diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag
index 3002cd36060..519d12c25a1 100644
--- a/dag/gunbc/recurring_failure_mode.dag
+++ b/dag/gunbc/recurring_failure_mode.dag
@@ -89,7 +89,7 @@ type RecurringFailureMode {
 
 data hollow_alias: RecurringFailureMode = RecurringFailureMode { identity: "hollow_alias" as NonEmptyStr, authored: "hollow alias (minimality ≠ grounding)", evidence: [] }
 
-data state_space_conflation: RecurringFailureMode = RecurringFailureMode { identity: "state_space_conflation" as NonEmptyStr, authored: "state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over \"the input is wrong\" and \"this strategy had nothing to say about it\", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic <kernel:NAME> that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read <kernel:String> as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no <kernel:NAME> can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal \"<kernel:\" as a row in a roster of MODULE PATHS; is_kernel_minted_file is a substring predicate over the same spelling; and v1.compiler.env resolved_node_is_kernel_identity_for_name owns the same fact by EXACT EQUALITY, its own note recording that a substring or prefix test is a second, weaker authority for it. **Recognition rule for this form: when a value's domain is carried in a type that cannot express one of its inhabitants, look for the inhabitant being recognised by SPELLING somewhere -- a prefix test, a magic string in a roster of real values, a sentinel. Each such site is a consumer that already knows the state exists, and their number is the count of authorities the missing constructor has spawned.** NO WRONG ANSWER IS CLAIMED FOR THE SPECIMEN AND NONE WAS MEASURED: for the kernel names reaching those gates today the spelling-keyed answer is the correct one, which is exactly why it never surfaced -- the class is filed on the state space, not on an output, and a form that produces no incident is the one that will be found last. **CLIMB RECEIPT (2026-09-02), appended rather than replacing the filing above, because DESIGN section 4b(4) keeps a class's discriminating evidence enrolled AFTER the climb rather than dissolving it with the production machinery.** The missing constructor now exists: std.coercion TypeDeclarationProvenance is CorpusDeclared | KernelMinted | DeclarationIdentityAbsent, minted by v1.std.core declaration_provenance_of, which decides the kernel arm by EXACT EQUALITY against kernel_span -- the minter itself -- rather than by a prefix test over its output. All four spelling authorities this row counted are gone: the literal \"<kernel:\" row is deleted from numeric_realization_declaring_modules, is_kernel_minted_file is deleted, and the two gates that substring-compared a synthetic identity against real paths now take the coproduct, so the structural gate's unreachability for a kernel-resolved reference stops being BY CONSTRUCTION and becomes BY DECISION -- a named arm answering false. **WHAT IS NOT CLAIMED, because this row's own honesty is the thing being climbed:** no wrong answer was found before and none is fixed now; every answer is preserved bit for bit, which is why the climb is in the STATE SPACE and not in an output. The empty-string inhabitant is likewise gone from the channel, and the bare-table answer it used to reach silently is now the named ground GroundedByUnidentifiedBareRow, so a declared rung drop that was previously indistinguishable from a properly-keyed answer is countable and refusable. **THE RECOGNITION RULE IS CORROBORATED AND THE CORROBORATION IS INDEPENDENT.** gunbc.type_reference_decl_file_occurrence_census reached this same four-authority set from the opposite direction -- that census asked what each of thirty-nine occurrences NEEDS, this row asked what the identity key can HOLD -- and the counts agreed. **WHAT SURVIVES UNCLIMBED, stated so the row is not read as closed:** CorpusDeclared still carries a file path matched by contains, so the surviving arm answers WHAT A DECLARATION REALIZES AS positionally. v1.compiler.infer_env global_bare_fallback_invariant already states the terminal key for it -- filepaths are irrelevant, the declared module path is the containment tree -- and re-keying that arm needs a declaration reference at each gate, which is a separate change.\n\n**A FOURTH FORM, MEASURED 2026-09-02 (quick-crab-396), AND IT SITS IN THE INTERPRETER RATHER THAN IN ANY MODEL: DECLARED OPTIONAL AND CONSTRUCTED ABSENT ARE TWO STATES WEARING ONE SPELLING.** A record field declared `T?` is read by authors -- and by this document's own §2 reasoning about optional carriers -- as optional-with-a-none-default. It is not. A literal that OMITS the field typechecks, and a later read of that field REFUSES at evaluation with `NoSuchField { type_name, field }`. So `T?` means mandatory-at-construction-and-typed-optional, and the two states the spelling conflates are `the field is absent because the author wrote none` and `the field is absent because the literal predates it`. EVIDENCE, a two-row probe with a positive control, which is what makes it a finding rather than a conjecture about one type: `type Widget { name: String  tag: Int? }` with `Widget { name: \"w\" }` refuses on `.tag` with `NoSuchField { type_name: \"Widget\", field: \"tag\" }`, while `Widget { name: \"w\", tag: Present { value: 3 } }.tag` reads back correctly -- so the mechanism is neither `reads fail` nor `this type is broken`, it is omission-with-no-default, and it is GENERAL to any record type. RUNG: this is FAIL-CLOSED and explicitly NOT silent wrongness -- the interpreter refuses rather than answering the false that a reader would expect -- which is the whole of the good news and it is what sets the rung at mitigatable rather than below the ladder. WHAT THE CORPUS CURRENTLY BELIEVES INSTEAD, and this is the reason the row exists: two carriers filed this on 2026-08-27 as `a nested compile is not evaluable in the interpreter, refusing with NoSuchField Node.ident` -- v1.tests.claim.reference_derived_disposition_census_witness_test and a sibling paragraph in v1.compiler.emit_rust. Nested compiles are one POPULATION that happens to construct Nodes through helpers omitting v1.std.core Node's `ident` and then read it; they are not the class, and the repair that description suggests (route around the nested pipeline with a host builtin) does not touch the cause. **POPULATION: UNENUMERATED, and stated as such rather than guessed.** It is every record type in the corpus carrying an optional field together with a literal that omits it; `v1.std.core Node.ident` is one specimen and the probe above is another. NEXT-RUNG TRIGGER, a capability and not an artifact: construction that supplies every declared field, so that a literal omitting an optional field is either unwritable or carries the absent value -- at which point the distinction between the two absences is made at construction and no read can encounter a field that was never written. NOT REPAIRED HERE BY RULING: a defaulting change alters evaluation semantics corpus-wide and needs its own subject, population and review.", evidence: [] }
+data state_space_conflation: RecurringFailureMode = RecurringFailureMode { identity: "state_space_conflation" as NonEmptyStr, authored: "state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over \"the input is wrong\" and \"this strategy had nothing to say about it\", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic <kernel:NAME> that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read <kernel:String> as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no <kernel:NAME> can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal \"<kernel:\" as a row in a roster of MODULE PATHS; is_kernel_minted_file is a substring predicate over the same spelling; and v1.compiler.env resolved_node_is_kernel_identity_for_name owns the same fact by EXACT EQUALITY, its own note recording that a substring or prefix test is a second, weaker authority for it. **Recognition rule for this form: when a value's domain is carried in a type that cannot express one of its inhabitants, look for the inhabitant being recognised by SPELLING somewhere -- a prefix test, a magic string in a roster of real values, a sentinel. Each such site is a consumer that already knows the state exists, and their number is the count of authorities the missing constructor has spawned.** NO WRONG ANSWER IS CLAIMED FOR THE SPECIMEN AND NONE WAS MEASURED: for the kernel names reaching those gates today the spelling-keyed answer is the correct one, which is exactly why it never surfaced -- the class is filed on the state space, not on an output, and a form that produces no incident is the one that will be found last. **CLIMB RECEIPT (2026-09-02), appended rather than replacing the filing above, because DESIGN section 4b(4) keeps a class's discriminating evidence enrolled AFTER the climb rather than dissolving it with the production machinery.** The missing constructor now exists: std.coercion TypeDeclarationProvenance is CorpusDeclared | KernelMinted | DeclarationIdentityAbsent, minted by v1.std.core declaration_provenance_of, which decides the kernel arm by EXACT EQUALITY against kernel_span -- the minter itself -- rather than by a prefix test over its output. All four spelling authorities this row counted are gone: the literal \"<kernel:\" row is deleted from numeric_realization_declaring_modules, is_kernel_minted_file is deleted, and the two gates that substring-compared a synthetic identity against real paths now take the coproduct, so the structural gate's unreachability for a kernel-resolved reference stops being BY CONSTRUCTION and becomes BY DECISION -- a named arm answering false. **WHAT IS NOT CLAIMED, because this row's own honesty is the thing being climbed:** no wrong answer was found before and none is fixed now; every answer is preserved bit for bit, which is why the climb is in the STATE SPACE and not in an output. The empty-string inhabitant is likewise gone from the channel, and the bare-table answer it used to reach silently is now the named ground GroundedByUnidentifiedBareRow, so a declared rung drop that was previously indistinguishable from a properly-keyed answer is countable and refusable. **THE RECOGNITION RULE IS CORROBORATED AND THE CORROBORATION IS INDEPENDENT.** gunbc.type_reference_decl_file_occurrence_census reached this same four-authority set from the opposite direction -- that census asked what each of thirty-nine occurrences NEEDS, this row asked what the identity key can HOLD -- and the counts agreed. **WHAT SURVIVES UNCLIMBED, stated so the row is not read as closed:** CorpusDeclared still carries a file path matched by contains, so the surviving arm answers WHAT A DECLARATION REALIZES AS positionally. v1.compiler.infer_env global_bare_fallback_invariant already states the terminal key for it -- filepaths are irrelevant, the declared module path is the containment tree -- and re-keying that arm needs a declaration reference at each gate, which is a separate change.\n\n**A FOURTH FORM, MEASURED 2026-09-02 (quick-crab-396), AND IT SITS IN THE INTERPRETER RATHER THAN IN ANY MODEL: DECLARED OPTIONAL AND CONSTRUCTED ABSENT ARE TWO STATES WEARING ONE SPELLING.** A record field declared `T?` is read by authors -- and by this document's own §2 reasoning about optional carriers -- as optional-with-a-none-default. It is not. A literal that OMITS the field typechecks, and a later read of that field REFUSES at evaluation with `NoSuchField { type_name, field }`. So `T?` means mandatory-at-construction-and-typed-optional, and the two states the spelling conflates are `the field is absent because the author wrote none` and `the field is absent because the literal predates it`. EVIDENCE, a two-row probe with a positive control, which is what makes it a finding rather than a conjecture about one type: `type Widget { name: String  tag: Int? }` with `Widget { name: \"w\" }` refuses on `.tag` with `NoSuchField { type_name: \"Widget\", field: \"tag\" }`, while `Widget { name: \"w\", tag: Present { value: 3 } }.tag` reads back correctly -- so the mechanism is neither `reads fail` nor `this type is broken`, it is omission-with-no-default, and it is GENERAL to any record type. RUNG: this is FAIL-CLOSED and explicitly NOT silent wrongness -- the interpreter refuses rather than answering the false that a reader would expect -- which is the whole of the good news and it is what sets the rung at mitigatable rather than below the ladder. WHAT THE CORPUS CURRENTLY BELIEVES INSTEAD, and this is the reason the row exists: two carriers filed this on 2026-08-27 as `a nested compile is not evaluable in the interpreter, refusing with NoSuchField Node.ident` -- v1.tests.claim.reference_derived_disposition_census_witness_test and a sibling paragraph in v1.compiler.emit_rust. Nested compiles are one POPULATION that happens to construct Nodes through helpers omitting v1.std.core Node's `ident` and then read it; they are not the class, and the repair that description suggests (route around the nested pipeline with a host builtin) does not touch the cause. **POPULATION: UNENUMERATED, and stated as such rather than guessed.** It is every record type in the corpus carrying an optional field together with a literal that omits it; `v1.std.core Node.ident` is one specimen and the probe above is another. NEXT-RUNG TRIGGER, a capability and not an artifact: construction that supplies every declared field, so that a literal omitting an optional field is either unwritable or carries the absent value -- at which point the distinction between the two absences is made at construction and no read can encounter a field that was never written. NOT REPAIRED HERE BY RULING: a defaulting change alters evaluation semantics corpus-wide and needs its own subject, population and review. A POINTER TO ONE SPECIMEN OF THIS SHAPE IN THIS LEDGER'S OWN TOOLING, 2026-09-03: a referential-closure check over these rosters that JOINS BY NAME cannot see two declarations sharing one name whose CONTENT differs. Measured by injection -- main's `recurrence_ledger_scoped_below_the_recurrence` duplicated with a pre-rename spelling of a symbol it cites, 9006 bytes against 8993 -- a name-grain check reports nothing rostered-undeclared and nothing declared-unrostered and PASSES, while the tree carries a citation to a symbol with zero declarations. The guard's state space has no cell for content divergence, so its count is the same either way. What such a check must additionally do is adjudicate any surviving duplicate against main's BYTES and REFUSE when neither copy matches, rather than resolve by position or first-wins, which is silent.", evidence: [] }
 
 data absorbing_fallback: RecurringFailureMode = RecurringFailureMode { identity: "absorbing_fallback" as NonEmptyStr, authored: "absorbing fallback (a failure arm that widens — rerun everything, scan all keys, always run — instead of refusing; ⊤-as-answer conflated with ⊤-as-ignorance; the deficit's frequency zeroed by construction, the corpus-denominated cost breaking the budget later)", evidence: [] }
 
@@ -270,6 +270,9 @@ data obligation_fields_as_prose_make_their_own_grain_check_undecidable: Recurrin
 data absence_classifier_default_bucket: RecurringFailureMode = RecurringFailureMode { identity: "absence_classifier_default_bucket" as NonEmptyStr, authored: "**absence-classifier default bucket, unprotected by its residual refusal** (a classifier whose ACCEPTED bucket is defined by the ABSENCE of properties is only as complete as the enumeration of kinds it was derived from, and it fails silently TOWARD THE DEFAULT rather than toward its refusal arm. The refusal reads as coverage and is not: a residual can only catch kinds whose absence PATTERN differs from the accepted one, which is a strictly smaller population than the kinds that exist. RECOGNITION RULE: A RESIDUAL REFUSAL DOES NOT PROTECT A CLASSIFIER WHOSE ACCEPTED BUCKET IS DEFINED BY ABSENCE; A NEW KIND CAN SILENTLY RESEMBLE THE DEFAULT. THE CLASS HAS NOW PRODUCED BOTH POLARITIES FROM ONE CLASSIFIER, which is what makes it structural rather than anecdotal. v1.compiler.parse decided 'this module item is a type declaration' from no body AND no transport AND no type annotation. OVER-STAMPING: `resource Filesystem` / `Clock` / `Entropy` in std.resources carry none of those three, so all three were stamped TYPE DECLARATIONS -- and the exhaustive match's ModuleItemUnrecognized arm could not fire, because a resource is not unrecognised, it is INDISTINGUISHABLE from a type under that rule. The premise that the item kinds were four was falsified by the parser's own item error, which names ten: alias, type, fn, func, service, resource, data, extern, pattern, interface. UNDER-STAMPING: the repair keyed the resource arm on `properties` being non-empty, and `type X sole_constructor { .. }` carries a property too -- so 202 sole-constructor type declarations across 100 modules were classified as RESOURCES and vanished from the declaration population. Opposite direction, same classifier, same root: an absence-and-presence heuristic standing where a positive kind belongs. WHY EXCLUSION-BY-NAME IS NOT THE FIX EITHER, though it is what stands today: the surviving repair excludes the ONE modifier the minting authority owns, and it is complete by ENUMERATION OF MINTING SITES rather than by grep -- v1.compiler.parse has exactly two, parsed_sole_constructor_properties (one field-init named sole_constructor, the only source every type-item constructor passes along) and parse_resource_entries; nominal_opaque is dropped lexically by drop_leading_type_modifier and mints nothing; mint_parsed_optional_int_property is confined to nested where-predicate nodes. A one-member set established by construction is worth more than a longer list found by search. But a second modifier that MINTS a property on a type item reintroduces this in the same silent direction, and no longer list can prevent that. NEXT-RUNG TRIGGER, a capability and not an artifact: parse constructors that CARRY the module-item kind they already dispatched on, consumed by an exhaustive match with NO DEFAULT TYPE BUCKET -- at which point membership is decided at construction and the residual refusal becomes real rather than decorative. THE SECOND SPECIMEN IS IN A DIFFERENT AUTHORITY AND IS FILED, NOT REPAIRED: v1.compiler.emit_core_support is_bare_leaf_item reads a CAPABILITY-LESS resource as a type declaration -- `resource Network` and `resource AuthContext` in std.resources have no children, no body, no params and no connective -- so the emit-side shape predicates carry the same defect in the same direction. Two specimens, one module, unrepaired here because it is a change to a different authority and smuggling it into a parser change would fork the subject. THE COUNTERMEASURE, AND IT IS THE MOST TRANSFERABLE THING IN THIS ROW: those two were invisible while ONE classifier answered, because both readers of the question AGREED they were types -- the agreed-wrong pair a disagreement census cannot see by construction ([[disagreement_census_blind_to_agreed_wrong]]), and no amount of running that census harder finds it. Splitting the question across two INDEPENDENTLY DERIVED readers -- absence-of-body/transport/annotation in the parser versus connective/params/children in the emitter -- converted their agreement into a disagreement, which is the only form the census can report. That split arrived here as a side effect of building the population join, not as a design goal, which is exactly why it is written down: RECOGNITION RULE: WHERE A CENSUS COMPARES TWO READERS, A THIRD INDEPENDENTLY-DERIVED READER IS THE ONLY THING THAT CAN FALSIFY THEIR AGREEMENT -- reach for it ON PURPOSE when an agreed-wrong population is suspected. The corpus-wide instrument is `type_occurrence_binding_census --establish`, joining the two readers at occurrence-id grain with uniqueness on both sides and no extra members.)", evidence: [] }
 
 data green_reported_over_a_population_the_instrument_does_not_own: RecurringFailureMode = RecurringFailureMode { identity: "green_reported_over_a_population_the_instrument_does_not_own" as NonEmptyStr, authored: "**an instrument reports GREEN over a population it does not own, so a fact can be filed in an authority, absent from the projection readers are pointed at, and nothing refuses** (INVALID STATE: two actuators split one generated-artifact population, and the one lanes habitually run denominates only its own half. `claim_executor --required-regen` reports `first_generation_equal=true planned=155 executed=155 adjudicated=155` while `docs/design-failure-modes.md` is STALE, because the ledger projections are produced by a different actuator entirely -- `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet`. HARM: a lane files a row in `gunbc.recurring_failure_mode`, runs the regen, sees 155/155/155, and stops -- having shipped a row that exists in the authority and nowhere a reader can see it, since DESIGN.md points readers at the projection and not at the .dag. The green is not merely uninformative about the projection; it is READ as covering it, because the instrument's name and its round numbers make no distinction between the population it adjudicated and the population it was asked about. SPECIMEN, and it is the row filed beside this one: `absence_classifier_default_bucket` was authored into the authority, `--required-regen` returned first_generation_equal=true, and the projection still did not contain it. The gap was found by GREPPING THE PROJECTION for the row just filed, which is not a step any gate performs. THE TWO NEIGHBOURS THIS IS NOT, cited so the family is readable and this row is not consolidated into either. [[incidental_denominator_as_wall]] is THE SAME DENOMINATOR SHAPE WITH THE OPPOSITE SIGN: there, `is_compared_generated_basename` -- whose job is to denominate the DRIFT COMPARISON -- accidentally CREATED safety by never handing an installer a dangerous input, so nothing is wrong today and the harm is that the protection is uncredited and dissolves silently when the upstream question changes. Here the same accident runs the other way: a denominator written for one question accidentally DESTROYS COVERAGE while continuing to report green, and something IS wrong today. Uncredited protection versus credited assurance that is not there. [[authority_merges_unprotected_while_its_projection_is_guarded]] is a MERGE-TIME protection asymmetry over the same file pair -- projection driver-bound, hand-authored authority matching no merge attribute -- repaired by binding the driver to the authority path. This row is REGEN-TIME and is reachable with no merge in sight. (Two notes worth keeping. That merge row landed in the very merge that conflicted the branch filing this one, and it had already measured the 16,792-character line 144 that made the conflict hazardous -- the hazard was filed by another lane before this one hit it. And it has since been observed firing in production on a SIBLING lane's head: `git merge-tree --write-tree` returned rc=1 with BOTH projections refusing while `gh pr view` reported mergeable=MERGEABLE on that same commit, observed simultaneously -- a cleaner specimen of that row than the one it was filed with, and a second instrument disagreeing with a green.) A SECOND SPECIMEN, RECORDED BECAUSE THE AUTHOR OF THIS ROW COMMITTED THE SAME SHAPE WITHIN THE HOUR OF FILING IT, IN THE OPPOSITE DIRECTION: asked whether CI would ever run on a merge-conflicted head, they polled one branch once a minute for six minutes, observed no run, and reported that GitHub does not create runs for a head it cannot merge -- a NEVER claimed from an instrument whose denominator was one branch and six minutes. The control was one command away and refuted it: three other DIRTY pull requests in the same repository carried six and seven check-runs each, while the two heads at zero were simply the two most recently pushed, one dirty and one clean, under a backlog of sixty-two unfinished runs. Recency separated the population perfectly and dirtiness did not separate it at all. The general form is this row's own, with the sign flipped: there an instrument's GREEN was read as covering a population it never enumerated; here an instrument's SILENCE was. A transient state proves nothing about membership without duration or a control already sitting in the state being called impossible -- and DESIGN section 5 names the tell in advance, since NEVER is the word that lets a ratchet pass as a wall. RECOGNITION RULE: when an instrument reports a clean round count, ask WHICH ARTIFACTS ITS DENOMINATOR ENUMERATES and whether the artifact you changed is among them -- a per-artifact count is evidence about the artifacts counted and says nothing whatever about the ones the actuator does not own, while reading exactly like whole-population coverage. The tell is two actuators over one declared population with no join between their denominators. NEXT-RUNG TRIGGER, a capability and not an artifact: ONE adjudication over the whole declared generated-artifact population, so that a stale projection is a refusal from the same run that adjudicates the mirrors; failing that, a green that NAMES ITS OWN BOUNDARY -- reporting the artifacts it did not adjudicate rather than a bare count -- which is the weaker form and turns silent non-coverage into a stated one. RUNG: mitigatable. NOT REPAIRED HERE: extending an actuator's population or splitting its report is a change to the regen authority and does not belong in the diff that discovered it.)", evidence: [] }
+data admission_predicate_evidenced_from_inside_its_own_subject: RecurringFailureMode = RecurringFailureMode { identity: "admission_predicate_evidenced_from_inside_its_own_subject" as NonEmptyStr, authored: "**an admission predicate evidenced from inside its own subject** (a rule admits an action only when some condition holds -- `the refusal is carried entirely by this class`, `nothing else is failing`, `this is the only cause` -- and the evidence for that condition is read off a surface THAT ONLY REPORTS THE CLASS THE PREDICATE IS ABOUT. The surface answers faithfully and narrowly; it has no vocabulary for the thing that would falsify the rule, so IT CANNOT REPRESENT THE PREDICATE BEING FALSE. The test then confirms itself on every evaluation, and its greens carry no information. This is `executed_conjunct_discriminates_nothing` wearing an admission rule's clothes: the conjunct executes, it is honestly computed, and its outcome was decided by its own scoping rather than by the world. **RECOGNITION RULE, USABLE WITHOUT SUSPECTING ANYTHING: ask what SURFACE the predicate's evidence was read off, and whether that surface can represent the predicate being FALSE. If it cannot, the test is decorative.** SPECIMEN, AND IT IS THIS AUTHOR'S OWN RULE. A declared drop admitted a bounded mitigation -- one reroll per head -- on the condition that the run reported `failed=0` with the refusal carried entirely by that row's two cost arms. The evidence was read off the floor's own disposition counters, which enumerate COST dispositions. Those counters do not range over other phases at all, so they were incapable of reporting that anything else had failed. On the run that spent a reroll under this rule, the required job was `phases_run=3 failed=2` the whole time -- refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas -- and the predicate had been FALSE at every moment it was evaluated as true. REPAIR: evidence the predicate from OUTSIDE its own subject -- here, the RUN'S PHASE VERDICT (`phases_run`, `failed`, the `FAILED PHASE` lines) rather than the class's own counters. A predicate scoped to one class must be adjudicated at a grain that can see the other classes. **A SECOND SPECIMEN IN A DIFFERENT DOMAIN, WHICH IS WHAT ESTABLISHES THIS AS A SHAPE RATHER THAN A QUIRK OF COUNTERS.** A reviewer cited a declaration by FILE AND LINE. Asked to check it, they verified the citation AGAINST THEIR OWN CHECKOUT and IT VERIFIED GREEN -- printing that line returned exactly the text they had claimed -- while the declaration sits 1633 lines away on `origin/main`. THE GREEN IS THE POINT AND IT IS WORSE THAN A FAILURE WOULD HAVE BEEN: a check that returns green from inside its subject returns green every time it is run, and nothing about it prompts a second look, whereas a check that returned nothing would have sent the citer looking. **AND THE SURFACE WAS NOT A STALE TREE, WHICH IS WHAT MAKES THIS SPECIMEN LOAD-BEARING RATHER THAN A HYGIENE NOTE.** The citer was on their own FEATURE BRANCH -- clean, current, seven commits of their own ahead, 41 behind main because that is what a feature branch IS -- and cited a line read off it as main's. Read as staleness the finding has an obvious remedy, fetch more often, which lets a reader file it and move on. It has no such remedy. EVERY AUTHOR CITES FROM THE TREE THEY ARE WORKING IN, THAT TREE IS DIVERGENT FROM MAIN BY CONSTRUCTION, AND THE CITATION VERIFIES GREEN THERE EVERY TIME PRECISELY BECAUSE IT IS THE TREE THAT PRODUCED IT. No discipline of fetching closes it; only citing by symbol does. (The citer supplied this correction themselves, having first described their own position as staleness and then checked which branch they were on -- one more instrument that should have been run before describing the surface.) No counter and no admission rule is involved; the structure is identical -- evidence for a claim drawn from inside the claim's own source. It is also why DESIGN section 3 requires citing the SYMBOL: a symbol is checkable against a tree the citer does not control, and a line number is only ever checkable against a tree, so the positional form has no outside-the-subject verification available to it at all. The correction here came from a third party who resolved the same declaration BY SYMBOL. **A FOURTH SPECIMEN, AND IT IS THE ONE THAT CANNOT BE READ AS INATTENTION.** A reviewer asked a merge queue whether a pull request's required checks were passing, by querying for its NON-SUCCESS checks. The query returned an EMPTY LIST and they reported the context green. An empty list is returned by `everything passed` AND by `nothing ran`, and they had not asked for the denominator that separates the two. The truth was the second: the branch was dirty, so no merge ref could be computed, so NO WORKFLOW HAD EVER STARTED -- `check-runs total_count 0`, combined status `pending`, statuses array empty. The surface they read could not represent the state they were trying to rule out, which is this row's recognition rule exactly; `empty_observation_narrow` is the same failure of taking a numerator without its denominator. WHAT MAKES IT THE STRONGEST SPECIMEN IS ITS TIMING: it was committed ROUGHLY FORTY MINUTES AFTER the same author corrected another session's instance of this class, in the same thread, while explicitly writing about how easily a found-set is read as a population. A FIFTH INSTANCE FOLLOWED, INSIDE AN INSTRUCTION TO BE MORE RIGOROUS ABOUT CITATION: a reviewer relayed a peer's measurement as an established, present-tense fact about a tree they had not themselves examined, while directing another author to cite only what is checkable against that tree. Both parties then ran the check independently and it was FALSE. The discipline was in hand and was applied to someone else's sentence rather than to the sentence carrying it. THE SAME AUTHOR THEN DID IT AGAIN THREE HOURS LATER, in a message whose express purpose was to instruct another lane NOT to inherit anyone's numbers: they quoted their own working branch's roster count as main's, having already had that exact substitution filed as a specimen in this row. Both instances were caught only because the instruction they were wrapped in demanded a CHECKABLE form, so the recipient ran the check the instruction asked for and it disagreed with the instruction. **AWARENESS OF THIS CLASS DOES NOT CONFER IMMUNITY TO IT, AND THE EVIDENCE IS THIS ROW'S OWN AUTHORSHIP.** Three sessions committed this shape inside the single thread that produced this row, WHILE ACTIVELY DISCUSSING IT: one reported the return of a grep written from the specimen it was searching for as the census; the second passed that found-set onward as the population without asking what it was a view of; the third corrected the second while reporting their own grep's return as the extent, one level up. Each caught the person below them and none caught themselves. That is not three mistakes but ONE MECHANISM OBSERVED THREE TIMES under conditions as controlled as this repository will ever supply -- the participants informed, attentive, and looking directly at the class. It is stronger evidence than any single specimen, and it is the reason the detection sentence below is stated as a structural fact about WHO can find the defect rather than as an exhortation to be careful. **DETECTION IS THE HALF NOBODY WRITES DOWN, AND IT IS NOT MORE CARE: THE ONLY RELIABLE DETECTOR FOR A SELF-RATIFYING TEST IS AN AUDIT PERFORMED BY SOMEONE WHO ALREADY BELIEVES THE TEST PASSED.** The predicate confirms itself for everyone who relies on it, so no amount of diligence by the relier finds it; it was found here because a lane acted on the rule and then audited its own action, and reported the result against its own interest (neat-swift-219, 2026-09-02, who supplied both the specimen and this detection sentence). AN AGGRAVATING NEIGHBOUR THE SPECIMEN ALSO CARRIES, recorded because it is what made the narrow surface believable: `failed` is FORKED ACROSS THE OUTPUT VOCABULARY of one binary. FOUR EMITTERS AND FOUR SUBJECTS, from a sweep run to closure rather than from the two sites that prompted it, and the count matters because an earlier statement of this paragraph said two: `claim_executor` prints a required-ci line where `failed` counts PHASES and a disposition line where `failed` counts CLAIMS; `cli_run` prints a third with `deferred=` beside it; and `partition_crate_boundary_host` prints `failed=[..]` as a LIST rather than a count, beside a package count. THE THIRD SUBJECT IS THE DANGEROUS ONE AND WAS FOUND LAST: a DISCOVERY-ROW counter that is not a narrower or wider spelling of the claim population but a DIFFERENT one, absorbing NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted -- failure classes the claim counter excludes. Two counters that disagree about their subject are a fork; one that silently UNIONS classes another excludes will read as agreement whenever those classes happen to be empty. One word, one naming surface, no declared version transition -- a `meaning_fork` in the OUTPUT vocabulary, which is the worst place for one, because a reader hits the LINE and never reaches the ledger that would disambiguate it. THE LIST FORM IS THE PROOF RATHER THAN A CURIOSITY: a site printing a list where three others print a count establishes that these were never read as one vocabulary, which is what distinguishes a meaning fork from a rename that was merely never finished. **AND THE STRONGEST EVIDENCE IS NOT THAT THE FORK WENT UNNOTICED -- IT IS THAT IT HAS BEEN HIT AND LOCALLY REPAIRED AT LEAST TWICE, CORRECTLY, BY INDEPENDENT AUTHORS.** One declaration in `cli_run` lifts six fields onto the headline ledger line on the stated reasoning that a fix shipped as yet another separate line would reproduce what it repairs; one in `claim_executor` documents `failed=0` being finishable wrongly, names a session dispatched against a regression that did not exist because of it, and separates the concepts into `unexpected_failures` for answered-wrong and `verdict_incomplete` for never-answered. Each repair was sound at its own surface and each left the WORD forked at every other emitter, because neither author had any reason to look sideways. THAT is the argument for a vocabulary-level fix rather than a third local repair, and it is stronger than the absence of repairs would have been. AN EARLIER DRAFT OF THIS ROW SAID THE OPPOSITE -- that the arithmetic gap was 'already observed and carried only as prose' -- which understated shipped work and was corrected before landing by reading the surrounding declarations rather than the comment alone The fork's REPAIR is owned elsewhere and is deliberately not scoped here; it is entered as this class's evidence, since a forked counter name is precisely what makes an inside-the-subject reading look like an outside-the-subject one.)", evidence: [] }
+
+data agreement_over_absorbed_classes_that_are_empty: RecurringFailureMode = RecurringFailureMode { identity: "agreement_over_absorbed_classes_that_are_empty" as NonEmptyStr, authored: "**two instruments agree because the classes one of them ABSORBS happen to be empty** (two counters, reports or readers are compared, they return the same NUMBER, and the agreement is taken as evidence that they measure the same thing. They do not. One of them ranges over a WIDER POPULATION -- it additionally absorbs failure classes the other excludes -- and the two coincide exactly while those absorbed classes are EMPTY, which on a healthy system is most of the time. **NEITHER READING IS WRONG, WHICH IS WHAT SEPARATES THIS FROM ITS NEAREST NEIGHBOUR.** `disagreement_census_blind_to_agreed_wrong` is about two readers answering the same WRONG thing, where the defect is in the readings; here BOTH INSTRUMENTS ARE CORRECT ABOUT THEIR OWN SUBJECT and the defect is in the JOIN a reader performs between them. Nothing either instrument reports is false, so no amount of auditing either one finds it. **AND IT IS WORSE THAN DISAGREEMENT, NOT MILDER: disagreement is visible on the FIRST comparison, while this is invisible until the day one of the absorbed classes is non-empty -- so the evidence for the conflation arrives only at the moment it is doing damage.** SPECIMEN, 2026-09-02/03. One word, `failed`, was emitted by four sites of one binary carrying four subjects: lane PHASES, required-floor CLAIMS, a package LIST, and DISCOVERY ROWS. The discovery counter is not a narrower or wider spelling of the claim population -- it is a DIFFERENT population that additionally absorbs `NotBool`, `RuntimeError`, `HostToolUnresolved`, timeout, panic and `NotAttempted`. THOSE ARE PRECISELY THE CLASSES THAT ARE EMPTY ON A GOOD DAY, so the two counters agree on every ordinary run and diverge exactly when something has gone wrong in a way nobody is watching for. THE PROVENANCE IS THE ARGUMENT FOR A WALL RATHER THAN FOR MORE CARE: this fork was HIT AND CORRECTLY REPAIRED TWICE, by two independent authors, each at their own surface -- one lifting six fields onto a headline ledger line, one separating answered-wrong from never-answered after a session was dispatched against a regression that did not exist -- and each repair left the word forked everywhere else, because neither author had any signal to look sideways. Diligence did not catch it and could not have; the repair is a vocabulary-level split at the producer, which a separate lane owns. **RECOGNITION RULE, AND IT IS CHEAP: when two instruments AGREE, ask whether their subjects are the same POPULATION or merely the same NUMBER, and check the agreement on a run where the absorbed classes are NON-EMPTY. An agreement observed only over empty absorbed classes establishes nothing.** The corollary for authors is the same fact stated forward: a counter's name is not its subject, and two counters sharing a name is evidence about the naming surface rather than about what was counted.)", evidence: [] }
 
 data artifact_declares_a_threshold_it_is_not_measured_against: RecurringFailureMode = RecurringFailureMode { identity: "artifact_declares_a_threshold_it_is_not_measured_against" as NonEmptyStr, authored: "**an artifact's column names a governing threshold and carries a constant that is not the threshold enforced, so the artifact cannot predict the refusal it exists to explain** (INVALID STATE: a machine-readable receipt carries a field named for the limit its subject is judged against, and the value is a constant unrelated to the limit the judge actually applies. MEASURED on gunbc#10200's required run (run 33722461610, artifact `required-floor-claim-cost`, 2026-09-03): all 3534 rows of `required_floor_claim_cost.tsv` declare `cost_line_ms=100`, while the same run's floor refuses rows against a 500ms per-claim CPU budget and says so in its own refusal text. **300 of 3534 rows exceed the line the FILE declares; 13 exceed the line actually ENFORCED.** A consumer computing an over-cost population from the artifact gets a set 23 times too large, in a well-formed way, with no error anywhere and no column missing. HARM: the artifact is the only durable record of per-claim cost, so it is what anyone reaches for to ask whether a refusal was predictable, whether a row is near the line, or whether a population regressed. Every one of those questions is answered wrongly by the same factor, and the wrongness is invisible because 100 is a plausible per-claim budget. **THE SHARP POINT, AND IT IS WHY THIS IS ITS OWN ROW: THE PRESCRIBED REMEDY FOR THE NEIGHBOURING HAZARD DOES NOT PROTECT AGAINST THIS ONE, AND LOOKS LIKE IT DOES.** `gunbc.floor_cost_distribution` already records this constant, as a COLUMN-ORDERING hazard: `eval_steps` was inserted into the artifact between vintages, so a parser keyed on index 6 reads `cost_line_ms` -- the constant 100 -- as a step count and produces microsecond figures three orders of magnitude off, measured on three of eleven sampled runs. That note's remedy is DESIGN section 3's standing rule: locate columns by NAME, never by position. That remedy is correct for its own hazard and is exactly what fails here. A consumer who follows it perfectly -- reads the header, finds `cost_line_ms` by name, uses it as the line -- still computes the wrong population, because the defect is not WHERE the column is but WHAT IT SAYS. Citing by name protects a reader from a moved column; nothing protects them from a column whose name asserts a role its value does not fill. That note is CITED here, not restated, and the addition is that its constant is not merely a parsing trap but a false statement about the enforced line. WHY IT IS NOT `meaning_fork`: that class is one name carrying two material referents under hidden state, and its recognition rule is to hold the naming surface constant and vary the hidden state until the referent changes. Here there are not two referents. There is ONE name making ONE assertion -- this is the line this row is judged against -- which is simply false, at every vintage, for every row, with no state to vary. The dual is nicknaming and this is neither: it is a field whose name claims an authority relation its value does not have. THE DISTRIBUTION IS THE RECEIPT AND IT IS WHAT MAKES THE 5x GAP CONSEQUENTIAL RATHER THAN COSMETIC. Against the enforced 500ms line, that same run's rows sit at p50=2ms, p90=84ms, p99=364ms, p99.9=514ms, max=541ms, with 8 rows in 400-450, 8 in 450-500, 12 in 500-525, 1 in 525-550 and NOTHING above 541. So the only rows the line can ever separate are the 29 above 400ms, and 21 of those 29 sit within ten percent of it. A reader using the artifact's own column would place the threshold at 100ms, where 300 rows sit above it and the nearest rows are not clustered at all -- a completely different and far healthier-looking picture of the same run. The artifact does not merely mis-state the line; it conceals the clustering that makes the real line a change detector rather than an oracle. RUNG FOUND AT: outside the ladder, and this is the honest placement rather than rung 1. Nothing fails, nothing refuses, and no diagnostic fires: the file is well-formed, the column is present and correctly named by position and by header, and every value parses. The wrongness is silent and is discovered only by someone who happens to hold both the artifact and a refusal message from the same run and notices they disagree. CEILING: 4, structurally impossible. The line a claim is judged against is a fact the judge already holds at the moment it judges, so an artifact that carries the judge's own value rather than a literal cannot state a different one. That is construction rather than validation, and it is available today. NEXT TRIGGER, NAMED AS THE CAPABILITY: **each cost row emits the line ACTUALLY applied to that row, derived from the same authority the enforcement reads, so that the over-cost population computed from the artifact alone is the set the floor refused** -- sufficient for `rows where cpu_ms >= cost_line_ms` over the artifact to equal the run's refusal set, demonstrated by a discriminating red on a fixture where a row's declared line differs from its enforced one. Changing the constant from 100 to 500 does NOT discharge this: a second hand-authored literal agreeing with the current line by coincidence reproduces the class the moment either moves, and the defect is that the value is authored at all rather than derived. NOT REPAIRED HERE: the emit-family cost work and the mis-grounding of the 500ms line itself are separate subjects with their own dispatch; this row is the modelling defect in the instrument, which is what makes it filable independently of either.)", evidence: [] }
 
@@ -347,4 +350,6 @@ data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   green_reported_over_a_population_the_instrument_does_not_own,
   external_mechanism_asserted_under_a_correct_conclusion,
   artifact_declares_a_threshold_it_is_not_measured_against,
+  admission_predicate_evidenced_from_inside_its_own_subject,
+  agreement_over_absorbed_classes_that_are_empty,
 ]
diff --git a/dag/gunbc/rung_drop.dag b/dag/gunbc/rung_drop.dag
index 3f3c98375b6..554215d8999 100644
--- a/dag/gunbc/rung_drop.dag
+++ b/dag/gunbc/rung_drop.dag
@@ -99,7 +99,7 @@ data direct_call_arg_seam_v2_exemption: RungDrop = RungDrop {
   standing: Standing,
   authored: "**ONE OF THE TWO DIRECT-CALL ARGUMENT JUDGMENTS IS SWITCHED OFF FOR EVERY `v2.*` MODULE, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** The suppressed arm is `arg_compat_diags`; the inhabitance arm beside it is ungated and still runs there. That split is measured below, not assumed, and the loose reading -- that argument checking is off in `v2.*` -- is what this row exists to stop being repeated. `v1.compiler.infer` `module_skips_direct_call_arg_check` returns true for every module whose declared name begins with `v2.`, so at a direct call inside such a module the argument-position TYPE-COMPAT judgment does not run. It is ONE of two arms and the measurement below says which: the ungated inhabitance arm still runs there, so this is a narrowed judgment, not an absent one. The predicate is not new and its cost is not disputed: `gunbc.doc_graph_roots` already names it as the one in-tree violation of the no-escape-hatch clause, in its own words that the compiler being bootstrapped is authored under weaker checks than ordinary source. What has never existed is this row. PREVIOUS RUNG AT THIS ROW'S OWN SUBJECT GRAIN: NONE STOOD, and saying otherwise would be the cross-path inflation DESIGN 4b(1) forbids (codex review 58154, which caught it here). The subject is the compat arm INSIDE `v2.*`. That arm has never executed there -- the exemption predates this row -- so there is no rung for this row to have lowered and none is claimed. What the fixture establishes is a DIFFERENT path: that the suppressed check operates OUTSIDE the exemption, on the same tree and the same binary, which is what makes the exemption a real loss of an available guarantee rather than a check nobody has. Those two facts must not be averaged: `mechanically preventable outside v2.*` and `never executed inside v2.*` are separate paths, and a class's rung is the MINIMUM across its in-scope paths. This row therefore declares a STANDING ABSENCE at its subject grain rather than a regression, and it is filed as a drop because the obligation 4b(3) attaches -- population, reason, and a trigger that can retire it -- is the obligation an undeclared permanent exemption was escaping. TEMPORARY RUNG for the compat arm inside `v2.*`: mitigatable where the emitted-Rust self-host closure covers the module, because a wrong argument surviving acceptance becomes a rustc type error in the emitted crate -- refused late, in the wrong compiler, in the wrong phase -- and UNGUARDED on the source-acceptance path for every `v2.*` module that closure does not reach. Those are two paths and the row reports the MINIMUM, so the temporary rung for this subject is UNGUARDED, not mitigatable; the mitigated path is named because it bounds where the loss is observable at all, never to raise the reported rung. The ungated inhabitance arm keeps its rung throughout and is NOT part of this drop. REASON: the exemption's stated justification is representation-gap false positives at the argument seam — the same four classes the conformance lane grounds (brand aliases, optionality's two representations, anonymous record literals, expansion depth) — plus an unlocated historical claim of 104 TypeMismatch false positives that two audits have failed to find a receipt for. Its deletion is gunbc#8924, which is COMPLETE and MEASURED and CLOSED, held because its one missing precondition is a resolve-layer seam whose repair was DECLINED at the owning layer on 2026-08-22 with no owner and no schedule. THE POPULATION IS RESTATED HERE AND IT IS NOT THE ONE THE HOLD WAS PRICED AGAINST. The reopening condition recorded on `gunbc.doc_graph_roots` bounds the blast radius at 9 declarations under `src/v2/extdeps/formatters/`. The predicate's actual population is EVERY MODULE WHOSE DECLARED NAME BEGINS WITH `v2.` — the instrument is the predicate itself, re-derivable by matching `^module v2.` against the corpus's module declarations, and the count is deliberately not transcribed here. That population includes the SELF-HOST EMISSION CLOSURE. WHAT THE EXEMPTION ACTUALLY SUPPRESSES, MEASURED AT DIAGNOSTIC IDENTITY RATHER THAN ARGUED FROM THE PREDICATE. The instrument is one fixture authored twice, byte-identical but for its module line and a renaming of every declaration so nothing resolves across the pair, run through a gunbc built from this tree. Three arms each: a local alias parameter (`type Wrapped = FreeMonoid<Char>` declared in the calling module), a cross-module declaration-path parameter (`v2.std.text.String`), and an `Int` parameter as control, each receiving a kernel `String` actual. NON-`v2.` MODULE: the local-alias arm is ADMITTED with no diagnostic; the declaration-path arm REFUSES with `value does not inhabit its declared type at the direct call argument`, declared `Node(std.algebra.FreeMonoid<Product(Char)>)` produced `Primitive(String)`; the control REFUSES TWICE, once with `type mismatch: expected Primitive(Int), got Primitive(String)` and once with the inhabitance message. `v2.*` MODULE: the local-alias arm is ADMITTED; the declaration-path arm REFUSES with the SAME inhabitance message; the control refuses with the inhabitance message ONLY. EXACTLY ONE DIAGNOSTIC IDENTITY DISAPPEARS across the pair -- the `type mismatch` row -- and every other identity is preserved. That is the drop, measured: this exemption suppresses `arg_compat_diags` and NOTHING ELSE. THE SCOPE OF THE LOSS IS THEREFORE NARROWER THAN THE PREDICATE NAME SUGGESTS, and stating it narrowly is the point of measuring it. `v1.compiler.infer` computes `arg_compat_diags` under this gate and calls `direct_call_argument_inhabitance_diags` immediately after with NO gate, both feeding one `concat`, so the INHABITANCE judgment runs inside `v2.*` exactly as it runs everywhere else. A reader who takes the argument judgment to be off in `v2.*` -- as the first draft of this row did -- will misattribute every surviving refusal and every surviving admission. CONSEQUENTLY THIS ROW CLAIMS NO SELF-HOST HARM AND NAMES NONE. The specimen anyone reaches for first is `src/v2/std/integer.dag` calling `v2.std.text` `string_head`, whose emitted Rust rustc refuses; that call is NOT hidden by this exemption, because the surviving inhabitance arm is the one that judges its shape and the fixture shows the compat arm would not have refused it either. That shape belongs to a DIFFERENT and already-standing declaration, `text_boundary_identity_wall`. Citing it here would be an unbacked execution claim. THE CLAIM IS NOT THAT THE BLAST RADIUS NOW EXCEEDS 9. It is that THE SUBJECT CHANGED and the old bound no longer describes what is being bought, which is a reason to re-measure; a declared drop whose population is measured against a subject it no longer covers is the drop lying about its own size. ONE CONSEQUENCE FOR ANY READER OF A GREEN `v2.*` CALL SITE, stated precisely because the loose version of it is the easiest false inference available here and this row asserted the loose version first: a `v2.*` call site accepted WITHOUT a compat diagnostic says nothing, because that arm cannot speak there; a `v2.*` call site accepted with no INHABITANCE diagnostic says exactly what it says everywhere else, because that arm is ungated. A discriminating red for the SUPPRESSED arm is therefore only authorable in a non-`v2.` module -- not because the wall is absent in `v2.*`, but because only one of its two arms is. RESTORATION TRIGGER, named at capability grain: the resolve-layer seam capability that makes `arg_compat_diags` RUNNABLE on `v2.*` modules -- the argument-position conformance relation grounding the representation gaps that motivated the exemption (brand aliases, optionality's two representations, anonymous record literals, expansion depth), so that the compat arm refuses genuinely wrong argument bindings inside `v2.*` without fabricating a refusal against those four grounded classes. That capability is SUFFICIENT only under a two-direction A/B measured the way this row's own population was: the twin fixture re-run, with the `type mismatch` identity PRESENT on both the non-`v2.` and the `v2.*` side, and the corpus's existing `v2.*` call sites still ADMITTED. gunbc#8924 MERGING IS NOT THIS TRIGGER, and neither is any measurement that only re-prices the hold; the trigger is the seam being repaired at its owning layer, which was DECLINED on 2026-08-22 and is UNOWNED as of this declaration -- a trigger nobody is holding is still a trigger, and a reader must be able to see that nobody is holding it."
 }
-data floor_cost_claim_qualification_unavailable: RungDrop = RungDrop { identity: "floor_cost_claim_qualification_unavailable" as NonEmptyStr, subject: "Per-claim cost qualification is unavailable at the subject grain the gate consumes", declared: "2026-09-01", standing: Standing, authored: "Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. `required_floor_claim_cpu_safety_limit_ms` is a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 280ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR of 1.777, measured by identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed. A floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head per signature, and only where the run reported `failed=0` with the refusal carried entirely by this row's two arms. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job <job> --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it." }
+data floor_cost_claim_qualification_unavailable: RungDrop = RungDrop { identity: "floor_cost_claim_qualification_unavailable" as NonEmptyStr, subject: "Per-claim cost qualification is unavailable at the subject grain the gate consumes", declared: "2026-09-01", standing: Standing, authored: "Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. `required_floor_claim_cpu_safety_limit_ms` is a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 280ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR of 1.777, measured by identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed. A floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head, and only where the refusal is carried entirely by this row's two arms. THAT RULE WAS MIS-SPELLED AND MIS-EVIDENCED WHEN FIRST WRITTEN, AND BOTH DEFECTS ARE CORRECTED HERE RATHER THAN QUIETLY RESPELLED. It read `one reroll per head per signature`, which parses as a COUNTER KEY -- so many rerolls per distinct signature -- and that reading is self-defeating on this row's own claim: these arms vary across attempts of one unchanged tree, so A CHANGED SIGNATURE IS THE EXPECTED OUTCOME OF A REROLL rather than new information, and every reroll would license the next one for exactly the reason this row exists. The signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget. The budget is ONE, PER HEAD. AND THE ELIGIBILITY TEST MUST NOT BE EVALUATED AGAINST THIS CLASS'S OWN COUNTERS. It said `the run reported failed=0`, which was read off the floor's disposition counters; those enumerate COST dispositions and do not range over other phases, so they cannot report that anything else failed and the test could only ever confirm itself. THE RULE STATED SO IT SURVIVES THE SPELLING: ELIGIBILITY IS A PROPERTY OF THE RUN'S PHASE VERDICT AND IS NEVER READ OFF A CLASS'S OWN DISPOSITION COUNTERS, whatever either is called. The quotation `failed=0` above is preserved as a RECEIPT of what a run actually printed on 2026-09-02 and must not be restated as the current key: at the time, one word `failed` carried FOUR SUBJECTS across four emitters of one binary -- lane phases, required-floor claims, DISCOVERY ROWS, and a package LIST -- which is why an inside-the-subject reading looked like an outside-the-subject one. THE DISCOVERY SUBJECT IS THE ONE THAT MATTERS AND IT IS NOT A NARROWER OR WIDER SPELLING OF THE CLAIM POPULATION: it is a DIFFERENT population that additionally absorbs NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted, so a reader treating the two as the same word silently unions failure classes the other excludes. That fork is being repaired at the producer by a separate lane, into `phases_failed`, `claims_failed`, `discovery_rows_failed` and `packages_failed`, with `FAILED PHASE` unchanged; this row therefore names the phase verdict as the adjudicating SURFACE rather than any counter key. Eligibility is decided by the RUN'S PHASE VERDICT -- `phases_run`, `failed`, and the `FAILED PHASE` lines -- which is evidence from outside the predicate's own subject. The class is `admission_predicate_evidenced_from_inside_its_own_subject`. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). AND ONE FURTHER PAIR, ENTERED MARKED BECAUSE ITS ADMISSION WAS INVALID AND THAT IS PRECISELY WHY IT IS KEPT: gunbc#10077 run 33647114048, floor job 100317014535, head 74719e46dd, both attempts `planned=executed=3487` with no unexpected claim failures -- attempt 1 `interrupted_before_verdict=12` (all `interrupted_cpu_deadline`), `completed_over_cost_requirement=0`; attempt 2 `interrupted_before_verdict=1`, `completed_over_cost_requirement=2`. Refuse then refuse. All twelve of attempt 1's rows sit in `test.claim.self_host_compile_phase_frontier_witness` and `test.claim.self_host_compile_phase_live_gate_witness`, EACH MEASURED 501 TO 506 CPU-MS AGAINST THE 500MS LIMIT -- a one-to-six millisecond miss, which is the sharpest evidence this row has for its own claim: a witness failing at 900ms would be consistent with genuinely costing that much, and one failing at 501 is not. THE ADMISSION WAS FALSE WHEN IT WAS MADE. The run was `phases_run=3 failed=2`, refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas, so the refusal was never carried entirely by this row's two arms; the eligibility test had been evaluated against the floor's own disposition counters, which cannot report that another phase failed. IT IS ENTERED RATHER THAN REPLACED BY A CLEANER RUN, and the reason is structural: a clean run cannot evidence a defective admission predicate, so this is the only receipt that the rule was broken, and dropping it for being untidy would filter the mitigation's record by how the mitigation turned out. WHAT IT DOES NOT ESTABLISH, stated because the counts invite it: attempt 2's single interrupted row was ALSO IN attempt 1's twelve, so the pair is a SUBSET and not a disjoint redraw, and a stable population straddling the threshold explains both attempts without any redraw at all -- one module in this run carries members at 481, 490, 499, 500 and 501 ms. The counts moved; the membership did not leave the prior set. An earlier reading of this pair asserted that a fixed marginal set could not produce those counts; that assertion was withdrawn by its own author on the membership measurement before it was entered here. THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job <job> --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument defect is WIDER THAN WRONG-ATTEMPT, measured 2026-09-02 on gunbc#10077 by diffing both fetches of ONE job: the `gh run view` copy was MISSING THE `FAILED PHASE` LINES ENTIRELY. It does not merely serve the wrong attempt; it can DROP THE LINES CARRYING THE VERDICT, turning a two-phase failure into an apparent one-phase failure -- which is precisely how the admission predicate above was evaluated as true while it was false. An instrument whose omission is invisible is worse than one that is merely stale. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it." }
 
 data spark_role_scoped_retirement_production_root: RungDrop = RungDrop { identity: "spark_role_scoped_retirement_production_root" as NonEmptyStr, subject: "Spark serving role-scoped retirement evidence at the production plan root", declared: "2026-09-02", standing: Standing, authored: "**AN OPERATOR DECISION REMOVED A BEHAVIOUR'S ONLY SUBJECT, AND THIS ROW IS THAT DECLARATION (2026-09-02).** `gunbc.spark.cell_role` assigned srv6 to `SparkTrainingCell`, and the operator withdrew that dedication as premature -- 'i wouldn't dedicate a whole node for any task - just have it converge and serve whatever task we converge it to' -- so the production roster now holds ZERO training cells. Three claims in `test.claim.spark.spark_cell_role_retirement_witness_test` entered through `fleet_converge_plan_artifact`, the root the converge actuator itself walks, and each needed a production host holding that role to have a subject at all: `w_the_production_artifact_plans_four_retirements_for_the_training_cell`, `w_the_production_artifact_plans_no_rows_for_the_converged_serving_cell`, and `w_the_production_retirement_touches_no_baseline_address`. They are DELETED rather than left silently red, because a claim whose subject no longer exists is not a failing test, and leaving it to fail would have made an operator's decision look like a regression. **PREVIOUS RUNG: mechanically preventable** -- the training arm's four retirement rows and the serving arm's zero rows were both exercised through the production root, so a planner regression that pointed `spark_serving_full_membership_plan` back at the unscoped desired members went red there. **TEMPORARY RUNG: mitigatable** -- both arms are still exercised, but only at `spark_serving_role_scoped_desired_members_in` over an authored fixture roster (`w_the_planner_scopes_desired_state_by_role`), which is a real production function and is NOT the path the converge actuator calls; the same PR added `spark_cell_role_in` and that `_in` planner variant precisely so an arm's evidence stops depending on which machines are currently assigned what. **REASON:** operator decision, recorded with its basis at `gunbc.spark.cell_role` `spark_cell_role_assignment_basis`; role is converged desired state rather than a node dedication. **POPULATION, BOUNDED:** the training arm of Spark serving role scoping and the retirement rows it produces, AS REACHED THROUGH `fleet_converge_plan_artifact`. The serving arm, the no-role refusal, the reconcile, the freeze and the apply are unaffected and their production-root claims remain enrolled. **RESTORATION TRIGGER, NAMING THE CAPABILITY:** a roster-parameterized plan artifact -- the assignment roster threaded from `fleet_converge_plan_artifact` down to `spark_serving_role_scoped_desired_members_in` -- SUFFICIENT FOR a witness to drive the production root over an authored roster and read back the four retirement rows with no production host holding `SparkTrainingCell`. Half that capability exists today: both `_in` functions take the roster; what is missing is the threading through the generic artifact entry point. **RESTORING A TRAINING CELL TO THE PRODUCTION ROSTER DOES NOT RETIRE THIS DROP** -- that would re-create the coupling between an arm's evidence and the current assignment, which is the defect this row exists to record, and it is exactly the trigger-names-less-than-the-capability failure §4b(3) warns about." }
 data floor_cut_heal: RungDrop = RungDrop { identity: "floor_cut_heal" as NonEmptyStr, subject: "Heal job for generated artifacts", declared: "2026-09-01", standing: Retired { trigger_fired: "2026-09-02 -- THE CAPABILITY, OBSERVED, NOT THE EMISSION. gunbc#10118 restored the heal job as a job of gunbc.witness_floor_workflow, and the row is retired on an EXECUTED repair of a REAL divergence rather than on that emission. THE PROBE: commit 330c74f0735364644c6a527a2d61de8da0a37cd8 hand-edited docs/plans/input-envelope-roadmap.md, a generated projection, from 3555 bytes (sha256 4da64e1495ef627c31fa21f3e31e2746ba28c5be447c9f6565d9a004f2c23ead) to 3754 and did not regenerate it. The subject was chosen against the emitted script rather than assumed: it carries a git add line and does NOT appear in the AUTHOR_COMMIT_DRIFT population, so it exercises the PUSH arm; the three workflow projections would have exercised bundle-and-refuse while looking like a heal run. THE RECEIPT, run 33683175090 job 100433326005: HealProduced prior_head=330c74f0735364644c6a527a2d61de8da0a37cd8 healed_head=bc704687540d25796f53f88687226ee1a735743c changed_artifacts=docs/plans/input-envelope-roadmap.md -- exactly one path, no blast radius across the other 32 auto-push rows -- then SupersededByHealedHead and exit 1. The branch head moved, authored gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>, under the checkout persist-credentials binding gunbc.heal_push_plan resolves the push authority from. IDENTITY CONFIRMED TWO WAYS: the healed file is byte-identical to the pre-drift digest recorded BEFORE the probe, and a clean source-built regeneration on the healed head (whose src/ and dag/ are identical to the tree the binary was built from) changed ZERO files. RESTORED RUNG: 2 (mechanically preventable) -- drift is caught by the required generated-artifact phase and now CORRECTED without an author, which is the previous rung this row lost. NOT RESTORED, and this row does not claim it: revalidation of the head heal creates. CORRECTED 2026-09-03, AND THE ORIGINAL SENTENCE IS QUOTED RATHER THAN DELETED BECAUSE THE RECORD OF WHAT WAS CLAIMED IS THE POINT. This row said: 'An Actions-credential push starts no run, so heal exits nonzero with SupersededByHealedHead rather than reporting a verdict about a head nothing judged.' THE FIRST CLAUSE IS FALSE; EVERYTHING IT WAS OFFERED TO SUPPORT STANDS. Measured over the entire heal-push population since the job was restored -- n=4, healed heads bc704687540d25796f53f88687226ee1a735743c, 695f264c77, 7de8273834 and 958f743f9ec056f73fbd4e4adedf84a65a7bc41b, re-derivable by listing repos/gunb-ai/gunbc/actions/runs filtered to actor.login == github-actions[bot] and reading each run's ATTEMPT 1 rather than its latest attempt -- a pull_request run WAS created for the healed head 4 times out of 4. WHAT GITHUB WITHHOLDS IS EXECUTION, NOT CREATION: 0 of those 4 started a single job on the triggering attempt. Runs 33711005806, 33703032560 and 33705120607 completed action_required with zero jobs; run 33686753487 completed failure with zero jobs. EXACTLY ONE of the four ever executed a job at all: run 33703032560 on attempt 2, after a human acted. The other re-attempt, 33705120607 attempt 2, was cancelled having also started zero jobs, so a second attempt is not itself a verdict either. So the loss this clause names is unchanged -- no EXECUTED verdict exists for the healed head, and heal exits nonzero rather than speaking for a tree it produced -- while the shape of it is not. The judge is CREATED AND HELD, not absent. READ THIS AT ATTEMPT GRAIN OR IT INVERTS, and both obvious proxies fail toward the reassuring answer: GitHub stamps run_started_at equal to created_at on a run that never ran, and a held run still concludes failure or cancelled rather than action_required, so neither a start timestamp nor a conclusion string is an execution receipt. Count JOBS, ON THE ATTEMPT THE CLAIM IS ABOUT -- 'count jobs' alone is not the discriminator, because the default endpoint silently answers for the LATEST attempt. AND THE RUN OBJECT ITSELF MANUFACTURES THE WRONG NUMBER, verified on run 33703032560: its top-level created_at is ATTEMPT 1's creation while its run_started_at is ATTEMPT 2's start, so the object hands back two fields from two different attempts and names neither, and only run_attempt reveals it. Subtracting them yields a start delay that never happened. Reading the latest attempt hides the class outright: on run 33703032560 attempt 1 is action_required with 0 jobs and attempt 2, created 1h47m later after a human acted, runs 6. THREE READERS MADE A VERSION OF THIS ERROR IN ONE NIGHT, EACH LEVEL INVISIBLE FROM THE ONE ABOVE: a run's conclusion read as an execution receipt, then a job count taken on the wrong attempt, then the cross-attempt subtraction above -- recorded because the reader who warned about the second level was standing in the third while writing the warning. There was never a released run here; a human re-ran it. A CONSEQUENCE FOR THIS ROW'S OWN LANGUAGE, and it is why the clause is scoped rather than merely corrected: a held run CAN be released later and judge the head. Of the four, run 33703032560 eventually executed 6 jobs on a head heal had pushed. So 'a head nothing judged' is true AT EXIT TIME and may stop being true afterwards without anyone touching anything. The exit is a statement by the run printing it about the moment it prints, never a standing property of the healed head, and a carrier that states it unscoped is wrong the moment somebody approves. THE HOLD DISCRIMINATES ON THE EVENT, NOT ON THE IDENTITY OR THE TOKEN, and this arm is measured TWO-SIDED with the identity held constant on both sides. Forward: of 500 workflow_dispatch runs sampled, ZERO concluded action_required -- including all 151 actored by github-actions[bot], the same identity and default-token surface whose pull_request runs are held. Reverse control: the entire status=action_required listing is 17 runs and ALL 17 are event=pull_request, zero workflow_dispatch. Re-derive by listing repos/gunb-ai/gunbc/actions/runs with event=workflow_dispatch grouped by actor.login and conclusion, against the status=action_required listing grouped by event. Measured by cool-koi-623 and reproduced independently at the wider sample by fierce-ram-670, which is why the sample sizes here are the larger pair. Two things follow that the refuted premise concealed: releasing the healed head is an approve on that specific gated run (POST /actions/runs/<id>/approve) and not a re-run of another run, and a dispatched revalidation is a SECOND run on that head rather than the only one, costing a whole additional run and landing check-runs beside the gated run's on one commit where a name-keyed reader cannot tell them apart. That second cost buys something measured rather than duplicating what would have happened anyway -- by the event discriminator above, a dispatched run is the only route to the healed head that executes without a human. WHAT IS NOT ESTABLISHED AND IS NOT WRITTEN AS IF IT WERE: whether a dispatched run's contexts clear branch protection. repos/gunb-ai/gunbc/branches/main/protection is 403 to this token, and the held run is what protection was waiting on, so closing the REVALIDATION gap is measured and clearing the MERGE gate is not. WHY THE HOLD EXISTS IS LIKEWISE UNDETERMINED BECAUSE UNREADABLE, which is the honest shape and not an unexplained gap: repos/gunb-ai/gunbc/actions/permissions is 403 to these session tokens, so whether a repository setting explains it cannot be read from here. THE RETIREMENT ITSELF STANDS, stated as the output of the question rather than left to be inferred, and this correction does not move the row's rung: the restored capability is automatic repair of drifted generated artifacts, which the receipt above observed, and revalidation was already declared NOT RESTORED here. Its trigger is a workflow_dispatch input on gunbc.witness_floor_workflow carrying the healed sha, which every dispatched run binds its own github.sha and checkout against before any witness counts; tools.ci_heal_dispatch is the modeled half and stays unconsumed until then. That gap is a separate obligation, not this row. `floor_cut` DOES NOT RETIRE ON THIS: its trigger is the conjunction of five siblings and this is one." as NonEmptyStr }, authored: "**RETIRED 2026-09-02 BY gunbc#10118; READ THE DECLARATION BELOW IN THE PAST TENSE.** The heal job runs again, as a job of `gunbc.witness_floor_workflow` rather than of the deleted `gunbc.ci_workflow`, and the dangling-citation observation this row recorded is also repaired: `ci_heal_credential` `ci_heal_job_ref` and `ci_heal_workflow_ref` now name the emission that carries the job, and their spent `PRE_EXISTING_CITATION_DEBT` rows are deleted. The opening sentence is kept rather than rewritten because the declaration is the record of what was true when it was made; `standing` carries what is true now. ONE CLAUSE OF THE ORIGINAL LOSS IS NOT RESTORED AND IS NOT SILENTLY DROPPED: revalidation of the head heal creates -- see `trigger_fired` for its own trigger. **HEAL IS GONE AND ITS AUTHORITY MODULE IS GONE WITH IT, AND THIS ROW DECLARED THAT RUNG (2026-09-01).** Split out of `floor_cut`, whose single trigger could not retire it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required job regenerated drifted generated artifacts and pushed the repair onto the branch head, so the class `a committed generated artifact diverges from its authority` was caught and CORRECTED without an author. TEMPORARY RUNG: 1 (mitigatable) -- drift is still CAUGHT, by the `generated-artifact` required phase, but nothing repairs it, so every divergence is now a human round trip. REASON: the 2026-08-15 floor cut deleted the job with the workflow authority that carried it. BOUNDED POPULATION: one capability -- automatic repair of drifted generated artifacts on a branch head. MEASURED FROM THE TREE RATHER THAN FROM THE PARAGRAPH UNDER SUSPICION (2026-09-01): `gunbc.ci_heal_credential` survives in full and still carries `ci_heal_job_ref` and `ci_heal_workflow_ref` as DeclarationRefs to `gunbc.ci_workflow` `ci_heal_generated_artifacts_job` and `gunbc.ci_workflow` `ci_workflow` -- and `gunbc.ci_workflow` DOES NOT EXIST in this tree; the only module of that stem is `gunbc.ci_workflow_expressions`, and the decl name resolves nowhere. So heal's credential model is live and its job and workflow are deleted, which also means a typed citation to a deleted module is sitting unrefused; that second fact is recorded here as an observation and is NOT this row's subject. RESTORATION TRIGGER, A CAPABILITY: a required-run consumer that, on a branch head whose committed generated artifacts diverge from their authorities, WRITES the regenerated bytes back and pushes them under a credential the repository already models -- observed doing so on a real divergence, not merely emitted. WHAT DOES NOT RETIRE THIS ROW: restoring `gunbc.ci_workflow` or re-pointing `ci_heal_credential`'s dangling citations, which repairs the MODEL and heals nothing; nor a job that only reports drift, which is the phase we already have. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }
diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md
index c0f72ef4d35..0e16badff40 100644
--- a/docs/design-failure-modes.md
+++ b/docs/design-failure-modes.md
@@ -77,6 +77,8 @@ The exact `RecurringFailureMode.identity` population, which no other projection
 - `green_reported_over_a_population_the_instrument_does_not_own`
 - `external_mechanism_asserted_under_a_correct_conclusion`
 - `artifact_declares_a_threshold_it_is_not_measured_against`
+- `admission_predicate_evidenced_from_inside_its_own_subject`
+- `agreement_over_absorbed_classes_that_are_empty`
 
 ---
 
@@ -94,7 +96,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit
 - hollow alias (minimality ≠ grounding)
 - state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over "the input is wrong" and "this strategy had nothing to say about it", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic <kernel:NAME> that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read <kernel:String> as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no <kernel:NAME> can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal "<kernel:" as a row in a roster of MODULE PATHS; is_kernel_minted_file is a substring predicate over the same spelling; and v1.compiler.env resolved_node_is_kernel_identity_for_name owns the same fact by EXACT EQUALITY, its own note recording that a substring or prefix test is a second, weaker authority for it. **Recognition rule for this form: when a value's domain is carried in a type that cannot express one of its inhabitants, look for the inhabitant being recognised by SPELLING somewhere -- a prefix test, a magic string in a roster of real values, a sentinel. Each such site is a consumer that already knows the state exists, and their number is the count of authorities the missing constructor has spawned.** NO WRONG ANSWER IS CLAIMED FOR THE SPECIMEN AND NONE WAS MEASURED: for the kernel names reaching those gates today the spelling-keyed answer is the correct one, which is exactly why it never surfaced -- the class is filed on the state space, not on an output, and a form that produces no incident is the one that will be found last. **CLIMB RECEIPT (2026-09-02), appended rather than replacing the filing above, because DESIGN section 4b(4) keeps a class's discriminating evidence enrolled AFTER the climb rather than dissolving it with the production machinery.** The missing constructor now exists: std.coercion TypeDeclarationProvenance is CorpusDeclared | KernelMinted | DeclarationIdentityAbsent, minted by v1.std.core declaration_provenance_of, which decides the kernel arm by EXACT EQUALITY against kernel_span -- the minter itself -- rather than by a prefix test over its output. All four spelling authorities this row counted are gone: the literal "<kernel:" row is deleted from numeric_realization_declaring_modules, is_kernel_minted_file is deleted, and the two gates that substring-compared a synthetic identity against real paths now take the coproduct, so the structural gate's unreachability for a kernel-resolved reference stops being BY CONSTRUCTION and becomes BY DECISION -- a named arm answering false. **WHAT IS NOT CLAIMED, because this row's own honesty is the thing being climbed:** no wrong answer was found before and none is fixed now; every answer is preserved bit for bit, which is why the climb is in the STATE SPACE and not in an output. The empty-string inhabitant is likewise gone from the channel, and the bare-table answer it used to reach silently is now the named ground GroundedByUnidentifiedBareRow, so a declared rung drop that was previously indistinguishable from a properly-keyed answer is countable and refusable. **THE RECOGNITION RULE IS CORROBORATED AND THE CORROBORATION IS INDEPENDENT.** gunbc.type_reference_decl_file_occurrence_census reached this same four-authority set from the opposite direction -- that census asked what each of thirty-nine occurrences NEEDS, this row asked what the identity key can HOLD -- and the counts agreed. **WHAT SURVIVES UNCLIMBED, stated so the row is not read as closed:** CorpusDeclared still carries a file path matched by contains, so the surviving arm answers WHAT A DECLARATION REALIZES AS positionally. v1.compiler.infer_env global_bare_fallback_invariant already states the terminal key for it -- filepaths are irrelevant, the declared module path is the containment tree -- and re-keying that arm needs a declaration reference at each gate, which is a separate change.
 
-**A FOURTH FORM, MEASURED 2026-09-02 (quick-crab-396), AND IT SITS IN THE INTERPRETER RATHER THAN IN ANY MODEL: DECLARED OPTIONAL AND CONSTRUCTED ABSENT ARE TWO STATES WEARING ONE SPELLING.** A record field declared `T?` is read by authors -- and by this document's own §2 reasoning about optional carriers -- as optional-with-a-none-default. It is not. A literal that OMITS the field typechecks, and a later read of that field REFUSES at evaluation with `NoSuchField { type_name, field }`. So `T?` means mandatory-at-construction-and-typed-optional, and the two states the spelling conflates are `the field is absent because the author wrote none` and `the field is absent because the literal predates it`. EVIDENCE, a two-row probe with a positive control, which is what makes it a finding rather than a conjecture about one type: `type Widget { name: String  tag: Int? }` with `Widget { name: "w" }` refuses on `.tag` with `NoSuchField { type_name: "Widget", field: "tag" }`, while `Widget { name: "w", tag: Present { value: 3 } }.tag` reads back correctly -- so the mechanism is neither `reads fail` nor `this type is broken`, it is omission-with-no-default, and it is GENERAL to any record type. RUNG: this is FAIL-CLOSED and explicitly NOT silent wrongness -- the interpreter refuses rather than answering the false that a reader would expect -- which is the whole of the good news and it is what sets the rung at mitigatable rather than below the ladder. WHAT THE CORPUS CURRENTLY BELIEVES INSTEAD, and this is the reason the row exists: two carriers filed this on 2026-08-27 as `a nested compile is not evaluable in the interpreter, refusing with NoSuchField Node.ident` -- v1.tests.claim.reference_derived_disposition_census_witness_test and a sibling paragraph in v1.compiler.emit_rust. Nested compiles are one POPULATION that happens to construct Nodes through helpers omitting v1.std.core Node's `ident` and then read it; they are not the class, and the repair that description suggests (route around the nested pipeline with a host builtin) does not touch the cause. **POPULATION: UNENUMERATED, and stated as such rather than guessed.** It is every record type in the corpus carrying an optional field together with a literal that omits it; `v1.std.core Node.ident` is one specimen and the probe above is another. NEXT-RUNG TRIGGER, a capability and not an artifact: construction that supplies every declared field, so that a literal omitting an optional field is either unwritable or carries the absent value -- at which point the distinction between the two absences is made at construction and no read can encounter a field that was never written. NOT REPAIRED HERE BY RULING: a defaulting change alters evaluation semantics corpus-wide and needs its own subject, population and review.
+**A FOURTH FORM, MEASURED 2026-09-02 (quick-crab-396), AND IT SITS IN THE INTERPRETER RATHER THAN IN ANY MODEL: DECLARED OPTIONAL AND CONSTRUCTED ABSENT ARE TWO STATES WEARING ONE SPELLING.** A record field declared `T?` is read by authors -- and by this document's own §2 reasoning about optional carriers -- as optional-with-a-none-default. It is not. A literal that OMITS the field typechecks, and a later read of that field REFUSES at evaluation with `NoSuchField { type_name, field }`. So `T?` means mandatory-at-construction-and-typed-optional, and the two states the spelling conflates are `the field is absent because the author wrote none` and `the field is absent because the literal predates it`. EVIDENCE, a two-row probe with a positive control, which is what makes it a finding rather than a conjecture about one type: `type Widget { name: String  tag: Int? }` with `Widget { name: "w" }` refuses on `.tag` with `NoSuchField { type_name: "Widget", field: "tag" }`, while `Widget { name: "w", tag: Present { value: 3 } }.tag` reads back correctly -- so the mechanism is neither `reads fail` nor `this type is broken`, it is omission-with-no-default, and it is GENERAL to any record type. RUNG: this is FAIL-CLOSED and explicitly NOT silent wrongness -- the interpreter refuses rather than answering the false that a reader would expect -- which is the whole of the good news and it is what sets the rung at mitigatable rather than below the ladder. WHAT THE CORPUS CURRENTLY BELIEVES INSTEAD, and this is the reason the row exists: two carriers filed this on 2026-08-27 as `a nested compile is not evaluable in the interpreter, refusing with NoSuchField Node.ident` -- v1.tests.claim.reference_derived_disposition_census_witness_test and a sibling paragraph in v1.compiler.emit_rust. Nested compiles are one POPULATION that happens to construct Nodes through helpers omitting v1.std.core Node's `ident` and then read it; they are not the class, and the repair that description suggests (route around the nested pipeline with a host builtin) does not touch the cause. **POPULATION: UNENUMERATED, and stated as such rather than guessed.** It is every record type in the corpus carrying an optional field together with a literal that omits it; `v1.std.core Node.ident` is one specimen and the probe above is another. NEXT-RUNG TRIGGER, a capability and not an artifact: construction that supplies every declared field, so that a literal omitting an optional field is either unwritable or carries the absent value -- at which point the distinction between the two absences is made at construction and no read can encounter a field that was never written. NOT REPAIRED HERE BY RULING: a defaulting change alters evaluation semantics corpus-wide and needs its own subject, population and review. A POINTER TO ONE SPECIMEN OF THIS SHAPE IN THIS LEDGER'S OWN TOOLING, 2026-09-03: a referential-closure check over these rosters that JOINS BY NAME cannot see two declarations sharing one name whose CONTENT differs. Measured by injection -- main's `recurrence_ledger_scoped_below_the_recurrence` duplicated with a pre-rename spelling of a symbol it cites, 9006 bytes against 8993 -- a name-grain check reports nothing rostered-undeclared and nothing declared-unrostered and PASSES, while the tree carries a citation to a symbol with zero declarations. The guard's state space has no cell for content divergence, so its count is the same either way. What such a check must additionally do is adjudicate any surviving duplicate against main's BYTES and REFUSE when neither copy matches, rather than resolve by position or first-wins, which is silent.
 - absorbing fallback (a failure arm that widens — rerun everything, scan all keys, always run — instead of refusing; ⊤-as-answer conflated with ⊤-as-ignorance; the deficit's frequency zeroed by construction, the corpus-denominated cost breaking the budget later)
 - **empty-observation narrow** (the absorbing fallback's mirror: ⊥-as-answer conflated with ⊥-as-ignorance — an observation that could not express what changed rendered as the verdict "nothing is affected", so the run narrows to nothing instead of widening. Strictly worse than the widen §5 already forbids: a widen is merely expensive, a narrow is silently uncovered. Live specimen: a push whose baseline ref *is* the pushed ref diffs the commit against itself, and the witness floor reported the resulting zero-path observation as "N unaffected (import-closure, skipped without resolve)" — receipt, two main pushes reporting an identical `4118 unaffected` on different commits, a skip count that cannot be a function of the diff. The tell that one observation is wrong rather than three local choices reasonable: its consumers disagree — compile-clean widened to whole-tree, regen gated on the event name, the witness floor skipped) **RECEIPT, AND IT MOVES THE CLASS FROM AN OBSERVATION'S EXPRESSIVENESS TO AN ANALYSIS'S RANGE** (quick-crab-396, 2026-09-02). Authoring a coproduct arm named `Refused`, I ran a corpus-wide collision census over TYPE names, got a clean answer, and authored the name. required-regen then refused: `variant 'Refused' appears in both 'TypeRealizationDecision' and 'EmitterOutcome'`, and re-running the census over VARIANT spellings found `Refused` live in SIX declaring types. THE DEFECT WAS NOT A MISSING ANALYSIS. The compiler already computes exactly this collision -- it is what refused -- but it computes it during v2 self-compile over ONE RESOLVED CLOSURE, and the question being asked was about the CORPUS. Same subject, two ranges. From the author's seat the narrow analysis's silence was indistinguishable from a negative result, which is this row's own conflation with the scope quantifier moved: not an observation that could not EXPRESS what changed, but one that could not REACH where the answer lived. WHY IT IS FILED HERE RATHER THAN AS A NEW CLASS: the mechanism is identical and only the axis differs, and DESIGN section 2 prices a fresh authority for an existing concept as a failed decomposition. RECOGNITION RULE: when a check answers clean, ask what POPULATION it ranged over and whether that is the population the question was about -- an analysis scoped to the wrong range is, from the caller's seat, indistinguishable from an analysis that does not exist. NEXT-RUNG TRIGGER for this instance, named as the capability and not as an artifact: A CORPUS-WIDE NAMESPACE CENSUS OVER EVERY TYPE DECLARATION AND EVERY COPRODUCT ARM, sufficient to answer 'is this spelling already declared anywhere in the corpus' before a name is authored, rather than after emission. ONE census over the one Node tree, not a second check beside the type-name one -- two checks over one namespace is the range split that produced this instance.
 - cache impurity (key on declared-input content; byte-identical cached-vs-cold is the purity oracle)
@@ -165,3 +167,5 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit
 - **an instrument reports GREEN over a population it does not own, so a fact can be filed in an authority, absent from the projection readers are pointed at, and nothing refuses** (INVALID STATE: two actuators split one generated-artifact population, and the one lanes habitually run denominates only its own half. `claim_executor --required-regen` reports `first_generation_equal=true planned=155 executed=155 adjudicated=155` while `docs/design-failure-modes.md` is STALE, because the ledger projections are produced by a different actuator entirely -- `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet`. HARM: a lane files a row in `gunbc.recurring_failure_mode`, runs the regen, sees 155/155/155, and stops -- having shipped a row that exists in the authority and nowhere a reader can see it, since DESIGN.md points readers at the projection and not at the .dag. The green is not merely uninformative about the projection; it is READ as covering it, because the instrument's name and its round numbers make no distinction between the population it adjudicated and the population it was asked about. SPECIMEN, and it is the row filed beside this one: `absence_classifier_default_bucket` was authored into the authority, `--required-regen` returned first_generation_equal=true, and the projection still did not contain it. The gap was found by GREPPING THE PROJECTION for the row just filed, which is not a step any gate performs. THE TWO NEIGHBOURS THIS IS NOT, cited so the family is readable and this row is not consolidated into either. [[incidental_denominator_as_wall]] is THE SAME DENOMINATOR SHAPE WITH THE OPPOSITE SIGN: there, `is_compared_generated_basename` -- whose job is to denominate the DRIFT COMPARISON -- accidentally CREATED safety by never handing an installer a dangerous input, so nothing is wrong today and the harm is that the protection is uncredited and dissolves silently when the upstream question changes. Here the same accident runs the other way: a denominator written for one question accidentally DESTROYS COVERAGE while continuing to report green, and something IS wrong today. Uncredited protection versus credited assurance that is not there. [[authority_merges_unprotected_while_its_projection_is_guarded]] is a MERGE-TIME protection asymmetry over the same file pair -- projection driver-bound, hand-authored authority matching no merge attribute -- repaired by binding the driver to the authority path. This row is REGEN-TIME and is reachable with no merge in sight. (Two notes worth keeping. That merge row landed in the very merge that conflicted the branch filing this one, and it had already measured the 16,792-character line 144 that made the conflict hazardous -- the hazard was filed by another lane before this one hit it. And it has since been observed firing in production on a SIBLING lane's head: `git merge-tree --write-tree` returned rc=1 with BOTH projections refusing while `gh pr view` reported mergeable=MERGEABLE on that same commit, observed simultaneously -- a cleaner specimen of that row than the one it was filed with, and a second instrument disagreeing with a green.) A SECOND SPECIMEN, RECORDED BECAUSE THE AUTHOR OF THIS ROW COMMITTED THE SAME SHAPE WITHIN THE HOUR OF FILING IT, IN THE OPPOSITE DIRECTION: asked whether CI would ever run on a merge-conflicted head, they polled one branch once a minute for six minutes, observed no run, and reported that GitHub does not create runs for a head it cannot merge -- a NEVER claimed from an instrument whose denominator was one branch and six minutes. The control was one command away and refuted it: three other DIRTY pull requests in the same repository carried six and seven check-runs each, while the two heads at zero were simply the two most recently pushed, one dirty and one clean, under a backlog of sixty-two unfinished runs. Recency separated the population perfectly and dirtiness did not separate it at all. The general form is this row's own, with the sign flipped: there an instrument's GREEN was read as covering a population it never enumerated; here an instrument's SILENCE was. A transient state proves nothing about membership without duration or a control already sitting in the state being called impossible -- and DESIGN section 5 names the tell in advance, since NEVER is the word that lets a ratchet pass as a wall. RECOGNITION RULE: when an instrument reports a clean round count, ask WHICH ARTIFACTS ITS DENOMINATOR ENUMERATES and whether the artifact you changed is among them -- a per-artifact count is evidence about the artifacts counted and says nothing whatever about the ones the actuator does not own, while reading exactly like whole-population coverage. The tell is two actuators over one declared population with no join between their denominators. NEXT-RUNG TRIGGER, a capability and not an artifact: ONE adjudication over the whole declared generated-artifact population, so that a stale projection is a refusal from the same run that adjudicates the mirrors; failing that, a green that NAMES ITS OWN BOUNDARY -- reporting the artifacts it did not adjudicate rather than a bare count -- which is the weaker form and turns silent non-coverage into a stated one. RUNG: mitigatable. NOT REPAIRED HERE: extending an actuator's population or splitting its report is a change to the regen authority and does not belong in the diff that discovered it.)
 - **a MECHANISM about external reality is asserted as the reason for a conclusion that is independently CORRECT, so nothing the repository can execute ever refutes it** (INVALID STATE: a carrier states WHY an external system behaves as it does -- this platform suppresses that trigger, that endpoint rate-limits, this token cannot start a run -- and derives a design decision from it. The DECISION is right; the mechanism was never measured. HARM: DESIGN section 5 silent wrongness, and it is the immunised variety. A wrong premise attached to a wrong conclusion dies the first time the conclusion is tested. Here every test of the conclusion PASSES, so the premise is confirmed by association and hardens into the sentence later readers plan against -- and it is consumed for facts the conclusion never covered, which is where it is false. THE DISCRIMINATING QUESTION IS ALWAYS THE SAME: the conclusion says the good outcome does not HAPPEN; the mechanism says the machinery does not EXIST. Those differ exactly on cost and on remedy. If the thing exists and is merely withheld, something can release it, something already paid for it, and a second copy is a duplicate. RECOGNITION RULE, mechanical: for any prose of the form THE PLATFORM DOES NOT DO X, name the observation that would show X happening and say whether anyone ran it. If the only evidence offered is that the conclusion held, the mechanism is unmeasured. The sharpest tell is a mechanism stated in an ABSENCE form -- starts no run, sends no event, creates nothing -- beside a conclusion stated in an OUTCOME form; absence and non-execution are two states and the carrier collapsed them. DISTINCT FROM ITS NEIGHBOURS. `unbacked_execution_claim` is about an in-repository relation an authority could have backed and did not; here the subject is OUTSIDE the modeled guarantee, so no authority in the tree could have backed it and the only route is observation at the boundary. `state_space_conflation` names too few constructors for a modelled domain; here the domain is unmodelled and the prose supplies a two-state story for a three-state world. SPECIMEN (cool-koi-623, 2026-09-03). `gunbc.rung_drop` `floor_cut_heal` and the annotation above `gunbc.ci_spec` `gunbc_ci_heal_commit_push_script` both said an Actions-credential push starts no workflow run, GitHub suppressing that edge to stop a job triggering itself, and concluded that heal must exit nonzero rather than speak for a head nothing judged. The rung_drop row carries the correction; the ci_spec annotation still carries the refuted sentence AT THE TIME THIS ROW IS FILED, because that carrier is held by a concurrent lane and a second lane editing one premise from its own verdict is how one fact acquires two authorities -- recorded here as an observation rather than repaired here. The conclusion is correct and remains in force. The mechanism is false: over the whole heal-push population a pull_request run was CREATED 4 times out of 4, and it is EXECUTION that is withheld -- 0 of the 4 started a single job on the triggering attempt. The receipts and the re-derivation recipe are carried in that rung_drop row rather than restated here. WHAT THE FALSE MECHANISM CONCEALED, which is the harm made concrete: under starts-no-run a dispatched revalidation is free, and measured it is a SECOND run on that head whose check runs a name-keyed reader cannot separate from the held run s; and the human action that releases a healed head is an approve on that specific held run, not the re-run the annotation offered. A METHOD NOTE THAT IS PART OF THE CLASS RATHER THAN OF THE SPECIMEN: the first two readers of this population both read a run s TOP-LEVEL conclusion and its start timestamp and concluded the runs had executed. A run can conclude failure having started zero jobs, and a later attempt can execute after a human acts. When the subject is EXECUTION, count jobs on the attempt the event created, never read the latest attempt. RUNG FOUND AT: 1 ON AXIS (i) BELOW, mitigatable. The harm is contained because the conclusion the premise was offered for is independently sound; nothing was admitted that should not have been. A SECOND HARM THE SPECIMEN MADE VISIBLE AND THE CLASS SHOULD CARRY: the unmeasured mechanism was stated UNSCOPED, so the sentence is true at the moment it is written and can stop being true with nobody touching it -- here a held run may be released hours later and judge the head, at which point 'a head nothing judged' is simply false. Measure the mechanism, and then say WHEN the claim holds. THE SUBJECT OF THIS ROW IS A CARRIER IN THIS REPOSITORY, NOT THE EXTERNAL SYSTEM, and an earlier revision of this row got that backwards -- corrected here rather than annotated, because the error is exactly the one section 4b's carve-out exists to prevent. That revision assigned a LADDER RUNG to external reality, which section 4b deliberately keeps OFF the ladder, and then declined to name a trigger; between them those two moves let 'we do not model GitHub' stand where a rankable in-repository defect actually sits. The invalid state is an AUTHORING ACT that is wholly in the tree: a carrier states an unobserved mechanism as the reason for a decision. That is decidable from the carrier alone, so it ranks, and it is obligated to climb. TWO AXES, WITH DIFFERENT CEILINGS BECAUSE THEY HAVE DIFFERENT DECIDABILITY, and only the first is a ladder subject at all. (i) THE SEPARATION -- is this mechanism claim backed by an observation? Decidable by reading the carrier. CEILING: 4, structurally impossible, and DERIVED rather than aspirational: if the only construction able to express an external-system mechanism requires the observation that produced it, an unbacked mechanism claim has no constructor, and validation becomes unnecessary because the bad state cannot be written. Anything below 4 on this axis is a correctness gap, not a ceiling. (ii) THE TRUTH of the external fact -- whether the observed behaviour still holds. OUTSIDE THE MODELED GUARANTEE, not a rung and never one: observed, refused or mitigated at a declared boundary, never fabricated. It is named here precisely so it cannot be mistaken for a weak implementation that should climb. NEXT TRIGGER FOR AXIS (i), NAMED AS THE CAPABILITY AND NOT AS AN ARTIFACT: an external-system mechanism claim is expressible ONLY through a typed construction carrying the observation that produced it -- the query, the population, the date -- together with a consumer that ENUMERATES carriers stating such a claim without one. The pairing is the whole trigger: the construction alone makes the honest form available, and only the enumerating consumer makes the dishonest form unwritable rather than merely noticed once. Authoring one such row by hand discharges nothing and is the artifact-for-capability substitution section 4b(3) forbids. It is CAN-CLIMB-NOW-BUT-UNBUILT rather than blocked on grounding: `extdeps` already owns the shape for cited upstream facts. SECTION 4c DECIDES WHERE THIS CANNOT LIVE, recorded so the cheap version is not proposed later as an economy: semantic passes receive only the annotation-erased projection, so an annotation can never carry the observation and the construction must be a real declaration. WHAT THE DISCHARGED TRIGGER DOES NOT BUY, stated so it is not read as covering axis (ii): every mechanism claim would then carry a receipt, and a receipt is not currency -- a system that changes without notice makes any observation a statement about a past world. That residual is axis (ii) and stays outside the guarantee by construction. WHAT IS ASYMMETRIC ABOUT THIS CLASS, and it is why it survives review rather than why it cannot be ranked: the DEFECT is visible from inside the tree -- a claim with no observation beside it -- while the REFUTATION lives in the external system and no lens, gate or witness reading this tree can reach it. So the class is detectable here and falsifiable only there, which is what lets a wrong mechanism sit unchallenged beside a correct conclusion for as long as nobody goes outside to look. Until axis (i)'s trigger is built this row is a reading discipline and citing it as coverage is the rung inflation section 4b(1) names.
 - **an artifact's column names a governing threshold and carries a constant that is not the threshold enforced, so the artifact cannot predict the refusal it exists to explain** (INVALID STATE: a machine-readable receipt carries a field named for the limit its subject is judged against, and the value is a constant unrelated to the limit the judge actually applies. MEASURED on gunbc#10200's required run (run 33722461610, artifact `required-floor-claim-cost`, 2026-09-03): all 3534 rows of `required_floor_claim_cost.tsv` declare `cost_line_ms=100`, while the same run's floor refuses rows against a 500ms per-claim CPU budget and says so in its own refusal text. **300 of 3534 rows exceed the line the FILE declares; 13 exceed the line actually ENFORCED.** A consumer computing an over-cost population from the artifact gets a set 23 times too large, in a well-formed way, with no error anywhere and no column missing. HARM: the artifact is the only durable record of per-claim cost, so it is what anyone reaches for to ask whether a refusal was predictable, whether a row is near the line, or whether a population regressed. Every one of those questions is answered wrongly by the same factor, and the wrongness is invisible because 100 is a plausible per-claim budget. **THE SHARP POINT, AND IT IS WHY THIS IS ITS OWN ROW: THE PRESCRIBED REMEDY FOR THE NEIGHBOURING HAZARD DOES NOT PROTECT AGAINST THIS ONE, AND LOOKS LIKE IT DOES.** `gunbc.floor_cost_distribution` already records this constant, as a COLUMN-ORDERING hazard: `eval_steps` was inserted into the artifact between vintages, so a parser keyed on index 6 reads `cost_line_ms` -- the constant 100 -- as a step count and produces microsecond figures three orders of magnitude off, measured on three of eleven sampled runs. That note's remedy is DESIGN section 3's standing rule: locate columns by NAME, never by position. That remedy is correct for its own hazard and is exactly what fails here. A consumer who follows it perfectly -- reads the header, finds `cost_line_ms` by name, uses it as the line -- still computes the wrong population, because the defect is not WHERE the column is but WHAT IT SAYS. Citing by name protects a reader from a moved column; nothing protects them from a column whose name asserts a role its value does not fill. That note is CITED here, not restated, and the addition is that its constant is not merely a parsing trap but a false statement about the enforced line. WHY IT IS NOT `meaning_fork`: that class is one name carrying two material referents under hidden state, and its recognition rule is to hold the naming surface constant and vary the hidden state until the referent changes. Here there are not two referents. There is ONE name making ONE assertion -- this is the line this row is judged against -- which is simply false, at every vintage, for every row, with no state to vary. The dual is nicknaming and this is neither: it is a field whose name claims an authority relation its value does not have. THE DISTRIBUTION IS THE RECEIPT AND IT IS WHAT MAKES THE 5x GAP CONSEQUENTIAL RATHER THAN COSMETIC. Against the enforced 500ms line, that same run's rows sit at p50=2ms, p90=84ms, p99=364ms, p99.9=514ms, max=541ms, with 8 rows in 400-450, 8 in 450-500, 12 in 500-525, 1 in 525-550 and NOTHING above 541. So the only rows the line can ever separate are the 29 above 400ms, and 21 of those 29 sit within ten percent of it. A reader using the artifact's own column would place the threshold at 100ms, where 300 rows sit above it and the nearest rows are not clustered at all -- a completely different and far healthier-looking picture of the same run. The artifact does not merely mis-state the line; it conceals the clustering that makes the real line a change detector rather than an oracle. RUNG FOUND AT: outside the ladder, and this is the honest placement rather than rung 1. Nothing fails, nothing refuses, and no diagnostic fires: the file is well-formed, the column is present and correctly named by position and by header, and every value parses. The wrongness is silent and is discovered only by someone who happens to hold both the artifact and a refusal message from the same run and notices they disagree. CEILING: 4, structurally impossible. The line a claim is judged against is a fact the judge already holds at the moment it judges, so an artifact that carries the judge's own value rather than a literal cannot state a different one. That is construction rather than validation, and it is available today. NEXT TRIGGER, NAMED AS THE CAPABILITY: **each cost row emits the line ACTUALLY applied to that row, derived from the same authority the enforcement reads, so that the over-cost population computed from the artifact alone is the set the floor refused** -- sufficient for `rows where cpu_ms >= cost_line_ms` over the artifact to equal the run's refusal set, demonstrated by a discriminating red on a fixture where a row's declared line differs from its enforced one. Changing the constant from 100 to 500 does NOT discharge this: a second hand-authored literal agreeing with the current line by coincidence reproduces the class the moment either moves, and the defect is that the value is authored at all rather than derived. NOT REPAIRED HERE: the emit-family cost work and the mis-grounding of the 500ms line itself are separate subjects with their own dispatch; this row is the modelling defect in the instrument, which is what makes it filable independently of either.)
+- **an admission predicate evidenced from inside its own subject** (a rule admits an action only when some condition holds -- `the refusal is carried entirely by this class`, `nothing else is failing`, `this is the only cause` -- and the evidence for that condition is read off a surface THAT ONLY REPORTS THE CLASS THE PREDICATE IS ABOUT. The surface answers faithfully and narrowly; it has no vocabulary for the thing that would falsify the rule, so IT CANNOT REPRESENT THE PREDICATE BEING FALSE. The test then confirms itself on every evaluation, and its greens carry no information. This is `executed_conjunct_discriminates_nothing` wearing an admission rule's clothes: the conjunct executes, it is honestly computed, and its outcome was decided by its own scoping rather than by the world. **RECOGNITION RULE, USABLE WITHOUT SUSPECTING ANYTHING: ask what SURFACE the predicate's evidence was read off, and whether that surface can represent the predicate being FALSE. If it cannot, the test is decorative.** SPECIMEN, AND IT IS THIS AUTHOR'S OWN RULE. A declared drop admitted a bounded mitigation -- one reroll per head -- on the condition that the run reported `failed=0` with the refusal carried entirely by that row's two cost arms. The evidence was read off the floor's own disposition counters, which enumerate COST dispositions. Those counters do not range over other phases at all, so they were incapable of reporting that anything else had failed. On the run that spent a reroll under this rule, the required job was `phases_run=3 failed=2` the whole time -- refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas -- and the predicate had been FALSE at every moment it was evaluated as true. REPAIR: evidence the predicate from OUTSIDE its own subject -- here, the RUN'S PHASE VERDICT (`phases_run`, `failed`, the `FAILED PHASE` lines) rather than the class's own counters. A predicate scoped to one class must be adjudicated at a grain that can see the other classes. **A SECOND SPECIMEN IN A DIFFERENT DOMAIN, WHICH IS WHAT ESTABLISHES THIS AS A SHAPE RATHER THAN A QUIRK OF COUNTERS.** A reviewer cited a declaration by FILE AND LINE. Asked to check it, they verified the citation AGAINST THEIR OWN CHECKOUT and IT VERIFIED GREEN -- printing that line returned exactly the text they had claimed -- while the declaration sits 1633 lines away on `origin/main`. THE GREEN IS THE POINT AND IT IS WORSE THAN A FAILURE WOULD HAVE BEEN: a check that returns green from inside its subject returns green every time it is run, and nothing about it prompts a second look, whereas a check that returned nothing would have sent the citer looking. **AND THE SURFACE WAS NOT A STALE TREE, WHICH IS WHAT MAKES THIS SPECIMEN LOAD-BEARING RATHER THAN A HYGIENE NOTE.** The citer was on their own FEATURE BRANCH -- clean, current, seven commits of their own ahead, 41 behind main because that is what a feature branch IS -- and cited a line read off it as main's. Read as staleness the finding has an obvious remedy, fetch more often, which lets a reader file it and move on. It has no such remedy. EVERY AUTHOR CITES FROM THE TREE THEY ARE WORKING IN, THAT TREE IS DIVERGENT FROM MAIN BY CONSTRUCTION, AND THE CITATION VERIFIES GREEN THERE EVERY TIME PRECISELY BECAUSE IT IS THE TREE THAT PRODUCED IT. No discipline of fetching closes it; only citing by symbol does. (The citer supplied this correction themselves, having first described their own position as staleness and then checked which branch they were on -- one more instrument that should have been run before describing the surface.) No counter and no admission rule is involved; the structure is identical -- evidence for a claim drawn from inside the claim's own source. It is also why DESIGN section 3 requires citing the SYMBOL: a symbol is checkable against a tree the citer does not control, and a line number is only ever checkable against a tree, so the positional form has no outside-the-subject verification available to it at all. The correction here came from a third party who resolved the same declaration BY SYMBOL. **A FOURTH SPECIMEN, AND IT IS THE ONE THAT CANNOT BE READ AS INATTENTION.** A reviewer asked a merge queue whether a pull request's required checks were passing, by querying for its NON-SUCCESS checks. The query returned an EMPTY LIST and they reported the context green. An empty list is returned by `everything passed` AND by `nothing ran`, and they had not asked for the denominator that separates the two. The truth was the second: the branch was dirty, so no merge ref could be computed, so NO WORKFLOW HAD EVER STARTED -- `check-runs total_count 0`, combined status `pending`, statuses array empty. The surface they read could not represent the state they were trying to rule out, which is this row's recognition rule exactly; `empty_observation_narrow` is the same failure of taking a numerator without its denominator. WHAT MAKES IT THE STRONGEST SPECIMEN IS ITS TIMING: it was committed ROUGHLY FORTY MINUTES AFTER the same author corrected another session's instance of this class, in the same thread, while explicitly writing about how easily a found-set is read as a population. A FIFTH INSTANCE FOLLOWED, INSIDE AN INSTRUCTION TO BE MORE RIGOROUS ABOUT CITATION: a reviewer relayed a peer's measurement as an established, present-tense fact about a tree they had not themselves examined, while directing another author to cite only what is checkable against that tree. Both parties then ran the check independently and it was FALSE. The discipline was in hand and was applied to someone else's sentence rather than to the sentence carrying it. THE SAME AUTHOR THEN DID IT AGAIN THREE HOURS LATER, in a message whose express purpose was to instruct another lane NOT to inherit anyone's numbers: they quoted their own working branch's roster count as main's, having already had that exact substitution filed as a specimen in this row. Both instances were caught only because the instruction they were wrapped in demanded a CHECKABLE form, so the recipient ran the check the instruction asked for and it disagreed with the instruction. **AWARENESS OF THIS CLASS DOES NOT CONFER IMMUNITY TO IT, AND THE EVIDENCE IS THIS ROW'S OWN AUTHORSHIP.** Three sessions committed this shape inside the single thread that produced this row, WHILE ACTIVELY DISCUSSING IT: one reported the return of a grep written from the specimen it was searching for as the census; the second passed that found-set onward as the population without asking what it was a view of; the third corrected the second while reporting their own grep's return as the extent, one level up. Each caught the person below them and none caught themselves. That is not three mistakes but ONE MECHANISM OBSERVED THREE TIMES under conditions as controlled as this repository will ever supply -- the participants informed, attentive, and looking directly at the class. It is stronger evidence than any single specimen, and it is the reason the detection sentence below is stated as a structural fact about WHO can find the defect rather than as an exhortation to be careful. **DETECTION IS THE HALF NOBODY WRITES DOWN, AND IT IS NOT MORE CARE: THE ONLY RELIABLE DETECTOR FOR A SELF-RATIFYING TEST IS AN AUDIT PERFORMED BY SOMEONE WHO ALREADY BELIEVES THE TEST PASSED.** The predicate confirms itself for everyone who relies on it, so no amount of diligence by the relier finds it; it was found here because a lane acted on the rule and then audited its own action, and reported the result against its own interest (neat-swift-219, 2026-09-02, who supplied both the specimen and this detection sentence). AN AGGRAVATING NEIGHBOUR THE SPECIMEN ALSO CARRIES, recorded because it is what made the narrow surface believable: `failed` is FORKED ACROSS THE OUTPUT VOCABULARY of one binary. FOUR EMITTERS AND FOUR SUBJECTS, from a sweep run to closure rather than from the two sites that prompted it, and the count matters because an earlier statement of this paragraph said two: `claim_executor` prints a required-ci line where `failed` counts PHASES and a disposition line where `failed` counts CLAIMS; `cli_run` prints a third with `deferred=` beside it; and `partition_crate_boundary_host` prints `failed=[..]` as a LIST rather than a count, beside a package count. THE THIRD SUBJECT IS THE DANGEROUS ONE AND WAS FOUND LAST: a DISCOVERY-ROW counter that is not a narrower or wider spelling of the claim population but a DIFFERENT one, absorbing NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted -- failure classes the claim counter excludes. Two counters that disagree about their subject are a fork; one that silently UNIONS classes another excludes will read as agreement whenever those classes happen to be empty. One word, one naming surface, no declared version transition -- a `meaning_fork` in the OUTPUT vocabulary, which is the worst place for one, because a reader hits the LINE and never reaches the ledger that would disambiguate it. THE LIST FORM IS THE PROOF RATHER THAN A CURIOSITY: a site printing a list where three others print a count establishes that these were never read as one vocabulary, which is what distinguishes a meaning fork from a rename that was merely never finished. **AND THE STRONGEST EVIDENCE IS NOT THAT THE FORK WENT UNNOTICED -- IT IS THAT IT HAS BEEN HIT AND LOCALLY REPAIRED AT LEAST TWICE, CORRECTLY, BY INDEPENDENT AUTHORS.** One declaration in `cli_run` lifts six fields onto the headline ledger line on the stated reasoning that a fix shipped as yet another separate line would reproduce what it repairs; one in `claim_executor` documents `failed=0` being finishable wrongly, names a session dispatched against a regression that did not exist because of it, and separates the concepts into `unexpected_failures` for answered-wrong and `verdict_incomplete` for never-answered. Each repair was sound at its own surface and each left the WORD forked at every other emitter, because neither author had any reason to look sideways. THAT is the argument for a vocabulary-level fix rather than a third local repair, and it is stronger than the absence of repairs would have been. AN EARLIER DRAFT OF THIS ROW SAID THE OPPOSITE -- that the arithmetic gap was 'already observed and carried only as prose' -- which understated shipped work and was corrected before landing by reading the surrounding declarations rather than the comment alone The fork's REPAIR is owned elsewhere and is deliberately not scoped here; it is entered as this class's evidence, since a forked counter name is precisely what makes an inside-the-subject reading look like an outside-the-subject one.)
+- **two instruments agree because the classes one of them ABSORBS happen to be empty** (two counters, reports or readers are compared, they return the same NUMBER, and the agreement is taken as evidence that they measure the same thing. They do not. One of them ranges over a WIDER POPULATION -- it additionally absorbs failure classes the other excludes -- and the two coincide exactly while those absorbed classes are EMPTY, which on a healthy system is most of the time. **NEITHER READING IS WRONG, WHICH IS WHAT SEPARATES THIS FROM ITS NEAREST NEIGHBOUR.** `disagreement_census_blind_to_agreed_wrong` is about two readers answering the same WRONG thing, where the defect is in the readings; here BOTH INSTRUMENTS ARE CORRECT ABOUT THEIR OWN SUBJECT and the defect is in the JOIN a reader performs between them. Nothing either instrument reports is false, so no amount of auditing either one finds it. **AND IT IS WORSE THAN DISAGREEMENT, NOT MILDER: disagreement is visible on the FIRST comparison, while this is invisible until the day one of the absorbed classes is non-empty -- so the evidence for the conflation arrives only at the moment it is doing damage.** SPECIMEN, 2026-09-02/03. One word, `failed`, was emitted by four sites of one binary carrying four subjects: lane PHASES, required-floor CLAIMS, a package LIST, and DISCOVERY ROWS. The discovery counter is not a narrower or wider spelling of the claim population -- it is a DIFFERENT population that additionally absorbs `NotBool`, `RuntimeError`, `HostToolUnresolved`, timeout, panic and `NotAttempted`. THOSE ARE PRECISELY THE CLASSES THAT ARE EMPTY ON A GOOD DAY, so the two counters agree on every ordinary run and diverge exactly when something has gone wrong in a way nobody is watching for. THE PROVENANCE IS THE ARGUMENT FOR A WALL RATHER THAN FOR MORE CARE: this fork was HIT AND CORRECTLY REPAIRED TWICE, by two independent authors, each at their own surface -- one lifting six fields onto a headline ledger line, one separating answered-wrong from never-answered after a session was dispatched against a regression that did not exist -- and each repair left the word forked everywhere else, because neither author had any signal to look sideways. Diligence did not catch it and could not have; the repair is a vocabulary-level split at the producer, which a separate lane owns. **RECOGNITION RULE, AND IT IS CHEAP: when two instruments AGREE, ask whether their subjects are the same POPULATION or merely the same NUMBER, and check the agreement on a run where the absorbed classes are NON-EMPTY. An agreement observed only over empty absorbed classes establishes nothing.** The corollary for authors is the same fact stated forward: a counter's name is not its subject, and two counters sharing a name is evidence about the naming surface rather than about what was counted.)
diff --git a/docs/design-rung-drops.md b/docs/design-rung-drops.md
index ddfababc5da..b81511c3bee 100644
--- a/docs/design-rung-drops.md
+++ b/docs/design-rung-drops.md
@@ -44,7 +44,7 @@ Each row declares a safety guarantee that was lowered: what stood before, what s
 
 ### Per-claim cost qualification is unavailable at the subject grain the gate consumes — declared 2026-09-01
 
-Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. `required_floor_claim_cpu_safety_limit_ms` is a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 280ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR of 1.777, measured by identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed. A floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head per signature, and only where the run reported `failed=0` with the refusal carried entirely by this row's two arms. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job <job> --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it.
+Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. `required_floor_claim_cpu_safety_limit_ms` is a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 280ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR of 1.777, measured by identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed. A floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head, and only where the refusal is carried entirely by this row's two arms. THAT RULE WAS MIS-SPELLED AND MIS-EVIDENCED WHEN FIRST WRITTEN, AND BOTH DEFECTS ARE CORRECTED HERE RATHER THAN QUIETLY RESPELLED. It read `one reroll per head per signature`, which parses as a COUNTER KEY -- so many rerolls per distinct signature -- and that reading is self-defeating on this row's own claim: these arms vary across attempts of one unchanged tree, so A CHANGED SIGNATURE IS THE EXPECTED OUTCOME OF A REROLL rather than new information, and every reroll would license the next one for exactly the reason this row exists. The signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget. The budget is ONE, PER HEAD. AND THE ELIGIBILITY TEST MUST NOT BE EVALUATED AGAINST THIS CLASS'S OWN COUNTERS. It said `the run reported failed=0`, which was read off the floor's disposition counters; those enumerate COST dispositions and do not range over other phases, so they cannot report that anything else failed and the test could only ever confirm itself. THE RULE STATED SO IT SURVIVES THE SPELLING: ELIGIBILITY IS A PROPERTY OF THE RUN'S PHASE VERDICT AND IS NEVER READ OFF A CLASS'S OWN DISPOSITION COUNTERS, whatever either is called. The quotation `failed=0` above is preserved as a RECEIPT of what a run actually printed on 2026-09-02 and must not be restated as the current key: at the time, one word `failed` carried FOUR SUBJECTS across four emitters of one binary -- lane phases, required-floor claims, DISCOVERY ROWS, and a package LIST -- which is why an inside-the-subject reading looked like an outside-the-subject one. THE DISCOVERY SUBJECT IS THE ONE THAT MATTERS AND IT IS NOT A NARROWER OR WIDER SPELLING OF THE CLAIM POPULATION: it is a DIFFERENT population that additionally absorbs NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted, so a reader treating the two as the same word silently unions failure classes the other excludes. That fork is being repaired at the producer by a separate lane, into `phases_failed`, `claims_failed`, `discovery_rows_failed` and `packages_failed`, with `FAILED PHASE` unchanged; this row therefore names the phase verdict as the adjudicating SURFACE rather than any counter key. Eligibility is decided by the RUN'S PHASE VERDICT -- `phases_run`, `failed`, and the `FAILED PHASE` lines -- which is evidence from outside the predicate's own subject. The class is `admission_predicate_evidenced_from_inside_its_own_subject`. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). AND ONE FURTHER PAIR, ENTERED MARKED BECAUSE ITS ADMISSION WAS INVALID AND THAT IS PRECISELY WHY IT IS KEPT: gunbc#10077 run 33647114048, floor job 100317014535, head 74719e46dd, both attempts `planned=executed=3487` with no unexpected claim failures -- attempt 1 `interrupted_before_verdict=12` (all `interrupted_cpu_deadline`), `completed_over_cost_requirement=0`; attempt 2 `interrupted_before_verdict=1`, `completed_over_cost_requirement=2`. Refuse then refuse. All twelve of attempt 1's rows sit in `test.claim.self_host_compile_phase_frontier_witness` and `test.claim.self_host_compile_phase_live_gate_witness`, EACH MEASURED 501 TO 506 CPU-MS AGAINST THE 500MS LIMIT -- a one-to-six millisecond miss, which is the sharpest evidence this row has for its own claim: a witness failing at 900ms would be consistent with genuinely costing that much, and one failing at 501 is not. THE ADMISSION WAS FALSE WHEN IT WAS MADE. The run was `phases_run=3 failed=2`, refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas, so the refusal was never carried entirely by this row's two arms; the eligibility test had been evaluated against the floor's own disposition counters, which cannot report that another phase failed. IT IS ENTERED RATHER THAN REPLACED BY A CLEANER RUN, and the reason is structural: a clean run cannot evidence a defective admission predicate, so this is the only receipt that the rule was broken, and dropping it for being untidy would filter the mitigation's record by how the mitigation turned out. WHAT IT DOES NOT ESTABLISH, stated because the counts invite it: attempt 2's single interrupted row was ALSO IN attempt 1's twelve, so the pair is a SUBSET and not a disjoint redraw, and a stable population straddling the threshold explains both attempts without any redraw at all -- one module in this run carries members at 481, 490, 499, 500 and 501 ms. The counts moved; the membership did not leave the prior set. An earlier reading of this pair asserted that a fixed marginal set could not produce those counts; that assertion was withdrawn by its own author on the membership measurement before it was entered here. THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job <job> --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument defect is WIDER THAN WRONG-ATTEMPT, measured 2026-09-02 on gunbc#10077 by diffing both fetches of ONE job: the `gh run view` copy was MISSING THE `FAILED PHASE` LINES ENTIRELY. It does not merely serve the wrong attempt; it can DROP THE LINES CARRYING THE VERDICT, turning a two-phase failure into an apparent one-phase failure -- which is precisely how the admission predicate above was evaluated as true while it was false. An instrument whose omission is invisible is worse than one that is merely stale. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it.
 
 ### Emitted-bytes fixture witnesses in a required lane — declared 2026-09-01