Name the differenced population, and split the two movements gross_increases had fused

[briansrls]

gunbc.namespace_step0_canary_v2's receipt printed blocking_rows / blocking_occurrences beside
gross_increases, and those figures range over different populations: step0_blocking_measure
filters to row.blocking, while step0_histogram_differential is handed the full census. Both were
arithmetically correct. A reader who differenced the blocking occurrences and could not reach the
delta had no way to find out why — nothing in either value named the rows it was about, and no
assertion anywhere could go red on the mismatch. That is the class this receipt exists to refuse,
turned on the receipt.

The labelling was the symptom; the shape was the defect. gross_increases folded a post-only
bucket's whole count in beside shared-bucket growth, so one name described two movements at once and
no conservation identity could range over it. The four movements are now separate primitives —
shared_increases, shared_decreases, pre_only_occurrences, post_only_occurrences — and
gross_increases / gross_decreases become derived projections (§2), so the two views cannot
disagree. The identity became writable only after that split, which is the evidence the old shape
was wrong rather than merely under-labelled.

The domain is a typed field, not a caption. Step0DifferentialDomain (EveryCensusRow |
BlockingCensusRowsOnly) travels inside the differential; every renderer prints it from there. A
caption cannot carry the fact — it is prose the substrate cannot read (§4c) and the reader who needs
it is reading a value. The blocking line names its domain too, so the two figures side by side now
each say which rows they cover.

The identity refuses rather than prints, and it is a join between two producers. The left side is
each arm's own occurrence total, walked directly over its row list by step0_census_occurrences. The
right side is the bucket fold's four movements. Different walks over the same rows, so a delta whose
domain does not match the totals it is differenced against cannot satisfy it. A check that recomputed
the same fold and compared it to itself would be the change-detector shape §5 names.

Executing evidence — four controls in test.claim.namespace_step0_canary_v2_witness:

• the_four_occurrence_movements_are_reported_separately — a pair that moves occurrences in all four
  directions, where shared_increases (8) and gross_increases (14) are deliberately different
  numbers. Under the fused field this row could not be written at all.
• the_differential_names_the_whole_census_as_its_domain — the domain is EveryCensusRow and the
  totals equal step0_census_occurrences of each row list; the pair carries advisory rows on purpose,
  since their inclusion is exactly the fact the receipt failed to state.
• a_differential_whose_movements_do_not_conserve_its_population_is_refused — the discriminating RED.
  The perturbation is a domain mismatch: totals from one population, movements from another. It is
  authored in the fixture because the production fold cannot emit it, which is the point — the
  identity is the wall that keeps it unemittable (§4b).
• the_conservation_identity_is_not_vacuous_on_a_moving_pair — a conserving answer here is about this
  pair rather than about zero.

Not in this PR: the binding-provenance census. This is the receipt-labelling repair the census
work sits on top of, landing alone so the record is straight first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvMEJFpYsy55NRdJ1Az4Vd

[gunbai-bot]

Both reviews approve with no blocking finding; thanks. One remark is worth answering rather than
patching, and one is worth recording.

On BlockingCensusRowsOnly being "only used as a label at the print site". It is read, and by
the site that matters: step0_blocking_line renders it through step0_differential_domain_label, so
the blocking figures and the delta now name their populations from one closed authority instead
of from two independently-authored captions. That is the whole repair — the defect was never that a
caption was missing, it was that two figures over two populations were printed side by side with
nothing joining their names to a single source. A variant read at one site is not the write-only
storage class; I deleted two of those from #10247 an hour ago, and the distinguishing question is the
same one — who reads this, by name — which here has an answer.

What I did consider and rejected: carrying the domain as a field on Step0BlockingMeasure so the
print site reads it from the value rather than naming the constant. It is the more symmetric shape
and I would take it in a change that already touches that type. On an approved diff it buys a field
whose only reader is the same renderer, at the cost of a CI cycle, so it is polish rather than
repair.

Worth recording beside this PR: the conservation identity landing here is the one that would
catch a domain mismatch between a headline and a delta. It cannot catch a population that is
missing members, because the denominator and the movements are walked from the same rows. I have
since measured exactly that failure one layer up, in the reference-occurrence census this receipt
sits beneath — two reference families produce no denominator row at all, and every conservation law
still balances over what remains. That is a separate finding and a separate change; noting it here so
nobody reads a green conservation check as evidence the population is complete.

— sent from jolly-badger-374

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvMEJFpYsy55NRdJ1Az4Vd