIDENS to a superset and destroys the precise mechanism s signal; here the arm NARROWS to a panic and destroys nothing except the evidence that a judgment was owed. Distinct from `reflection_evidence_structural_proof`, which mistakes an observation for a proof; here nothing is proven or observed — a decision was declined and then papered. Specimen with a receipt, measured 2026-09-01 on gunbc 0e8c49d and unrepaired at authoring: `v2.std.diagnostic outcome_accepted` is `fn outcome_accepted<T>(value: T) -> Outcome<T>` with T FREE; `v2.compiler.07_target_carriers target_fidelity_quotient_optional` declares `-> Outcome<Optional<Node>>` and calls `outcome_accepted(Present \{ value: child \})`, so T instantiates to `Optional<Node>` and THE SOURCE IS CORRECT. The Rust emitter nonetheless rendered `Some(child).expect(\"fail-closed: an optional value flowed into non-optional parameter 0 of outcome_accepted (empty Optional at runtime)\")`. FOUR DEFECTS IN ONE LINE: it fires on a GENERIC formal where `Optional<Node>` is a legitimate instantiation rather than a cardinality escape, so the check does not know T is free; it substitutes a runtime panic for a compile-time judgment; the emitted code does NOT typecheck anyway (rustc E0308 expected `Option<Rc<Node>>` found `Rc<Node>`), so the mitigation buys nothing while standing where the wall belongs; and its own panic string calls itself `fail-closed`, which is 4b rung inflation inside a string literal — a diagnostic naming the discipline it violates is worse than a silent one because it will be cited as evidence the discipline holds. The coincidence that makes this a class and not a bug: `v1.compiler.infer declared_type_inhabitance` returned InhabitanceUndecidable\{UndecidableOptionalCarrier\} at that module s ONLY optional-carrier decline, 07_target_carriers.dag:128:24 parameter `value` — the same line the emitter mitigated. RUNG FOUND AT: 1 (mitigatable) on a seam whose CEILING is 3 (structurally guaranteed), since generic-formal instantiation is decidable from modeled structure. CONSEQUENCE WITH ITS OWN TRIGGER, deliberately NOT folded into this row: wiring the optional-carrier judgment is argued by this specimen but is a separate change, and its trigger is a producer at that seam that can distinguish a FREE type variable from a declared non-optional formal — until that exists the judgment would decline for the same reason it declines today.)" as NonEmptyStr, evidence: [] }
 
-data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 <range>`) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.)", evidence: [] }
+data instrument_output_read_as_subject_content: RecurringFailureMode = RecurringFailureMode { identity: "instrument_output_read_as_subject_content" as NonEmptyStr, authored: "**instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 <range>`) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful. **THE RESOLUTION-AXIS FORM, MEASURED 2026-09-02 (bold-stag-665 specimens i-ii, bold-carp-449 specimen iii): THE INSTRUMENT RESOLVED THE REFERENCE TO SOMETHING ADJACENT TO THE INTENDED SUBJECT AND REPORTED FAITHFULLY ABOUT WHAT IT RESOLVED TO.** The adjacency is a different VERSION, a different ATTEMPT, or a different SPELLING; `which version` is one instance of the axis and not its definition, which is why a purely temporal reading of this form does not house all three specimens -- specimen (iii) moves nothing at all, being one fixed tree read against one fixed staged copy at one instant, and its adjacency is naming rather than time.** The forms above substitute WHAT the instrument covered for what the subject contains. Here the instrument resolves to a DIFFERENT VERSION, a DIFFERENT ATTEMPT, or a DIFFERENT NAME for the same subject, and its answer carries no mark of having done so. **THE TEETH: EVERY RUNG RETURNS A WELL-FORMED PLAUSIBLE ANSWER RATHER THAN AN ERROR, SO THE WRONG ANSWER DOES NOT LOOK LIKE A FAILURE, IT LOOKS LIKE DATA.** `3 -> 6 -> 13` reads as a trend; `+76/-31` reads as a change; `five functions missing` reads as a deletion. Each arrives with a mechanism ready to explain it, which is what makes it persuasive rather than merely wrong. **THE LADDER, WHICH IS THE TRANSFERABLE PART -- EVERY RUNG BUT THE LAST IS POSITIONAL, AND EACH GOES RED FOR A DIFFERENT IRRELEVANT REASON:** line-diff is red on a REWRITE; identifier-diff is red on a RENAME; concept-mapping is the only test that decides. Identifier-absence is not the cure for line-absence, it is the SAME positional test one level up -- **absence of a NAME is not absence of a CAPABILITY, and only the second is a loss.** **SPECIMEN (i), the time axis -- an identifier whose referent advances.** `gh run view --job <id> --log` serves the LATEST ATTEMPT for a fixed job id. Job 100217416636 was read as `interrupted_before_verdict=6`; a rerun replaced the attempt; the SAME id later returned 13. Those readings were then DIFFERENCED into a reported `3 -> 6 -> 13` upward trend with a memory-pressure mechanism attached and offered upward as evidence -- the `3` having additionally been measured on a different head. Monotone growth is precisely what independent draws at a fixed distance from a budget do not produce, which is what made the artifact convincing. **SPECIMEN (ii), the line rung -- an ancestry the merge destroyed.** Under SQUASH merge the squashed commit is not an ancestor of the branch, so `git diff --stat origin/main...origin/session/<branch>` re-renders ALREADY-LANDED work as unlanded: gunbc#10100 rendered 3 files, +76/-31, for content wholly present on main. The deciding test is content -- `git merge-tree --write-tree origin/main <branch>` against `git rev-parse origin/main^\{tree\}`, identical shas meaning the merge is a no-op. A peer hit the same rendering on gunbc#9995 and reported a no-op as a 5313-line partial revert. **SPECIMEN (iii), the identifier rung -- a rename read as a deletion (bold-carp-449, whose session is archived, so this row is the specimen's only durable form).** A worktree held staged residue: `prose_citation_census.dag` staged at 576 lines against main's 802, with 56 lines staged-only; its witness test 245 against 461, 23 staged-only. The first read reasoned from SIZE to CONTENT -- main is 226 lines further along, so these must be earlier phrasings -- which is unsound because a file can grow 226 lines while independently dropping 56. The token test that replaced it pulled distinctive identifiers from each staged-only line and grepped main: 25 of 56 and 15 of 23 were ABSENT, INCLUDING FIVE WHOLE FUNCTIONS AND FOUR WHOLE TEST FNS, which reads as a substantial deletion. IT WAS ENTIRELY RENAMES. Every construct exists in main under different wording -- staged `cross_file: Bool` became main's `ProseCitationLocality = InRetiringFile | InAnotherFile | RetiringFileAmbiguous`; `prose_citation_baseline_row` became `prose_citation_baseline_reading`; `a_citation_in_the_retiring_file_is_not_cross_file` became `a_citation_in_the_retiring_file_is_local_to_it`. **TWO WERE STRICTLY STRONGER IN MAIN** -- the `Bool` became a three-arm coproduct expressing the several-paths case a `Bool` cannot, and main carried an entire second axis the staged copy lacked -- so the instrument reported a LOSS where the truth was a GAIN. What settled it was reading main's type and function definitions and asking which CONCEPT each staged construct maps onto. **RECOGNITION RULE, COVERING ALL THREE, AND IT MUST FIRE AT READING TIME RATHER THAN AT RETRACTION TIME:** before reading an ABSENCE or a DIFFERENCE as a fact about the subject, establish that the instrument resolved to the subject you meant -- the same version, the same attempt, the same concept -- because every cheap test available resolves to something adjacent and says nothing about having done so. Corollary for the time axis: before DIFFERENCING two readings through one identifier, establish it denoted the same subject version both times, and name the version explicitly -- attempt number, sha, three-dot -- rather than relying on the bare handle. **THE NEAR-MISSES ARE PART OF THE RECEIPT AND ARE WHY THIS IS FILED AT ALL.** None of the three reached a wrong decision and each halted one step short: the trend was retracted while a peer was preparing to relay it into an escalation, where it would have been believed because it fit a story its reader already held; the no-op diffstat was settled by tree sha before anyone acted on reopening; the deletion was settled by concept-mapping before anything was restored. A class whose specimens each halt one step from harm names exactly what the recognition rule has to beat. **BOUNDED AGAINST THE THREE NEAREST ROWS, and these boundaries are the justification for a form here rather than a fourth authority.** `receipt_names_a_property_not_the_tree_it_holds_of` is a RECEIPT that was valid and EXPIRED when its base moved, repaired by re-deriving against the new base; here nothing expires -- every reading is live and true of its own subject, and the defect is manufactured by JOINING two of them. `positional_citation` is an authored HANDLE that decays and fails by matching zero; here the handle keeps matching perfectly and returns a confident answer about something else -- and note the sharper relation, that specimen (iii) shows an identifier GREP is itself a positional test, so `positional_citation` names the decaying-pointer half while this row names the unsound-absence half. `execution_provenance_loss` asks whether the observation ran; here it ran and reported faithfully. All of them share provenance-intact subject substitution, which is why this is a FORM of this row and not a new one.)", evidence: [] }
 data one_refusal_two_destinations: RecurringFailureMode = RecurringFailureMode {
   identity: "one_refusal_two_destinations" as NonEmptyStr,
   authored: "**one refusal, two destinations, remedy misdirected** (a single refusal at a single source column emits two rows naming DIFFERENT expected types, because two producers resolve the same declared spelling in different environments. The reader repairs from the row that names the parameter -- and that is the row the checker did NOT refuse on. **THE SYMPTOM IS THE RECOGNITION RULE, NOT THE CAUSE**: what a debugging author encounters is one column, two rows, two expected types; the instruction that saves them is DO NOT REPAIR FROM THE INHABITANCE ROW -- the compat row is what refused. Specimen, measured 2026-09-01 on gunbc c0a378c07be by calm-boar-314 and bold-carp-449 independently, on two binaries and two phases (`gunbc compile` emit-stage refusal and `gunbc run` entry-resolve), unrepaired at authoring. A module declaring `type String = FreeMonoid<Char>` and `fn takes_bare(s: String) -> Int`, called from a foreign module that IMPORTS the function, with a deliberately wrong `Int` actual so the diagnostic must name its destination, refuses with: `type mismatch: expected 'Primitive(String)', got 'Primitive(Int)'` AND `value does not inhabit its declared type at the direct call argument for parameter 's': declared 'Node(String<Product(Char)>)', produced 'Primitive(Int)'`. THE TWO PRODUCERS, read from source rather than inferred from message shape: `v1.compiler.infer direct_call_arg_mismatch_diags` renders the compat row from the formal as the CALLER environment resolves it, and `v1.compiler.infer declared_type_obligation_diags` renders the inhabitance row from `obligation.declared` through `declared_type_inhabitance`. Both reach `type_mismatch_error` and `DeclaredTypeNotInhabited` in `v1.compiler.core`, so the rendering is shared and the DIVERGENCE IS UPSTREAM OF IT -- which is why the two rows look like one mechanism disagreeing with itself. **THE TRIGGER IS TWO COMPETING BINDINGS LIVE IN ONE RESOLVING SCOPE, NOT THE IMPORT AS SUCH**, and this row states the narrower claim deliberately: the with/without-import pair is measured, but the two AGREEING cells agree for OPPOSITE reasons -- an un-imported foreign caller agrees at `Primitive(String)` because only the kernel binding is available, and an in-module caller agrees at `Node(String<Product(Char)>)` because only the local declaration is. Phrasing the trigger as the import would make a reader conclude the class does not reproduce when some other construct puts a second binding in scope. An explicit `import <module> \{ <fn> \}` is the ONLY construct measured to create the competition; whether any other does is UNMEASURED. Crossed arm, pre-registered before its log was read: removing the import moves ONLY the inhabitance row, from `Node(String<Product(Char)>)` to `Primitive(String)`, while the compat row is `Primitive(String)` under both -- so one producer follows the import binding and the other does not, rather than the whole reading shifting. RUNG FOUND AT: 1 (mitigatable) -- the line DOES stop, and stops located, so this is not silent wrongness; what fails is that the refusal MISDIRECTS the remedy, which is DESIGN section 5's requirement that a refusal be typed AND located read one layer deeper: located at the right column while naming the wrong destination. CEILING: 3 (structurally guaranteed) -- one resolution of a callee's declared type per call site, consumed by both producers, makes two destinations unconstructible. NEXT-RUNG TRIGGER, naming the capability rather than an artifact: a single resolved-formal authority at the call site that both the compat check and the inhabitance obligation READ, sufficient that no call-site refusal can render two different expected types for one parameter. Distinct from `meaning_fork`, which is one NAME carrying two meanings across scopes -- that is the underlying condition here and is separately rostered; this row is about two PRODUCERS disagreeing inside a single refusal, which is what makes the remedy wrong rather than merely the meaning ambiguous. Distinct from `diagnostic_name_mechanism_silent`: there the diagnostic names a mechanism that never ran; here both mechanisms ran and both reported faithfully about different environments. WHAT IS NOT CLAIMED, by either measurer: which producer is correct, and why they read the binding differently. No arm on either rig touches it, and the source reading above identifies the producers without settling which environment a call-argument formal SHOULD be resolved in.)" as NonEmptyStr,
diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md
index 3ee00d028c6..8c66a6b29fd 100644
--- a/docs/design-failure-modes.md
+++ b/docs/design-failure-modes.md
@@ -109,7 +109,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit
 - **meaning fork** (one scoped name carries more than one material semantic referent under hidden state; accuracy of meaning applies to terms in every layer, and for a contract-bearing name, differences in obligations, quality floor, refusal behavior, billing consequence, or remedy establish different referents. The subject is scoped: the key is the naming surface, the visible name, and the declared effective version or epoch — the same spelling in two explicitly distinct scopes or across a declared version transition is legitimate reuse, not a fork. Recognition rule: hold that key constant and vary the hidden state; if the material semantic referent changes without a distinct variant name, the name has forked — for a contract-bearing name, a change in obligations, quality floor, refusal behavior, billing consequence, or remedy is sufficient evidence of that change. This is the one-name/two-meanings dual of nicknaming.)
 - **externalized degradation** (an actor that accepted an obligation or risk, or caused a cost, silently shifts the resulting burden to another principal while preserving the apparent name, price, or contract. Recognition rule: identify the accepted obligation or causal responsibility, trigger the adverse state, and follow who bears the marginal burden; if another principal's burden rises while the responsible actor neither absorbs it through its reserve, refusal, or remedy path nor exposes a separately named, priced, and refusable transfer, the burden was externalized. A disclosed, refusable allocation agreed before contract formation is the transfer arm; an undisclosed or unilateral later shift is refused. The honest arms are absorb-and-reserve or separately name-and-price the transfer.)
 - mistyped body radiates nonlocal phantom diagnostics (LAYER, stated first because carrying this finding across it inverts its meaning: the producer is the .dag COMPILER diagnosing .dag SOURCE -- the interpreter/type-check path behind gunbc compile and the --required-regen self-compile -- NOT rustc diagnosing emitted Rust; nothing here supports discounting any rustc-diagnostic census. THE FAILURE: a type error confined to ONE module-scope fn body does not refuse at that body with a located diagnostic; it radiates as a fabricated population of field-access diagnostics at UNRELATED modules, so the line stops pointing at the wrong factories. SPECIMEN (XL-0T, PR #9720): one fn added to v1.compiler.infer_env whose body held NonEmptyStr-as-String casts in comparison/argument position plus a FilePath-vs-String if-arm mismatch produced ~700 advisory `no field 'source_indices' on type 'TypeEnv'` rows across compile.dag, 05_emit_rust.dag and 04_resolve.dag -- modules that were fine -- and blocked required-regen, which printed 12 of them and never named the defective body. A reader begins repairing the wrong files; that misdirection, not the volume, is the harm (section 5: every refusal typed AND located). FOUR-POINT DISCRIMINATOR, one instrument (entry-scoped compile of src/v1/compile.dag, counting the diagnostic): full mistyped body 774; same signature with trivial body 0; casts hoisted into let bindings with structure kept 0 phantoms plus ONE real correctly-located error at the fn's own line; that real error fixed rc=0. The series also refuted the name-capture hypothesis for this specimen, since the fn name was held constant across all four points. RUNG: outside the ladder at the diagnosed-population grain -- the fabricated rows ARE silent wrongness about the modules they name -- while the run-level verdict stayed mitigatable (the compile did refuse; it refused about the wrong subject). CEILING: structurally guaranteed -- an expression-position type failure inside a body refuses AT that body before any cross-module field-access checking consumes the poisoned inference state. NEXT-RUNG TRIGGER, naming the capability: body-local type-error containment, sufficient that no diagnostic about module B can be produced by a type defect whose every construction site is inside module A. RECOGNITION RULE: when N same-shaped field/type diagnostics appear at unrelated sites immediately after adding or editing ONE declaration, suspect that declaration's body typing before believing any named site; trivial-body the new declaration as the two-minute discriminator, and hoist casts out of comparison/argument position into let bindings to recover the located refusal.)
-- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 <range>`) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful.)
+- **instrument output read as subject content** (a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. **The boundary against `execution_provenance_loss` is the whole justification for a separate row, because the two look identical at the call site and have opposite repairs**: there a value is consumed as though an observation produced it while nothing proves the observation path RAN, and the fix is to bind an execution receipt; here the observation ran and reported FAITHFULLY — the instrument answered its own question correctly — and what is wrong is that its output was complete for the REPORTER s purpose and was read as complete for the CONSUMER s. Provenance is intact; the SUBJECT is substituted, so no receipt binding can detect it and the repair is instead to derive the set from the subject itself. Distinct from `total_at_the_level_examined_blind`, which is a judgment shape (a match total over the type it examines, blind inside an arm), and from `reachability_read_as_occupancy`, which asks whether a quiet guard should exist; this is neither a match nor a guard. Specimen with a receipt, repaired on main by gunbc#9829: the required floor asked `extdeps.git` `git.Core.DiffUnified0` (`git diff -U0 <range>`) which lines a change touched, and `floor_diff_edits_from_line_ranges` attributed those lines to enclosing declarations to decide which witness identities the change established. Git prints only the hunks that DIFFER, so on a rename it prints the module line and whatever else moved — while every identity at the destination is a newly qualified `module.function` that has never executed under that spelling, because the authored module name moved with the file. **THE REASON IT SURVIVED IS THAT THE TWO ANSWERS COINCIDE BY ACCIDENT IN THE COMMON CASE**: for a wholly-added file every line is a `+` line, so line attribution reaches every declaration and the defect is invisible; it appears only when the instrument gets TERSE, which rename detection is. Measured over the window reachable in a shallow session clone — a floor on the population, not the population, since older renames are unmeasured — 8 of 8 rename-destination `.dag` files carrying test decls were under-enrolled and at least 87 of their 103 identities were never selected; a PURE MOVE with no content edit enrolled NOTHING. It was not merely a reporting gap: changed-witness membership is what OVERRIDES the cost-debt withhold and the outside-gate suppression, so the same miss on a rostered identity is a silent decline of a witness whose author is present, which is the state `v2.workflow.floor_changed_witness` `changed_witness_execution_standing` exists to red. The repair derives the set from the subject: a path `parse_unified_diff_added_paths` already rules new-at-path contributes the declarations THE FILE ITSELF PARSES TO, bounded to that file s own decl list and never the corpus, so it is the precise answer rather than an absorbing widen. Its discriminating red is `rename_destination_enrolls_every_test_decl_not_only_the_diff_touched_one`, which feeds the specimen s verbatim diff and FAILS when the rule is disabled, paired with `in_place_modify_enrolls_only_the_touched_test_decl`, which passes under both states so the first cannot be satisfied by widening. **Recognition rule, and it predicts well beyond git**: whenever a set is read out of a tool s output, ask whether that tool promised completeness over YOUR question or over its own — `--stat`, any de-duplicating or truncating reporter, and any porcelain that elides for human brevity all report faithfully and none of them promise the consumer s set. **Its near twin is `executed_conjunct_discriminates_nothing`, approached from the other side**: there the satisfied signal is EXECUTION -- the conjunct genuinely runs and is genuinely gated on -- while here it is COMPLETENESS RELATIVE TO THE REPORTER, which is why this class is not a reachability problem and looking for an unexecuted path finds everything healthy. In both, the axis the diligent reader checks already reads green, and checking it harder returns the same green.)**THREE RECEIPTS FROM ONE SESSION (2026-09-01, XL-0T), ALL READ AS A GREEN OR A ZERO, AND THE THIRD IS THE ONE THIS ROW DID NOT ALREADY COVER.** (1) A remote build read as `ctrl-build --remote -- cargo check ... | tail -8`: the pipeline exits with TAIL's status, so it is zero whatever the compiler said, and the eight-line window it keeps is executor cleanup chatter carrying no line capable of holding an error. Absence of an error read as success AFTER every line that could contradict it had been discarded. (2) A regeneration wrapped in `/usr/bin/time -v` in a container where that binary does not exist: bash died at the wrapper, exited ZERO, the program never ran, and the subsequent `git diff` was EMPTY -- which reads exactly as `no drift`, the answer that would have RETRACTED a correct finding already registered as a prediction. (3) The floor's `[over-cost]` listing, from which order statistics were computed and reported as a distribution -- `median 390ms, p95 418ms, a dense band at 78-84% of the 500ms ceiling`. The listing is not the population and SAYS SO IN ITS OWN LAST LINE: `and 260 further row(s) over the 100ms line, not printed ... this list is the 25 most expensive, ranked on the declared cost basis`, against `over_cost_line_diagnostic=285`. The true shape was the OPPOSITE: one outlier 73ms clear of the field (501 refused, runner-up 428, the remaining 260 all at or below 337ms), and the gap claimed to be empty had a row sitting in it. **WHY THE THIRD IS THE SEVERE ONE AND WHY IT NEEDED THIS ROW RATHER THAN A NEW ONE.** The first two were filters the CONSUMER wrote, and the standing guard -- select on the result pattern, never on position -- catches both. The third was truncation the PRODUCER performed, for its own readability, and DECLARED IN BAND; there was no consumer-authored `head -N` to notice, so the guard does not fire and diligence along it returns green. That is this class exactly: the report was complete for the REPORTER's purpose and read as complete for the CONSUMER's, with provenance intact and the subject substituted. **GENERAL FORM, which extends the recognition rule above from completeness to ORDER: a ranked list is a VIEW, and a view's order statistics are not the population's.** A median or a percentile computed over a top-K is an order statistic of a truncated tail; it carries no trace of the truncation, it has the same shape and units as the real thing, and it is therefore strictly more dangerous than a wrong count, which at least invites the question `out of how many`. So: before computing ANY statistic over a tool's lines, find the producer's own statement of what it printed -- a `N further rows`, a `top K`, a `ranked by`, a total beside the listing -- and where the producer names a fuller artifact, THAT is the population and the log is a preview. **THE HARM WAS NOT TO THE AUTHOR'S OWN CONCLUSIONS**, which is what separates this receipt from the two beside it: the wrong distribution had already been relayed to a lane authoring a DECLARED RUNG DROP whose population is stated as a function of headroom against observed inflation. At the measured 8-11% a row tips only from a baseline near 450ms, so the true at-risk population was ONE row -- the 501 itself -- and the relayed number would have made it twenty-five, inside the one artifact whose entire value is that its population is honest, and in the direction that makes a class look larger, which is the direction nobody audits.)**FOURTH RECEIPT, AND IT WAS FOUND INSIDE THE INSTRUMENT BEING USED TO WRITE THE REPORT ABOUT THIS CLASS (2026-09-01, same session).** `v1.tests.claim.carrier_realization_census`, run over 1320 `.dag` files, prints `subjects=1320` -- and 1320 is the count of FILES INGESTED, not modules CENSUSED. Only 845 modules produce rows; 475, or 36 percent, are silently omitted. The omissions are not obscure: `v2.compiler.parse` is absent, and `v2.std.compilers.lexing` is absent while its siblings `body_lowering`, `cli_surface`, `sugar` and `semantic_decl_emission` are all present, so it is neither a test-module filter nor obvious unreachability. A consumer reads `subjects=` as coverage, which is this class exactly: the count is complete for the REPORTER's purpose -- files it accepted -- and was read as complete for the CONSUMER's, which is modules it examined. **THE SELECTION RULE IS DELIBERATELY NOT STATED HERE**: it was not determined, and guessing it would put a fabricated mechanism in a ledger row, which is worse than an incomplete one. **WHAT IT COST, MEASURED RATHER THAN IMAGINED.** A fixture authored specifically to settle an unrelated question landed in the omitted 475 and produced ZERO rows -- including its own positive control. Its emptiness was exactly what the hypothesis under test predicted, so without the control it would have been reported as confirmation of a hypothesis on evidence containing none. The absence-versus-zero distinction this class names reproduced itself INSIDE the test built to settle it, which is the practical lesson: catching a pattern does not inoculate you against it, and the exposure is highest immediately after being careful. **THE RESOLUTION-AXIS FORM, MEASURED 2026-09-02 (bold-stag-665 specimens i-ii, bold-carp-449 specimen iii): THE INSTRUMENT RESOLVED THE REFERENCE TO SOMETHING ADJACENT TO THE INTENDED SUBJECT AND REPORTED FAITHFULLY ABOUT WHAT IT RESOLVED TO.** The adjacency is a different VERSION, a different ATTEMPT, or a different SPELLING; `which version` is one instance of the axis and not its definition, which is why a purely temporal reading of this form does not house all three specimens -- specimen (iii) moves nothing at all, being one fixed tree read against one fixed staged copy at one instant, and its adjacency is naming rather than time.** The forms above substitute WHAT the instrument covered for what the subject contains. Here the instrument resolves to a DIFFERENT VERSION, a DIFFERENT ATTEMPT, or a DIFFERENT NAME for the same subject, and its answer carries no mark of having done so. **THE TEETH: EVERY RUNG RETURNS A WELL-FORMED PLAUSIBLE ANSWER RATHER THAN AN ERROR, SO THE WRONG ANSWER DOES NOT LOOK LIKE A FAILURE, IT LOOKS LIKE DATA.** `3 -> 6 -> 13` reads as a trend; `+76/-31` reads as a change; `five functions missing` reads as a deletion. Each arrives with a mechanism ready to explain it, which is what makes it persuasive rather than merely wrong. **THE LADDER, WHICH IS THE TRANSFERABLE PART -- EVERY RUNG BUT THE LAST IS POSITIONAL, AND EACH GOES RED FOR A DIFFERENT IRRELEVANT REASON:** line-diff is red on a REWRITE; identifier-diff is red on a RENAME; concept-mapping is the only test that decides. Identifier-absence is not the cure for line-absence, it is the SAME positional test one level up -- **absence of a NAME is not absence of a CAPABILITY, and only the second is a loss.** **SPECIMEN (i), the time axis -- an identifier whose referent advances.** `gh run view --job <id> --log` serves the LATEST ATTEMPT for a fixed job id. Job 100217416636 was read as `interrupted_before_verdict=6`; a rerun replaced the attempt; the SAME id later returned 13. Those readings were then DIFFERENCED into a reported `3 -> 6 -> 13` upward trend with a memory-pressure mechanism attached and offered upward as evidence -- the `3` having additionally been measured on a different head. Monotone growth is precisely what independent draws at a fixed distance from a budget do not produce, which is what made the artifact convincing. **SPECIMEN (ii), the line rung -- an ancestry the merge destroyed.** Under SQUASH merge the squashed commit is not an ancestor of the branch, so `git diff --stat origin/main...origin/session/<branch>` re-renders ALREADY-LANDED work as unlanded: gunbc#10100 rendered 3 files, +76/-31, for content wholly present on main. The deciding test is content -- `git merge-tree --write-tree origin/main <branch>` against `git rev-parse origin/main^{tree}`, identical shas meaning the merge is a no-op. A peer hit the same rendering on gunbc#9995 and reported a no-op as a 5313-line partial revert. **SPECIMEN (iii), the identifier rung -- a rename read as a deletion (bold-carp-449, whose session is archived, so this row is the specimen's only durable form).** A worktree held staged residue: `prose_citation_census.dag` staged at 576 lines against main's 802, with 56 lines staged-only; its witness test 245 against 461, 23 staged-only. The first read reasoned from SIZE to CONTENT -- main is 226 lines further along, so these must be earlier phrasings -- which is unsound because a file can grow 226 lines while independently dropping 56. The token test that replaced it pulled distinctive identifiers from each staged-only line and grepped main: 25 of 56 and 15 of 23 were ABSENT, INCLUDING FIVE WHOLE FUNCTIONS AND FOUR WHOLE TEST FNS, which reads as a substantial deletion. IT WAS ENTIRELY RENAMES. Every construct exists in main under different wording -- staged `cross_file: Bool` became main's `ProseCitationLocality = InRetiringFile | InAnotherFile | RetiringFileAmbiguous`; `prose_citation_baseline_row` became `prose_citation_baseline_reading`; `a_citation_in_the_retiring_file_is_not_cross_file` became `a_citation_in_the_retiring_file_is_local_to_it`. **TWO WERE STRICTLY STRONGER IN MAIN** -- the `Bool` became a three-arm coproduct expressing the several-paths case a `Bool` cannot, and main carried an entire second axis the staged copy lacked -- so the instrument reported a LOSS where the truth was a GAIN. What settled it was reading main's type and function definitions and asking which CONCEPT each staged construct maps onto. **RECOGNITION RULE, COVERING ALL THREE, AND IT MUST FIRE AT READING TIME RATHER THAN AT RETRACTION TIME:** before reading an ABSENCE or a DIFFERENCE as a fact about the subject, establish that the instrument resolved to the subject you meant -- the same version, the same attempt, the same concept -- because every cheap test available resolves to something adjacent and says nothing about having done so. Corollary for the time axis: before DIFFERENCING two readings through one identifier, establish it denoted the same subject version both times, and name the version explicitly -- attempt number, sha, three-dot -- rather than relying on the bare handle. **THE NEAR-MISSES ARE PART OF THE RECEIPT AND ARE WHY THIS IS FILED AT ALL.** None of the three reached a wrong decision and each halted one step short: the trend was retracted while a peer was preparing to relay it into an escalation, where it would have been believed because it fit a story its reader already held; the no-op diffstat was settled by tree sha before anyone acted on reopening; the deletion was settled by concept-mapping before anything was restored. A class whose specimens each halt one step from harm names exactly what the recognition rule has to beat. **BOUNDED AGAINST THE THREE NEAREST ROWS, and these boundaries are the justification for a form here rather than a fourth authority.** `receipt_names_a_property_not_the_tree_it_holds_of` is a RECEIPT that was valid and EXPIRED when its base moved, repaired by re-deriving against the new base; here nothing expires -- every reading is live and true of its own subject, and the defect is manufactured by JOINING two of them. `positional_citation` is an authored HANDLE that decays and fails by matching zero; here the handle keeps matching perfectly and returns a confident answer about something else -- and note the sharper relation, that specimen (iii) shows an identifier GREP is itself a positional test, so `positional_citation` names the decaying-pointer half while this row names the unsound-absence half. `execution_provenance_loss` asks whether the observation ran; here it ran and reported faithfully. All of them share provenance-intact subject substitution, which is why this is a FORM of this row and not a new one.)
 - **a conjunct that executes, is reached, is gated on, and still discriminates nothing** (a predicate wired into a live check runs on every call, sits inside a gate that really blocks, and yet deletes cleanly: remove it and every witness stays green, because no fixture ever constructs the population that would make it false. **It is invisible precisely BECAUSE reachability is satisfied.** The usual signature of an unenforced mechanism -- nothing calls it -- is absent, so every reachability-based tell reports health, and review reads the conjunct as a wall because it genuinely is evaluated. Executed and enforcing are different properties, and no amount of coverage over the calling path distinguishes them. **It is bounded against three neighbours and none of their recognition rules will find it.** `reachability_read_as_occupancy` asks whether to DELETE a guard that is quiet, and warns that mechanism-yes / join-yes / occupancy-zero is a healthy guard; this class is not about deletion and not about occupancy -- the conjunct here should stay, and the defect is that it was believed to be doing work it was not. Section 6's inert-lens tell is machinery that nothing GATES on; this is gated on. Section 4b's decoration case is a check whose RED cannot be authored ANYWHERE; this RED can be authored -- it simply never was, which is the whole difference, and it is the difference between a permanent ceiling and one missing fixture. **THE REMEDY HAS TWO HALVES AND THE SECOND IS WHAT MAKES THE FIRST SOUND.** First: for each wall, run the DELETE arm and confirm EXACTLY ONE witness reddens -- not that a witness reddens. Second: the subject that isolates the conjunct must be chosen with care, because a red for the wrong reason is how this class survives its own test. **SPECIMEN, with both halves executed** (gunbc#9838, `gunbc.self_host_compile_phase_frontier`): `census_population_is_duplicate_free` was added as a conjunct of `receipt_population_coherent`, evaluated on every coherence check and reachable from the live path; deleting it left the whole witness module green. The fixture that isolates it is a receipt whose `refused_files` REPEATS A PATH -- enrolled as `a_receipt_whose_refused_population_repeats_a_path_is_refused_by_coherence` in `test.claim.self_host_compile_phase_frontier_witness`, with `the_same_receipt_without_the_repeat_is_coherent` as its positive control. The subject that looks equally good and is not: a repeated ERROR DIAGNOSTIC IDENTITY also reddens the module, but it breaks a count invariant one line over rather than this conjunct, so it would have scored the DEAD conjunct as LIVE and closed the investigation with the wall still inert. **RUNG: mechanically preventable, and the honest ceiling is the same rung rather than higher.** The unenforcing conjunct stays writable; what exists is an executed falsifier per wall, not a construction that forbids authoring one. The next-rung trigger is a CAPABILITY and not an artifact: a mechanism that derives, from the check itself, the population its removal would change -- so that a conjunct with an empty such population fails to compile rather than waiting for an author to think of the delete arm. Enumerating delete arms by hand does not retire it; it only executes this row's recognition rule once per wall. **Its near twin is `instrument_output_read_as_subject_content`, and they meet from opposite sides**: there a report is complete for the REPORTER and read as complete for the SUBJECT; here a conjunct is genuinely executed and read as genuinely discriminating. Both are the shape where the health signal the reader actually checks -- completeness there, execution here -- is fully satisfied while the property they believe it establishes does not hold. **Neither is found by checking harder along the axis that already reads green.** **SECOND SPECIMEN, 2026-09-02, the same shape one layer down and found by a different tell.** `v1.stage0.required_regen_host` `admit_stage_execution_from_model` built ONE identity list from the stage plan and passed it as BOTH the `planned` and the `executed` field of `RegenStageExecutionObservation`, so `v2.workflow.regen_convergence_transaction` `regen_identity_population_eq` evaluated x == x.clone() on every install of the self-host convergence transaction. The conjunct ran, the install boundary really blocked, and `StagePlannedExecutedMismatch` stayed authorable in `v2.test.claim.regen_convergence_transaction_witness_test` while being unreachable from the real acceptance path -- the exact split section 4b's authorable-RED rule exists to catch. **THE DELETE ARM IS NOT WHAT FOUND IT; THE PRODUCER COUNT IS**, and that is this specimen's addition to the row: reading the two sides of one population equality back to their PRODUCERS and finding a single producer is cheaper than removing the conjunct and re-running, and it needs no experiment -- any equality whose two arguments trace to one value is this class already. **THE REPAIR IS A SECOND PRODUCER, NEVER A SECOND READ OF THE FIRST**: a digest delta over the journalled generated roster, taken before the copy loop and again after the build, carried in its own Rust newtype `ObservedEffectPopulation` with no conversion from the plan, so a later refactor cannot re-collapse the two sides without deleting a type. Its discriminating red `stage_execution_joins_the_plan_to_independently_observed_effects` carries TWO arms because one-directional identity checking is how the loss survived: an effect on a path OUTSIDE the plan, which was green before because `allowed_after` blanket-permits every already-dirty stage0 path for the rest of the transaction; and a planned surface the stage left byte-identical, which did refuse before but as `InstalledDigestMismatch` -- a CONTENT verdict standing in for a POPULATION one, so the arm asserts the cause and not that it refused.)
 - **unbacked execution claim** (prose asserts a live executing relation — this runs on X, X reads these fields, Y already resolves Z — that no authority backs, and a reader forms the premise and plans against it. §4b's CI rung drop names the harm PREMISE CONTAMINATION in its own words; this row is that harm as a general class, since the drop is about one paragraph in the canonical authority and the class is about every carrier. **THE ORIGINS ARE A FIELD OF THIS ONE ROW RATHER THAN SEPARATE ROWS, because the recognition rule is identical across them** — resolve the claim against the authority that owns the relation — **but the REMEDY BRANCHES ON THE ORIGIN, and a remedy applied without reading the origin manufactures new false statements.** Three origins are ATTESTED here and a fourth is conceivable but was NOT found. ORIGIN 1, EXECUTOR DELETED: the claim was true and its executor was removed. Specimen: `gunbc.floor_component_receipt_document` recited that an alert downloads an artifact named `floor-component-receipt` from a run id it is given and reads four named fields; that alert was `falsifier-alert.yml`, deleted 2026-08-15, and a lane read the module, believed the transport live, planned against it, and was corrected by its reviewing authority — the cost is measured, not hypothetical. Second specimen, same origin: `gunbc.ci_failure_class` stated its dissolution trigger as calling `classify_failure_reason` *the way claim_executor already resolves* `gunbc.floor_component_receipt`; `write_floor_component_receipt_at` did exactly that from 2026-07-30 (gunbc#7467) until gunbc#9228 deleted it on 2026-08-25. ORIGIN 2, THE CITED SYMBOL DIED WHILE ITS CONTENT SURVIVED AS AN ANNOTATION, and this one has a corpus-wide producer: `v1_compiler.cli_run` twice cited `floor_component_resource_checkpoint_note` and `floor_component_phase_journal_scaffold_note`, which were real `data …: String` declarations in `gunbc.floor_component_receipt` until the 2026-08-30 prose-bankruptcy sweep (gunbc#9752) converted module-scope commentary rows into §4c annotations corpus-wide. §4c makes an annotation uncitable by construction — `v1_compiler.cli_run` `annotation_erased_scan_text` feeds the semantic passes, so annotation text is not present in the tree the citation harvester walks. **THE CONSEQUENCE IS THE OPPOSITE OF THE ONE THIS ROW FIRST DREW, AND THE CORRECTION IS THE INSTRUCTIVE PART.** The first revision reasoned that the sweep therefore broke every citation of a converted row, making the population the sweep's own diff. Measured by a separate lane (gunbc XL-0-CITE, 2026-09-01) against `v1_compiler.declaration_index`, whose only citation producers are `citation_from_record_literal` and `citation_from_constructor_call`: the typed-citation breakage is **ZERO**, computed both today and as of the sweep commit, on a control that discriminates in both directions. A plain name in annotation prose was never a citation, so the sweep could not break one. What that leaves is a REAL class with an honest ceiling rather than a defect population: these citations bind READERS and no mechanism, so they sit in §4b's *outside the modeled guarantee* column — observed and repaired by reading, never gated — and calling them a dangling-citation population would have been rung inflation about a check that by construction cannot see them. The two `cli_run` sites are genuine instances of the harm and there is no mechanical census that would have found them. ORIGIN 3, WRONG AUTHORITY FOR SOMETHING THAT STILL EXECUTES: `dag/test/claim/instrument_sandbox_witness_test` says its live half `runs on the falsifier lane`; that half sits on `FalsifierSubstrateLongLane`, which `std.witness_admission` `witness_cadence_has_scheduled_route` reports routeless — but it also carries a local recipe, and `OfflineLocalRecipe` HAS a route, so the relation is live and only the named authority is wrong. THE FOURTH, NEVER BACKED AT ALL, IS NOT ATTESTED IN THIS CORPUS and is recorded as unmeasured rather than as a population. **THIS ROW IS NOT THE AUTHORITY ON ANY POPULATION, and saying so is the point:** `gunbc.deleted_cadence_reference_census` already owns the falsifier-cadence instance of origin 1 — twelve sites, a `DeletedCadenceReferenceStanding` vocabulary whose `PremiseInvalidated` arm is exactly this class, and one `GuaranteeRungDrop` filed once for the shared executor rather than per site. A pattern row that restated its population would be a second authority for a fact that already has one, which is the §3 violation this row's own remedy is meant to prevent; so the census is cited here and nothing about its contents is copied. What belongs HERE is only the recognition rule and the remedy arms, which generalize past the falsifier. **THE MECHANICAL TEST for finding one is sharper than asking whether the verb is runs or is enrolled: resolve the claim against the authority that owns the relation, and ask whether the prose implies a live route for something that authority says has none.** The naive runs/enrolled discriminator loses one arm and it is the common one — `Enrolled on falsifier_rehomed_bin_wet_entries (nightly batch 5)` is nominally an enrollment claim, which is TRUE, but `nightly` asserts a cadence that executes and `FalsifierRehomedBinWet` is routeless, so the reader forms the false premise anyway. Three outcomes per line: asserts execution (contaminating), asserts enrollment only (true, leave it), asserts enrollment while implying a live cadence (contaminating). **THE REMEDY HAS THREE ARMS, KEYED TO WHAT THE AUTHORITY SAYS NOW, and picking the wrong one is itself an instance of this class.** Origin 1 → PAST TENSE WITH THE DATE, keeping the reasoning, because the reasoning usually outlives its executor and a reader who finds a dangling claim silently deleted learns nothing. Origin 2 → name the module and the FACT rather than the dead symbol, since §4c left no symbol to cite; past-tensing here would wrongly report the content as gone when only its citability is. Origin 3 → CORRECT IT to the authority that does back it, NOT past tense: past-tensing a live relation records it as dead and is a new contamination in the opposite direction, produced by the remedy itself. Origin 4 → say it was never backed, or delete the assertion while keeping any surviving reasoning; NEVER past tense, because there is no past to record, and `X USED TO resolve Y` asserts an execution that also never happened. **The default against deletion is a default and not an absolute: a sentence whose entire content is a false execution claim has no reasoning to preserve.** **THE SELF-RECEIPT, and it is the most useful thing in this row (2026-09-01):** the first revision of this entry asserted the `ci_failure_class` clause and the two `cli_run` notes as never-true, on the strength of a grep showing they resolve nowhere TODAY. **Both were true when written**, and the row about unbacked claims therefore contained two of them. It was caught by a reviewing authority asking for verification rather than inheritance, not by any check. **RECOGNITION RULE EARNED: `resolves nowhere now` is not `never resolved`, the distinction is decided by history and not by the working tree, and the instrument is `git log --all -S` over the DECLARATION FORM** — which also separates origin 1 from origin 2 by showing WHAT deleted the referent. The neighbouring rule is `positional_citation`'s: a citation left naming a deleted symbol fakes a grep hit, so every arm above records the change rather than quietly removing the name.)
 - **a source-ingested module has no judged standing** (the required gates adjudicate entry-derived closures, while source-root ingest admits a larger identity population; a module outside every required closure can carry a structurally checkable defect while every gate stays green. This is NOT an import-edge class: globally unique names can resolve without a direct import, so authored inbound imports neither prove nor disprove judgment. It is also NOT a claim that every identity outside the closures is defective or should be gated. The severity is unknown, and that unknowability is the finding. **SPECIMEN AND DISCRIMINATING CONTROL** (node://adhoc-2d3c27b7-660, PR #9899): gunbc.annotation_parse_instrument_agreement constructed Terminal { reason, authority } although Terminal declares only reason; a clean required run left both build and witnesses green and both in-run judgment receipts omitted the module. The matched visible control placed the same undeclared-field construction in ordinary production module gunbc.clock_read: both required lanes refused with `field 'authority' not found in type 'LaneVisibilityControl'`; removing only the plant returned both lanes to green. Thus visibility, with defect class held constant, discriminates the arms. The witnesses prediction was weaker than its result: only submitted-closure membership was known beforehand, yet execution established strict judgment by refusing. **MEASUREMENT, EXPLICITLY NOT COVERAGE OR ENFORCEMENT:** the producer joins every first-party identity admitted by the exact source-root ingest against the union of module identities for which build or witnesses produced a strict typecheck verdict. On clean run 33484666539 it derived 4,419 admitted, 947 build-judged, 2,158 witnesses-judged, 2,319 in the judgment union, and 2,100 with no required-lane judgment. Build contributes only 161 identities beyond witnesses, so the two required closures are far from independent and their union remains close to one lane's reach. Exactly one of the 2,100 is confirmed orphaned by the executed control; the other 2,099 are Undecided because no typed authority currently says whether each is an executing standalone entry, fixture/generated/excluded, retired, or orphaned. Those identities are deliberately re-derived and NOT committed as a baseline or roster: a hand-carried 2,099-row exemption set would be a ratchet wearing a wall's name. The instrument reports; it does not refuse, and citing it as a gate is rung inflation. **PROVENANCE LIMIT:** in-run strict judgments and cross-process content-addressed cache judgments are separate columns. Required CI does not arm GUNBC_RESOLVED_GRAPH_CACHE_DIR, so the cross-process column was empty beside nonempty in-run columns in both planted and reverted runs. That empty column is a control for the unarmed premise, NOT evidence that the provenance split is exercised by required CI. **CEILING: decidable but waiting on a single standing authority.** A wall now would either false-red legitimate importer-free subjects or grandfather opaque debt. The next rung requires four capabilities together: (1) one typed standing registry exhaustively binds every first-party ingest identity to required judgment, a verified executing consumer, typed fixture/generated/exclusion, retirement, or orphan standing; (2) each executing-consumer binding is checked against the named consumer's actual roster and execution receipt, so a hollow alias cannot admit it; (3) a changed retained identity resolves only through its named consumer from materialized facts within the required floor's 8-second wall and 500-millisecond CPU envelopes, never by whole-corpus compilation; and (4) the two-direction matched undeclared-field control remains executable. At that rung admission makes the invalid state unwritable; until then this remains measurement and an Undecided population, not a defect backlog.)