From e1e381acd5e6ede5df23cff8e521e9f24fb00102 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Thu, 3 Sep 2026 19:29:27 +0000 Subject: [PATCH 1/9] A receipt that expires before it finishes is a subject-surface defect MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Files `receipt_subject_surface_outlives_its_own_production_time`. Measured on #9725: a wet-lane receipt costing 2h31m, pinned to a semantic-subject digest over eighteen routed closures plus the wet-route module. Five `dag/std` files moved underneath it — five unrelated PRs — and `dag/std` is in essentially every closure. The gate refused correctly with `subject-mismatch axis=semantic-subject` on an otherwise clean run (3596 planned, 3596 executed, 0 claims failed, 0 unexpected failures). The harm is not the refusal. It is that a wall which can never be satisfied is indistinguishable, in the ledger, from a wall that holds: its RED is permanent, its GREEN unreachable, so it stops discriminating while still being counted. Freezing the surface spends every other lane's night to buy one landing, and `dag/std` is high-traffic for the same reason it is in every closure — one fact, both halves. Waiting lowers the arrival rate until a dispatch gets lucky, which is the treadmill run slower. Waiving the axis would admit the artifact by disabling the property it exists to establish. Trigger names the capability: a subject ranging over what the routed entries SEMANTICALLY DEPEND ON, not the bytes of every file in their closure. Not satisfied by a faster dispatch, a quieter window, or a wider waiver — each leaves the denominator unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GvVoivi7L449wbh6rjeJY4 --- dag/gunbc/recurring_failure_mode.dag | 3 +++ docs/design-failure-modes.md | 2 ++ 2 files changed, 5 insertions(+) diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index 9ed0f68e8a4..fc466cf5d94 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -288,7 +288,10 @@ data binding_chosen_by_pool_membership_rather_than_by_the_declared_rule: Recurri data join_judged_against_its_sibling_rather_than_its_declared_context: RecurringFailureMode = RecurringFailureMode { identity: "join_judged_against_its_sibling_rather_than_its_declared_context" as NonEmptyStr, authored: "**join judged against its sibling rather than against its declared context** (INVALID STATE: v1.compiler.infer's if-expression join infers both branches independently, then tests them against EACH OTHER with node_type_compatible; the enclosing declared return type is never consulted. There is synthesis plus a sibling compatibility test and NO CHECKING MODE. HARM: a well-typed coproduct construction -- one variant of the declared return per arm -- is REFUSED, which is a false positive at the ordinary compiler floor, and DESIGN section 4b makes a floor failure a below-baseline regression rather than something a higher-order capability offsets. DISTINGUISHING FACT, and it is what makes the defect narrow and cheap: prefer_specific_type ALREADY COMPUTES THE CORRECT JOIN for the refused pair. For Coproduct(ClaimCostReading) against Product(RightCensoredCost) it returns the left, the declared return, because every re-selection arm falls through -- not same_kind, both fully resolved, the left not a bare leaf. So the diagnostic fires BESIDE a unification the compiler just computed right, corroborated by the refusing runs carrying that as their only blocking error: no downstream mismatch at the declared return and none at the call site, either of which a wrong unification would have produced. The check is refusing a pair it can already join. RUNG FOUND AT: mitigatable -- the refusal is loud, typed and located, and nothing silent is produced; what is wrong is the verdict, not its containment. CEILING, WITH ITS REASON: structurally guaranteed. Whether a branch inhabits a DECLARED type is decidable wherever both the declaration and the branch resolve, so the join can be a checking judgement against the declared context with synthesis reserved for the undeclared case; it cannot reach structural impossibility, because an if-expression whose arms disagree under no declared context is authorable by construction and must still be refused rather than made unwritable. NEXT-RUNG TRIGGER, named as the capability: a checking-mode judgement for branch joins -- each arm judged against the expected type when one is in scope, with the sibling comparison retained only as the synthesis fallback where no expectation exists -- sufficient to accept every arm that inhabits the declared return and to refuse every arm that does not. NOT A CLAUSE OF ITS ROOT AND DELIBERATELY FILED SEPARATELY: the specimen that exposed this join was mis-resolved upstream by binding_chosen_by_pool_membership_rather_than_by_the_declared_rule, and a repair here that silenced the diagnostic would entrench that fault by deleting the evidence carrying it. Resolution is repaired first; this join is its own lane.)", evidence: [] } +data receipt_subject_surface_outlives_its_own_production_time: RecurringFailureMode = RecurringFailureMode { identity: "receipt_subject_surface_outlives_its_own_production_time" as NonEmptyStr, authored: "**a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, five files under `dag/std` moved -- landed by five unrelated pull requests -- and `dag/std` is inside essentially every closure. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.)", evidence: [] } + data recurring_failure_mode_roster: List = [ + receipt_subject_surface_outlives_its_own_production_time, censored_estimator_drops_its_own_tail, selection_view_read_as_population, unlanded_citation_indistinguishable_at_the_citing_end, diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 7fcc1a1e53d..3dd8623c77b 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -4,6 +4,7 @@ Generated from `gunbc.recurring_failure_mode`. Do not hand-edit — the generate The exact `RecurringFailureMode.identity` population, which no other projection renders: the row bodies below carry `authored` prose, and an identity appearing inside one is a coincidence of wording rather than a projection of the field. This index lives in the PREAMBLE, above the horizontal rule, so it reintroduces no path shared with the rung-drop document and leaves the authored body below byte-identical to its pre-split form. +- `receipt_subject_surface_outlives_its_own_production_time` - `censored_estimator_drops_its_own_tail` - `selection_view_read_as_population` - `unlanded_citation_indistinguishable_at_the_citing_end` @@ -97,6 +98,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. +- **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, five files under `dag/std` moved -- landed by five unrelated pull requests -- and `dag/std` is inside essentially every closure. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) - **censored estimator drops its own tail** (an estimate of a variable is computed over the observations that SURVIVED a threshold on that same variable, so the sample structurally excludes its own extreme and the estimate is biased low with no bound. It is the neighbour of `instrument_output_read_as_subject_content` moved one step earlier: there a REPORT is complete for the reporter and read as complete for the consumer; here the truncation is in the ESTIMATOR'S OWN DOMAIN, and no amount of reading the instrument's output correctly recovers what the filter removed. SPECIMEN, both directions, 2026-09-01: the required floor's per-run cost inflation was estimated by pairing every claim that reported a cost in BOTH attempts of one tree -- median 1.053, p90 1.107. A claim that exceeds the cpu ceiling goes INTERRUPTED-BEFORE-VERDICT AND REPORTS NO COST, so the pairing dropped exactly the two most inflated observations; recovered from the ceiling itself, their inflation was at least 500/418 = 1.196, censored from above. THE SECOND HALF IS WHY THE ROW EXISTS: a peer lane, correcting a DIFFERENT defect in the same measurement, took the biased p90 by relay and derived an at-risk population of ONE -- an understatement arriving with the credibility of a retraction, which is the artifact nobody re-audits. Both counts were lower bounds and neither was labelled as one. RECOGNITION RULE: whenever an estimate is computed over rows that COMPLETED, RETURNED, PASSED, or were OBSERVED, ask what the incomplete rows would have contributed -- and if the incompleteness is caused by the very variable being estimated, the statistic is a floor and must be reported as one. The tell is a filter and an estimand naming the same quantity: cost estimated over rows that finished, latency over requests that did not time out, size over responses that were not truncated. REMEDY: report the censored bound rather than the sample statistic, and recover the excluded observations from the THRESHOLD they crossed, which is a real datum -- a row killed at 500ms is not missing, it is known to be above 500.) - **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**) - **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) From e1c6d38a687fbd6b543d2b41e1fb7b10a4a46b6d Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Thu, 3 Sep 2026 19:56:14 +0000 Subject: [PATCH 2/9] Three files in the measured closure, not five in a directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correction, not a strengthening: the row asserted five `dag/std` files moved under the receipt, from a file-level diff. Enumerating the actual closure by execution (18 entries, 194 unique files, intersected against everything changed since the dispatch tree) gives THREE — `dag/std/measure.dag`, `dag/std/pareto.dag`, `src/v2/std/nat.dag`. Three of the changed `dag/std` files are in no closure at all, and one of the three that matter is not under `dag/std`. The overstatement is now part of the row's content, because it is the same mistake in miniature: a closure is measured, not inferred from a directory name. And three arrivals in one afternoon were already enough, which makes the finding worse rather than smaller. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GvVoivi7L449wbh6rjeJY4 --- dag/gunbc/recurring_failure_mode.dag | 2 +- docs/design-failure-modes.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index fc466cf5d94..22239ed0199 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -288,7 +288,7 @@ data binding_chosen_by_pool_membership_rather_than_by_the_declared_rule: Recurri data join_judged_against_its_sibling_rather_than_its_declared_context: RecurringFailureMode = RecurringFailureMode { identity: "join_judged_against_its_sibling_rather_than_its_declared_context" as NonEmptyStr, authored: "**join judged against its sibling rather than against its declared context** (INVALID STATE: v1.compiler.infer's if-expression join infers both branches independently, then tests them against EACH OTHER with node_type_compatible; the enclosing declared return type is never consulted. There is synthesis plus a sibling compatibility test and NO CHECKING MODE. HARM: a well-typed coproduct construction -- one variant of the declared return per arm -- is REFUSED, which is a false positive at the ordinary compiler floor, and DESIGN section 4b makes a floor failure a below-baseline regression rather than something a higher-order capability offsets. DISTINGUISHING FACT, and it is what makes the defect narrow and cheap: prefer_specific_type ALREADY COMPUTES THE CORRECT JOIN for the refused pair. For Coproduct(ClaimCostReading) against Product(RightCensoredCost) it returns the left, the declared return, because every re-selection arm falls through -- not same_kind, both fully resolved, the left not a bare leaf. So the diagnostic fires BESIDE a unification the compiler just computed right, corroborated by the refusing runs carrying that as their only blocking error: no downstream mismatch at the declared return and none at the call site, either of which a wrong unification would have produced. The check is refusing a pair it can already join. RUNG FOUND AT: mitigatable -- the refusal is loud, typed and located, and nothing silent is produced; what is wrong is the verdict, not its containment. CEILING, WITH ITS REASON: structurally guaranteed. Whether a branch inhabits a DECLARED type is decidable wherever both the declaration and the branch resolve, so the join can be a checking judgement against the declared context with synthesis reserved for the undeclared case; it cannot reach structural impossibility, because an if-expression whose arms disagree under no declared context is authorable by construction and must still be refused rather than made unwritable. NEXT-RUNG TRIGGER, named as the capability: a checking-mode judgement for branch joins -- each arm judged against the expected type when one is in scope, with the sibling comparison retained only as the synthesis fallback where no expectation exists -- sufficient to accept every arm that inhabits the declared return and to refuse every arm that does not. NOT A CLAUSE OF ITS ROOT AND DELIBERATELY FILED SEPARATELY: the specimen that exposed this join was mis-resolved upstream by binding_chosen_by_pool_membership_rather_than_by_the_declared_rule, and a repair here that silenced the diagnostic would entrench that fault by deleting the evidence carrying it. Resolution is repaired first; this join is its own lane.)", evidence: [] } -data receipt_subject_surface_outlives_its_own_production_time: RecurringFailureMode = RecurringFailureMode { identity: "receipt_subject_surface_outlives_its_own_production_time" as NonEmptyStr, authored: "**a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, five files under `dag/std` moved -- landed by five unrelated pull requests -- and `dag/std` is inside essentially every closure. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.)", evidence: [] } +data receipt_subject_surface_outlives_its_own_production_time: RecurringFailureMode = RecurringFailureMode { identity: "receipt_subject_surface_outlives_its_own_production_time" as NonEmptyStr, authored: "**a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, THREE files INSIDE that measured closure moved -- `dag/std/measure.dag`, `dag/std/pareto.dag` and `src/v2/std/nat.dag`, landed by three unrelated pull requests, none of them the receipt's own author. The closure was enumerated by execution rather than estimated: eighteen entries printed, 194 unique files, intersected against every file changed since the dispatch tree. THE FILE-LEVEL DIFF FIRST SUGGESTED FIVE AND THAT WAS AN OVERSTATEMENT -- three of the changed `dag/std` files are in NO closure at all -- which is itself the lesson: a closure is measured, not inferred from a directory name, and THREE ARRIVALS IN ONE AFTERNOON WERE ALREADY ENOUGH. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.)", evidence: [] } data recurring_failure_mode_roster: List = [ receipt_subject_surface_outlives_its_own_production_time, diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 3dd8623c77b..def33152de2 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -98,7 +98,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. -- **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, five files under `dag/std` moved -- landed by five unrelated pull requests -- and `dag/std` is inside essentially every closure. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) +- **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, THREE files INSIDE that measured closure moved -- `dag/std/measure.dag`, `dag/std/pareto.dag` and `src/v2/std/nat.dag`, landed by three unrelated pull requests, none of them the receipt's own author. The closure was enumerated by execution rather than estimated: eighteen entries printed, 194 unique files, intersected against every file changed since the dispatch tree. THE FILE-LEVEL DIFF FIRST SUGGESTED FIVE AND THAT WAS AN OVERSTATEMENT -- three of the changed `dag/std` files are in NO closure at all -- which is itself the lesson: a closure is measured, not inferred from a directory name, and THREE ARRIVALS IN ONE AFTERNOON WERE ALREADY ENOUGH. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) - **censored estimator drops its own tail** (an estimate of a variable is computed over the observations that SURVIVED a threshold on that same variable, so the sample structurally excludes its own extreme and the estimate is biased low with no bound. It is the neighbour of `instrument_output_read_as_subject_content` moved one step earlier: there a REPORT is complete for the reporter and read as complete for the consumer; here the truncation is in the ESTIMATOR'S OWN DOMAIN, and no amount of reading the instrument's output correctly recovers what the filter removed. SPECIMEN, both directions, 2026-09-01: the required floor's per-run cost inflation was estimated by pairing every claim that reported a cost in BOTH attempts of one tree -- median 1.053, p90 1.107. A claim that exceeds the cpu ceiling goes INTERRUPTED-BEFORE-VERDICT AND REPORTS NO COST, so the pairing dropped exactly the two most inflated observations; recovered from the ceiling itself, their inflation was at least 500/418 = 1.196, censored from above. THE SECOND HALF IS WHY THE ROW EXISTS: a peer lane, correcting a DIFFERENT defect in the same measurement, took the biased p90 by relay and derived an at-risk population of ONE -- an understatement arriving with the credibility of a retraction, which is the artifact nobody re-audits. Both counts were lower bounds and neither was labelled as one. RECOGNITION RULE: whenever an estimate is computed over rows that COMPLETED, RETURNED, PASSED, or were OBSERVED, ask what the incomplete rows would have contributed -- and if the incompleteness is caused by the very variable being estimated, the statistic is a floor and must be reported as one. The tell is a filter and an estimand naming the same quantity: cost estimated over rows that finished, latency over requests that did not time out, size over responses that were not truncated. REMEDY: report the censored bound rather than the sample statistic, and recover the excluded observations from the THRESHOLD they crossed, which is a real datum -- a row killed at 500ms is not missing, it is known to be above 500.) - **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**) - **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) From 8d16294edfc661e2e2c9796453b581d4388ac878 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Thu, 3 Sep 2026 20:00:49 +0000 Subject: [PATCH 3/9] Take the count out of the row entirely; name the instrument MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Parent ruling, overriding my own five-to-three correction: do not fix the number, remove it. A transcribed measurement in a ledger row is unreachable from the thing that produced it, and this one rotted inside a single evening — before the PR merged. The row's claim needs no count: production time exceeds the edit interval of the surface the digest ranges over. Worse, severity moved OPPOSITE to the count. Fewer arriving files means a smaller surface was already sufficient, so a reader anchored on the number would have read the correction as good news. The row now carries the SHAPE (unrelated PRs, none the receipt's own author, one afternoon sufficient) and NAMES THE INSTRUMENT that re-derives it: `claim_batch --print-entry-closure` over the routed entries, intersected against the diff — with the warning to run a positive control beside it, because an empty intersection and a dead instrument print the same thing. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GvVoivi7L449wbh6rjeJY4 --- dag/gunbc/recurring_failure_mode.dag | 2 +- docs/design-failure-modes.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index 22239ed0199..e21f0afd572 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -288,7 +288,7 @@ data binding_chosen_by_pool_membership_rather_than_by_the_declared_rule: Recurri data join_judged_against_its_sibling_rather_than_its_declared_context: RecurringFailureMode = RecurringFailureMode { identity: "join_judged_against_its_sibling_rather_than_its_declared_context" as NonEmptyStr, authored: "**join judged against its sibling rather than against its declared context** (INVALID STATE: v1.compiler.infer's if-expression join infers both branches independently, then tests them against EACH OTHER with node_type_compatible; the enclosing declared return type is never consulted. There is synthesis plus a sibling compatibility test and NO CHECKING MODE. HARM: a well-typed coproduct construction -- one variant of the declared return per arm -- is REFUSED, which is a false positive at the ordinary compiler floor, and DESIGN section 4b makes a floor failure a below-baseline regression rather than something a higher-order capability offsets. DISTINGUISHING FACT, and it is what makes the defect narrow and cheap: prefer_specific_type ALREADY COMPUTES THE CORRECT JOIN for the refused pair. For Coproduct(ClaimCostReading) against Product(RightCensoredCost) it returns the left, the declared return, because every re-selection arm falls through -- not same_kind, both fully resolved, the left not a bare leaf. So the diagnostic fires BESIDE a unification the compiler just computed right, corroborated by the refusing runs carrying that as their only blocking error: no downstream mismatch at the declared return and none at the call site, either of which a wrong unification would have produced. The check is refusing a pair it can already join. RUNG FOUND AT: mitigatable -- the refusal is loud, typed and located, and nothing silent is produced; what is wrong is the verdict, not its containment. CEILING, WITH ITS REASON: structurally guaranteed. Whether a branch inhabits a DECLARED type is decidable wherever both the declaration and the branch resolve, so the join can be a checking judgement against the declared context with synthesis reserved for the undeclared case; it cannot reach structural impossibility, because an if-expression whose arms disagree under no declared context is authorable by construction and must still be refused rather than made unwritable. NEXT-RUNG TRIGGER, named as the capability: a checking-mode judgement for branch joins -- each arm judged against the expected type when one is in scope, with the sibling comparison retained only as the synthesis fallback where no expectation exists -- sufficient to accept every arm that inhabits the declared return and to refuse every arm that does not. NOT A CLAUSE OF ITS ROOT AND DELIBERATELY FILED SEPARATELY: the specimen that exposed this join was mis-resolved upstream by binding_chosen_by_pool_membership_rather_than_by_the_declared_rule, and a repair here that silenced the diagnostic would entrench that fault by deleting the evidence carrying it. Resolution is repaired first; this join is its own lane.)", evidence: [] } -data receipt_subject_surface_outlives_its_own_production_time: RecurringFailureMode = RecurringFailureMode { identity: "receipt_subject_surface_outlives_its_own_production_time" as NonEmptyStr, authored: "**a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, THREE files INSIDE that measured closure moved -- `dag/std/measure.dag`, `dag/std/pareto.dag` and `src/v2/std/nat.dag`, landed by three unrelated pull requests, none of them the receipt's own author. The closure was enumerated by execution rather than estimated: eighteen entries printed, 194 unique files, intersected against every file changed since the dispatch tree. THE FILE-LEVEL DIFF FIRST SUGGESTED FIVE AND THAT WAS AN OVERSTATEMENT -- three of the changed `dag/std` files are in NO closure at all -- which is itself the lesson: a closure is measured, not inferred from a directory name, and THREE ARRIVALS IN ONE AFTERNOON WERE ALREADY ENOUGH. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.)", evidence: [] } +data receipt_subject_surface_outlives_its_own_production_time: RecurringFailureMode = RecurringFailureMode { identity: "receipt_subject_surface_outlives_its_own_production_time" as NonEmptyStr, authored: "**a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, files INSIDE that closure moved, landed by UNRELATED pull requests, none of them the receipt's own author, and A SINGLE AFTERNOON'S ARRIVALS WERE ALREADY SUFFICIENT. THE COUNT IS DELIBERATELY NOT CARRIED HERE, and its absence is part of the finding: the first attempt to state it was taken from a file-level diff, overstated, and was corrected against the measured closure WITHIN THE SAME EVENING, before this row had even landed -- a transcribed measurement is unreachable from the thing that produced it, so it rots while nobody touches either end. Worse, the severity moved OPPOSITE to the count: fewer arriving files means a SMALLER surface was already enough, so a reader anchored on the number would have read the correction as good news. NAME THE INSTRUMENT INSTEAD, and re-derive rather than quote: enumerate the closure with `v1_compiler.bin.claim_batch` `--print-entry-closure` over the routed entries -- a non-evaluating mode that prints the population the RESOLVER retained, not an import re-walk -- and intersect it against the files changed since the dispatch tree. Run it beside a positive control whose membership is known, because an empty intersection and a dead instrument print the same thing. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.)", evidence: [] } data recurring_failure_mode_roster: List = [ receipt_subject_surface_outlives_its_own_production_time, diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index def33152de2..82237eebbde 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -98,7 +98,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. -- **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, THREE files INSIDE that measured closure moved -- `dag/std/measure.dag`, `dag/std/pareto.dag` and `src/v2/std/nat.dag`, landed by three unrelated pull requests, none of them the receipt's own author. The closure was enumerated by execution rather than estimated: eighteen entries printed, 194 unique files, intersected against every file changed since the dispatch tree. THE FILE-LEVEL DIFF FIRST SUGGESTED FIVE AND THAT WAS AN OVERSTATEMENT -- three of the changed `dag/std` files are in NO closure at all -- which is itself the lesson: a closure is measured, not inferred from a directory name, and THREE ARRIVALS IN ONE AFTERNOON WERE ALREADY ENOUGH. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) +- **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, files INSIDE that closure moved, landed by UNRELATED pull requests, none of them the receipt's own author, and A SINGLE AFTERNOON'S ARRIVALS WERE ALREADY SUFFICIENT. THE COUNT IS DELIBERATELY NOT CARRIED HERE, and its absence is part of the finding: the first attempt to state it was taken from a file-level diff, overstated, and was corrected against the measured closure WITHIN THE SAME EVENING, before this row had even landed -- a transcribed measurement is unreachable from the thing that produced it, so it rots while nobody touches either end. Worse, the severity moved OPPOSITE to the count: fewer arriving files means a SMALLER surface was already enough, so a reader anchored on the number would have read the correction as good news. NAME THE INSTRUMENT INSTEAD, and re-derive rather than quote: enumerate the closure with `v1_compiler.bin.claim_batch` `--print-entry-closure` over the routed entries -- a non-evaluating mode that prints the population the RESOLVER retained, not an import re-walk -- and intersect it against the files changed since the dispatch tree. Run it beside a positive control whose membership is known, because an empty intersection and a dead instrument print the same thing. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) - **censored estimator drops its own tail** (an estimate of a variable is computed over the observations that SURVIVED a threshold on that same variable, so the sample structurally excludes its own extreme and the estimate is biased low with no bound. It is the neighbour of `instrument_output_read_as_subject_content` moved one step earlier: there a REPORT is complete for the reporter and read as complete for the consumer; here the truncation is in the ESTIMATOR'S OWN DOMAIN, and no amount of reading the instrument's output correctly recovers what the filter removed. SPECIMEN, both directions, 2026-09-01: the required floor's per-run cost inflation was estimated by pairing every claim that reported a cost in BOTH attempts of one tree -- median 1.053, p90 1.107. A claim that exceeds the cpu ceiling goes INTERRUPTED-BEFORE-VERDICT AND REPORTS NO COST, so the pairing dropped exactly the two most inflated observations; recovered from the ceiling itself, their inflation was at least 500/418 = 1.196, censored from above. THE SECOND HALF IS WHY THE ROW EXISTS: a peer lane, correcting a DIFFERENT defect in the same measurement, took the biased p90 by relay and derived an at-risk population of ONE -- an understatement arriving with the credibility of a retraction, which is the artifact nobody re-audits. Both counts were lower bounds and neither was labelled as one. RECOGNITION RULE: whenever an estimate is computed over rows that COMPLETED, RETURNED, PASSED, or were OBSERVED, ask what the incomplete rows would have contributed -- and if the incompleteness is caused by the very variable being estimated, the statistic is a floor and must be reported as one. The tell is a filter and an estimand naming the same quantity: cost estimated over rows that finished, latency over requests that did not time out, size over responses that were not truncated. REMEDY: report the censored bound rather than the sample statistic, and recover the excluded observations from the THRESHOLD they crossed, which is a real datum -- a row killed at 500ms is not missing, it is known to be above 500.) - **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**) - **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) From d54c25ad52cb44bbba49fa9f329ae89caff5b95b Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Fri, 4 Sep 2026 03:59:16 +0000 Subject: [PATCH 4/9] chore: regenerate drifted generated artifacts (ci auto-heal) --- docs/design-failure-modes.md | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 881b58ae530..2b552043801 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -88,7 +88,18 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `one_dissolution_event_recorded_twice_or_not_at_all` - `exact_duplicate_match_arm_not_refused` - `premise_that_a_shared_subject_means_disagreement` +- `live_argument_threaded_past_the_arm_that_decides` +- `check_subject_shape_cannot_represent_the_state_the_check_detects` +- `per_argument_exhaustive_matrix_blind_to_a_cross_argument_relation` +- `closure_subject_with_no_enumerable_membership` +- `ceiling_never_exercised_for_a_population_the_census_cannot_plan` +- `content_digest_makes_annotations_semantically_load_bearing` +- `subject_and_its_digest_as_independent_parameters` +- `a_written_row_is_not_a_firing_mechanism` +- `required_evidence_absent_reads_as_evidence_of_pass` +- `right_censored_cost_read_as_exact` - `receipt_subject_surface_outlives_its_own_production_time` +- `trigger_satisfied_before_the_row_was_written` --- @@ -182,10 +193,21 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an admission predicate evidenced from inside its own subject** (a rule admits an action only when some condition holds -- `the refusal is carried entirely by this class`, `nothing else is failing`, `this is the only cause` -- and the evidence for that condition is read off a surface THAT ONLY REPORTS THE CLASS THE PREDICATE IS ABOUT. The surface answers faithfully and narrowly; it has no vocabulary for the thing that would falsify the rule, so IT CANNOT REPRESENT THE PREDICATE BEING FALSE. The test then confirms itself on every evaluation, and its greens carry no information. This is `executed_conjunct_discriminates_nothing` wearing an admission rule's clothes: the conjunct executes, it is honestly computed, and its outcome was decided by its own scoping rather than by the world. **RECOGNITION RULE, USABLE WITHOUT SUSPECTING ANYTHING: ask what SURFACE the predicate's evidence was read off, and whether that surface can represent the predicate being FALSE. If it cannot, the test is decorative.** SPECIMEN, AND IT IS THIS AUTHOR'S OWN RULE. A declared drop admitted a bounded mitigation -- one reroll per head -- on the condition that the run reported `failed=0` with the refusal carried entirely by that row's two cost arms. The evidence was read off the floor's own disposition counters, which enumerate COST dispositions. Those counters do not range over other phases at all, so they were incapable of reporting that anything else had failed. On the run that spent a reroll under this rule, the required job was `phases_run=3 failed=2` the whole time -- refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas -- and the predicate had been FALSE at every moment it was evaluated as true. REPAIR: evidence the predicate from OUTSIDE its own subject -- here, the RUN'S PHASE VERDICT (`phases_run`, `failed`, the `FAILED PHASE` lines) rather than the class's own counters. A predicate scoped to one class must be adjudicated at a grain that can see the other classes. **A SECOND SPECIMEN IN A DIFFERENT DOMAIN, WHICH IS WHAT ESTABLISHES THIS AS A SHAPE RATHER THAN A QUIRK OF COUNTERS.** A reviewer cited a declaration by FILE AND LINE. Asked to check it, they verified the citation AGAINST THEIR OWN CHECKOUT and IT VERIFIED GREEN -- printing that line returned exactly the text they had claimed -- while the declaration sits 1633 lines away on `origin/main`. THE GREEN IS THE POINT AND IT IS WORSE THAN A FAILURE WOULD HAVE BEEN: a check that returns green from inside its subject returns green every time it is run, and nothing about it prompts a second look, whereas a check that returned nothing would have sent the citer looking. **AND THE SURFACE WAS NOT A STALE TREE, WHICH IS WHAT MAKES THIS SPECIMEN LOAD-BEARING RATHER THAN A HYGIENE NOTE.** The citer was on their own FEATURE BRANCH -- clean, current, seven commits of their own ahead, 41 behind main because that is what a feature branch IS -- and cited a line read off it as main's. Read as staleness the finding has an obvious remedy, fetch more often, which lets a reader file it and move on. It has no such remedy. EVERY AUTHOR CITES FROM THE TREE THEY ARE WORKING IN, THAT TREE IS DIVERGENT FROM MAIN BY CONSTRUCTION, AND THE CITATION VERIFIES GREEN THERE EVERY TIME PRECISELY BECAUSE IT IS THE TREE THAT PRODUCED IT. No discipline of fetching closes it; only citing by symbol does. (The citer supplied this correction themselves, having first described their own position as staleness and then checked which branch they were on -- one more instrument that should have been run before describing the surface.) No counter and no admission rule is involved; the structure is identical -- evidence for a claim drawn from inside the claim's own source. It is also why DESIGN section 3 requires citing the SYMBOL: a symbol is checkable against a tree the citer does not control, and a line number is only ever checkable against a tree, so the positional form has no outside-the-subject verification available to it at all. The correction here came from a third party who resolved the same declaration BY SYMBOL. **A FOURTH SPECIMEN, AND IT IS THE ONE THAT CANNOT BE READ AS INATTENTION.** A reviewer asked a merge queue whether a pull request's required checks were passing, by querying for its NON-SUCCESS checks. The query returned an EMPTY LIST and they reported the context green. An empty list is returned by `everything passed` AND by `nothing ran`, and they had not asked for the denominator that separates the two. The truth was the second: the branch was dirty, so no merge ref could be computed, so NO WORKFLOW HAD EVER STARTED -- `check-runs total_count 0`, combined status `pending`, statuses array empty. The surface they read could not represent the state they were trying to rule out, which is this row's recognition rule exactly; `empty_observation_narrow` is the same failure of taking a numerator without its denominator. WHAT MAKES IT THE STRONGEST SPECIMEN IS ITS TIMING: it was committed ROUGHLY FORTY MINUTES AFTER the same author corrected another session's instance of this class, in the same thread, while explicitly writing about how easily a found-set is read as a population. A FIFTH INSTANCE FOLLOWED, INSIDE AN INSTRUCTION TO BE MORE RIGOROUS ABOUT CITATION: a reviewer relayed a peer's measurement as an established, present-tense fact about a tree they had not themselves examined, while directing another author to cite only what is checkable against that tree. Both parties then ran the check independently and it was FALSE. The discipline was in hand and was applied to someone else's sentence rather than to the sentence carrying it. THE SAME AUTHOR THEN DID IT AGAIN THREE HOURS LATER, in a message whose express purpose was to instruct another lane NOT to inherit anyone's numbers: they quoted their own working branch's roster count as main's, having already had that exact substitution filed as a specimen in this row. Both instances were caught only because the instruction they were wrapped in demanded a CHECKABLE form, so the recipient ran the check the instruction asked for and it disagreed with the instruction. **AWARENESS OF THIS CLASS DOES NOT CONFER IMMUNITY TO IT, AND THE EVIDENCE IS THIS ROW'S OWN AUTHORSHIP.** Three sessions committed this shape inside the single thread that produced this row, WHILE ACTIVELY DISCUSSING IT: one reported the return of a grep written from the specimen it was searching for as the census; the second passed that found-set onward as the population without asking what it was a view of; the third corrected the second while reporting their own grep's return as the extent, one level up. Each caught the person below them and none caught themselves. That is not three mistakes but ONE MECHANISM OBSERVED THREE TIMES under conditions as controlled as this repository will ever supply -- the participants informed, attentive, and looking directly at the class. It is stronger evidence than any single specimen, and it is the reason the detection sentence below is stated as a structural fact about WHO can find the defect rather than as an exhortation to be careful. **DETECTION IS THE HALF NOBODY WRITES DOWN, AND IT IS NOT MORE CARE: THE ONLY RELIABLE DETECTOR FOR A SELF-RATIFYING TEST IS AN AUDIT PERFORMED BY SOMEONE WHO ALREADY BELIEVES THE TEST PASSED.** The predicate confirms itself for everyone who relies on it, so no amount of diligence by the relier finds it; it was found here because a lane acted on the rule and then audited its own action, and reported the result against its own interest (neat-swift-219, 2026-09-02, who supplied both the specimen and this detection sentence). AN AGGRAVATING NEIGHBOUR THE SPECIMEN ALSO CARRIES, recorded because it is what made the narrow surface believable: `failed` is FORKED ACROSS THE OUTPUT VOCABULARY of one binary. FOUR EMITTERS AND FOUR SUBJECTS, from a sweep run to closure rather than from the two sites that prompted it, and the count matters because an earlier statement of this paragraph said two: `claim_executor` prints a required-ci line where `failed` counts PHASES and a disposition line where `failed` counts CLAIMS; `cli_run` prints a third with `deferred=` beside it; and `partition_crate_boundary_host` prints `failed=[..]` as a LIST rather than a count, beside a package count. THE THIRD SUBJECT IS THE DANGEROUS ONE AND WAS FOUND LAST: a DISCOVERY-ROW counter that is not a narrower or wider spelling of the claim population but a DIFFERENT one, absorbing NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted -- failure classes the claim counter excludes. Two counters that disagree about their subject are a fork; one that silently UNIONS classes another excludes will read as agreement whenever those classes happen to be empty. One word, one naming surface, no declared version transition -- a `meaning_fork` in the OUTPUT vocabulary, which is the worst place for one, because a reader hits the LINE and never reaches the ledger that would disambiguate it. THE LIST FORM IS THE PROOF RATHER THAN A CURIOSITY: a site printing a list where three others print a count establishes that these were never read as one vocabulary, which is what distinguishes a meaning fork from a rename that was merely never finished. **AND THE STRONGEST EVIDENCE IS NOT THAT THE FORK WENT UNNOTICED -- IT IS THAT IT HAS BEEN HIT AND LOCALLY REPAIRED AT LEAST TWICE, CORRECTLY, BY INDEPENDENT AUTHORS.** One declaration in `cli_run` lifts six fields onto the headline ledger line on the stated reasoning that a fix shipped as yet another separate line would reproduce what it repairs; one in `claim_executor` documents `failed=0` being finishable wrongly, names a session dispatched against a regression that did not exist because of it, and separates the concepts into `unexpected_failures` for answered-wrong and `verdict_incomplete` for never-answered. Each repair was sound at its own surface and each left the WORD forked at every other emitter, because neither author had any reason to look sideways. THAT is the argument for a vocabulary-level fix rather than a third local repair, and it is stronger than the absence of repairs would have been. AN EARLIER DRAFT OF THIS ROW SAID THE OPPOSITE -- that the arithmetic gap was 'already observed and carried only as prose' -- which understated shipped work and was corrected before landing by reading the surrounding declarations rather than the comment alone The fork's REPAIR is owned elsewhere and is deliberately not scoped here; it is entered as this class's evidence, since a forked counter name is precisely what makes an inside-the-subject reading look like an outside-the-subject one.) - **two instruments agree because the classes one of them ABSORBS happen to be empty** (two counters, reports or readers are compared, they return the same NUMBER, and the agreement is taken as evidence that they measure the same thing. They do not. One of them ranges over a WIDER POPULATION -- it additionally absorbs failure classes the other excludes -- and the two coincide exactly while those absorbed classes are EMPTY, which on a healthy system is most of the time. **NEITHER READING IS WRONG, WHICH IS WHAT SEPARATES THIS FROM ITS NEAREST NEIGHBOUR.** `disagreement_census_blind_to_agreed_wrong` is about two readers answering the same WRONG thing, where the defect is in the readings; here BOTH INSTRUMENTS ARE CORRECT ABOUT THEIR OWN SUBJECT and the defect is in the JOIN a reader performs between them. Nothing either instrument reports is false, so no amount of auditing either one finds it. **AND IT IS WORSE THAN DISAGREEMENT, NOT MILDER: disagreement is visible on the FIRST comparison, while this is invisible until the day one of the absorbed classes is non-empty -- so the evidence for the conflation arrives only at the moment it is doing damage.** SPECIMEN, 2026-09-02/03. One word, `failed`, was emitted by four sites of one binary carrying four subjects: lane PHASES, required-floor CLAIMS, a package LIST, and DISCOVERY ROWS. The discovery counter is not a narrower or wider spelling of the claim population -- it is a DIFFERENT population that additionally absorbs `NotBool`, `RuntimeError`, `HostToolUnresolved`, timeout, panic and `NotAttempted`. THOSE ARE PRECISELY THE CLASSES THAT ARE EMPTY ON A GOOD DAY, so the two counters agree on every ordinary run and diverge exactly when something has gone wrong in a way nobody is watching for. THE PROVENANCE IS THE ARGUMENT FOR A WALL RATHER THAN FOR MORE CARE: this fork was HIT AND CORRECTLY REPAIRED TWICE, by two independent authors, each at their own surface -- one lifting six fields onto a headline ledger line, one separating answered-wrong from never-answered after a session was dispatched against a regression that did not exist -- and each repair left the word forked everywhere else, because neither author had any signal to look sideways. Diligence did not catch it and could not have; the repair is a vocabulary-level split at the producer, which a separate lane owns. **RECOGNITION RULE, AND IT IS CHEAP: when two instruments AGREE, ask whether their subjects are the same POPULATION or merely the same NUMBER, and check the agreement on a run where the absorbed classes are NON-EMPTY. An agreement observed only over empty absorbed classes establishes nothing.** The corollary for authors is the same fact stated forward: a counter's name is not its subject, and two counters sharing a name is evidence about the naming surface rather than about what was counted.) - **a rendered window reports its contents as the change's subject** (an instrument that renders a WINDOW AROUND a change -- a diff hunk, a context excerpt, a snippet, a log tail -- is read for WHICH SUBJECT CHANGED, and whenever the subject is WIDER THAN THE WINDOW the reader meets neighbours first and takes an identity from one of them. INVALID STATE: a change identity taken from material the renderer placed near the change rather than derived from the change itself. HARM: DESIGN section 5 silent wrongness in its most confident form -- the reader gets a SPECIFIC, PLAUSIBLE, WRONG subject, and nothing in the rendering marks the difference between a row that was shown and a row that was changed. DISCOVERED AND ANALYSED BY cool-koi-623; the mechanism was reproduced by tidy-swift-334 before routing and the diff figures below were re-executed by this author against the pull request rather than relayed. SPECIMEN, gunbc#10191 against `dag/gunbc/rung_drop.dag`. THE INSTRUMENT IS NAMED AND ITS OUTPUT IS NOT TRANSCRIBED, which this row owes twice over: a diff of that pull request against main names, in its hunk header and its context, the rows `direct_call_arg_seam_v2_exemption`, `floor_cost_claim_qualification_unavailable`, `spark_role_scoped_retirement_production_root` and `floor_cut_effect_gates`, ALL OF WHICH ARE UNTOUCHED, while filtering the same diff to lines beginning `+data` or `-data` yields the single changed row, `floor_cut_heal`. That filter IS the instrument -- one predicate over the diff, re-derivable by anyone against that pull request -- and it is the whole repair as well as the whole evidence. The row identities above are SYMBOLS and not measurements, which is why they are carried; the hunk's line numbers and the changed row's character width are neither carried nor needed, since DESIGN section 3 forbids citing a position where a symbol exists to name and section 6 forbids copying a counter where its producer can be named. What matters structurally is that the carrier's rows are single lines far wider than a screen, so the changed row's own text is off the right-hand edge while its untouched neighbours are the first thing read. THE READING FAILURE IS NOT CARELESSNESS AND THAT IS THE POINT: the hunk header answers a genuine question -- which declaration encloses line 102 -- and answers it correctly. It is simply a different question from the one the reader is asking, and the diff figures above establish that WITHOUT REFERENCE TO ANY READER. **AN INCIDENT WAS CUT FROM THIS ROW AND THE REASON IS ITSELF THE LESSON.** The class was found because approving reviews on that pull request described the change wrongly, and the natural sentence to write here is that the trap FIRES ON REAL READERS. Neither the discoverer nor this author can produce that evidence: the review texts arrived through a dashboard PUSH NOTIFICATION WITH NO CORRESPONDING PULL -- the summary exposes verdicts, the artifact paths in it do not resolve from a session, and both parties confirmed that rather than assuming it. A quotation from the discoverer would be THE SAME SOURCE and not corroboration, converting an unverifiable claim into an unverifiable claim with a witness. So the incident is out and the executed diff is what the row rests on. The discoverer named the shape correctly on themselves: a conclusion almost certainly right, backed by a channel nothing in the repository can query, which is the external-mechanism class landing in gunbc#10191 applied to its own author. A row about taking an identity from the wrong surface may not carry one taken from an unreadable one. RECOGNITION RULE, mechanical and cheap: when a carrier's rows are SINGLE-LINE and wider than a screen, never take a row identity from a hunk header or a context line. Filter to lines that actually begin `+data` or `-data`, or diff the row content directly. The review-side tell is any statement of the form THIS CHANGE TOUCHES ROW X where X can be found in the diff's unchanged material. CROSS-REFERENCE, NOT A MERGER, and the shared sentence is worth carrying: `instrument_output_read_as_subject_content` -- specifically its resolution-axis form and the P/Q/C formulation folded into it -- and this row both say AN INSTRUMENT AND ITS SUBJECT COINCIDE ONLY INSIDE A WINDOW. There the window is a CONDITION that holds for a while and lapses, and the instrument resolves to an adjacent subject; here it is SPATIAL, a rendering extent narrower than the subject, and the instrument resolves to the subject asked for and renders its NEIGHBOURS beside it. They stay separate on the repair-crossing test that row states as its own boundary method: filtering a diff to lines beginning `+data` or `-data` repairs THIS row completely and does nothing for a reading whose instrument resolved to the wrong version or the wrong name, while establishing that the instrument resolved to the subject you meant repairs THAT row and leaves this one untouched, because here it resolved correctly and the identity was taken from material rendered alongside the answer. DESIGN section 4b keys rows on the REPAIR, and these two repairs do not transfer in either direction. RUNG FOUND AT: below the ladder, silent wrongness -- the wrong subject was adjudicated and nothing anywhere refused. CEILING: 3, structurally guaranteed. THE ARGUMENT IS cool-koi-623'S AND IS PRESERVED AS THEY MADE IT, because it is what makes the trigger BUILDABLE RATHER THAN ASPIRATIONAL. The changed row's identity is derivable from the diff mechanically and cheaply -- one filter over lines beginning `+data` or `-data`, demonstrated above in a single command. So a consumer that reports THIS CHANGE ALTERS ROWS X AND Y by identity is a real wall and not a caution, and a reader consuming it cannot construct a subject the diff does not contain. A roster whose every row is aspirational stops being read, so a class that is cheap to close should say so plainly. NEXT-RUNG TRIGGER, named as the capability: a change-identity producer over row-structured carriers that derives the altered row identities from the diff and serves them to review, sufficient that no reviewer of such a carrier reads a subject off rendered context. WHAT IS NOT CLAIMED: that the renderer is defective. `git diff` is correct and its hunk header answers its own question faithfully; the defect is entirely in the JOIN, where a reader picks the identity nearest the change instead of the one that changed -- which is the same joining error `liveness_probe_read_as_currency` makes with observations, and this row is its rendering-side sibling.) -- **a stale-base branch reads as ordinary pending work, in CONTENT form with no ref-level tell** (a branch whose substantive content has ALREADY LANDED through another PR presents, after main moves on, as a perfectly ordinary feature branch: its merge-base predates the landing, so its three-dot diff against main shows only insertions and no deletions, and every sentence a reviewer would write about it -- adds the note, properly scoped, no code touched -- is ACCURATE RELATIVE TO THAT BASE and wrong relative to main. Merging it re-injects an older, smaller version of content main has since extended. **THE KNOWN FORM OF THIS HAZARD IS THE REF FORM AND IT IS NARROWER THAN THE CLASS.** The ref form announces itself: a surviving branch on a squash-merged PR, a same-sha duplicate, an auto-opened PR with a template body -- something structural to notice, and the three prior instances were all found that way. THIS instance had no duplicate ref, no auto-open and no surviving-branch signal. The only tell was that the branch's copy of the one file it touched was SHORTER THAN MAIN'S, and NOTHING IN A +73/-0 DIFF SAYS SO -- a diff renders what the branch adds to its base, never what its base is missing. SPECIMEN, 2026-09-03, gunbc#10234: main 544 lines / branch 340 lines on `src/v2/workflow/floor_pure_producer_share.dag`, merge-base 00bb2f473a, three-dot +73/-0, two-dot +225/-21. Its content had landed as gunbc#10158 and been extended by gunbc#10141. **THE HARM IS THAT THE LINE STOPS WITH THE WRONG PRESCRIPTION.** A merge conflict DID fire, so nothing merged silently and the class sits at mitigatable rather than below the floor -- but the notice instructed `rebase on main, resolve the conflicts, and push`, and following it would have produced a revert wearing a resolution's clothes. There was no content decision available to make: one side was simply stale, so a reviewer weighing the two sides was choosing between a current note and a historical copy of it while believing they were reconciling two intentions. A loud stop whose prescribed repair is the harmful arm is worse than a quiet one, because the diligence of following instructions is what causes the loss. **THE DECIDABLE CHECK, WHICH IS WHY THE CEILING IS NOT THE CURRENT RUNG:** the comparison that exposes it is mechanical and needs no judgment -- for each file a PR changes, compare the BRANCH'S version against MAIN'S rather than reading the diff, and treat main-longer-and-containing-the-branch's-additions as supersession rather than conflict. Equivalently: a merge-base that predates a merge which touched the same file is a supersession candidate, and that is computable from the ref graph alone. What is NOT decidable in general is content subsumption, so the honest gate refuses for ANALYSIS rather than auto-closing. **RUNG FOUND AT: MITIGATABLE.** The conflict contains the harm by stopping the merge; nothing computes the distinction, and the diagnostic actively misdirects. **CEILING: MECHANICALLY PREVENTABLE**, because the merge-base-versus-file-touching-merge comparison is derivable from refs and can refuse before a human is asked to resolve. Not higher: a stale branch is representable by construction -- forbidding one would mean forbidding branches from being behind, which this repository deliberately allows, since PRs here merge behind main routinely. **NEXT TRIGGER, naming the capability and not an artifact:** a producer that, for each file a pull request changes, joins the branch version against main's and against the merge-base, and emits a typed supersession verdict distinct from a content conflict -- SUFFICIENT FOR routing the two to different prescriptions, since the whole harm is that one prescription is issued for both. A checklist item asking reviewers to compare line counts would be satisfied while the capability stayed dead. **BOUNDARY against `merge_region_excludes_shared_tail`:** that class is about a conflict region resolved WRONGLY on a live carrier where both sides are current; this one is about a conflict that should never have been presented as a conflict at all. Their repairs are disjoint -- one fixes how a region is resolved, the other decides whether the region is a decision. **THE CLASS PRODUCED A CONFIRMING INSTANCE WITHIN THE HOUR, AND THE INSTANCE IS AN APPROVAL.** This row asserts that every sentence a reviewer writes about a stale-base branch is accurate relative to that base. A scheduled review of the specimen PR approved it -- `APPROVE -- annotation-only change on an existing carrier, no substrate impact`, and separately that `the revision addresses a prior codex REQUEST_CHANGES by correcting the re-derivation claim`. Both statements are true of the branch, which was 204 lines behind main, and both are unhelpful about main, where the same paragraph still carried the unrepaired sentence. So the reviewer was not careless and did not need to be: the artifact it was handed contains no representation of what main has since become, which is the whole class. That is the recorded reason this row's trigger names a PRODUCER and not reviewer diligence -- diligence is precisely what was exercised here, and it produced an approval of superseded content. **A SECOND SUB-CLAIM WAS WRITTEN HERE AND WITHDRAWN, RECORDED BECAUSE THE WITHDRAWAL IS THIS ROW'S OWN SUBJECT.** An earlier revision said the review landed twenty minutes AFTER the PR was closed, and concluded that the review scheduler does not read closure. THE ORDER IS THE REVERSE: the review completed 2026-09-03T15:39:02Z and the closure followed at 15:41:20Z, about two minutes later. Nothing in this specimen shows a scheduler reviewing a closed pull request, so the closure-semantics claim had no receipt and is withdrawn -- it may well be true of the scheduler and would need a review whose completion genuinely follows a closure. It is left in the row rather than deleted because a ledger row asserting a behaviour its own cited receipt does not show is the fabricated-citation class appearing INSIDE the row that files its neighbour, and the scoping repair is the same one that spared a true citation six lines above the note this specimen came from: repair the false claim, do not delete the true one beside it.) +- **a stale-base branch reads as ordinary pending work, in CONTENT form with no ref-level tell** (a branch whose substantive content has ALREADY LANDED through another PR presents, after main moves on, as a perfectly ordinary feature branch: its merge-base predates the landing, so its three-dot diff against main shows only insertions and no deletions, and every sentence a reviewer would write about it -- adds the note, properly scoped, no code touched -- is ACCURATE RELATIVE TO THAT BASE and wrong relative to main. Merging it re-injects an older, smaller version of content main has since extended. **THE KNOWN FORM OF THIS HAZARD IS THE REF FORM AND IT IS NARROWER THAN THE CLASS.** The ref form announces itself: a surviving branch on a squash-merged PR, a same-sha duplicate, an auto-opened PR with a template body -- something structural to notice, and the three prior instances were all found that way. THIS instance had no duplicate ref, no auto-open and no surviving-branch signal. The only tell was that the branch's copy of the one file it touched was SHORTER THAN MAIN'S, and NOTHING IN A +73/-0 DIFF SAYS SO -- a diff renders what the branch adds to its base, never what its base is missing. SPECIMEN, 2026-09-03, gunbc#10234: main 544 lines / branch 340 lines on `src/v2/workflow/floor_pure_producer_share.dag`, merge-base 00bb2f473a, three-dot +73/-0, two-dot +225/-21. Its content had landed as gunbc#10158 and been extended by gunbc#10141. **THE HARM IS THAT THE LINE STOPS WITH THE WRONG PRESCRIPTION.** A merge conflict DID fire, so nothing merged silently and the class sits at mitigatable rather than below the floor -- but the notice instructed `rebase on main, resolve the conflicts, and push`, and following it would have produced a revert wearing a resolution's clothes. There was no content decision available to make: one side was simply stale, so a reviewer weighing the two sides was choosing between a current note and a historical copy of it while believing they were reconciling two intentions. A loud stop whose prescribed repair is the harmful arm is worse than a quiet one, because the diligence of following instructions is what causes the loss. **THE DECIDABLE CHECK, WHICH IS WHY THE CEILING IS NOT THE CURRENT RUNG:** the comparison that exposes it is mechanical and needs no judgment -- for each file a PR changes, compare the BRANCH'S version against MAIN'S rather than reading the diff, and treat main-longer-and-containing-the-branch's-additions as supersession rather than conflict. Equivalently: a merge-base that predates a merge which touched the same file is a supersession candidate, and that is computable from the ref graph alone. What is NOT decidable in general is content subsumption, so the honest gate refuses for ANALYSIS rather than auto-closing. **RUNG FOUND AT: MITIGATABLE.** The conflict contains the harm by stopping the merge; nothing computes the distinction, and the diagnostic actively misdirects. **CEILING: MECHANICALLY PREVENTABLE**, because the merge-base-versus-file-touching-merge comparison is derivable from refs and can refuse before a human is asked to resolve. Not higher: a stale branch is representable by construction -- forbidding one would mean forbidding branches from being behind, which this repository deliberately allows, since PRs here merge behind main routinely. **NEXT TRIGGER, naming the capability and not an artifact:** a producer that, for each file a pull request changes, joins the branch version against main's and against the merge-base, and emits a typed supersession verdict distinct from a content conflict -- SUFFICIENT FOR routing the two to different prescriptions, since the whole harm is that one prescription is issued for both. A checklist item asking reviewers to compare line counts would be satisfied while the capability stayed dead. **BOUNDARY against `merge_region_excludes_shared_tail`:** that class is about a conflict region resolved WRONGLY on a live carrier where both sides are current; this one is about a conflict that should never have been presented as a conflict at all. Their repairs are disjoint -- one fixes how a region is resolved, the other decides whether the region is a decision. **THE CLASS PRODUCED A CONFIRMING INSTANCE WITHIN THE HOUR, AND THE INSTANCE IS AN APPROVAL.** This row asserts that every sentence a reviewer writes about a stale-base branch is accurate relative to that base. A scheduled review of the specimen PR approved it -- `APPROVE -- annotation-only change on an existing carrier, no substrate impact`, and separately that `the revision addresses a prior codex REQUEST_CHANGES by correcting the re-derivation claim`. Both statements are true of the branch, which was 204 lines behind main, and both are unhelpful about main, where the same paragraph still carried the unrepaired sentence. So the reviewer was not careless and did not need to be: the artifact it was handed contains no representation of what main has since become, which is the whole class. That is the recorded reason this row's trigger names a PRODUCER and not reviewer diligence -- diligence is precisely what was exercised here, and it produced an approval of superseded content. **A SECOND SUB-CLAIM WAS WRITTEN HERE AND WITHDRAWN, RECORDED BECAUSE THE WITHDRAWAL IS THIS ROW'S OWN SUBJECT.** An earlier revision said the review landed twenty minutes AFTER the PR was closed, and concluded that the review scheduler does not read closure. THE ORDER IS THE REVERSE: the review completed 2026-09-03T15:39:02Z and the closure followed at 15:41:20Z, about two minutes later. Nothing in this specimen shows a scheduler reviewing a closed pull request, so the closure-semantics claim had no receipt and is withdrawn -- it may well be true of the scheduler and would need a review whose completion genuinely follows a closure. It is left in the row rather than deleted because a ledger row asserting a behaviour its own cited receipt does not show is the fabricated-citation class appearing INSIDE the row that files its neighbour, and the scoping repair is the same one that spared a true citation six lines above the note this specimen came from: repair the false claim, do not delete the true one beside it.)**THE ANALYST FORM, BESIDE THE READER FORM ABOVE (amended 2026-09-03, tidy-koi-619 and warm-seal-35, three git specimens inside one evening; a fourth was carried and removed, see below).** Everything above describes the ARTIFACT misleading someone who reads it. This form is the person who MEASURES CORRECTLY AND LABELS THE MEASUREMENT WRONG. THE INVALID STATE, SCOPED TO WHAT THIS ROW'S TRIGGER CAN RETIRE: a DIFF DIRECTION labelled as the question it does not answer, when analysing whether a branch's content has already landed. THE GENERAL FORM IS REAL AND IS NOT A LADDER CLASS AT ALL, which is a stronger statement than 'not claimed here' and is made deliberately so that nobody later closes an implied gap with a decoration. Any label authored separately from the measurement it names is a genuine authoring hazard, but ask section 4b's question before filing it: IS THE RED AUTHORABLE? For the general form, no. The labels in the specimens below were echo strings and heredoc headings in SHELL COMMANDS TYPED BY AN AGENT -- not in the corpus, not in any Accepted program, not reachable by any lens over the Node tree. No fixture can express 'an author wrote a heading that misdescribes the command beneath it', because the subject is not a program, it is an author. That places it in section 4b's adjacent column -- OUTSIDE THE MODELED GUARANTEE, which is deliberately not a fifth rung -- and a row whose trigger names a capability that can have no discriminating RED is a decoration that will later be cited as coverage. The DECIDABLE SLICES are already owned and that is the honest state: this row owns diff-direction labelling under a producer that can actually retire it, and per-instrument fixes like `grep -H` or printing the ref expression are invocation-site discipline rather than ladder classes. WHAT WOULD CHANGE THIS: a fixture harness able to express a mislabelled measurement AS SOURCE. Nobody has constructed one; that is the trigger if it exists. This row's own trigger names a producer scoped to 'each file a pull request changes', so it can never retire an instance with no pull request in it, and a row carrying a loss its trigger cannot reach is the grain mismatch DESIGN section 4b(3) names as a review tell. That boundary was established by review 59526 on gunbc#10286, against an earlier revision of this amendment which asserted the general form here. It is worse than the reader form rather than milder: the reader form yields a MISSED fact, this yields a SPECIFIC FALSE CLAIM, and a specific false claim gets acted on. THE GIT INSTANCE: diff(merge-base, head) is WHAT THE PULL REQUEST DOES and is the only direction that describes a merge; diff(head, main) and two-dot main..branch are WHAT THE BRANCH LACKS. Both readings are true; only the label is wrong. SPECIMEN ONE (gunbc#10242 and gunbc#10276): reported that merging two survivor branches would DELETE eight and then four named files, including a witness test that had landed twenty minutes earlier, and posted it on a closed pull request AS A CORRECTION. Measured, the branches' own diffs are 3A/26M/2R/0D and 2M/0D -- zero deletions, and the named test is in neither diff. The 'deletion set' was main's FORWARD MOVEMENT read out of the wrong direction. THE TELL PRESENT AND MISSED: across four branches of one session the counts were 22, 14, 7 and 4, MONOTONE IN BRANCH AGE. A deletion set does not correlate with staleness; a forward-movement set does so by definition. SPECIMEN TWO (gunbc#10265, the MIRROR DIRECTION): the rule held correctly, a MERGE-BASE hunk quoted, labelled an answer about MAIN. A THIRD SPECIMEN WAS CARRIED HERE AND HAS BEEN REMOVED, and recording the removal is worth more than the specimen was: two greps in ONE shell command over two job logs, output read as belonging to the first. It was included BECAUSE it has no branch in it, on the reasoning that this forecloses the objection that the class is about git. That reasoning was exactly backwards. No branch in it is why it CANNOT belong here: a producer joining branch, main and merge-base cannot make a hand-authored log label unwritable, so the specimen sat under a trigger that could never retire it. It does not get to live under this one, and -- see the invalid-state receipt above -- it does not get its own row either, because its RED is not authorable anywhere a fixture can reach. SPECIMEN FOUR (gunbc#10284, the sharpest): `git diff origin/main..$BR --stat` run under an echo string reading 'what the branch would ADD to main', returning 36 files, 743 insertions and 4,680 DELETIONS -- which read for about ten seconds as a mass revert about to be proposed. Two-dot main..branch shows what the branch LACKS; three-dot shows four deletions. THE LABEL WAS WRITTEN BEFORE THE COMMAND RAN, so the output could only confirm it. A PRE-WRITTEN LABEL IS NOT A LABEL, IT IS A HYPOTHESIS WEARING ONE. THE REPAIR FOR THE SPECIMENS THIS ROW KEEPS is the trigger already named: the supersession producer's output leaves the analyst nothing to compose or label by hand, which is where all three git specimens failed. The wider repair -- make every producer emit its own identity, so the diff prints the ref expression it evaluated -- would also cover them, but it is a DIFFERENT capability and naming it here would grow this row's trigger past what retires it. WHAT DECIDES THIS BELONGS HERE RATHER THAN IN A ROW OF ITS OWN, and it is also the strongest support for this row's existing trigger: THE FIRST TWO SPECIMENS OCCURRED WHILE ANALYSING AN INSTANCE OF THIS VERY CLASS. Both branches were stale-base survivors whose content had already landed. Neither analyst stumbled into a neighbouring failure; each failed AT the class while examining it, having stated the distinction correctly to the other in writing beforehand. The row already argues the trigger must name a PRODUCER rather than reviewer diligence, citing an approval of superseded content; this is stronger, because the approval shows someone MISLED BY THE ARTIFACT while these show two analysts who KNEW THE RULE, HAD JUST WRITTEN IT DOWN, AND STILL MISLABELLED A DIRECTION WITHIN HOURS. If holding the rule is not sufficient, diligence is definitively not the repair. THE TRIGGER IS NOT EXTENDED AND MUST NOT BE: the producer already named -- joining branch against main AND against the merge-base and emitting a typed supersession verdict -- covers this form, because its output leaves nothing to COMPOSE OR LABEL BY HAND, and that is where all three kept specimens failed. A trigger that grows to name a second capability is how a row stops being retirable. THE FALLBACK WHEN YOU CANNOT TELL WHICH WAY YOU MEASURED, recorded because it is what held while every directional claim beside it was retracted: ZERO BRANCH-ONLY FILES, plus the branch's content verified PRESENT ON MAIN BY CONTENT rather than by ancestry, since a squash destroys ancestry. It needs no direction to be correct and was sufficient to close both pull requests on its own. A NEIGHBOUR CITED RATHER THAN RESTATED, because restating a neighbour's fact here is the failure this ledger exists to prevent: the empty-result half is `empty_capture_read_as_clean_result`, and citing it is load-bearing because BOTH AUTHORS OF THIS AMENDMENT INDEPENDENTLY REPORTED AS A FRESH METHOD NOTE A SPECIMEN THAT ROW ALREADY NAMES -- `gh api` job logs writing ZERO BYTES without --allow-escape-sequences, refusing on stderr. One of us was one message from filing a second authority for it. TWO OF THIS AMENDMENT'S OWN NEAR-MISSES BELONG TO THAT NEIGHBOUR AND NOT HERE, and measuring them split them: `git show` against an unfetched sha exits 128 and prints 108 bytes of `fatal:` while writing an empty file, later read as zero declarations in an 83-row module; and the `gh api` sweep exited 1 under a `2>/dev/null | grep -c ... || true` that deleted the exit code and the message in the same command that produced the wrong answer. For both, that row's remedy works as written -- consult the typed status. A THIRD HAS NO TYPED STATUS TO CONSULT, and it is recorded WITH ITS CONTROL because without the control it is a curiosity and with it a defect. Both arms as a pair: `gh run list --commit` on a ref that does not exist, and on a REAL commit that genuinely has no runs, both return rc=0, three bytes of stdout `[]` and zero bytes of stderr -- BYTE-IDENTICAL ON EVERY CHANNEL THE CALLER CAN READ, exit code included. TWO DISTINCT STATES COLLAPSED INTO ONE VALUE. The remedy is named rather than left as a gap: not read the status, but ESTABLISH THAT THE SUBJECT EXISTS BEFORE CONSUMING AN OBSERVATION ABOUT IT -- a `git cat-file -e` existence probe separates the two arms where no channel of the instrument can. An empty observation set is readable only once the subject is known to be in the domain, which is 'a zero is only readable beside a nonzero' moved from the COUNT to the SUBJECT. The repair belongs to that neighbour and is pointed at rather than performed here. ONE RECOGNITION RULE BELONGING TO THAT SAME NEIGHBOUR, placed here only because this amendment was the edit in flight on this carrier and two lanes appending to one roster is how the duplicate-declaration defect of 2026-09-03 was created: `2>/dev/null` and `|| true` INSIDE A MEASUREMENT are a mechanical, greppable tell. Both are legitimate in a probe whose failure is expected and uninteresting; in an instrument they delete exactly the evidence that the instrument did not run. - **binding chosen by pool membership rather than by the declared resolution rule** (THE ROOT IN ONE SENTENCE, AND IT IS AN ASYMMETRY: A COPRODUCT ARM IS POOL-VISIBLE CORPUS-WIDE WHILE NOT BEING A LOCAL BINDING UNDER ITS OWN SPELLING. An off-chain module that imports nothing may reference another module's arm name and receive only an ADVISORY -- unlisted import use -- never a refusal; and INSIDE the declaring module not even that advisory fires, because there the spelling is in source_visible_names. That is why the specimen was silent. INVALID STATE: two modules declare one spelling -- one as a top-level type, one as an arm of a coproduct -- and a reference to that spelling binds to whichever declaration the assembled pool happens to contain, with no diagnostic at the referencing site. THE INVARIANT THIS FALSIFIES, NAMED, because 'the verdict depends on scope' understates it -- IRRELEVANT-SCOPE EXTENSION INVARIANCE: for source S with resolved dependency closure C, an environment E1 derived from C and an environment E2 that is E1 plus declarations UNREACHABLE from S, typecheck(S, E1) must equal typecheck(S, E2). It does not. The local judgement consumes more environment than its subject owns, which is the defect in one line and is what a repair has to restore rather than merely make the specimen green. HARM: the same source is ACCEPTED under one closure and REFUSED under another, and the refusal names an innocent site in a module that neither declares nor imports the competing type. DISTINGUISHING FACT, and it is what separates this from an ordinary ambiguity: THE VERDICT FLIPS ON THE PRESENCE OF AN UNRELATED, UNIMPORTED MODULE, so closure composition -- not the source -- decides the type. SPECIMEN AND DISCRIMINATING RED, both entry-scoped and therefore reachable on the ordinary acceptance path: gunbc.floor_cost_distribution declares RightCensoredCost as an arm of ClaimCostReading while v2.workflow.claim_cost_observation declares a same-named standalone product, and the first module does not import the second; a 21-module closure over the first alone compiles with 0 blocking errors, while a 45-module closure that adds only the second reproduces the required-floor refusal character for character -- if branches resolve to incompatible types: Coproduct(ClaimCostReading) vs Product(RightCensoredCost). The isolating synthetic is three modules and a 6-module closure: A declares Shape = Circle or Square and returns one variant per if-arm; B declares an unrelated Square; C imports A and B. A never imports B, C need not import B's Square at all, and the verdict flips on B's mere presence -- symmetric under swapping which arm collides. THAT SYNTHETIC IS COMMITTED RATHER THAN DESCRIBED, because a row citing a probe that no longer exists is a transcription wearing a citation's clothes -- the numbers survive and the thing that produced them does not, so the row rots the moment anyone doubts it. It lives in fixtures.if_join_pool_binding as four modules: declaring_module holds the subject and is byte-identical across both arms, colliding_module is the whole of the perturbation, and closure_with_collision and closure_without_collision are the two entry points. Reproduce with gunbc compile --source-root dag --source-root fixtures/if_join_pool_binding --entry fixtures/if_join_pool_binding/closure_with_collision.dag, which refuses at declaring_module with Coproduct(PoolSpecimenShape) vs Product(PoolSpecimenSquare), against the same command at closure_without_collision.dag, which reports 0 diagnostics. The fixture is deliberately OUTSIDE the compiled source roots: an authentic collision committed into dag or src/v2 would be a real corpus fork, so the specimen is source handed to the compiler by a fixture, which is the position DESIGN section 4b names when it asks whether a RED is authorable. SO THE RED IS AUTHORABLE ON THE ENTRY-SCOPED PATH AND NEEDS NO WHOLE-CORPUS HARNESS, which is the DESIGN section 4b question asked before the check: nothing here is permanently green. MECHANISM, stated because the obvious reading is wrong: resolution is LOCAL-FIRST -- v1.compiler.infer_env lookup_binding_by_name tries the module's own bindings, then its ancestry bindings, then the intern table, and only on a miss reaches global_bare_lookup -- so a local declaration is not being outranked. A coproduct ARM is simply not a local binding under its own spelling, so the arm reference misses local lookup entirely and lands in the pool beside the foreign top-level type. Downstream, v1.compiler.infer lookup_variant_parent_enum and variant_owner_node widen a record literal to its owner coproduct only when the binding resolves to a Disj owning that name, so the uncollided arm widens and the collided arm stays bare -- which is the whole of the asymmetry the diagnostic reports. THE RULE THIS SUBSTRATE ALREADY HAS, AND THE REASON THIS IS NOT A CALL FOR A NEW ONE: namespace-resolution-design.md section 13, operator-ratified 2026-07-21, is ANCESTOR-CHAIN UNIQUENESS -- exactly one on-chain candidate resolves, two-plus on-chain refuses as a typed AmbiguousReference, zero on-chain refuses as UnresolvedType -- and its host bracket NAME_RESOLUTION_POLICY_NAMESPACE_ONLY defaults to TRUE. That rule is LIVE on the function-signature channel, where a cli_run test must explicitly set the policy false to assert first-hit-wins and then re-asserts that the default REFUSES the two-parent homonym. IT IS LIVE ON THE TYPE CHANNEL TOO, AND THAT IS THE FINDING -- THE RULE IS NOT BYPASSED, IT IS ASKED ABOUT AN INCOMPLETE POPULATION. THIS ROW ASSERTED THE OPPOSITE FIRST, and the retraction is kept rather than overwritten because the wrong version is the one a reader will re-derive: behavior alone said the policy was not running, and behavior alone was wrong twice about this class. THE DISCRIMINATING PAIR, entry-scoped, isolating exactly ONE variable -- same policy, same chain geometry, same closure size. TWO SAME-NAMED TOP-LEVEL TYPES both on the referencing module's chain REFUSE correctly, with the right message and the right population: ambiguous reference 'Zorkle': 2 candidates, naming both declaring modules and telling the author to qualify, alias or rename. CHANGE ONE CANDIDATE FROM A TOP-LEVEL TYPE TO A COPRODUCT ARM, holding everything else fixed, and there is NO AmbiguousReference at all: the foreign product binds silently and the refusal surfaces later as the branch-join mismatch. A third-module variant of that arm gives the same result and removes the last confound, that the reference sat inside its own declaring module. So the wall is alive and the arm is simply not in front of it. THE MECHANISM IS LOCATED IN THE SOURCE AND IT IS A DELIBERATE RULE WITH A STATED RATIONALE, not an omission: v1.compiler.infer_env global_bare_fallback_invariant declares that global_bare tracking is decl-only over type, fn and data names PLUS ONLY THOSE Disj VARIANT ALIASES THAT ARE UNIQUE ACROSS THE WHOLE BARE-NAME SPACE -- a variant whose name any type, fn or data declaration claims stays qualified-only and NEVER BECOMES A GLOBAL_BARE CANDIDATE -- because admitting it would create a type-versus-variant tie that refuses every FAR use of the type. SO THE REPAIR IS NOT TO COMPLETE THE POPULATION, and that proposal is withdrawn: re-admitting arms re-creates exactly the tie the exclusion exists to prevent. What the exclusion actually does is trade one refusal for another and take the SILENT one -- it protects far uses of the type at the cost of the arm's OWN declaring module and chain losing their arm without a diagnostic, which is DESIGN section 5's rule that a failure arm must refuse rather than widen, applied to a tie that is suppressed globally instead of reported locally. The decidable question the repair has to answer is therefore WHERE THE TIE IS REPORTED, not whether the arm is a candidate; and the exclusion's own justification is about FAR uses, which is the asymmetry a locality-respecting rule would exploit. A SECOND ROUTE TO THE SAME HARM IS DELIBERATELY NOT FOLDED IN HERE, because folding it in would hide it: when the referencing module IMPORTS both competing modules, the competitors arrive through ancestry_str_bindings, a MAP with one entry per name, so the bind is settled by whichever import won at map-build time and global_bare_lookup is never consulted at all. THAT IS WHAT THE TWO-COMPETING-TOP-LEVEL-DECLARATIONS-WITH-IMPORTS PROBE MEASURES, and it is recorded because the next reader will run it and misread it: it silently picks and reds on the picked declaration's shape, and that is evidence about the map grain, NOT about the policy branch, which is what it was first taken for. The longest-common-prefix tiebreak global_bare_nearest_ancestor is reached ONLY on the non-namespace-only arm and is therefore DEAD CODE under the shipped default, so deleting it is parallel-authority hygiene and CENSUSES NOTHING -- recorded because a census over unreachable code returns the empty set for the same reason a healthy tree does, and the two are indistinguishable in the output. It sits beside a measurement hook -- record_global_bare_ambiguous_silent_pick -- that already NAMES the behavior a silent pick in the source. THE HOOK IS NOT MERELY INERT, IT IS INERT IN TWO SEPARATE WAYS, and both were read rather than assumed. FIRST, the SILENT-PICK-GATE in the gunbc binary consults only the fn_parent_first_hits field of the telemetry and exits 1 on it; the global_bare_lcp_picks and global_bare_lcp_ties vectors -- the type and value channel, which is this class -- are COLLECTED AND NEVER READ. SECOND, resolution_silent_pick_enable is reached only after the --source-root arm has already exited, so on every modern compile the telemetry is never armed at all and the gate guards only the legacy --source-dir flat scan. The deficit was observed, named in the source, given a recorder and a gate, and the gate does not cover it -- SO THE GATE CANNOT GO RED ON THIS CLASS BY CONSTRUCTION, and has not been able to since the --source-root path landed -- permanently green for TWO INDEPENDENT REASONS, wrong field and wrong code path, either of which alone would suffice. That is worse than an absent check and DESIGN section 4b says why: it will be CITED AS COVERAGE, because a reader who finds a fail-closed exit 1 on silent picks concludes the class is walled. Section 4b asks whether a check's RED is AUTHORABLE before the check is written; here it is not, and nobody asked. Fixing one axis would leave it looking fixed. The gate must therefore be REPAIRED OR DELETED, and if repaired its RED must be DEMONSTRATED rather than assumed. Whether the type channel bypasses global_bare_lookup or reaches it past the policy branch is NOT yet isolated and is not guessed here. INDEPENDENT CORROBORATION, from the lane that hit this first and reached it from the other side, and cited as gunbc#10210 -- the PR, whose diff survives squash-merge and branch deletion, rather than the branch commits, which do not: a four-arm table over the real specimen in which the decisive row holds the branch RESTRUCTURE constant and changes only the NAMES -- renaming the two arms to unique spellings, with the if-expression untouched, is GREEN. Its mirror row is restructured, green, and STILL FORKED, which is why a green there proves nothing about the fork. That is an ORTHOGONAL PERTURBATION AXIS rather than a second opinion: every probe in this row varies POOL MEMBERSHIP with the spelling held constant, and that table varies the SPELLING with pool membership held constant, so neither alone excludes the other's confound and together they do. It isolates the collision as the cause rather than the branch shape, and it carries the harm in one sentence: the compiler sent an author to restructure an innocent if-join for two hours and the shipped commit message records the disagreement as undiagnosed. RUNG FOUND AT: below the ladder on the source-to-interpretation path, because the wrong binding is taken silently and the only refusal is a downstream consequence at an innocent site. Under DESIGN section 4b(1) the class's rung is the MINIMUM across in-scope paths, and byte-identical source accepting at one closure grain and refusing at another means neither grain establishes anything. CEILING, WITH ITS REASON: structurally guaranteed, not structurally impossible. Nothing stops two modules from spelling a type the same, so the invalid state stays WRITABLE; what is attainable is that no Accepted program RESOLVES THROUGH one, which is a refusal derived from modeled structure and therefore rung 3. NEXT-RUNG TRIGGER, named as the capability: a declaration-identity authority that decides a reference's binder from the referencing module's own containment chain for EVERY occurrence channel -- types, coproduct arms, record-literal heads and free calls alike -- sufficient to refuse an off-chain or multiply-on-chain reference at resolve time rather than adjudicate it. That is the same capability gunbc.recurring_failure_mode empty_observation_narrow already names from the census direction -- one namespace census over the one Node tree, not a second check beside the type-name one -- and reaching rung 4 additionally needs the second declaration to be unwritable, which is a further, separate capability. CROSS-LINK: this class is what makes join_judged_against_its_sibling_rather_than_its_declared_context visible; repairing that join alone would silence the diagnostic while leaving the wrong binding in place, so the ordering is resolution first. - **join judged against its sibling rather than against its declared context** (INVALID STATE: v1.compiler.infer's if-expression join infers both branches independently, then tests them against EACH OTHER with node_type_compatible; the enclosing declared return type is never consulted. There is synthesis plus a sibling compatibility test and NO CHECKING MODE. HARM: a well-typed coproduct construction -- one variant of the declared return per arm -- is REFUSED, which is a false positive at the ordinary compiler floor, and DESIGN section 4b makes a floor failure a below-baseline regression rather than something a higher-order capability offsets. DISTINGUISHING FACT, and it is what makes the defect narrow and cheap: prefer_specific_type ALREADY COMPUTES THE CORRECT JOIN for the refused pair. For Coproduct(ClaimCostReading) against Product(RightCensoredCost) it returns the left, the declared return, because every re-selection arm falls through -- not same_kind, both fully resolved, the left not a bare leaf. So the diagnostic fires BESIDE a unification the compiler just computed right, corroborated by the refusing runs carrying that as their only blocking error: no downstream mismatch at the declared return and none at the call site, either of which a wrong unification would have produced. The check is refusing a pair it can already join. RUNG FOUND AT: mitigatable -- the refusal is loud, typed and located, and nothing silent is produced; what is wrong is the verdict, not its containment. CEILING, WITH ITS REASON: structurally guaranteed. Whether a branch inhabits a DECLARED type is decidable wherever both the declaration and the branch resolve, so the join can be a checking judgement against the declared context with synthesis reserved for the undeclared case; it cannot reach structural impossibility, because an if-expression whose arms disagree under no declared context is authorable by construction and must still be refused rather than made unwritable. NEXT-RUNG TRIGGER, named as the capability: a checking-mode judgement for branch joins -- each arm judged against the expected type when one is in scope, with the sibling comparison retained only as the synthesis fallback where no expectation exists -- sufficient to accept every arm that inhabits the declared return and to refuse every arm that does not. NOT A CLAUSE OF ITS ROOT AND DELIBERATELY FILED SEPARATELY: the specimen that exposed this join was mis-resolved upstream by binding_chosen_by_pool_membership_rather_than_by_the_declared_rule, and a repair here that silenced the diagnostic would entrench that fault by deleting the evidence carrying it. Resolution is repaired first; this join is its own lane.) - **one dissolution event, recorded twice or not at all** (a roster rule assigns deletion of CONSUMED admissions to the next roster-touching change. The rule is CORRECT AND THIS ROW DOES NOT DISPUTE IT: the obligation reaches every concurrent roster-touching change and is discharged by whichever observes it first, exactly as its own prose says. What recurs is not a broken trigger but an ASYMMETRY BETWEEN THE TWO THINGS IT OBLIGES, AND BOTH HALVES OF IT CAN MERGE SILENTLY. The DELETION COMPOSES IDEMPOTENTLY: two branches removing the same rows compose to one absence with no conflict, which the authority itself records -- `v1_compiler.namespace_wave_admission` says of the 57-row case MAIN EMPTIED INDEPENDENTLY, WHICH IS THE TRIGGER MECHANISM WORKING RATHER THAN A COLLISION. The RECORD COMPOSES ADDITIVELY: each observer authors an ordinal-bearing dissolution writeup, and two writeups of ONE event merge cleanly into two. AN EARLIER REVISION OF THIS ROW CLAIMED THE DELETION COLLIDES LOUDLY, WHICH ITS OWN CITED SPECIMEN CONTRADICTS, and the error is instructive: this row's author generalised from a TEXTUAL CONFLICT they hit on gunbc#10248, which was an ADD/ADD on a roster line and not a deletion at all. Idempotence is exactly what lets the duplicated observation collapse while the duplicated history survives, so the deletion never reliably announces the race. INVALID STATE: one dissolution event carrying two records, or carrying none. HARM: both wrong arms are silent and neither is countable. Yield when nothing else is recording and N admissions vanish from main unexplained, which is precisely what the roster history exists to prevent; author when something else is recording and one event acquires two ordinal-bearing records, a DESIGN section 3 meaning fork committed inside the ledger that explains the deletion. THE DECIDING INPUT IS UNREADABLE, WHICH IS THE WHOLE CLASS: choosing between the arms requires knowing whether a competing branch is LIVE AND RECORDING. That is not derivable from the artifact, is not visible to review, and CHANGES BETWEEN CI ROUNDS -- so the decision is correct or incorrect for reasons the author cannot read and a later reader cannot reconstruct. No amount of care closes it. DISCOVERED BY valiant-bee-316 AND tidy-koi-619 across their own cuts; drafted here by a third lane at their request, from shas they supplied, so that one record exists rather than two -- which is this row obeying its own subject. The two main-side quotations below were verified verbatim against origin/main by the drafter rather than relayed. SPECIMENS -- THREE EVENTS, FIVE INSTANCES, TWO BRANCHES, ABOUT TWENTY HOURS. EVENT 1, 57 rows: main and a branch deleted the same consumed rows independently, recorded in main as SEVENTEENTH TRANSITION in `v1_compiler.namespace_wave_admission` -- neither aware of the other, both paying the rule. No double record, because one side was main. EVENT 2, 3 rows, consumed when gunbc#10011 merged as 4acf8ac234: TWO branches observed it independently and BOTH authored NINETEENTH DISSOLUTION -- 889a5f52493 and 29db34e975. One was yielded at 2fafa0f9591, deletion kept and record dropped in favour of a pointer. THIS IS THE CLASS FIRING AND BEING CAUGHT BY HAND. EVENT 3, 47 rows, consumed when gunbc#10106 merged as 78e022c51e4: only one branch observed it, so the same trigger correctly produced the OPPOSITE action -- record rather than yield, TWENTIETH DISSOLUTION at edbfcd7b45f. SAME TRIGGER, OPPOSITE CORRECT ACTION, DECIDED ENTIRELY BY WHETHER A COMPETING RECORD EXISTED. Plus three ORDINAL COLLISIONS on one file from one branch: SIXTEENTH TRANSITION taken mid-branch by gunbc#10010, then SEVENTEENTH TRANSITION and NINETEENTH DISSOLUTION both taken by gunbc#10106, forcing EIGHTEENTH TRANSITION -- the same silent-merge surface reached through the ordinal rather than the record. THE COST AND THE MECHANISM ARE TWO CLAIMS AND A READER WHO CONFLATES THEM REPAIRS THE WRONG THING. The cost is real: a branch touching the roster for its own unrelated reasons inherits another lane's sweep, each inheritance costing a commit, a CI round and a judgement call -- one call-reachability cut paid it TWICE for two upstream transitions it did not cause. But the same evidence shows the TRIGGER WORKING. Repairing the trigger would break the only part that is sound. RUNG FOUND AT: 1, mitigatable, resting on author diligence -- nothing refuses either wrong arm and nothing counts them. CEILING: 2, mechanically preventable, and the reason it is not higher is that the record is author-assigned PROSE; making the state unwritable means the record ceasing to be prose, which is a carrier question this row deliberately does not decide. Reaching 2 is decidable, BUT NOT FROM THE MERGE-BASE ALONE: a base containing no record admits BOTH concurrent branches, each locally clean, and the duplicate prose then composes without conflict -- so a check with perfect merge-base access still passes both and admits the second record. Decidability requires the EXACT WOULD-LAND COMPOSITION at a serialized boundary, which is why the trigger below names that rather than the base. NOT MEASURED, AND CARRIED AS UNMEASURED BECAUSE THE ORIGINATING LANE FLAGGED IT: whether the merge-base is REACHABLE to such a check at the point the admission phase runs. If it is not, the ceiling argument needs re-deriving before anyone builds against it. NEXT-RUNG TRIGGER, named as the CAPABILITY AND JOINING BOTH DIRECTIONS: at the serialized merge boundary, derive a dissolution-event identity from the CONSUMED ADMISSION POPULATION and require the exact would-land tree to contain EXACTLY ONE history record per event and EXACTLY ONE event per record -- refusing zero, refusing duplicates, and refusing or re-executing when current main differs from the main revision adjudicated. AN AT-MOST-ONE WALL IS NOT SUFFICIENT AND AN EARLIER REVISION OF THIS ROW NAMED ONE: refusing a record whose label already carries one says nothing about consumed rows deleted with NO record, which is half of the invalid state above. That is the section 4b(3) grain mismatch -- a two-armed loss under a one-armed trigger -- committed in the same row that warns against it. ITS DISCRIMINATING REDS ARE BOTH ARMS AND ONE OF THEM MUST CROSS THE RACE: consumed rows deleted with ZERO record; one event carrying TWO records; and, because a static two-record fixture does not exercise the actual specimen, TWO CONCURRENT BRANCHES SHARING A BASE WITH NO RECORD, each locally clean and admissible, where the SECOND composition refuses after the first lands. Positive control: one event, one record, admitted. CROSS-REFERENCE, NOT A MERGER: `ambient_process_state_read_by_a_concurrent_reader` shares the sentence CORRECTNESS DEPENDS ON CONCURRENT STATE THE ACTOR CANNOT READ, but there the defect is a READ that returns a well-formed value about a different subject, repaired by making the ambient fact a parameter. Here it is a WRITE DECISION with no readable input at all, repaired by making a second record refuse. Neither repair transfers, which is DESIGN section 4b's keying-on-the-repair test.) - **an exact duplicate constructor pattern appears twice in one match, the second arm is unreachable, and the compiler accepts both -- so SOURCE ORDER silently decides which body answers** (INVALID STATE: two arms of one `match` name the SAME closed-variant constructor with DIFFERENT bodies. HARM: the second body is dead, and nothing says so. The author wrote it believing it would run; the reader cannot tell which of the two the machine picks without knowing the arm-selection rule; and the wrong one being first is a wrong answer that type-checks, projects and passes every gate. THE SPECIMEN IS MINE AND IS MEASURED (gunbc#9981, 2026-09-03). `probe_owner_is_wet_lib_module` in `v2.test.claim.self_host.stage0_executable_assembly_test` carried `WetActuatorLibModuleOwner` twice -- once as the matching arm binding `module_basename` and `declaration_route`, and again in the trailing list of `=> false` arms, where I had added it while enumerating the coproduct for exhaustiveness. The compiler accepted it in every lane it reached. It was found by a review reading the arm list, not by any check. THIS IS THE DUAL OF EXHAUSTIVENESS, NOT AN INSTANCE OF IT. Exhaustiveness asks whether the UNION of the arms covers the domain, and gunbc does refuse when it does not -- the same file's missing `WetActuatorLibModuleOwner` arm refused loudly earlier in the same PR. The unasked question is whether each arm CONTRIBUTES an inhabitant no earlier arm already covers. A duplicate arm makes the union no larger, so an exhaustiveness check is green by construction on exactly the source that carries this defect: adding the duplicate is the one edit that cannot move that verdict. THE MEASURED GRAIN IS NARROW AND IS STATED NARROWLY, because the general form is not the same question. Deciding whether an arbitrary later pattern is subsumed by the union of earlier ones is a coverage problem over guards, nested patterns and bindings; the measured specimen is the decidable corner of it -- two SYNTACTICALLY IDENTICAL closed-variant constructor heads at the same match. Claiming the general form here would put a ratchet where a wall is available, and would let the narrow wall be cited as coverage for the broad class. RUNG FOUND AT: outside the ladder -- the state is writable, accepted, and silent. CEILING: 3, structurally guaranteed, and the reason it is not 4 is that a `match` is written arm by arm, so a second identical head is spellable in any source a human or a generator can emit; no constructor arrangement removes it. What rung 3 buys is that no `Accepted` program contains one. NEXT TRIGGER, NAMED AS THE CAPABILITY: **a match-arm usefulness judgment in the compiler frontend that REFUSES a second arm whose constructor head is already covered, locating both the duplicate and the arm that covers it** -- with a discriminating RED (two identical constructor patterns, different bodies, refused at the second arm), an accepted positive control (two distinct constructor patterns, accepted), and a retention control establishing that adding a variant to the coproduct does not weaken the duplicate judgment. A diagnostic that names the duplicate without refusing it does not discharge this: a warning on an accepted program is the tier DESIGN section 6 calls an inert lens, and this class is silent precisely because nothing stops the line.) - **A PREMISE THAT MAKES A COST LOOK CORRECT RENDERS THE REGION BEHIND IT UNEXAMINABLE, AND THE TELL IS REPEATED REPAIRS THAT ALL STOP AT THE SAME BOUNDARY.** The invalid state is a stated justification -- not a check, not a type -- that classifies an observed cost as intended, so no instrument is ever pointed at it and its absence looks like the absence of a problem rather than the absence of a measurement. SPECIMEN, and it is this carrier's own history: `gunbc.recurring_failure_mode` was repaired twice for merge contention -- blob to `data` rows, then rows to one line each -- and BOTH repairs measured only the APPEND OF A WHOLE ROW. Both rested on a premise stated in the first: that two lanes editing the SAME class conflicting is "correct, because that is real disagreement about one fact." THE PREMISE IS FALSE FOR THIS CARRIER, and the discriminator is what actually accretes on a class. What lands is INDEPENDENT RECEIPTS from unrelated lanes -- a second specimen, a climb receipt, a corroboration reached from the opposite direction -- not competing claims about one fact. On 2026-09-02/03 three lanes appended three independent receipts to `state_space_conflation` and resolved it by hand-negotiating byte order; that row reached 23,023 characters. Independent accretion is not disagreement, so the conflict was textual contention wearing the mask the premise had fitted for it. **WHAT MAKES THIS A CLASS RATHER THAN ONE MISTAKE IS THE SHAPE OF THE EVIDENCE: the premise was load-bearing for two repairs, and neither repair's author looked inside a row.** A false premise does not merely produce a wrong answer -- it produces NO answer, because it removes the question. That is why it survived a measurement campaign that was otherwise careful: the same lane that measured `git merge-file` at a named merge base to characterise the block-tail defect never measured an intra-row edit, because the premise said the result would be correct. RECOGNITION RULE: when a repair of a recurring cost is being scoped, find the sentence that explains why the ADJACENT cost is acceptable, and ask what measurement would falsify it. If no measurement was ever run against it -- and especially if the same boundary has now been re-approached more than once -- the premise is a candidate, not a finding, and the cheap discriminator is to run the instrument the premise made look unnecessary. Here that was one `git merge-file` on two lanes editing one row: 0 conflicts on different receipts, 1 minimal conflict on two appends. **WHAT IS NOT CLAIMED.** This is not the claim that stated justifications are suspect in general, which would be unusable. The class is narrower and its two conditions are jointly required: a premise that classifies an observed, RECURRING cost as intended, AND a repair history in which the same boundary was approached more than once without that cost being measured. One repair stopping at a boundary is ordinary scoping. RUNG: mitigatable, and honestly so. The harm is deferred author time -- three lanes hand-negotiating byte order on one row -- and it is contained only by someone eventually re-deriving the premise, which is a review practice and not a mechanism. CEILING, derived rather than aspirational: this cannot climb to construction, because whether a stated justification is true is not decidable from the tree -- the premise here was refuted by an empirical fact about how lanes ACTUALLY append, which no property of the source expresses. It is a ratchet forever in the sense of DESIGN section 5. NEXT-RUNG TRIGGER, a capability and not an artifact: the ability to measure contention on a carrier CONTINUOUSLY rather than at repair time -- a per-declaration conflict count over merge history -- so that a region the premise renders unexaminable still produces a number that rises. That is what would have made the intra-row cost visible without anyone doubting the sentence. +- **a live argument threaded past the arm that actually decides the verdict** (INVALID STATE: a check is named and cited as LIVE because one of its arguments is read from the real tree, while the predicate it asserts is already settled by a different, hand-authored argument that the live one cannot influence -- so the live input is threaded into a call whose answer does not depend on it. HARM: the row is permanently green with respect to the tree it claims to observe, and its name is what a reader consults when asking whether the class is covered live, which is exactly the decoration DESIGN section 4b calls worse than absent because it will be cited as coverage. It also BUYS THE COST OF LIVENESS WITHOUT THE SIGNAL -- the live producer here is a whole-tree fill -- so the row looks expensive enough to be doing something. DISTINGUISHING FACT, and it is what separates this from an ordinary weak assertion: THE DECIDING ARM AND THE LIVE ARM ARE DISJOINT INPUTS TO ONE TOTAL FUNCTION, so nothing at the call site looks wrong; every argument is well-typed, the live producer is genuinely called, and the fixture argument is genuinely a fixture. The tell is structural and mechanical -- find the arm that can produce the asserted outcome ALONE, and ask whether the live argument is an input to it. SPECIMEN, gunbc 2026-09-03: v2.test.claim.long.effect_reach_test effect_reach_live_03_normalize_witness_derived_host_reading_holds asserted v2.lens.effect_reach derived_host_reading over effect_reach_classification_from_facts with decls bound to v2.std.fn_index fn_arrow_decl_facts_live and data_inits bound to a hand-authored one-element live_03_normalize_data_inits. In that function the data-init arm closure_data_init_path_flows consumes only closure_modules and data_inits: a path-shaped literal_fp in any closure module yields a GunbcCompileEntrySink flow with no reachability and no decls, and any non-empty flow list is HostEffectReach, hence derived_host_reading. The module also carried an annotation asserting that this row LEGITIMATELY READS the live producer, so the false claim was stated in prose beside the code that falsified it. DISCRIMINATING RED AND POSITIVE CONTROL, BOTH EXECUTED rather than argued, via claim_batch on the lens: substituting decls to the EMPTY list while holding the hand data_inits fixed leaves derived_host_reading TRUE -- the live argument is non-discriminating; and holding the LIVE decls while substituting data_inits to EMPTY yields derived_host_reading FALSE with effect_reach_flow_count 0 -- the live scan contributes ZERO flows from this entry, so the row had no live content at all rather than merely a weak one. The unmodified row PASSES, which is the positive control that the harness and the lens were both working. THE PAIR IS THE METHOD AND NOT AN INCIDENT OF THIS SPECIMEN: neither substitution alone decides the question, because a passing empty-decls arm is consistent with the live arm merely being redundant, and only the second substitution shows it was empty. RESOLUTION AND WHY IT IS A DELETION: the row was removed rather than renamed, because its deciding arm was already enrolled over the identical literal_fp as effect_reach_path_data_init_derived_host_reading_holds in the same module, so a rename would have kept a DESIGN section 2 duplicate spelled with real module names; and no live row is authorable on that lens today, since its closure comes from ModuleImportFact, which v2.lens.live_read_classification g2_live_production_boundary_law declares FIXTURE-FACING with no live producer in the corpus. THE SHAPE OF THE MISTAKE IS AUTHORABLE BEFORE THE PRODUCER EXISTS, which is why the name of the missing producer is the trigger and not the excuse. RUNG FOUND AT: 1, mitigatable -- nothing silent is produced, the row simply asserts less than its name, and the only thing containing the harm is that a reader may read the call. CEILING: 2, mechanically preventable. The question -- does the asserted outcome change when this argument is replaced by its type identity or an empty value -- is decidable by EXECUTION per argument and is exactly the coverage-is-per-argument grain, but it is not derivable from the call shape alone, because whether an argument is influential depends on the callee body over the actual fixture values. Not higher: a caller may pass any well-typed value to any parameter and forbidding a non-influential argument would forbid ordinary total functions, so the invalid state stays writable. NEXT-RUNG TRIGGER, named as the capability and covering BOTH directions: a per-argument influence check that, for each argument of an enrolled witness call, re-executes the witness with that argument substituted and refuses when the verdict is unchanged for an argument the row NAMES -- sufficient for reddening both a non-discriminating live argument and a row whose live arm contributes nothing, since the specimen needed both substitutions to be characterised. A convention that live rows must be named live would be satisfied while the capability stayed dead. BOUNDARY against neighbouring classes: check_subject_narrower_than_its_declared_claim is about a subject that is a strict subset of what the row claims to range over, and the repair there is widening the subject; here the subject is right and one INPUT is inert, and the repair is either removing the inert input or supplying the producer the name promises. It is likewise not incidental_denominator_as_wall, which is about the wall being computed over the wrong population. AND IT IS SHARPER THAN THE ASSERTED-NOT-PRODUCED SHAPE IT MOST RESEMBLES, which is the reason it is filed rather than folded in: there the producer is IMPORTED AND UNCALLED, so the tell is visible at the call site -- a hand-built value stands where a produced one should. HERE THE PRODUCER IS GENUINELY CALLED and its result is genuinely passed, and what fails is REACHABILITY INSIDE THE CALLEE, so no reading of the call site can see it and the tell is only recoverable from the callee's arm structure or from substitution. THE GENERAL FORM IS WORTH MORE THAN ANY ONE ROW: a verdict DISJOINED over a live arm and a fixture arm silently becomes the fixture arm, and nothing goes red, because the disjunction is satisfied before the live arm is consulted. BOUNDARY against the three adjacent roster rows, none of which is this: absorbing_fallback is a FAILURE arm that widens instead of refusing, and here no arm fails at all -- the wrong answer is a TRUE one reached without the input it names; empty_observation_narrow is a CENSUS whose population is narrower than its claim, where the subject is the defect, while here the subject is right and one input is inert; and predicate_vacuously_true_on_an_empty_domain is green because its domain is EMPTY, whereas this predicate ranges over a perfectly non-empty fixture domain and is simply not a function of the argument the row is named for. The repairs are disjoint in all three directions, which is DESIGN section 4b's keying-on-the-repair test.) +- **a lens is correct and live over a subject shape that cannot represent the state it detects** (a check reaches its subject, executes on every run, and is enrolled as coverage -- and its RED is UNAUTHORABLE there, because the representation the subject is expressed in has no constructor for the state the check matches on. Nothing is skipped, nothing is absorbed, no population is withheld, and the check is not wrong: hand it a value of the shape it expects and it fires correctly. It is the SUBJECT that cannot carry the state, so the check is permanently green over that subject while reading as verified. **THE BOUNDARY AGAINST check_subject_narrower_than_its_declared_claim DECIDES THE REMEDY AND THEY ARE NOT THE SAME DEFECT.** There the subject is a SMALLER POPULATION than the claim -- widen it and the missing instances appear, so the repair is a scope edit. Here the population is exactly right and every member is structurally incapable of exhibiting the state; widening adds more members that equally cannot exhibit it, so a scope edit is guaranteed to change nothing while looking like a fix. It is also NOT absorbing_fallback: nothing widens on failure and no arm degrades -- the check runs its ordinary path to an honest verdict over a subject that could only ever produce one answer. **SPECIMEN WITH A RECEIPT, measured 2026-09-03 on gunbc#10245 against origin/main 8b2323f414 and reproduced on 8bfae78d78.** v2.lens.determinism classifies a call through node_callee_symbol, which requires node_is_call, which matches ComputationNode { behavior: Transform }. Its live subject is the fn-arrow body skeletons built by v1_compiler.coproduct_reflection marshal_skeleton, which returns conj_record at both return sites, i.e. TypeNode { connective: Conj }, for EVERY node. A Conj TypeNode cannot satisfy that match, so no skeleton node is ever a call, every body classifies Deterministic by non-membership, and determinism_transitive_holds over a fn_arrow_decl_facts_live population is green by construction. The same mismatch holds four production_qualification_origin_probe_witness frontier rows red, which is what makes it a class rather than an incident: one representation mismatch darkens every consumer of that subject at once. **WHY IT SURVIVES REVIEW, and this is the dangerous part.** The check is real, the lens is correct, the subject is live and non-empty, and a positive control asserting the population is non-empty PASSES -- so every ordinary vacuity guard agrees. A NON-EMPTY SUBJECT IS A NECESSARY PRECONDITION MASQUERADING AS THE CHECK. Nine approving reviews passed over the specimen and none exercised the body skeletons; it was found by planting a violation and watching nothing happen. **THE BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, filed the same day and easy to conflate with this.** There the check CAN go red -- a different, hand-authored argument decides the verdict and the live argument is threaded past it, so the row is inert with respect to the tree while the predicate itself still discriminates. Here NO argument can produce the refused state, because the subject's representation cannot express it; there is no other arm carrying the verdict, and substituting inputs changes nothing. The two are distinguished by one question: is there an arm that could produce the asserted outcome alone? If yes and the live input is not one of its inputs, that is the threaded-argument class and the remedy is to delete or re-source the row. If no arm can produce the refused outcome at all, this is the class and the remedy is a representation change, which is why its trigger names a shape rather than a call site. **RECOGNITION RULE, which is DESIGN 4b's own question asked BEFORE the check is written rather than after: name the state the check refuses, then construct a value in the subject's OWN representation that exhibits it.** If you cannot construct one, the check is a decoration over that subject however correct its logic. The construction is cheap and is the whole test: two values differing only in the field the check keys on, asserting it FIRES on one and is BLIND to the other. Both arms passing is the executing record of the gap; when the representation lands, the blind arm reds and names itself. **THE REPORTING RULE THAT FOLLOWS: a class's rung is the minimum across its in-scope paths (4b(1)), so a fixture path where the RED is authorable does NOT stand in for a live path where it is not.** Citing the fixture rung while the live path is dark is rung inflation. **AND IT IS NOT A 4b(3) DECLARED DROP -- filing one is its own error**, which is where the specimen nearly went: 4b(3) governs a REGRESSION, with a previous rung and a population that LOST a guarantee. When the shape mismatch predates the check, the wall was never lit through that path, and a capability that was never real cannot be dropped. The honest instruments are 4b(1) rung honesty and 4b(2) an untracked stall made tracked. **RUNG: 1 (mitigatable) -- the gap is nameable and, once found, held open by the two-arm control. CEILING: 4, since whether a subject's representation can inhabit the state a check matches on is decidable from two declarations the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: a check declares the subject representation it matches over, and a check whose match is unsatisfiable by that representation fails to compile -- so the decoration cannot be authored at all, rather than being found later by someone constructing the value by hand.**) +- **a per-argument exhaustive matrix cannot see a cross-argument relation, and it READS as exhaustive precisely because it is** (INVALID STATE: a gate function takes two independently derived arguments -- here `wet_route_gate_disposition(standing:admission:)`, whose `standing` came from one receipt envelope and whose `admission` came from a lease pinned to a DIFFERENT envelope. Every arm of `admission` was enumerated and refused correctly for that argument in isolation; every arm of `standing` likewise. The reachable OFF-DIAGONAL state -- lease-admits-A composed with standing-derived-from-B -- inhabits no single argument, so no per-argument enumeration contains it. HARM: the author reports the enumeration as complete, and the report is TRUE. That is what makes this worse than a false completeness claim: a false one is refuted by any counterexample within its stated domain, while a true one over an UNSTATED domain has no counterexample inside the domain it names, so the reader cannot separate `all cases of the argument` from `all cases of the decision`. SPECIMEN (gunbc#9725): five refusal arms of the bootstrap-lease admission were each shown going red under mutation, and `six arms of one argument is not the gate; the gate is the relation between two` was the correction. The repair was structural rather than another arm -- FUSE THE DOOR: the gate no longer accepts a pre-computed admission, it derives the admission itself from the envelope it is judging, so the mismatched pair has no constructor. RECOGNITION RULE: when a matrix is enumerated per argument, ask WHICH RELATIONS BETWEEN ARGUMENTS THE FUNCTION SIGNATURE ADMITS. If two parameters can be derived from different subjects, the product space -- not the union of the axes -- is the domain, and an axis-wise sweep is exhaustive over a projection of it. The tell is a decision function whose arguments are each independently derivable by a caller. THE NEIGHBOUR THIS IS NOT: [[check_subject_narrower_than_its_declared_claim]] is a subject mismatch that a reader can catch by comparing the claim to the check; here the claim and the check agree exactly, and the narrowing is in the DOMAIN both of them share. NEXT-RUNG TRIGGER, a capability and not an artifact: deriving a decision's dependent inputs INSIDE the decision rather than accepting them, wherever two parameters name the same subject -- which is the fused-door move generalized, and makes the off-diagonal unconstructible instead of merely unenumerated. RUNG FOUND AT: mechanically preventable, by a probe that had to be written to construct the state. CEILING: structurally impossible, and reached for this specimen.) +- **a subject defined by a CLOSURE with no enumerable membership cannot be protected in advance, only violated in arrears** (INVALID STATE: a receipt, cache key, or admission is pinned to a digest computed over a TRANSITIVE CLOSURE -- here the wet lane's `semantic_subject`, over the per-entry closure of 23 routed witness entries plus `v2.workflow.floor_wet_route`. The digest is a perfectly good detector and a useless protector: it reports a MISMATCH AFTER THE FACT rather than a MEMBERSHIP LIST BEFORE it. HARM: a two-hour dispatch completed and its receipt arrived uncommittable as `ReceiptSubjectDifferent`, because a commit landed inside the closure after the run's head. The lane that would break such a subject cannot decide for itself whether its diff intersects one, so the only available discipline is asking the holder afterwards -- which is not a discipline, it is a post-mortem. THE VISIBLE SURFACE IS NOT THE SUBJECT, and reporting it as one is the same defect in a different costume: the wet subject's visible surface is 19 files, while the resolver's own lines report 47 modules and 1180 resolved items for ONE entry, reaching transitively into `src/v2/std/` and `src/v2/compiler/`. A lane can invalidate the receipt while touching none of the 19 and doing nothing wrong. A list handed a completeness property by the mere fact that it is a list is the trap; the resolver's numbers are what refute it, which is why they are quoted rather than estimated. THE CONSEQUENCE FOR ANNOUNCEMENTS, recorded because it is the half that fools the announcer: a hold announced over an unenumerable subject is not protection, and the artifact recording that the announcement happened is indistinguishable from the protection existing. A hold nobody can check is WORSE than no hold, because its holder then treats the subject as protected. SCOPE, and it is wider than the specimen: EVERY subject-pinned receipt in this repository has this hole; the others have not noticed because none has yet burned a long run to it. RECOGNITION RULE: when a digest pins a subject, ask WHETHER ANYTHING PRINTS THE SUBJECT'S MEMBERSHIP. If the only instrument that knows the membership is the comparison itself, the subject is detectable and not defendable, and any fence described over it is a request rather than a constraint. NEXT-RUNG TRIGGER, a capability and not an artifact: a producer that PRINTS the closure membership for a routed entry, SUFFICIENT that a lane can decide FOR ITSELF, BEFORE LANDING, whether its diff intersects a live subject. THE POINTED PART, CORRECTED ONCE ALREADY AND THE CORRECTION IS THE WHOLE VALUE: the set is not merely computed and discarded, it is COMPUTED, HELD, AND RETURNED TO THE CALLER. In `v1_compiler.claim_batch` `resolve_timed`, the resolved graph is bound, its `modules` and `item_registry` are read for their LENGTHS to print the `[resolve]` line, and the whole graph is then handed back to the caller. Nothing is thrown away except THE NAMES, and only at the `eprintln!`. So the missing thing is an EMITTER over a set the process already holds and the caller already receives -- not an analysis, not a resolver change. THIS DISTINCTION IS THE ROW'S RUNG HONESTY AND 4b(2) TURNS ON IT: `nobody can determine this in advance` and `nobody has printed it` are different claims. The first is a permanent ceiling under which every future lane pays the same cost again; the second is an unbuilt next rung one emitter away. Filed as the former this row would sound honest and be wrong, and would foreclose its own repair -- which is this very class applied to our own tooling, a claim about a population made by an instrument that never enumerated it. RUNG FOUND AT: mitigatable, and the mitigation is a message. CEILING: mechanically preventable -- membership is decidable and computed, but a lane's intersection with a LIVE subject depends on which runs are in flight, which is external state observed at a boundary.) +- **a bound is never EVALUATED for a whole population, so the first unrelated edit that makes one of them run discovers the line as a merge block** (INVALID STATE: an identity that the ordinary floor never plans is subject to a ceiling that has therefore never been exercised against it. Specimen: `test.claim.witness_floor_workflow_consolidation_witness_test.w_RED_fabric_evidence_executes_without_gating` has ZERO planned rows on main -- checked in the `required-floor-claim-cost` artifact of two consecutive main runs, 0 of 3549 -- because it executes ONLY as a CHANGED witness. Its 500ms CPU line was first exercised by gunbc#9725, a change about the wet execution route, which touched `gunbc.witness_floor_workflow` and thereby made the witness changed; it refused at 504ms and 505ms on two heads. HARM: the discovering PR is not the causing PR in any sense its author can act on. The block arrives on a change that has nothing to do with cost, the author has no baseline to compare against because none was ever produced, and the only available dispositions are to enroll a debt row or to stall. THE NEIGHBOUR THIS IS NOT, and the distinction is the whole row: the NEAR-LINE family says a bound is MISPLACED -- measured over the whole corpus by the FLOOR-COST-500MS lane, 21 of the ~29 identities that can approach the line at all sit within +/-10% of it with nothing beyond 541ms, so the threshold was drawn through a cluster. This row says a bound was NEVER EVALUATED for a population at all. Different invalid state, different trigger, and the repairs diverge: a per-witness declared cost envelope fixes the misplaced line, and does NOT by itself cause the ceiling to be exercised for identities the ordinary floor does not plan. WHY IT IS STRUCTURALLY INVISIBLE TO THE OBVIOUS INSTRUMENT: a census that samples what the ordinary floor PLANS has this population outside its denominator BY CONSTRUCTION -- the cost lane's own survey could not see the class, and found it only when a lane that had tripped the line reported it. This is [[green_reported_over_a_population_the_instrument_does_not_own]] in the cost dimension: the survey was accurate about the rows it enumerated and silent about the rows it could not. RECOGNITION RULE: when a bound is declared per-identity but enforcement is gated on a SELECTION (changed, affected, sampled, scheduled), ask WHICH IDENTITIES THE SELECTION NEVER SELECTS ON THE MAINLINE. Those carry unevaluated bounds, and the population is discoverable in advance -- it is the declared identities minus the planned ones, both of which are already published per run. NEXT-RUNG TRIGGER, a capability and not an artifact: the ceiling is EXERCISED AND ITS RESULT PUBLISHED for every identity carrying one, including those the ordinary floor does not plan -- sufficient that a bound's first contact with an identity is a measurement someone chose to take, not a merge block on an unrelated change. Until then the class is discovered one PR at a time by whoever happens to edit the triggering authority. RUNG FOUND AT: mitigatable, and the mitigation is a debt row written after the fact. CEILING: mechanically preventable -- the unplanned population is a decidable set difference over data each run already emits.) +- **a subject digest taken over RAW FILE CONTENT makes annotations semantically load-bearing, which is the property DESIGN section 4c declares impossible** (INVALID STATE: a receipt, cache key or admission is pinned to a digest computed by `v1_compiler.resolved_graph_cache` `closure_content_digest`, which folds each source's `content` -- the authored bytes -- rather than anything the annotation-erased projection would produce. So ADDING, DELETING OR REFLOWING A COMMENT in a module inside such a subject moves the digest. 4c states the opposite in terms: annotation capture is disjoint from semantic occurrence allocation, and adding, deleting or moving an annotation cannot alter any semantic occurrence identity, semantic graph, resolution result, SEMANTIC HASH, or target-program bytes. HARM, MEASURED RATHER THAN IMAGINED: on gunbc#9725 the wet lane's semantic subject folds `v2.workflow.floor_wet_route`'s own closure content, a receipt from a 2h31m dispatch was pinned to that digest, and an operator-granted one-shot lease pinned the same value as `exact_semantic_subject_digest`. Repairing a one-word COMMENT in that module would have voided the grant and forced a re-dispatch plus a second operator grant. Three real defects were therefore repaired in the seed and left standing in the substrate authority, which is filed separately as `gunbc.guarantee_stall` `wet_route_model_lags_seed_stall`. The next occurrence will not be so visible: someone reflows a paragraph and silently invalidates a receipt with no diagnostic connecting the two. THE DISJUNCTION, because only one of these can be true and neither is currently written down. EITHER the closure content digest is NOT a semantic hash in 4c's sense -- in which case it must stop being read as one, and the distinction between a CONTENT identity (what bytes were on disk) and a SEMANTIC identity (what program they denote) has to be authored somewhere a reader meets before pinning anything to it. OR 4c's guarantee genuinely does not hold for this carrier, and 4c is overclaiming for every consumer that digests sources rather than the erased projection. RECOGNITION RULE: when a digest is described as a subject, a semantic subject, or a program identity, ask WHAT IT FOLDS. If the answer is file content, then comments, whitespace and formatting are inside it, and every guarantee stated about annotations being semantically inert is false of that digest -- while reading exactly like a guarantee about the program. The tell is a digest whose name says semantic and whose producer takes `content`. NEXT-RUNG TRIGGER, a capability and not an artifact: a subject digest folded over the ANNOTATION-ERASED projection that semantic passes already receive -- the same erasure 4c requires those passes to consume -- so that the digest is invariant under comment edits by construction and 4c's guarantee is true of it rather than merely stated near it. Failing that, the weaker form: the content digest is RENAMED to say it is a content identity and every pinning consumer is re-read against that meaning. RUNG FOUND AT: mitigatable, and the mitigation is that authors happen to know. CEILING: structurally impossible -- an erased-projection digest cannot move on an annotation edit, because the annotation is not in the input.) +- **a value and a summary of it -- a digest, a count, a view, an annotation -- placed side by side without a join can disagree silently, and the corroboration the reader believes they are getting was never computed** (INVALID STATE: a signature takes a value AND a summary of that value as two peer arguments -- `envelope` beside `envelope_digest`, `roster_identities` beside `roster_digest` -- with no arm relating them. The signature admits a digest of something OTHER than the value beside it; nothing refuses; and every downstream guarantee that cites the digest is then citing a summary of a different object, while reading exactly like a guarantee about the value. DISTINGUISHING FACTS: the two arguments are supplied by the same caller from the same site TODAY, so the pairing is held by lexical proximity rather than by anything the type system or a fold can see; the defect is constructible without touching a single caller, by supplying a correct digest of a different subject. EVIDENCE, TWO INSTANCES IN ONE MODULE, which is what makes it a class rather than a coincidence: `v2.workflow.floor_wet_route` `wet_route_gate_disposition_for_receipt` carries BOTH the envelope/digest pair and the roster-identities/roster-digest pair. The first was demonstrated live -- `v2.test.floor_wet_route` `wet_lease_admits_an_envelope_whose_content_the_digest_does_not_name` constructs an envelope whose content the pinned digest does not name, and the lease gate ADMITS. THE SAME DEFECT READ FROM THE OTHER END: agreement among derived views is vacuous when the views share one reader. A projection was nearly shipped with a row silently deleted because FOUR derived views agreed, all fed by a single reader -- one source feeding many views made agreement carry no information, exactly as a digest and its subject being independent lets them disagree unnoticed. THE THIRD FACE, AND THE ONE THAT SURVIVED REVIEW LONGEST: PROSE ADJACENCY IS NOT A JOIN EITHER. `wet_route_identity_rows_block_with_publication` carried an annotation stating that EXACTLY TWO per-identity classes are waived under a valid publication transaction, three lines above a body that returned false unconditionally and waived FOUR -- so `no_verdict`, the ABSENCE of a verdict, was converted into a green merge path. The prose and the code disagreed by a factor of two IN THE SAME FUNCTION and FOUR APPROVALS READ PAST IT. An annotation is not checked against the body it sits above by anything: it READS as documentation and FUNCTIONS as an assertion, and by DESIGN section 4c no `Accepted` program can read one, so nothing in the toolchain will ever disagree with it. Provider count is not attention -- four approvals is not four readings of that function. AND FIELD ADJACENCY IS NOT A JOIN EITHER, which is the same claim one scale down: in `v1_compiler.bin.claim_batch`'s two pre-execution refusal arms the annotation two lines above `WetReceiptIdentityRow` was RIGHT, and the neighbouring fields `observed_entry_rel` and `observed_function` were RIGHT -- Optional, and correctly None on exactly those arms -- and `wall_ms`, two fields later in the SAME STRUCT LITERAL, fabricates a 0 for a duration nothing measured. PROXIMITY TO A CORRECT THING IS NOT CORRECTNESS: a reader scanning that literal gets three signals of care and one fabrication, with nothing in the text distinguishing them. And 0 is the WORST available fabricated value for that field rather than a neutral placeholder, because it is THE FASTEST OBSERVABLE EXECUTION -- so a consumer that averages, thresholds or ranks on wall_ms without first branching on the outcome wire reads the ABSENCE of a measurement as the BEST measurement in the corpus. An anomalous-looking fabrication is found by whoever first sorts the column; this one sorts to the top and is found by nobody. All three faces are one defect: A JOIN THAT WAS NEVER MADE, so the corroboration a reader believes they are getting was never computed. RECOGNITION RULE: whenever a parameter list contains a value and a summary, hash, count, digest or identity OF that value, ask what refuses when they disagree. If the answer is nothing, the summary is unverified input wearing the costume of a derived fact. The mirror question for agreement: when N sources agree, ask how many INDEPENDENT reads produced them; if the answer is one, the agreement is a copy agreeing with itself. THE REPAIR, already built once and therefore not speculative: DERIVE THE DIGEST FROM THE VALUE AT THE POINT THE VALUE IS OBTAINED, NEVER ACCEPT IT AS A PEER PARAMETER. The seed`s `read_wet_receipt_envelope` now returns the decoded envelope and the digest of the bytes it decoded FROM, in one call, so the two cannot name different objects; its control `carried_digest_names_the_bytes_the_envelope_was_decoded_from` rewrites the file between reads and asserts the carried digest still names its own bytes. RUNG FOUND AT: mitigatable -- a comment and a caller convention. CEILING: structurally impossible, because a digest produced by the same operation that produces the value has no constructor that lets it name a different one. NEXT-RUNG TRIGGER, a capability: a carrier type that pairs a value with a digest DERIVED at construction, so no signature anywhere can accept the two separately -- the `.dag` instances named in `gunbc.guarantee_stall` `wet_route_model_lags_seed_stall` are the population that trigger retires.) +- **a written rule is how a LATER READER learns what happened; it is not how a PRESENT AUTHOR is stopped, so a ledger that grows without changing what is easy to type buys documentation and no prevention** (INVALID STATE: a failure class is answered by APPENDING A ROW -- to this roster, to a stall roster, to an annotation -- and the row is then counted as the remedy. The class recurs anyway, because at the moment of authoring the dangerous form is still the shortest thing to type and nothing costs more when it is chosen. RECOGNITION RULE, which is the whole row: after filing, ask WHAT IS NOW HARDER TO DO THAN IT WAS BEFORE. If the honest answer is nothing, the filing was a RECORD and not a REPAIR, the class rung did not move, and it must be reported as UNREMEDIED rather than as covered. WHY IT IS NOT MERELY WEAK BUT ACTIVELY MISLEADING: a filed class gets CITED AS COVERAGE, so a reviewer meeting it reads it as handled and the filing converts an open deficit into a closed-looking one while leaving the deficit exactly where it was -- a DESIGN section 4b(1) rung wearing a 4b(2) costume, which is this ledger own version of rung inflation. An unrepaired filing is therefore WORSE than no filing, not equal to it. WHY THE RECALL DOES NOT FIRE: a rule filed under its SUBJECT MATTER is retrieved by thinking about that subject matter, and an author executing a step attends to THE GOAL, not the class of the step. Nothing in `retire the superseded poller` cues `I am about to type a pattern that can match myself`. THE TEST RUN ON A REAL POPULATION THE SAME NIGHT IT WAS WRITTEN, AND IT CAME BACK MOSTLY NEGATIVE: across ten class-filings required in one day, the identity-join rows made nothing harder (`sort -u` is exactly as easy to type as `sort`); the prose-adjacency, field-adjacency and digest-beside-subject rows made nothing harder (no lens refuses a digest passed beside its subject, and that signature is still the natural one to write); the empty-reading rows made nothing harder (the short read is still shorter than the head-filtered one, which is precisely why four people reached for it). ONE of the ten changed what is easy, and IT WAS NOT A FILING: a schema hazard was answered by computing the affected population and commenting on each of the five pull requests about to hit it, delivering friction to five named authors rather than prose to a ledger. A second was initially scored as a climb and the correction is the sharper result: the carrier ALREADY HAD THE RIGHT SHAPE and nothing about it was built that day; what the day produced was the DISCOVERY that a wrong thing was writable beside it, because an author wrote a fabricated previous-rung into a drop row, A REGEN RAN GREEN OVER IT, and a reader happened to look at the field. NO MECHANISM WAS WATCHING. Corrected score: ONE push-friction instance that expires when five pull requests land, ZERO climbs, ONE discovery -- and the discovery is the least repeatable item in the list, since the next occurrence is written where nobody is reading and the green regen is identical. A LUCKY READ IS NOT COVERAGE. THE TWO KINDS OF FRICTION ARE NOT INTERCHANGEABLE AND ONLY ONE COMPOUNDS: PUSH friction is delivered to named authors at the moment of impact and EXPIRES when their changes land; PULL-PROOF friction removes the constructor, so nothing needs delivering to anyone ever again. A day producing one of each must not report two. THE CONCLUSION THE AUDIT FORCES, STRONGER THAN THIS ROW STARTED: retrieval-by-recall is not a mechanism that becomes adequate at a smaller ledger size -- IT IS THE WRONG MECHANISM AT ANY SIZE, because the retrieval cue never arrives regardless of how few rows there are. Every row real deliverable is THE FRICTION, and the prose is its RECEIPT rather than its product. RUNG FOUND AT: mitigatable, and this row is an instance of what it describes, which is why it carries a trigger rather than resting on having been written. CEILING: structurally impossible for any class whose dangerous form can be removed from the vocabulary entirely -- an unwritable form needs no rule. NEXT-RUNG TRIGGER, a capability and not an artifact: for each filed class, a named ARTEFACT OF FRICTION -- a lens that refuses the shape, a carrier with no unsafe constructor, a wrapper shorter to invoke than the raw form -- so that a filing arrives WITH a change in what is easy, and the obligation is symmetric: whoever ASKS for a row owes the friction artefact or the plain sentence that nothing got harder and the class stands UNREMEDIED.) +- **a gate that admits when its required evidence has not reported, because the admission arm keys on OBSERVED FAILURE rather than on OBSERVED SUCCESS.** INVALID STATE: a required check exists, is correctly configured, and is consulted -- and the consulting arm asks `has anything reported a failure` where the guarantee needs `has everything reported a success`. Between those two questions sits the state where nothing has reported at all, and it is admitted. HARM, AND THE REASON THE CLASS SURVIVES REVIEW: every artifact reads as present and correct. The gate is enumerated in the required roster, it is active, it blocks a reported failure exactly as advertised, and a reader auditing the configuration finds no drift -- because there is none. The defect is in the QUANTIFIER, and a quantifier has no configuration surface to inspect. DISTINGUISHING FACT, AND IT IS THE RACE RATHER THAN ANY FIELD: the class is only reachable inside the window between the evidence being DEMANDED and the evidence ARRIVING, so it is invisible to any observation taken after that window closes -- afterwards the check has reported, the record looks ordinary, and only the ORDER of two timestamps distinguishes an admitted merge from a blocked one. RECOGNITION RULE: for every gate, find the arm that admits and read what it is quantified over. If it enumerates the evidence that HAS arrived and asks a property of each, the empty enumeration admits. If it enumerates the evidence that is REQUIRED and asks each for a success, it refuses. The two spellings are one word apart and behave identically on every input except the one the class lives in. DISTINCT FROM `absorbing_fallback`: that arm WIDENS when it cannot compute an answer and is at least loud about doing work; this arm NARROWS to the empty set and is silent, because a fold over nothing returns its seed and nobody wrote the seed down as a decision. **SPECIMEN (eager-bear-107, gunbc#10236, 2026-09-03), and it landed a break rather than merely permitting one.** The pull request pushed head d8cd3034 at 19:49:33Z, GitHub created its `witnesses` run at 19:49:40Z, and the merge completed at 19:49:43Z -- three seconds after run creation, before any job of it reported. That run then concluded with `required-witnesses-build` and `required-witnesses-floor` both FAILURE, and the head it certified nothing about landed on main as cfe19ea7, adding two duplicate declarations to THIS MODULE that refused main at resolve until a repair pull request landed. WHICH LANE CAUGHT IT IS PART OF THE FILING, because the two main flakes are separable in this evidence and a reader who conflates them loses that: on the post-merge main run at cfe19ea7 the duplicates reddened `required-witnesses-build` while `required-witnesses-floor` was GREEN, so the break is not the cost class this repository's other main flake belongs to and cannot be waved away as more floor variance. THE DETECTING LANE WORKED AND WAS TWENTY MINUTES LATE, which is the shape of this class rather than an aggravating detail: `required-witnesses-build` refused the duplicates correctly -- `generated-artifact CarrierRefused cause=resolve`, the authority declining to answer -- and its job completed at 20:04:14Z against a merge at 19:49:43Z, an unadjudicated interval of twenty minutes and thirty-one seconds. NOTHING WAS MISROUTED AND NO LANE WAS MISSING. **A RETRACTION IS RECORDED HERE BECAUSE THE MISREADING IS ITSELF AN INSTANCE OF A ROSTERED CLASS.** An earlier revision of this row said the catcher was `heal-generated-artifacts` and that it was event-conditional, on the evidence that heal FAILED on the pull-request run and was SKIPPED on the main run of identical content. The job graph refutes it: heal died at step 2, `Checkout triggering branch head`, at 19:52:01Z, with `Regenerate every committed generated artifact` SKIPPED -- the regenerator never ran, so heal detected nothing, and it failed because the merge had deleted the branch head it wanted three seconds after the run was created. A downstream consequence of the merge was read as a detection of the defect. That is `green_reported_over_a_population_the_instrument_does_not_own` inverted -- a RED reported over a population the instrument never reached -- and the recognition rule transfers exactly: A JOB'S CONCLUSION IS NOT EVIDENCE ABOUT THE SUBJECT IT IS NAMED FOR UNTIL ITS STEP RECORD SHOWS IT REACHED THE STEP THAT JUDGES. It survived four readers passing a narrative and was caught by one who read the job graph. Ruleset 16178731 carried zero divergence from `gunbc.repo_ruleset` desired state throughout. Over the forty most recently merged pull requests, six had no `witnesses` run that completed successfully on their own head before `merged_at`. **THE SAME SHAPE IN THIS REPOSITORY'S OWN MODEL, which is what makes it a class and not an incident:** `gunbc.merge_lifecycle` `merge_enabled` folded `policy_admits` over the receipts found for a head from `init: false`, so the absent-receipt verdict was a caller-local constant standing in for a policy fact. There the seed was the SAFE answer and the harm was the mirror image -- the live behavior became unrepresentable, no witness could go red on it, and the module named a policy stronger than the live one as live for two months. RUNG FOUND AT: mitigatable, and only by human habit. CEILING: structurally guaranteed -- the merge queue construction makes the queued ref's run a precondition of landing rather than a fact observed beside it. NEXT TRIGGER: `gunbc.guarantee_stall` `merge_admission_terminal_verdict_stall`. FILED AS A STALL AND NOT A RUNG DROP: a 4b(3) drop asserts a REGRESSION and nothing regressed -- GitHub's rule has evaluated reported check runs this way since the ruleset was created, so the capability was never held and a previous rung would be invented. What existed was 4b(1) inflation, corrected by making the live policy representable. +- **a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.) - **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, files INSIDE that closure moved, landed by UNRELATED pull requests, none of them the receipt's own author, and A SINGLE AFTERNOON'S ARRIVALS WERE ALREADY SUFFICIENT. THE COUNT IS DELIBERATELY NOT CARRIED HERE, and its absence is part of the finding: the first attempt to state it was taken from a file-level diff, overstated, and was corrected against the measured closure WITHIN THE SAME EVENING, before this row had even landed -- a transcribed measurement is unreachable from the thing that produced it, so it rots while nobody touches either end. Worse, the severity moved OPPOSITE to the count: fewer arriving files means a SMALLER surface was already enough, so a reader anchored on the number would have read the correction as good news. NAME THE INSTRUMENT INSTEAD, and re-derive rather than quote: enumerate the closure with `v1_compiler.bin.claim_batch` `--print-entry-closure` over the routed entries -- a non-evaluating mode that prints the population the RESOLVER retained, not an import re-walk -- and intersect it against the files changed since the dispatch tree. Run it beside a positive control whose membership is known, because an empty intersection and a dead instrument print the same thing. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) +- **a next-rung trigger naming a capability that had ALREADY SHIPPED when the row was written, so the class is born retired and its stall is permanent and invisible** (INVALID STATE: a class below its ceiling names a restoration or next-rung trigger, as section 4b(2) obliges it to, and the named capability was ALREADY PRESENT IN THE TREE AT FILING TIME. The trigger is therefore not a transition: there is no future event at which it becomes true, because it was never false. The row reads as tracked debt with a named exit and is in fact untracked -- nobody will retire it, because retiring it requires observing a change that already happened before anyone was watching. HARM: this is worse than an untriggered stall, because an untriggered stall at least presents as unfinished. A row with a satisfied trigger presents as COMPLETE WORK AWAITING AN EVENT, so it is skipped by exactly the audits that exist to find stalls, and the class it describes stays at its found rung indefinitely while the roster reports it as governed. THE GAP THAT ADMITS IT IS IN THE OBLIGATION ITSELF: section 4b(2) requires a class below ceiling to NAME its next-rung trigger and says nothing about that trigger being UNSATISFIED AT FILING TIME. Naming is checked by review and by the reader; satisfiability is checked by nobody.RECEIPT, AND IT IS THE STRONGEST KIND -- FOUND BY THE AUTHOR OF THE ROW WHILE WITHDRAWING IT, NOT BY AN AUDIT: session vivid-ibex-751 withdrew a finding of their own whose trigger read that the listing states its own truncation and total, against a capability that had shipped in gunbc#9648 a WEEK EARLIER. The trigger was true on the day it was written. Credit for the specimen is theirs and it is cited here as their withdrawal rather than as a third-party report, because the withdrawal is what makes it evidence: an author checking their own trigger against the tree is the only place this is currently caught.RECOGNITION RULE, DECIDABLE AND CHEAP, WHICH IS WHY THIS IS A ROW AND NOT A NOTE: a trigger whose named capability PREDATES THE ROW'S OWN EARLIEST RECEIPT. Both operands are already carried -- the capability has a landing commit and the row has its receipts -- so the comparison needs no judgement and no new authority. A class whose detection needs judgement gets detected once.ITS EXACT DUAL IS ALREADY ROSTERED AS restoration_promise_names_a_route_that_does_not_exist, AND THE PAIR IS THE FINDING RATHER THAN EITHER HALF. That row is a trigger naming a run, lane, cadence or sweep the tree DOES NOT CONTAIN; this row is a trigger naming a capability the tree ALREADY CONTAINS. NOT-YET and ALREADY are TWO WAYS a named condition fails to be a TRANSITION, and both leave a class untracked while it reads as tracked. THIS IS DELIBERATELY NOT WRITTEN AS AN EXHAUSTIVE PAIR, and the reason is this row's own subject turned on itself: a closed count over a population nobody enumerated is the defect rostered as selection_view_read_as_population, and TWO IS THE NUMBER OF ARMS THE ROSTER HAPPENS TO HOLD TONIGHT, not a proof that a third is unwritable. At least one further arm is already conceivable -- a trigger whose satisfaction is UNDECIDABLE, which is neither not-yet nor already and cannot fire for a third reason -- and it is unrostered because nobody has hit it, which is exactly the evidence a closed claim would have suppressed. The axis is offered as a DISCOVERED PAIR to search along, never as a partition to check membership against -- the first as a promise that can never fire, the second as tracking that fired before anyone was watching.WHY TWO ROWS AND NOT ONE ROW WITH TWO ARMS, STATED EXPLICITLY BECAUSE A READER LANDING ON THE PAIR WILL ASK AND AN UNSTATED ANSWER READS AS AN OVERSIGHT. The test applied is whether the REPAIRS diverge, and they do, in both the detection and the remedy. DETECTION: the dual is decided against THE TREE'S CONTENTS -- does the named route exist -- and is at ceiling 3 for exactly that reason; this row is decided against THE ROW'S OWN RECEIPT DATES, which the tree does not need to be consulted for at all. REMEDY: the dual is repaired by BUILDING THE ROUTE the trigger names, or by rescoping the promise to one that exists -- work outside the row. This row is repaired by RE-TRIAGING THE CLASS ITSELF, because a trigger that was already true means the class's current rung was never re-measured after the capability landed, so the row may be at ceiling already, may have climbed silently, or may be genuinely stalled for a different reason nobody has looked for -- work inside the row. Different evidence, different actor, different artifact touched. They are cited to each other rather than merged.THREE NEARBY ROWS THAT ARE NOT THIS ONE, RECORDED BECAUSE THE THIRD WILL BE RE-LITIGATED. self_authorized_dissolution is about a trigger offered as PERMISSION to create debt rather than as a lifecycle fact -- an authority question, not a satisfiability one, and a trigger can be validly authorized and still satisfied at birth. a_written_row_is_not_a_firing_mechanism is about a row STANDING IN FOR a mechanism -- and a trigger satisfied at birth may sit under a perfectly real, perfectly firing mechanism, which is what makes it invisible. predicate_vacuously_true_on_an_empty_domain is the closest in flavour and still a different subject: its domain is empty at EVALUATION time and its harm is a verdict read as evidence, whereas this is satisfied at FILING time and its harm is a transition that can never occur.RUNG FOUND AT: mitigatable, and the mitigation is that an author happens to check their own trigger against the tree while withdrawing something else. CEILING: structurally guaranteed -- a trigger carrying the capability it names, rather than prose describing it, admits a filing-time comparison against that capability's landing, so no Accepted program can file a row whose trigger is already discharged. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot itself be satisfied at birth: the trigger field is typed as a reference to the capability it names rather than as prose, AND the roster refuses a row whose referenced capability predates the row's own earliest receipt. Neither half alone is sufficient -- the typed reference without the refusal is a shape that permits the state, and the refusal without the typed reference has no operand to compare. From 69ef45b55bacd710709e842d03759555cfb27bd2 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Fri, 4 Sep 2026 06:39:37 +0000 Subject: [PATCH 5/9] chore: regenerate drifted generated artifacts (ci auto-heal) --- docs/design-failure-modes.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 2b552043801..80149b13443 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -90,6 +90,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `premise_that_a_shared_subject_means_disagreement` - `live_argument_threaded_past_the_arm_that_decides` - `check_subject_shape_cannot_represent_the_state_the_check_detects` +- `prose_asserts_an_enforcement_no_operation_can_produce` - `per_argument_exhaustive_matrix_blind_to_a_cross_argument_relation` - `closure_subject_with_no_enumerable_membership` - `ceiling_never_exercised_for_a_population_the_census_cannot_plan` @@ -98,6 +99,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `a_written_row_is_not_a_firing_mechanism` - `required_evidence_absent_reads_as_evidence_of_pass` - `right_censored_cost_read_as_exact` +- `guard_precondition_discharged_by_the_route_that_uses_it` - `receipt_subject_surface_outlives_its_own_production_time` - `trigger_satisfied_before_the_row_was_written` @@ -201,6 +203,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **A PREMISE THAT MAKES A COST LOOK CORRECT RENDERS THE REGION BEHIND IT UNEXAMINABLE, AND THE TELL IS REPEATED REPAIRS THAT ALL STOP AT THE SAME BOUNDARY.** The invalid state is a stated justification -- not a check, not a type -- that classifies an observed cost as intended, so no instrument is ever pointed at it and its absence looks like the absence of a problem rather than the absence of a measurement. SPECIMEN, and it is this carrier's own history: `gunbc.recurring_failure_mode` was repaired twice for merge contention -- blob to `data` rows, then rows to one line each -- and BOTH repairs measured only the APPEND OF A WHOLE ROW. Both rested on a premise stated in the first: that two lanes editing the SAME class conflicting is "correct, because that is real disagreement about one fact." THE PREMISE IS FALSE FOR THIS CARRIER, and the discriminator is what actually accretes on a class. What lands is INDEPENDENT RECEIPTS from unrelated lanes -- a second specimen, a climb receipt, a corroboration reached from the opposite direction -- not competing claims about one fact. On 2026-09-02/03 three lanes appended three independent receipts to `state_space_conflation` and resolved it by hand-negotiating byte order; that row reached 23,023 characters. Independent accretion is not disagreement, so the conflict was textual contention wearing the mask the premise had fitted for it. **WHAT MAKES THIS A CLASS RATHER THAN ONE MISTAKE IS THE SHAPE OF THE EVIDENCE: the premise was load-bearing for two repairs, and neither repair's author looked inside a row.** A false premise does not merely produce a wrong answer -- it produces NO answer, because it removes the question. That is why it survived a measurement campaign that was otherwise careful: the same lane that measured `git merge-file` at a named merge base to characterise the block-tail defect never measured an intra-row edit, because the premise said the result would be correct. RECOGNITION RULE: when a repair of a recurring cost is being scoped, find the sentence that explains why the ADJACENT cost is acceptable, and ask what measurement would falsify it. If no measurement was ever run against it -- and especially if the same boundary has now been re-approached more than once -- the premise is a candidate, not a finding, and the cheap discriminator is to run the instrument the premise made look unnecessary. Here that was one `git merge-file` on two lanes editing one row: 0 conflicts on different receipts, 1 minimal conflict on two appends. **WHAT IS NOT CLAIMED.** This is not the claim that stated justifications are suspect in general, which would be unusable. The class is narrower and its two conditions are jointly required: a premise that classifies an observed, RECURRING cost as intended, AND a repair history in which the same boundary was approached more than once without that cost being measured. One repair stopping at a boundary is ordinary scoping. RUNG: mitigatable, and honestly so. The harm is deferred author time -- three lanes hand-negotiating byte order on one row -- and it is contained only by someone eventually re-deriving the premise, which is a review practice and not a mechanism. CEILING, derived rather than aspirational: this cannot climb to construction, because whether a stated justification is true is not decidable from the tree -- the premise here was refuted by an empirical fact about how lanes ACTUALLY append, which no property of the source expresses. It is a ratchet forever in the sense of DESIGN section 5. NEXT-RUNG TRIGGER, a capability and not an artifact: the ability to measure contention on a carrier CONTINUOUSLY rather than at repair time -- a per-declaration conflict count over merge history -- so that a region the premise renders unexaminable still produces a number that rises. That is what would have made the intra-row cost visible without anyone doubting the sentence. - **a live argument threaded past the arm that actually decides the verdict** (INVALID STATE: a check is named and cited as LIVE because one of its arguments is read from the real tree, while the predicate it asserts is already settled by a different, hand-authored argument that the live one cannot influence -- so the live input is threaded into a call whose answer does not depend on it. HARM: the row is permanently green with respect to the tree it claims to observe, and its name is what a reader consults when asking whether the class is covered live, which is exactly the decoration DESIGN section 4b calls worse than absent because it will be cited as coverage. It also BUYS THE COST OF LIVENESS WITHOUT THE SIGNAL -- the live producer here is a whole-tree fill -- so the row looks expensive enough to be doing something. DISTINGUISHING FACT, and it is what separates this from an ordinary weak assertion: THE DECIDING ARM AND THE LIVE ARM ARE DISJOINT INPUTS TO ONE TOTAL FUNCTION, so nothing at the call site looks wrong; every argument is well-typed, the live producer is genuinely called, and the fixture argument is genuinely a fixture. The tell is structural and mechanical -- find the arm that can produce the asserted outcome ALONE, and ask whether the live argument is an input to it. SPECIMEN, gunbc 2026-09-03: v2.test.claim.long.effect_reach_test effect_reach_live_03_normalize_witness_derived_host_reading_holds asserted v2.lens.effect_reach derived_host_reading over effect_reach_classification_from_facts with decls bound to v2.std.fn_index fn_arrow_decl_facts_live and data_inits bound to a hand-authored one-element live_03_normalize_data_inits. In that function the data-init arm closure_data_init_path_flows consumes only closure_modules and data_inits: a path-shaped literal_fp in any closure module yields a GunbcCompileEntrySink flow with no reachability and no decls, and any non-empty flow list is HostEffectReach, hence derived_host_reading. The module also carried an annotation asserting that this row LEGITIMATELY READS the live producer, so the false claim was stated in prose beside the code that falsified it. DISCRIMINATING RED AND POSITIVE CONTROL, BOTH EXECUTED rather than argued, via claim_batch on the lens: substituting decls to the EMPTY list while holding the hand data_inits fixed leaves derived_host_reading TRUE -- the live argument is non-discriminating; and holding the LIVE decls while substituting data_inits to EMPTY yields derived_host_reading FALSE with effect_reach_flow_count 0 -- the live scan contributes ZERO flows from this entry, so the row had no live content at all rather than merely a weak one. The unmodified row PASSES, which is the positive control that the harness and the lens were both working. THE PAIR IS THE METHOD AND NOT AN INCIDENT OF THIS SPECIMEN: neither substitution alone decides the question, because a passing empty-decls arm is consistent with the live arm merely being redundant, and only the second substitution shows it was empty. RESOLUTION AND WHY IT IS A DELETION: the row was removed rather than renamed, because its deciding arm was already enrolled over the identical literal_fp as effect_reach_path_data_init_derived_host_reading_holds in the same module, so a rename would have kept a DESIGN section 2 duplicate spelled with real module names; and no live row is authorable on that lens today, since its closure comes from ModuleImportFact, which v2.lens.live_read_classification g2_live_production_boundary_law declares FIXTURE-FACING with no live producer in the corpus. THE SHAPE OF THE MISTAKE IS AUTHORABLE BEFORE THE PRODUCER EXISTS, which is why the name of the missing producer is the trigger and not the excuse. RUNG FOUND AT: 1, mitigatable -- nothing silent is produced, the row simply asserts less than its name, and the only thing containing the harm is that a reader may read the call. CEILING: 2, mechanically preventable. The question -- does the asserted outcome change when this argument is replaced by its type identity or an empty value -- is decidable by EXECUTION per argument and is exactly the coverage-is-per-argument grain, but it is not derivable from the call shape alone, because whether an argument is influential depends on the callee body over the actual fixture values. Not higher: a caller may pass any well-typed value to any parameter and forbidding a non-influential argument would forbid ordinary total functions, so the invalid state stays writable. NEXT-RUNG TRIGGER, named as the capability and covering BOTH directions: a per-argument influence check that, for each argument of an enrolled witness call, re-executes the witness with that argument substituted and refuses when the verdict is unchanged for an argument the row NAMES -- sufficient for reddening both a non-discriminating live argument and a row whose live arm contributes nothing, since the specimen needed both substitutions to be characterised. A convention that live rows must be named live would be satisfied while the capability stayed dead. BOUNDARY against neighbouring classes: check_subject_narrower_than_its_declared_claim is about a subject that is a strict subset of what the row claims to range over, and the repair there is widening the subject; here the subject is right and one INPUT is inert, and the repair is either removing the inert input or supplying the producer the name promises. It is likewise not incidental_denominator_as_wall, which is about the wall being computed over the wrong population. AND IT IS SHARPER THAN THE ASSERTED-NOT-PRODUCED SHAPE IT MOST RESEMBLES, which is the reason it is filed rather than folded in: there the producer is IMPORTED AND UNCALLED, so the tell is visible at the call site -- a hand-built value stands where a produced one should. HERE THE PRODUCER IS GENUINELY CALLED and its result is genuinely passed, and what fails is REACHABILITY INSIDE THE CALLEE, so no reading of the call site can see it and the tell is only recoverable from the callee's arm structure or from substitution. THE GENERAL FORM IS WORTH MORE THAN ANY ONE ROW: a verdict DISJOINED over a live arm and a fixture arm silently becomes the fixture arm, and nothing goes red, because the disjunction is satisfied before the live arm is consulted. BOUNDARY against the three adjacent roster rows, none of which is this: absorbing_fallback is a FAILURE arm that widens instead of refusing, and here no arm fails at all -- the wrong answer is a TRUE one reached without the input it names; empty_observation_narrow is a CENSUS whose population is narrower than its claim, where the subject is the defect, while here the subject is right and one input is inert; and predicate_vacuously_true_on_an_empty_domain is green because its domain is EMPTY, whereas this predicate ranges over a perfectly non-empty fixture domain and is simply not a function of the argument the row is named for. The repairs are disjoint in all three directions, which is DESIGN section 4b's keying-on-the-repair test.) - **a lens is correct and live over a subject shape that cannot represent the state it detects** (a check reaches its subject, executes on every run, and is enrolled as coverage -- and its RED is UNAUTHORABLE there, because the representation the subject is expressed in has no constructor for the state the check matches on. Nothing is skipped, nothing is absorbed, no population is withheld, and the check is not wrong: hand it a value of the shape it expects and it fires correctly. It is the SUBJECT that cannot carry the state, so the check is permanently green over that subject while reading as verified. **THE BOUNDARY AGAINST check_subject_narrower_than_its_declared_claim DECIDES THE REMEDY AND THEY ARE NOT THE SAME DEFECT.** There the subject is a SMALLER POPULATION than the claim -- widen it and the missing instances appear, so the repair is a scope edit. Here the population is exactly right and every member is structurally incapable of exhibiting the state; widening adds more members that equally cannot exhibit it, so a scope edit is guaranteed to change nothing while looking like a fix. It is also NOT absorbing_fallback: nothing widens on failure and no arm degrades -- the check runs its ordinary path to an honest verdict over a subject that could only ever produce one answer. **SPECIMEN WITH A RECEIPT, measured 2026-09-03 on gunbc#10245 against origin/main 8b2323f414 and reproduced on 8bfae78d78.** v2.lens.determinism classifies a call through node_callee_symbol, which requires node_is_call, which matches ComputationNode { behavior: Transform }. Its live subject is the fn-arrow body skeletons built by v1_compiler.coproduct_reflection marshal_skeleton, which returns conj_record at both return sites, i.e. TypeNode { connective: Conj }, for EVERY node. A Conj TypeNode cannot satisfy that match, so no skeleton node is ever a call, every body classifies Deterministic by non-membership, and determinism_transitive_holds over a fn_arrow_decl_facts_live population is green by construction. The same mismatch holds four production_qualification_origin_probe_witness frontier rows red, which is what makes it a class rather than an incident: one representation mismatch darkens every consumer of that subject at once. **WHY IT SURVIVES REVIEW, and this is the dangerous part.** The check is real, the lens is correct, the subject is live and non-empty, and a positive control asserting the population is non-empty PASSES -- so every ordinary vacuity guard agrees. A NON-EMPTY SUBJECT IS A NECESSARY PRECONDITION MASQUERADING AS THE CHECK. Nine approving reviews passed over the specimen and none exercised the body skeletons; it was found by planting a violation and watching nothing happen. **THE BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, filed the same day and easy to conflate with this.** There the check CAN go red -- a different, hand-authored argument decides the verdict and the live argument is threaded past it, so the row is inert with respect to the tree while the predicate itself still discriminates. Here NO argument can produce the refused state, because the subject's representation cannot express it; there is no other arm carrying the verdict, and substituting inputs changes nothing. The two are distinguished by one question: is there an arm that could produce the asserted outcome alone? If yes and the live input is not one of its inputs, that is the threaded-argument class and the remedy is to delete or re-source the row. If no arm can produce the refused outcome at all, this is the class and the remedy is a representation change, which is why its trigger names a shape rather than a call site. **RECOGNITION RULE, which is DESIGN 4b's own question asked BEFORE the check is written rather than after: name the state the check refuses, then construct a value in the subject's OWN representation that exhibits it.** If you cannot construct one, the check is a decoration over that subject however correct its logic. The construction is cheap and is the whole test: two values differing only in the field the check keys on, asserting it FIRES on one and is BLIND to the other. Both arms passing is the executing record of the gap; when the representation lands, the blind arm reds and names itself. **THE REPORTING RULE THAT FOLLOWS: a class's rung is the minimum across its in-scope paths (4b(1)), so a fixture path where the RED is authorable does NOT stand in for a live path where it is not.** Citing the fixture rung while the live path is dark is rung inflation. **AND IT IS NOT A 4b(3) DECLARED DROP -- filing one is its own error**, which is where the specimen nearly went: 4b(3) governs a REGRESSION, with a previous rung and a population that LOST a guarantee. When the shape mismatch predates the check, the wall was never lit through that path, and a capability that was never real cannot be dropped. The honest instruments are 4b(1) rung honesty and 4b(2) an untracked stall made tracked. **RUNG: 1 (mitigatable) -- the gap is nameable and, once found, held open by the two-arm control. CEILING: 4, since whether a subject's representation can inhabit the state a check matches on is decidable from two declarations the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: a check declares the subject representation it matches over, and a check whose match is unsatisfiable by that representation fails to compile -- so the decoration cannot be authored at all, rather than being found later by someone constructing the value by hand.**) +- **an annotation states a refusal the model has no operation capable of returning, over a field that is recorded and never read** (INVALID STATE: a carrier records a discriminating value, prose beside it describes what that value prevents, and no function anywhere ACCEPTS the value and can return a different answer because of it. The declaration typechecks, the witnesses pass, and the sentence is not a lie about intent -- it is a description of a wall that was never built. HARM: the prose is read as the guarantee, because a reader checking whether a class is handled finds a paragraph saying it is. The field's presence corroborates the paragraph and the paragraph explains the field, so each is the other's evidence and neither touches an executed path. **THE RECOGNITION RULE IS A RESOLVED READ, NOT AN INFLUENCE TEST, AND THE DIFFERENCE IS WHAT MAKES THE CLASS DECIDABLE: name one RESOLVED, NON-CONSTRUCTION READ of this field. If none exists anywhere in the field's dependent production closure, the field is inert and the sentence beside it is the only wall.** An earlier draft of this rule asked whether an operation could 'return two different results because of' the field. That is semantic INFLUENCE, and it does not agree with the census that would decide it: a function may bind a field and never use the binding, or compare it inside an arm already decided, leaving the answer invariant while a use census reports the wall present. Stating the rule as influence and the instrument as syntax would reproduce, in this row's own enforcement, exactly the false coverage the row exists to name. So the population is narrowed to the mechanically decidable one -- absence of any resolved non-construction read -- and the residue is handed to a neighbour rather than absorbed. **THE THREE-APPEARANCE TELL IS A CANDIDATE GENERATOR, NOT A PROOF, AND MUST NOT BE CITED AS ONE.** The cheap instrument is a field appearing exactly three times -- type declaration, constructor parameter, constructor body -- and nowhere else. It is greppable and it is where every instance below was first noticed. It is not the adjudicator: a consumer may live in another module, reach the field through an alias or a re-export, or read it under a differently spelled binding, so only resolved field-use data settles the question. A grep is how the candidate is found and never how the row is closed. **BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, which owns the residue this narrowing hands off.** A field that IS syntactically read but does not influence the answer -- threaded past the arm that already decided, or bound and dropped -- is not this class and a field-use census cannot adjudicate it; it needs mutation or influence testing. Keeping it here would put an undecidable obligation inside a class whose whole value is that its question is decidable by a read the namespace authority already performs. **WHY IT SURVIVES REVIEW, WHICH IS THE PART THAT MAKES IT RECUR: THE DISCRIMINATING RED IS UNAUTHORABLE.** A reviewer looking for the missing negative case cannot write one, because there is no call to make -- the wrong input has no operation to be wrong to. So the class produces no red, and review of a diff that contains it correctly reports no failing check. Measured: three instances passed three independent review rounds and two side-chat rulings on gunbc#10264 and gunbc#10249 before any was found, and the third was found only after a peer session described the shape from an unrelated lane. The count is three and not four because a fourth candidate was carried in this row's first draft and then refused by the rule stated above -- that reclassification is recorded in its own receipt below, and it is the reason the measurement is quotable at all: a count that never loses a member is measuring the author's attention, not the class. **BOUNDARY AGAINST check_subject_shape_cannot_represent_the_state_the_check_detects, which is the nearest neighbour and a DIFFERENT defect with a different remedy.** There a check EXISTS, executes, and is enrolled, and its red is unauthorable because the subject representation has no constructor for the state it matches -- the repair is to change the subject's shape. Here NO CHECK EXISTS AT ALL: the red is unauthorable because there is no operation to call, and the repair is to add the question so the recorded value is examined. Both are permanently green and both read as coverage, which is why they are easy to conflate; a scope edit fixes neither, and a subject-shape edit fixes only the first. **BOUNDARY AGAINST specification-without-execution (DESIGN section 5), which is the general case rather than this class.** There a specification has no consumer. Here there IS a consumer, it executes on every run, and it is green -- what is missing is the interrogation of one field it already carries. The general rule 'find a real consumer green by execution' is satisfied by the defect, which is exactly why it does not catch it. **THREE RECEIPTS ON ONE LANE, gunbc#10264 and gunbc#10249, 2026-09-03.** (1) `tensor_parallel_rank` was recorded on every rank participant and examined by nothing, so a population claiming both workers were tensor-parallel rank 0 decided COHERENT under a law named after tensor parallelism. (2) `EvidenceRouteResolvedConfiguration`'s CAPTURE PAYLOAD FIELDS, and the grain matters because the outer value was not ignored: the response DISCRIMINANT was read, and reading it advanced the stage. What no operation examined were the three strings inside the capture, supplied from a public constructor, so `"garbage"`, `"0"` and `"anything"` rode through a refusal stage on the strength of the arm name alone. The unread subject is the payload, not the coproduct. (3) `VllmHealthCoverageFact.backend` was written once and read by nothing, beneath an annotation promising that a consumer asking about another backend 'gets no answer here rather than a borrowed one' -- the only reachable path was the Ray row, so a multiprocessing deployment would have read Ray's answer off it. **AND ONE THAT THIS ROW DECLINES, BECAUSE THE ROW'S OWN RECOGNITION RULE REFUSES IT.** `vllm_host_vantage(host:)` on the same lane looked like a fourth instance and was carried as one in the first draft of this row. It is not. Its annotation did overstate a wall -- it asserted that acquired provenance now cost 'a vantage per host rather than a keyword' when it cost one wrapper call per host -- but the host argument IS examined: it becomes the vantage's content and is carried into the provenance the annotation is about. Apply the rule in this row and it comes back negative, because an operation taking that value and returning a different answer because of it does exist. The defect there is a FREE CONSTRUCTOR conferring unearned authority, which is a different invalid state with a different repair: the fix was deleting the vocabulary because a wrapper over a bare host name earns nothing, not adding a question about an unread field. Recorded here rather than dropped silently, because a class that absorbs its neighbours stops ranking anything -- and a receipt its own recognition rule rejects is the first evidence that the boundary is real rather than asserted. **AND A SECOND CANDIDATE DECLINED, FROM AN INDEPENDENT LANE, RECORDED BECAUSE THE REFUSAL IS THE BOUNDARY WORKING TWICE.** A peer session's `OobeBrowserSessionReady` on gunbc#10254 was carried here as a fifth receipt on the strength of sounding alike. It is an UNINHABITED SUCCESS SURFACE: whole-tree resolution found no construction anywhere, so no field instance was ever produced and then ignored. That contradicts this row's own boundary sentence, which requires that a consumer EXISTS, executes on every run, and is green while one field it already carries goes uninterrogated -- there is no such consumer when the carrier cannot be built at all. The remedies diverge accordingly: an unread field needs a question that consumes it, an unproducible success surface needs a real construction path or the deletion of the advertised state. Two candidates from two lanes were admitted by resemblance and refused by the rule; that is the evidence that the rule is doing work. **THE CEILING IS STRUCTURAL AND THE TRIGGER IS A SWEEP, NOT ATTENTION.** Both lanes found instances only after independently repairing three or four smaller ones each, and both kept missing the next at the top of the type graph. The next rung is a lens over the Node tree asking, for every declared field of every record, whether any RESOLVED NON-CONSTRUCTION READ of it exists in its dependent production closure -- the same read the namespace authority already performs, so the analysis costs no substrate edit. Two properties of that question are load-bearing and neither is optional. It must be RESOLVED rather than textual, because a consumer may sit in another module or reach the field through an alias, and a grep that misses it would report inertness that is not there. And it must EXCLUDE CONSTRUCTION, because the constructor body reads every field by definition; a census counting that read finds no inert field anywhere and is permanently green -- the decoration this row's own ceiling warns about, one level up. The lens decides absence of a read; it does not decide influence, which is why the influence residue is scoped to the neighbour class above rather than promised here. Until that lens exists the class is mitigatable by review diligence, which both lanes have now measured to be insufficient. - **a per-argument exhaustive matrix cannot see a cross-argument relation, and it READS as exhaustive precisely because it is** (INVALID STATE: a gate function takes two independently derived arguments -- here `wet_route_gate_disposition(standing:admission:)`, whose `standing` came from one receipt envelope and whose `admission` came from a lease pinned to a DIFFERENT envelope. Every arm of `admission` was enumerated and refused correctly for that argument in isolation; every arm of `standing` likewise. The reachable OFF-DIAGONAL state -- lease-admits-A composed with standing-derived-from-B -- inhabits no single argument, so no per-argument enumeration contains it. HARM: the author reports the enumeration as complete, and the report is TRUE. That is what makes this worse than a false completeness claim: a false one is refuted by any counterexample within its stated domain, while a true one over an UNSTATED domain has no counterexample inside the domain it names, so the reader cannot separate `all cases of the argument` from `all cases of the decision`. SPECIMEN (gunbc#9725): five refusal arms of the bootstrap-lease admission were each shown going red under mutation, and `six arms of one argument is not the gate; the gate is the relation between two` was the correction. The repair was structural rather than another arm -- FUSE THE DOOR: the gate no longer accepts a pre-computed admission, it derives the admission itself from the envelope it is judging, so the mismatched pair has no constructor. RECOGNITION RULE: when a matrix is enumerated per argument, ask WHICH RELATIONS BETWEEN ARGUMENTS THE FUNCTION SIGNATURE ADMITS. If two parameters can be derived from different subjects, the product space -- not the union of the axes -- is the domain, and an axis-wise sweep is exhaustive over a projection of it. The tell is a decision function whose arguments are each independently derivable by a caller. THE NEIGHBOUR THIS IS NOT: [[check_subject_narrower_than_its_declared_claim]] is a subject mismatch that a reader can catch by comparing the claim to the check; here the claim and the check agree exactly, and the narrowing is in the DOMAIN both of them share. NEXT-RUNG TRIGGER, a capability and not an artifact: deriving a decision's dependent inputs INSIDE the decision rather than accepting them, wherever two parameters name the same subject -- which is the fused-door move generalized, and makes the off-diagonal unconstructible instead of merely unenumerated. RUNG FOUND AT: mechanically preventable, by a probe that had to be written to construct the state. CEILING: structurally impossible, and reached for this specimen.) - **a subject defined by a CLOSURE with no enumerable membership cannot be protected in advance, only violated in arrears** (INVALID STATE: a receipt, cache key, or admission is pinned to a digest computed over a TRANSITIVE CLOSURE -- here the wet lane's `semantic_subject`, over the per-entry closure of 23 routed witness entries plus `v2.workflow.floor_wet_route`. The digest is a perfectly good detector and a useless protector: it reports a MISMATCH AFTER THE FACT rather than a MEMBERSHIP LIST BEFORE it. HARM: a two-hour dispatch completed and its receipt arrived uncommittable as `ReceiptSubjectDifferent`, because a commit landed inside the closure after the run's head. The lane that would break such a subject cannot decide for itself whether its diff intersects one, so the only available discipline is asking the holder afterwards -- which is not a discipline, it is a post-mortem. THE VISIBLE SURFACE IS NOT THE SUBJECT, and reporting it as one is the same defect in a different costume: the wet subject's visible surface is 19 files, while the resolver's own lines report 47 modules and 1180 resolved items for ONE entry, reaching transitively into `src/v2/std/` and `src/v2/compiler/`. A lane can invalidate the receipt while touching none of the 19 and doing nothing wrong. A list handed a completeness property by the mere fact that it is a list is the trap; the resolver's numbers are what refute it, which is why they are quoted rather than estimated. THE CONSEQUENCE FOR ANNOUNCEMENTS, recorded because it is the half that fools the announcer: a hold announced over an unenumerable subject is not protection, and the artifact recording that the announcement happened is indistinguishable from the protection existing. A hold nobody can check is WORSE than no hold, because its holder then treats the subject as protected. SCOPE, and it is wider than the specimen: EVERY subject-pinned receipt in this repository has this hole; the others have not noticed because none has yet burned a long run to it. RECOGNITION RULE: when a digest pins a subject, ask WHETHER ANYTHING PRINTS THE SUBJECT'S MEMBERSHIP. If the only instrument that knows the membership is the comparison itself, the subject is detectable and not defendable, and any fence described over it is a request rather than a constraint. NEXT-RUNG TRIGGER, a capability and not an artifact: a producer that PRINTS the closure membership for a routed entry, SUFFICIENT that a lane can decide FOR ITSELF, BEFORE LANDING, whether its diff intersects a live subject. THE POINTED PART, CORRECTED ONCE ALREADY AND THE CORRECTION IS THE WHOLE VALUE: the set is not merely computed and discarded, it is COMPUTED, HELD, AND RETURNED TO THE CALLER. In `v1_compiler.claim_batch` `resolve_timed`, the resolved graph is bound, its `modules` and `item_registry` are read for their LENGTHS to print the `[resolve]` line, and the whole graph is then handed back to the caller. Nothing is thrown away except THE NAMES, and only at the `eprintln!`. So the missing thing is an EMITTER over a set the process already holds and the caller already receives -- not an analysis, not a resolver change. THIS DISTINCTION IS THE ROW'S RUNG HONESTY AND 4b(2) TURNS ON IT: `nobody can determine this in advance` and `nobody has printed it` are different claims. The first is a permanent ceiling under which every future lane pays the same cost again; the second is an unbuilt next rung one emitter away. Filed as the former this row would sound honest and be wrong, and would foreclose its own repair -- which is this very class applied to our own tooling, a claim about a population made by an instrument that never enumerated it. RUNG FOUND AT: mitigatable, and the mitigation is a message. CEILING: mechanically preventable -- membership is decidable and computed, but a lane's intersection with a LIVE subject depends on which runs are in flight, which is external state observed at a boundary.) - **a bound is never EVALUATED for a whole population, so the first unrelated edit that makes one of them run discovers the line as a merge block** (INVALID STATE: an identity that the ordinary floor never plans is subject to a ceiling that has therefore never been exercised against it. Specimen: `test.claim.witness_floor_workflow_consolidation_witness_test.w_RED_fabric_evidence_executes_without_gating` has ZERO planned rows on main -- checked in the `required-floor-claim-cost` artifact of two consecutive main runs, 0 of 3549 -- because it executes ONLY as a CHANGED witness. Its 500ms CPU line was first exercised by gunbc#9725, a change about the wet execution route, which touched `gunbc.witness_floor_workflow` and thereby made the witness changed; it refused at 504ms and 505ms on two heads. HARM: the discovering PR is not the causing PR in any sense its author can act on. The block arrives on a change that has nothing to do with cost, the author has no baseline to compare against because none was ever produced, and the only available dispositions are to enroll a debt row or to stall. THE NEIGHBOUR THIS IS NOT, and the distinction is the whole row: the NEAR-LINE family says a bound is MISPLACED -- measured over the whole corpus by the FLOOR-COST-500MS lane, 21 of the ~29 identities that can approach the line at all sit within +/-10% of it with nothing beyond 541ms, so the threshold was drawn through a cluster. This row says a bound was NEVER EVALUATED for a population at all. Different invalid state, different trigger, and the repairs diverge: a per-witness declared cost envelope fixes the misplaced line, and does NOT by itself cause the ceiling to be exercised for identities the ordinary floor does not plan. WHY IT IS STRUCTURALLY INVISIBLE TO THE OBVIOUS INSTRUMENT: a census that samples what the ordinary floor PLANS has this population outside its denominator BY CONSTRUCTION -- the cost lane's own survey could not see the class, and found it only when a lane that had tripped the line reported it. This is [[green_reported_over_a_population_the_instrument_does_not_own]] in the cost dimension: the survey was accurate about the rows it enumerated and silent about the rows it could not. RECOGNITION RULE: when a bound is declared per-identity but enforcement is gated on a SELECTION (changed, affected, sampled, scheduled), ask WHICH IDENTITIES THE SELECTION NEVER SELECTS ON THE MAINLINE. Those carry unevaluated bounds, and the population is discoverable in advance -- it is the declared identities minus the planned ones, both of which are already published per run. NEXT-RUNG TRIGGER, a capability and not an artifact: the ceiling is EXERCISED AND ITS RESULT PUBLISHED for every identity carrying one, including those the ordinary floor does not plan -- sufficient that a bound's first contact with an identity is a measurement someone chose to take, not a merge block on an unrelated change. Until then the class is discovered one PR at a time by whoever happens to edit the triggering authority. RUNG FOUND AT: mitigatable, and the mitigation is a debt row written after the fact. CEILING: mechanically preventable -- the unplanned population is a decidable set difference over data each run already emits.) @@ -209,5 +212,6 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **a written rule is how a LATER READER learns what happened; it is not how a PRESENT AUTHOR is stopped, so a ledger that grows without changing what is easy to type buys documentation and no prevention** (INVALID STATE: a failure class is answered by APPENDING A ROW -- to this roster, to a stall roster, to an annotation -- and the row is then counted as the remedy. The class recurs anyway, because at the moment of authoring the dangerous form is still the shortest thing to type and nothing costs more when it is chosen. RECOGNITION RULE, which is the whole row: after filing, ask WHAT IS NOW HARDER TO DO THAN IT WAS BEFORE. If the honest answer is nothing, the filing was a RECORD and not a REPAIR, the class rung did not move, and it must be reported as UNREMEDIED rather than as covered. WHY IT IS NOT MERELY WEAK BUT ACTIVELY MISLEADING: a filed class gets CITED AS COVERAGE, so a reviewer meeting it reads it as handled and the filing converts an open deficit into a closed-looking one while leaving the deficit exactly where it was -- a DESIGN section 4b(1) rung wearing a 4b(2) costume, which is this ledger own version of rung inflation. An unrepaired filing is therefore WORSE than no filing, not equal to it. WHY THE RECALL DOES NOT FIRE: a rule filed under its SUBJECT MATTER is retrieved by thinking about that subject matter, and an author executing a step attends to THE GOAL, not the class of the step. Nothing in `retire the superseded poller` cues `I am about to type a pattern that can match myself`. THE TEST RUN ON A REAL POPULATION THE SAME NIGHT IT WAS WRITTEN, AND IT CAME BACK MOSTLY NEGATIVE: across ten class-filings required in one day, the identity-join rows made nothing harder (`sort -u` is exactly as easy to type as `sort`); the prose-adjacency, field-adjacency and digest-beside-subject rows made nothing harder (no lens refuses a digest passed beside its subject, and that signature is still the natural one to write); the empty-reading rows made nothing harder (the short read is still shorter than the head-filtered one, which is precisely why four people reached for it). ONE of the ten changed what is easy, and IT WAS NOT A FILING: a schema hazard was answered by computing the affected population and commenting on each of the five pull requests about to hit it, delivering friction to five named authors rather than prose to a ledger. A second was initially scored as a climb and the correction is the sharper result: the carrier ALREADY HAD THE RIGHT SHAPE and nothing about it was built that day; what the day produced was the DISCOVERY that a wrong thing was writable beside it, because an author wrote a fabricated previous-rung into a drop row, A REGEN RAN GREEN OVER IT, and a reader happened to look at the field. NO MECHANISM WAS WATCHING. Corrected score: ONE push-friction instance that expires when five pull requests land, ZERO climbs, ONE discovery -- and the discovery is the least repeatable item in the list, since the next occurrence is written where nobody is reading and the green regen is identical. A LUCKY READ IS NOT COVERAGE. THE TWO KINDS OF FRICTION ARE NOT INTERCHANGEABLE AND ONLY ONE COMPOUNDS: PUSH friction is delivered to named authors at the moment of impact and EXPIRES when their changes land; PULL-PROOF friction removes the constructor, so nothing needs delivering to anyone ever again. A day producing one of each must not report two. THE CONCLUSION THE AUDIT FORCES, STRONGER THAN THIS ROW STARTED: retrieval-by-recall is not a mechanism that becomes adequate at a smaller ledger size -- IT IS THE WRONG MECHANISM AT ANY SIZE, because the retrieval cue never arrives regardless of how few rows there are. Every row real deliverable is THE FRICTION, and the prose is its RECEIPT rather than its product. RUNG FOUND AT: mitigatable, and this row is an instance of what it describes, which is why it carries a trigger rather than resting on having been written. CEILING: structurally impossible for any class whose dangerous form can be removed from the vocabulary entirely -- an unwritable form needs no rule. NEXT-RUNG TRIGGER, a capability and not an artifact: for each filed class, a named ARTEFACT OF FRICTION -- a lens that refuses the shape, a carrier with no unsafe constructor, a wrapper shorter to invoke than the raw form -- so that a filing arrives WITH a change in what is easy, and the obligation is symmetric: whoever ASKS for a row owes the friction artefact or the plain sentence that nothing got harder and the class stands UNREMEDIED.) - **a gate that admits when its required evidence has not reported, because the admission arm keys on OBSERVED FAILURE rather than on OBSERVED SUCCESS.** INVALID STATE: a required check exists, is correctly configured, and is consulted -- and the consulting arm asks `has anything reported a failure` where the guarantee needs `has everything reported a success`. Between those two questions sits the state where nothing has reported at all, and it is admitted. HARM, AND THE REASON THE CLASS SURVIVES REVIEW: every artifact reads as present and correct. The gate is enumerated in the required roster, it is active, it blocks a reported failure exactly as advertised, and a reader auditing the configuration finds no drift -- because there is none. The defect is in the QUANTIFIER, and a quantifier has no configuration surface to inspect. DISTINGUISHING FACT, AND IT IS THE RACE RATHER THAN ANY FIELD: the class is only reachable inside the window between the evidence being DEMANDED and the evidence ARRIVING, so it is invisible to any observation taken after that window closes -- afterwards the check has reported, the record looks ordinary, and only the ORDER of two timestamps distinguishes an admitted merge from a blocked one. RECOGNITION RULE: for every gate, find the arm that admits and read what it is quantified over. If it enumerates the evidence that HAS arrived and asks a property of each, the empty enumeration admits. If it enumerates the evidence that is REQUIRED and asks each for a success, it refuses. The two spellings are one word apart and behave identically on every input except the one the class lives in. DISTINCT FROM `absorbing_fallback`: that arm WIDENS when it cannot compute an answer and is at least loud about doing work; this arm NARROWS to the empty set and is silent, because a fold over nothing returns its seed and nobody wrote the seed down as a decision. **SPECIMEN (eager-bear-107, gunbc#10236, 2026-09-03), and it landed a break rather than merely permitting one.** The pull request pushed head d8cd3034 at 19:49:33Z, GitHub created its `witnesses` run at 19:49:40Z, and the merge completed at 19:49:43Z -- three seconds after run creation, before any job of it reported. That run then concluded with `required-witnesses-build` and `required-witnesses-floor` both FAILURE, and the head it certified nothing about landed on main as cfe19ea7, adding two duplicate declarations to THIS MODULE that refused main at resolve until a repair pull request landed. WHICH LANE CAUGHT IT IS PART OF THE FILING, because the two main flakes are separable in this evidence and a reader who conflates them loses that: on the post-merge main run at cfe19ea7 the duplicates reddened `required-witnesses-build` while `required-witnesses-floor` was GREEN, so the break is not the cost class this repository's other main flake belongs to and cannot be waved away as more floor variance. THE DETECTING LANE WORKED AND WAS TWENTY MINUTES LATE, which is the shape of this class rather than an aggravating detail: `required-witnesses-build` refused the duplicates correctly -- `generated-artifact CarrierRefused cause=resolve`, the authority declining to answer -- and its job completed at 20:04:14Z against a merge at 19:49:43Z, an unadjudicated interval of twenty minutes and thirty-one seconds. NOTHING WAS MISROUTED AND NO LANE WAS MISSING. **A RETRACTION IS RECORDED HERE BECAUSE THE MISREADING IS ITSELF AN INSTANCE OF A ROSTERED CLASS.** An earlier revision of this row said the catcher was `heal-generated-artifacts` and that it was event-conditional, on the evidence that heal FAILED on the pull-request run and was SKIPPED on the main run of identical content. The job graph refutes it: heal died at step 2, `Checkout triggering branch head`, at 19:52:01Z, with `Regenerate every committed generated artifact` SKIPPED -- the regenerator never ran, so heal detected nothing, and it failed because the merge had deleted the branch head it wanted three seconds after the run was created. A downstream consequence of the merge was read as a detection of the defect. That is `green_reported_over_a_population_the_instrument_does_not_own` inverted -- a RED reported over a population the instrument never reached -- and the recognition rule transfers exactly: A JOB'S CONCLUSION IS NOT EVIDENCE ABOUT THE SUBJECT IT IS NAMED FOR UNTIL ITS STEP RECORD SHOWS IT REACHED THE STEP THAT JUDGES. It survived four readers passing a narrative and was caught by one who read the job graph. Ruleset 16178731 carried zero divergence from `gunbc.repo_ruleset` desired state throughout. Over the forty most recently merged pull requests, six had no `witnesses` run that completed successfully on their own head before `merged_at`. **THE SAME SHAPE IN THIS REPOSITORY'S OWN MODEL, which is what makes it a class and not an incident:** `gunbc.merge_lifecycle` `merge_enabled` folded `policy_admits` over the receipts found for a head from `init: false`, so the absent-receipt verdict was a caller-local constant standing in for a policy fact. There the seed was the SAFE answer and the harm was the mirror image -- the live behavior became unrepresentable, no witness could go red on it, and the module named a policy stronger than the live one as live for two months. RUNG FOUND AT: mitigatable, and only by human habit. CEILING: structurally guaranteed -- the merge queue construction makes the queued ref's run a precondition of landing rather than a fact observed beside it. NEXT TRIGGER: `gunbc.guarantee_stall` `merge_admission_terminal_verdict_stall`. FILED AS A STALL AND NOT A RUNG DROP: a 4b(3) drop asserts a REGRESSION and nothing regressed -- GitHub's rule has evaluated reported check runs this way since the ruleset was created, so the capability was never held and a previous rung would be invented. What existed was 4b(1) inflation, corrected by making the live policy representable. - **a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.) +- **a guard that stops discriminating because its precondition moved is not a guard that failed -- it is one that was SILENTLY RETIRED, and it will keep reporting PASS forever** (INVALID STATE: a check is current, correct, and executing exactly as designed, and its answer has stopped carrying information because the condition it keys on is no longer reachable on the population it guards. Nothing is stale and nothing is broken. The check is dead and every consumer still reads its PASS as evidence. HARM: a failed check is loud and a retired one is indistinguishable from a healthy one, so the deficit never ranks for repair; worse, the guard continues to be CITED as coverage, and a second mechanism that would otherwise have been built is not built because this one is believed to exist.RECEIPT, MEASURED ON THIS REPOSITORY THE NIGHT THE ROUTE CHANGED: the generated-artifact merge driver refuses a projection only when BOTH SIDES have changed it since the merge base. gunbc#10302 delegated design-ledger regeneration to the heal job, and its declared repair route instructs the author to COMMIT THE PROVISIONAL BYTES. That commit MOVES THE MERGE BASE, after which only one side has changed the projection, so the driver has nothing left to refuse and reports a clean tree -- over a head that deletes rows from the ledger. THE REFUSAL WAS NOT DEFEATED, IT WAS DISCHARGED, BY THE VERY COMMIT THE ROUTE INSTRUCTS. Two pull requests sat in that state at once, one probing clean while deleting twenty-one rows.THE PART THAT MAKES IT A CLASS RATHER THAN A BUG IN ONE DRIVER: NOBODY WEAKENED ANYTHING. No rung was lowered, no waiver was written, no code in the driver was touched. A change elsewhere invalidated the driver's PREMISE, and DESIGN section 4b(3) governs DELIBERATE drops -- it has nothing to say about a guarantee that evaporates as a side effect. So this class of regression is structurally exempt from the mechanism built to catch regressions, which is why it can persist indefinitely with every roster and every gate reporting green.DISTINCT FROM THE STALE-TOOL CLASS, AND THE BOUNDARY IS CLEAN. A superseded tool executing in place of the current one is a VERSION fact and is repaired by installing the incoming copy. This is a PREMISE fact: the tool is the current one, it is correct, and it is running as designed. Different mechanism, different remedy, different row.ADJACENT TO THE NEVER-AUTHORABLE-RED CLASS AND DELIBERATELY NOT MERGED WITH IT, because the adjacency is the finding. DESIGN section 4b instructs an author to ask whether a check's RED is authorable BEFORE writing the check. That question has no owner once the check is written and shipped: this class is THE SAME QUESTION ASKED LATE, and nobody asks it late. A check whose RED was never authorable is born decorative and can be caught at review; a check whose RED was authorable and SILENTLY STOPPED BEING passes every review it ever had, because it was genuinely load-bearing at the moment it was approved. Same terminal state -- permanently green by construction -- reached from opposite ends.RECOGNITION RULE: FOR EVERY GUARD, NAME ITS PRECONDITION, THEN ASK WHAT WOULD MAKE THAT PRECONDITION PERMANENTLY FALSE AND WHETHER ANYTHING WOULD NOTICE. A guard whose precondition can be discharged by a ROUTINE, INSTRUCTED ACTION is not a guard, it is a coincidence detector. The sharpest form of the question is whether the route the guard protects is itself capable of satisfying the guard's escape condition, because a mechanism that disarms its own check is not a risk, it is a schedule.A SECOND-ORDER TRAP FOUND WHILE WRITING THIS ROW, AND THE REASON THE REPLACEMENT CHECK IS STATED AGAINST ZERO. The obvious replacement -- compare the projection against main and refuse on deletions -- was first written by declaring the observed deficit, twenty-one rows. Two hours later, with the branch untouched, it was twenty-three: THE DEFICIT IS A FUNCTION OF MAIN, NOT OF THE HEAD BEING JUDGED, so any declared count expires the next time an unrelated pull request lands. THE COUNT IS DATED, THE PREDICATE IS NOT. Zero is main-invariant and survives every main move, which is why the check must test against zero and never against a number someone measured.RUNG FOUND AT: mitigatable, and the mitigation is that a reviewer independently compared the projection to main instead of reading the guard's verdict. CEILING: structurally guaranteed -- a guard carrying its precondition as a declared, checkable fact rather than as an implicit property of how it is invoked admits a refusal when that precondition becomes unreachable, so no Accepted program contains a guard that has silently stopped discriminating. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot be satisfied by the instance that produced it: a guard declares the precondition under which its verdict carries information, AND the surrounding mechanism refuses when a guard is consulted on a population where that precondition cannot hold. Repairing the merge driver, or adding one deletion check to one gate, satisfies neither half and leaves every other guard in the tree exposed in exactly the same way. - **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, files INSIDE that closure moved, landed by UNRELATED pull requests, none of them the receipt's own author, and A SINGLE AFTERNOON'S ARRIVALS WERE ALREADY SUFFICIENT. THE COUNT IS DELIBERATELY NOT CARRIED HERE, and its absence is part of the finding: the first attempt to state it was taken from a file-level diff, overstated, and was corrected against the measured closure WITHIN THE SAME EVENING, before this row had even landed -- a transcribed measurement is unreachable from the thing that produced it, so it rots while nobody touches either end. Worse, the severity moved OPPOSITE to the count: fewer arriving files means a SMALLER surface was already enough, so a reader anchored on the number would have read the correction as good news. NAME THE INSTRUMENT INSTEAD, and re-derive rather than quote: enumerate the closure with `v1_compiler.bin.claim_batch` `--print-entry-closure` over the routed entries -- a non-evaluating mode that prints the population the RESOLVER retained, not an import re-walk -- and intersect it against the files changed since the dispatch tree. Run it beside a positive control whose membership is known, because an empty intersection and a dead instrument print the same thing. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) - **a next-rung trigger naming a capability that had ALREADY SHIPPED when the row was written, so the class is born retired and its stall is permanent and invisible** (INVALID STATE: a class below its ceiling names a restoration or next-rung trigger, as section 4b(2) obliges it to, and the named capability was ALREADY PRESENT IN THE TREE AT FILING TIME. The trigger is therefore not a transition: there is no future event at which it becomes true, because it was never false. The row reads as tracked debt with a named exit and is in fact untracked -- nobody will retire it, because retiring it requires observing a change that already happened before anyone was watching. HARM: this is worse than an untriggered stall, because an untriggered stall at least presents as unfinished. A row with a satisfied trigger presents as COMPLETE WORK AWAITING AN EVENT, so it is skipped by exactly the audits that exist to find stalls, and the class it describes stays at its found rung indefinitely while the roster reports it as governed. THE GAP THAT ADMITS IT IS IN THE OBLIGATION ITSELF: section 4b(2) requires a class below ceiling to NAME its next-rung trigger and says nothing about that trigger being UNSATISFIED AT FILING TIME. Naming is checked by review and by the reader; satisfiability is checked by nobody.RECEIPT, AND IT IS THE STRONGEST KIND -- FOUND BY THE AUTHOR OF THE ROW WHILE WITHDRAWING IT, NOT BY AN AUDIT: session vivid-ibex-751 withdrew a finding of their own whose trigger read that the listing states its own truncation and total, against a capability that had shipped in gunbc#9648 a WEEK EARLIER. The trigger was true on the day it was written. Credit for the specimen is theirs and it is cited here as their withdrawal rather than as a third-party report, because the withdrawal is what makes it evidence: an author checking their own trigger against the tree is the only place this is currently caught.RECOGNITION RULE, DECIDABLE AND CHEAP, WHICH IS WHY THIS IS A ROW AND NOT A NOTE: a trigger whose named capability PREDATES THE ROW'S OWN EARLIEST RECEIPT. Both operands are already carried -- the capability has a landing commit and the row has its receipts -- so the comparison needs no judgement and no new authority. A class whose detection needs judgement gets detected once.ITS EXACT DUAL IS ALREADY ROSTERED AS restoration_promise_names_a_route_that_does_not_exist, AND THE PAIR IS THE FINDING RATHER THAN EITHER HALF. That row is a trigger naming a run, lane, cadence or sweep the tree DOES NOT CONTAIN; this row is a trigger naming a capability the tree ALREADY CONTAINS. NOT-YET and ALREADY are TWO WAYS a named condition fails to be a TRANSITION, and both leave a class untracked while it reads as tracked. THIS IS DELIBERATELY NOT WRITTEN AS AN EXHAUSTIVE PAIR, and the reason is this row's own subject turned on itself: a closed count over a population nobody enumerated is the defect rostered as selection_view_read_as_population, and TWO IS THE NUMBER OF ARMS THE ROSTER HAPPENS TO HOLD TONIGHT, not a proof that a third is unwritable. At least one further arm is already conceivable -- a trigger whose satisfaction is UNDECIDABLE, which is neither not-yet nor already and cannot fire for a third reason -- and it is unrostered because nobody has hit it, which is exactly the evidence a closed claim would have suppressed. The axis is offered as a DISCOVERED PAIR to search along, never as a partition to check membership against -- the first as a promise that can never fire, the second as tracking that fired before anyone was watching.WHY TWO ROWS AND NOT ONE ROW WITH TWO ARMS, STATED EXPLICITLY BECAUSE A READER LANDING ON THE PAIR WILL ASK AND AN UNSTATED ANSWER READS AS AN OVERSIGHT. The test applied is whether the REPAIRS diverge, and they do, in both the detection and the remedy. DETECTION: the dual is decided against THE TREE'S CONTENTS -- does the named route exist -- and is at ceiling 3 for exactly that reason; this row is decided against THE ROW'S OWN RECEIPT DATES, which the tree does not need to be consulted for at all. REMEDY: the dual is repaired by BUILDING THE ROUTE the trigger names, or by rescoping the promise to one that exists -- work outside the row. This row is repaired by RE-TRIAGING THE CLASS ITSELF, because a trigger that was already true means the class's current rung was never re-measured after the capability landed, so the row may be at ceiling already, may have climbed silently, or may be genuinely stalled for a different reason nobody has looked for -- work inside the row. Different evidence, different actor, different artifact touched. They are cited to each other rather than merged.THREE NEARBY ROWS THAT ARE NOT THIS ONE, RECORDED BECAUSE THE THIRD WILL BE RE-LITIGATED. self_authorized_dissolution is about a trigger offered as PERMISSION to create debt rather than as a lifecycle fact -- an authority question, not a satisfiability one, and a trigger can be validly authorized and still satisfied at birth. a_written_row_is_not_a_firing_mechanism is about a row STANDING IN FOR a mechanism -- and a trigger satisfied at birth may sit under a perfectly real, perfectly firing mechanism, which is what makes it invisible. predicate_vacuously_true_on_an_empty_domain is the closest in flavour and still a different subject: its domain is empty at EVALUATION time and its harm is a verdict read as evidence, whereas this is satisfied at FILING time and its harm is a transition that can never occur.RUNG FOUND AT: mitigatable, and the mitigation is that an author happens to check their own trigger against the tree while withdrawing something else. CEILING: structurally guaranteed -- a trigger carrying the capability it names, rather than prose describing it, admits a filing-time comparison against that capability's landing, so no Accepted program can file a row whose trigger is already discharged. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot itself be satisfied at birth: the trigger field is typed as a reference to the capability it names rather than as prose, AND the roster refuses a row whose referenced capability predates the row's own earliest receipt. Neither half alone is sufficient -- the typed reference without the refusal is a shape that permits the state, and the refusal without the typed reference has no operand to compare. From c144a0fa82145b3ae02a380f5ee63086c4d83ca4 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Fri, 4 Sep 2026 08:22:59 +0000 Subject: [PATCH 6/9] chore: regenerate drifted generated artifacts (ci auto-heal) --- docs/design-failure-modes.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 80149b13443..0fe57506814 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -102,6 +102,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `guard_precondition_discharged_by_the_route_that_uses_it` - `receipt_subject_surface_outlives_its_own_production_time` - `trigger_satisfied_before_the_row_was_written` +- `summary_counters_aggregate_over_a_disposition_set_the_verdict_is_not_in` --- @@ -202,7 +203,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an exact duplicate constructor pattern appears twice in one match, the second arm is unreachable, and the compiler accepts both -- so SOURCE ORDER silently decides which body answers** (INVALID STATE: two arms of one `match` name the SAME closed-variant constructor with DIFFERENT bodies. HARM: the second body is dead, and nothing says so. The author wrote it believing it would run; the reader cannot tell which of the two the machine picks without knowing the arm-selection rule; and the wrong one being first is a wrong answer that type-checks, projects and passes every gate. THE SPECIMEN IS MINE AND IS MEASURED (gunbc#9981, 2026-09-03). `probe_owner_is_wet_lib_module` in `v2.test.claim.self_host.stage0_executable_assembly_test` carried `WetActuatorLibModuleOwner` twice -- once as the matching arm binding `module_basename` and `declaration_route`, and again in the trailing list of `=> false` arms, where I had added it while enumerating the coproduct for exhaustiveness. The compiler accepted it in every lane it reached. It was found by a review reading the arm list, not by any check. THIS IS THE DUAL OF EXHAUSTIVENESS, NOT AN INSTANCE OF IT. Exhaustiveness asks whether the UNION of the arms covers the domain, and gunbc does refuse when it does not -- the same file's missing `WetActuatorLibModuleOwner` arm refused loudly earlier in the same PR. The unasked question is whether each arm CONTRIBUTES an inhabitant no earlier arm already covers. A duplicate arm makes the union no larger, so an exhaustiveness check is green by construction on exactly the source that carries this defect: adding the duplicate is the one edit that cannot move that verdict. THE MEASURED GRAIN IS NARROW AND IS STATED NARROWLY, because the general form is not the same question. Deciding whether an arbitrary later pattern is subsumed by the union of earlier ones is a coverage problem over guards, nested patterns and bindings; the measured specimen is the decidable corner of it -- two SYNTACTICALLY IDENTICAL closed-variant constructor heads at the same match. Claiming the general form here would put a ratchet where a wall is available, and would let the narrow wall be cited as coverage for the broad class. RUNG FOUND AT: outside the ladder -- the state is writable, accepted, and silent. CEILING: 3, structurally guaranteed, and the reason it is not 4 is that a `match` is written arm by arm, so a second identical head is spellable in any source a human or a generator can emit; no constructor arrangement removes it. What rung 3 buys is that no `Accepted` program contains one. NEXT TRIGGER, NAMED AS THE CAPABILITY: **a match-arm usefulness judgment in the compiler frontend that REFUSES a second arm whose constructor head is already covered, locating both the duplicate and the arm that covers it** -- with a discriminating RED (two identical constructor patterns, different bodies, refused at the second arm), an accepted positive control (two distinct constructor patterns, accepted), and a retention control establishing that adding a variant to the coproduct does not weaken the duplicate judgment. A diagnostic that names the duplicate without refusing it does not discharge this: a warning on an accepted program is the tier DESIGN section 6 calls an inert lens, and this class is silent precisely because nothing stops the line.) - **A PREMISE THAT MAKES A COST LOOK CORRECT RENDERS THE REGION BEHIND IT UNEXAMINABLE, AND THE TELL IS REPEATED REPAIRS THAT ALL STOP AT THE SAME BOUNDARY.** The invalid state is a stated justification -- not a check, not a type -- that classifies an observed cost as intended, so no instrument is ever pointed at it and its absence looks like the absence of a problem rather than the absence of a measurement. SPECIMEN, and it is this carrier's own history: `gunbc.recurring_failure_mode` was repaired twice for merge contention -- blob to `data` rows, then rows to one line each -- and BOTH repairs measured only the APPEND OF A WHOLE ROW. Both rested on a premise stated in the first: that two lanes editing the SAME class conflicting is "correct, because that is real disagreement about one fact." THE PREMISE IS FALSE FOR THIS CARRIER, and the discriminator is what actually accretes on a class. What lands is INDEPENDENT RECEIPTS from unrelated lanes -- a second specimen, a climb receipt, a corroboration reached from the opposite direction -- not competing claims about one fact. On 2026-09-02/03 three lanes appended three independent receipts to `state_space_conflation` and resolved it by hand-negotiating byte order; that row reached 23,023 characters. Independent accretion is not disagreement, so the conflict was textual contention wearing the mask the premise had fitted for it. **WHAT MAKES THIS A CLASS RATHER THAN ONE MISTAKE IS THE SHAPE OF THE EVIDENCE: the premise was load-bearing for two repairs, and neither repair's author looked inside a row.** A false premise does not merely produce a wrong answer -- it produces NO answer, because it removes the question. That is why it survived a measurement campaign that was otherwise careful: the same lane that measured `git merge-file` at a named merge base to characterise the block-tail defect never measured an intra-row edit, because the premise said the result would be correct. RECOGNITION RULE: when a repair of a recurring cost is being scoped, find the sentence that explains why the ADJACENT cost is acceptable, and ask what measurement would falsify it. If no measurement was ever run against it -- and especially if the same boundary has now been re-approached more than once -- the premise is a candidate, not a finding, and the cheap discriminator is to run the instrument the premise made look unnecessary. Here that was one `git merge-file` on two lanes editing one row: 0 conflicts on different receipts, 1 minimal conflict on two appends. **WHAT IS NOT CLAIMED.** This is not the claim that stated justifications are suspect in general, which would be unusable. The class is narrower and its two conditions are jointly required: a premise that classifies an observed, RECURRING cost as intended, AND a repair history in which the same boundary was approached more than once without that cost being measured. One repair stopping at a boundary is ordinary scoping. RUNG: mitigatable, and honestly so. The harm is deferred author time -- three lanes hand-negotiating byte order on one row -- and it is contained only by someone eventually re-deriving the premise, which is a review practice and not a mechanism. CEILING, derived rather than aspirational: this cannot climb to construction, because whether a stated justification is true is not decidable from the tree -- the premise here was refuted by an empirical fact about how lanes ACTUALLY append, which no property of the source expresses. It is a ratchet forever in the sense of DESIGN section 5. NEXT-RUNG TRIGGER, a capability and not an artifact: the ability to measure contention on a carrier CONTINUOUSLY rather than at repair time -- a per-declaration conflict count over merge history -- so that a region the premise renders unexaminable still produces a number that rises. That is what would have made the intra-row cost visible without anyone doubting the sentence. - **a live argument threaded past the arm that actually decides the verdict** (INVALID STATE: a check is named and cited as LIVE because one of its arguments is read from the real tree, while the predicate it asserts is already settled by a different, hand-authored argument that the live one cannot influence -- so the live input is threaded into a call whose answer does not depend on it. HARM: the row is permanently green with respect to the tree it claims to observe, and its name is what a reader consults when asking whether the class is covered live, which is exactly the decoration DESIGN section 4b calls worse than absent because it will be cited as coverage. It also BUYS THE COST OF LIVENESS WITHOUT THE SIGNAL -- the live producer here is a whole-tree fill -- so the row looks expensive enough to be doing something. DISTINGUISHING FACT, and it is what separates this from an ordinary weak assertion: THE DECIDING ARM AND THE LIVE ARM ARE DISJOINT INPUTS TO ONE TOTAL FUNCTION, so nothing at the call site looks wrong; every argument is well-typed, the live producer is genuinely called, and the fixture argument is genuinely a fixture. The tell is structural and mechanical -- find the arm that can produce the asserted outcome ALONE, and ask whether the live argument is an input to it. SPECIMEN, gunbc 2026-09-03: v2.test.claim.long.effect_reach_test effect_reach_live_03_normalize_witness_derived_host_reading_holds asserted v2.lens.effect_reach derived_host_reading over effect_reach_classification_from_facts with decls bound to v2.std.fn_index fn_arrow_decl_facts_live and data_inits bound to a hand-authored one-element live_03_normalize_data_inits. In that function the data-init arm closure_data_init_path_flows consumes only closure_modules and data_inits: a path-shaped literal_fp in any closure module yields a GunbcCompileEntrySink flow with no reachability and no decls, and any non-empty flow list is HostEffectReach, hence derived_host_reading. The module also carried an annotation asserting that this row LEGITIMATELY READS the live producer, so the false claim was stated in prose beside the code that falsified it. DISCRIMINATING RED AND POSITIVE CONTROL, BOTH EXECUTED rather than argued, via claim_batch on the lens: substituting decls to the EMPTY list while holding the hand data_inits fixed leaves derived_host_reading TRUE -- the live argument is non-discriminating; and holding the LIVE decls while substituting data_inits to EMPTY yields derived_host_reading FALSE with effect_reach_flow_count 0 -- the live scan contributes ZERO flows from this entry, so the row had no live content at all rather than merely a weak one. The unmodified row PASSES, which is the positive control that the harness and the lens were both working. THE PAIR IS THE METHOD AND NOT AN INCIDENT OF THIS SPECIMEN: neither substitution alone decides the question, because a passing empty-decls arm is consistent with the live arm merely being redundant, and only the second substitution shows it was empty. RESOLUTION AND WHY IT IS A DELETION: the row was removed rather than renamed, because its deciding arm was already enrolled over the identical literal_fp as effect_reach_path_data_init_derived_host_reading_holds in the same module, so a rename would have kept a DESIGN section 2 duplicate spelled with real module names; and no live row is authorable on that lens today, since its closure comes from ModuleImportFact, which v2.lens.live_read_classification g2_live_production_boundary_law declares FIXTURE-FACING with no live producer in the corpus. THE SHAPE OF THE MISTAKE IS AUTHORABLE BEFORE THE PRODUCER EXISTS, which is why the name of the missing producer is the trigger and not the excuse. RUNG FOUND AT: 1, mitigatable -- nothing silent is produced, the row simply asserts less than its name, and the only thing containing the harm is that a reader may read the call. CEILING: 2, mechanically preventable. The question -- does the asserted outcome change when this argument is replaced by its type identity or an empty value -- is decidable by EXECUTION per argument and is exactly the coverage-is-per-argument grain, but it is not derivable from the call shape alone, because whether an argument is influential depends on the callee body over the actual fixture values. Not higher: a caller may pass any well-typed value to any parameter and forbidding a non-influential argument would forbid ordinary total functions, so the invalid state stays writable. NEXT-RUNG TRIGGER, named as the capability and covering BOTH directions: a per-argument influence check that, for each argument of an enrolled witness call, re-executes the witness with that argument substituted and refuses when the verdict is unchanged for an argument the row NAMES -- sufficient for reddening both a non-discriminating live argument and a row whose live arm contributes nothing, since the specimen needed both substitutions to be characterised. A convention that live rows must be named live would be satisfied while the capability stayed dead. BOUNDARY against neighbouring classes: check_subject_narrower_than_its_declared_claim is about a subject that is a strict subset of what the row claims to range over, and the repair there is widening the subject; here the subject is right and one INPUT is inert, and the repair is either removing the inert input or supplying the producer the name promises. It is likewise not incidental_denominator_as_wall, which is about the wall being computed over the wrong population. AND IT IS SHARPER THAN THE ASSERTED-NOT-PRODUCED SHAPE IT MOST RESEMBLES, which is the reason it is filed rather than folded in: there the producer is IMPORTED AND UNCALLED, so the tell is visible at the call site -- a hand-built value stands where a produced one should. HERE THE PRODUCER IS GENUINELY CALLED and its result is genuinely passed, and what fails is REACHABILITY INSIDE THE CALLEE, so no reading of the call site can see it and the tell is only recoverable from the callee's arm structure or from substitution. THE GENERAL FORM IS WORTH MORE THAN ANY ONE ROW: a verdict DISJOINED over a live arm and a fixture arm silently becomes the fixture arm, and nothing goes red, because the disjunction is satisfied before the live arm is consulted. BOUNDARY against the three adjacent roster rows, none of which is this: absorbing_fallback is a FAILURE arm that widens instead of refusing, and here no arm fails at all -- the wrong answer is a TRUE one reached without the input it names; empty_observation_narrow is a CENSUS whose population is narrower than its claim, where the subject is the defect, while here the subject is right and one input is inert; and predicate_vacuously_true_on_an_empty_domain is green because its domain is EMPTY, whereas this predicate ranges over a perfectly non-empty fixture domain and is simply not a function of the argument the row is named for. The repairs are disjoint in all three directions, which is DESIGN section 4b's keying-on-the-repair test.) -- **a lens is correct and live over a subject shape that cannot represent the state it detects** (a check reaches its subject, executes on every run, and is enrolled as coverage -- and its RED is UNAUTHORABLE there, because the representation the subject is expressed in has no constructor for the state the check matches on. Nothing is skipped, nothing is absorbed, no population is withheld, and the check is not wrong: hand it a value of the shape it expects and it fires correctly. It is the SUBJECT that cannot carry the state, so the check is permanently green over that subject while reading as verified. **THE BOUNDARY AGAINST check_subject_narrower_than_its_declared_claim DECIDES THE REMEDY AND THEY ARE NOT THE SAME DEFECT.** There the subject is a SMALLER POPULATION than the claim -- widen it and the missing instances appear, so the repair is a scope edit. Here the population is exactly right and every member is structurally incapable of exhibiting the state; widening adds more members that equally cannot exhibit it, so a scope edit is guaranteed to change nothing while looking like a fix. It is also NOT absorbing_fallback: nothing widens on failure and no arm degrades -- the check runs its ordinary path to an honest verdict over a subject that could only ever produce one answer. **SPECIMEN WITH A RECEIPT, measured 2026-09-03 on gunbc#10245 against origin/main 8b2323f414 and reproduced on 8bfae78d78.** v2.lens.determinism classifies a call through node_callee_symbol, which requires node_is_call, which matches ComputationNode { behavior: Transform }. Its live subject is the fn-arrow body skeletons built by v1_compiler.coproduct_reflection marshal_skeleton, which returns conj_record at both return sites, i.e. TypeNode { connective: Conj }, for EVERY node. A Conj TypeNode cannot satisfy that match, so no skeleton node is ever a call, every body classifies Deterministic by non-membership, and determinism_transitive_holds over a fn_arrow_decl_facts_live population is green by construction. The same mismatch holds four production_qualification_origin_probe_witness frontier rows red, which is what makes it a class rather than an incident: one representation mismatch darkens every consumer of that subject at once. **WHY IT SURVIVES REVIEW, and this is the dangerous part.** The check is real, the lens is correct, the subject is live and non-empty, and a positive control asserting the population is non-empty PASSES -- so every ordinary vacuity guard agrees. A NON-EMPTY SUBJECT IS A NECESSARY PRECONDITION MASQUERADING AS THE CHECK. Nine approving reviews passed over the specimen and none exercised the body skeletons; it was found by planting a violation and watching nothing happen. **THE BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, filed the same day and easy to conflate with this.** There the check CAN go red -- a different, hand-authored argument decides the verdict and the live argument is threaded past it, so the row is inert with respect to the tree while the predicate itself still discriminates. Here NO argument can produce the refused state, because the subject's representation cannot express it; there is no other arm carrying the verdict, and substituting inputs changes nothing. The two are distinguished by one question: is there an arm that could produce the asserted outcome alone? If yes and the live input is not one of its inputs, that is the threaded-argument class and the remedy is to delete or re-source the row. If no arm can produce the refused outcome at all, this is the class and the remedy is a representation change, which is why its trigger names a shape rather than a call site. **RECOGNITION RULE, which is DESIGN 4b's own question asked BEFORE the check is written rather than after: name the state the check refuses, then construct a value in the subject's OWN representation that exhibits it.** If you cannot construct one, the check is a decoration over that subject however correct its logic. The construction is cheap and is the whole test: two values differing only in the field the check keys on, asserting it FIRES on one and is BLIND to the other. Both arms passing is the executing record of the gap; when the representation lands, the blind arm reds and names itself. **THE REPORTING RULE THAT FOLLOWS: a class's rung is the minimum across its in-scope paths (4b(1)), so a fixture path where the RED is authorable does NOT stand in for a live path where it is not.** Citing the fixture rung while the live path is dark is rung inflation. **AND IT IS NOT A 4b(3) DECLARED DROP -- filing one is its own error**, which is where the specimen nearly went: 4b(3) governs a REGRESSION, with a previous rung and a population that LOST a guarantee. When the shape mismatch predates the check, the wall was never lit through that path, and a capability that was never real cannot be dropped. The honest instruments are 4b(1) rung honesty and 4b(2) an untracked stall made tracked. **RUNG: 1 (mitigatable) -- the gap is nameable and, once found, held open by the two-arm control. CEILING: 4, since whether a subject's representation can inhabit the state a check matches on is decidable from two declarations the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: a check declares the subject representation it matches over, and a check whose match is unsatisfiable by that representation fails to compile -- so the decoration cannot be authored at all, rather than being found later by someone constructing the value by hand.**) +- **a lens is correct and live over a subject shape that cannot represent the state it detects** (a check reaches its subject, executes on every run, and is enrolled as coverage -- and its RED is UNAUTHORABLE there, because the representation the subject is expressed in has no constructor for the state the check matches on. Nothing is skipped, nothing is absorbed, no population is withheld, and the check is not wrong: hand it a value of the shape it expects and it fires correctly. It is the SUBJECT that cannot carry the state, so the check is permanently green over that subject while reading as verified. **THE BOUNDARY AGAINST check_subject_narrower_than_its_declared_claim DECIDES THE REMEDY AND THEY ARE NOT THE SAME DEFECT.** There the subject is a SMALLER POPULATION than the claim -- widen it and the missing instances appear, so the repair is a scope edit. Here the population is exactly right and every member is structurally incapable of exhibiting the state; widening adds more members that equally cannot exhibit it, so a scope edit is guaranteed to change nothing while looking like a fix. It is also NOT absorbing_fallback: nothing widens on failure and no arm degrades -- the check runs its ordinary path to an honest verdict over a subject that could only ever produce one answer. **SPECIMEN WITH A RECEIPT, measured 2026-09-03 on gunbc#10245 against origin/main 8b2323f414 and reproduced on 8bfae78d78.** v2.lens.determinism classifies a call through node_callee_symbol, which requires node_is_call, which matches ComputationNode { behavior: Transform }. Its live subject is the fn-arrow body skeletons built by v1_compiler.coproduct_reflection marshal_skeleton, which returns conj_record at both return sites, i.e. TypeNode { connective: Conj }, for EVERY node. A Conj TypeNode cannot satisfy that match, so no skeleton node is ever a call, every body classifies Deterministic by non-membership, and determinism_transitive_holds over a fn_arrow_decl_facts_live population is green by construction. The same mismatch holds four production_qualification_origin_probe_witness frontier rows red, which is what makes it a class rather than an incident: one representation mismatch darkens every consumer of that subject at once. **WHY IT SURVIVES REVIEW, and this is the dangerous part.** The check is real, the lens is correct, the subject is live and non-empty, and a positive control asserting the population is non-empty PASSES -- so every ordinary vacuity guard agrees. A NON-EMPTY SUBJECT IS A NECESSARY PRECONDITION MASQUERADING AS THE CHECK. Nine approving reviews passed over the specimen and none exercised the body skeletons; it was found by planting a violation and watching nothing happen. **THE BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, filed the same day and easy to conflate with this.** There the check CAN go red -- a different, hand-authored argument decides the verdict and the live argument is threaded past it, so the row is inert with respect to the tree while the predicate itself still discriminates. Here NO argument can produce the refused state, because the subject's representation cannot express it; there is no other arm carrying the verdict, and substituting inputs changes nothing. The two are distinguished by one question: is there an arm that could produce the asserted outcome alone? If yes and the live input is not one of its inputs, that is the threaded-argument class and the remedy is to delete or re-source the row. If no arm can produce the refused outcome at all, this is the class and the remedy is a representation change, which is why its trigger names a shape rather than a call site. **RECOGNITION RULE, which is DESIGN 4b's own question asked BEFORE the check is written rather than after: name the state the check refuses, then construct a value in the subject's OWN representation that exhibits it.** If you cannot construct one, the check is a decoration over that subject however correct its logic. The construction is cheap and is the whole test: two values differing only in the field the check keys on, asserting it FIRES on one and is BLIND to the other. Both arms passing is the executing record of the gap; when the representation lands, the blind arm reds and names itself. **THE REPORTING RULE THAT FOLLOWS: a class's rung is the minimum across its in-scope paths (4b(1)), so a fixture path where the RED is authorable does NOT stand in for a live path where it is not.** Citing the fixture rung while the live path is dark is rung inflation. **AND IT IS NOT A 4b(3) DECLARED DROP -- filing one is its own error**, which is where the specimen nearly went: 4b(3) governs a REGRESSION, with a previous rung and a population that LOST a guarantee. When the shape mismatch predates the check, the wall was never lit through that path, and a capability that was never real cannot be dropped. The honest instruments are 4b(1) rung honesty and 4b(2) an untracked stall made tracked. **RUNG: 1 (mitigatable) -- the gap is nameable and, once found, held open by the two-arm control. CEILING: 4, since whether a subject's representation can inhabit the state a check matches on is decidable from two declarations the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: a check declares the subject representation it matches over, and a check whose match is unsatisfiable by that representation fails to compile -- so the decoration cannot be authored at all, rather than being found later by someone constructing the value by hand.**)**THE REPAIR LANDED AND ITS DIRECTION IS NOT SYMMETRIC: RESHAPE THE PRODUCER, NEVER WIDEN THE CHECK** (gunbc#10282, cool-fox-470, the reshape arm of the same specimen this row was filed from). `v1.stage0.coproduct_reflection` `marshal_generic` now returns a `ComputationNode { behavior: Transform }` record for an `ExprCall` with a non-empty authored name -- the case where the callee identity leaf is already the first positional edge -- so the subject representation gained the constructor the check matches on and the RED became authorable over the live substrate. The arm NOT taken is the one that looks equally available and is not: widening `node_is_call` to also accept the Conj spelling would have made the check green again by ratifying the fork, leaving the substrate with two definitions of a call and the compiler's own lowered-body carrier advisory. A check may not be taught the producer's spelling; the producer must emit the substrate's carrier. **THE FIELD TELL IS VISIBLE BY READING, BEFORE ANYTHING RUNS: A PRIVATE COPY OF THE SHARED PREDICATE.** `v2.lens.no_dual_representation_test.scan` carried `skeleton_is_call`, `skeleton_is_callee_atom` and `skeleton_call_argument_targets` -- `v2.std.node_query`'s `node_is_call` / `call_callee_target` / `call_argument_targets` respelled against `TypeNode { connective: Conj }` -- because the shared authority could not read its own substrate. A SECOND PREDICATE ANSWERING ONE QUESTION IS EVIDENCE THAT THE FIRST DOES NOT APPLY TO SOMEBODY'S INPUT, and it is a static, greppable symptom of this class that needs no execution to find. The fork and the defect shipped together: the workaround is what let the unrepresentable subject go unnoticed. It is deleted rather than parameterised in #10282, and `replace_param_in_output` in that same module -- which descended `Conj` alone -- would have returned every body containing a call UNSUBSTITUTED the moment the carrier appeared, a fail-open the repair itself would have created. **THE EVIDENCE SHAPE THAT SETTLES IT, AND THE ONE A .dag ROW CANNOT PROVIDE.** Two hand-built fixture nodes differing only in kind establish that the LENS discriminates; neither can establish that the PRODUCER emits the accepted shape, because both are constructed by the fixture -- which is the defect in miniature. That fact belongs in the producer's own test path: `marshaled_call_carries_the_transform_call_carrier`, with `marshaled_non_call_stays_a_conj_type_node` as its control, on the required `cargo test -p v1-compiler --lib` lane. Confirmed by mutation with the substitution asserted BEFORE any verdict was read: reverting `marshal_generic` to the unconditional Conj record reddens exactly that one test (4 passed, 1 failed) and restoring returns 5/5. The fixture pair stays enrolled as the 4b(4) regression control rather than retiring on the climb. - **an annotation states a refusal the model has no operation capable of returning, over a field that is recorded and never read** (INVALID STATE: a carrier records a discriminating value, prose beside it describes what that value prevents, and no function anywhere ACCEPTS the value and can return a different answer because of it. The declaration typechecks, the witnesses pass, and the sentence is not a lie about intent -- it is a description of a wall that was never built. HARM: the prose is read as the guarantee, because a reader checking whether a class is handled finds a paragraph saying it is. The field's presence corroborates the paragraph and the paragraph explains the field, so each is the other's evidence and neither touches an executed path. **THE RECOGNITION RULE IS A RESOLVED READ, NOT AN INFLUENCE TEST, AND THE DIFFERENCE IS WHAT MAKES THE CLASS DECIDABLE: name one RESOLVED, NON-CONSTRUCTION READ of this field. If none exists anywhere in the field's dependent production closure, the field is inert and the sentence beside it is the only wall.** An earlier draft of this rule asked whether an operation could 'return two different results because of' the field. That is semantic INFLUENCE, and it does not agree with the census that would decide it: a function may bind a field and never use the binding, or compare it inside an arm already decided, leaving the answer invariant while a use census reports the wall present. Stating the rule as influence and the instrument as syntax would reproduce, in this row's own enforcement, exactly the false coverage the row exists to name. So the population is narrowed to the mechanically decidable one -- absence of any resolved non-construction read -- and the residue is handed to a neighbour rather than absorbed. **THE THREE-APPEARANCE TELL IS A CANDIDATE GENERATOR, NOT A PROOF, AND MUST NOT BE CITED AS ONE.** The cheap instrument is a field appearing exactly three times -- type declaration, constructor parameter, constructor body -- and nowhere else. It is greppable and it is where every instance below was first noticed. It is not the adjudicator: a consumer may live in another module, reach the field through an alias or a re-export, or read it under a differently spelled binding, so only resolved field-use data settles the question. A grep is how the candidate is found and never how the row is closed. **BOUNDARY AGAINST live_argument_threaded_past_the_arm_that_decides, which owns the residue this narrowing hands off.** A field that IS syntactically read but does not influence the answer -- threaded past the arm that already decided, or bound and dropped -- is not this class and a field-use census cannot adjudicate it; it needs mutation or influence testing. Keeping it here would put an undecidable obligation inside a class whose whole value is that its question is decidable by a read the namespace authority already performs. **WHY IT SURVIVES REVIEW, WHICH IS THE PART THAT MAKES IT RECUR: THE DISCRIMINATING RED IS UNAUTHORABLE.** A reviewer looking for the missing negative case cannot write one, because there is no call to make -- the wrong input has no operation to be wrong to. So the class produces no red, and review of a diff that contains it correctly reports no failing check. Measured: three instances passed three independent review rounds and two side-chat rulings on gunbc#10264 and gunbc#10249 before any was found, and the third was found only after a peer session described the shape from an unrelated lane. The count is three and not four because a fourth candidate was carried in this row's first draft and then refused by the rule stated above -- that reclassification is recorded in its own receipt below, and it is the reason the measurement is quotable at all: a count that never loses a member is measuring the author's attention, not the class. **BOUNDARY AGAINST check_subject_shape_cannot_represent_the_state_the_check_detects, which is the nearest neighbour and a DIFFERENT defect with a different remedy.** There a check EXISTS, executes, and is enrolled, and its red is unauthorable because the subject representation has no constructor for the state it matches -- the repair is to change the subject's shape. Here NO CHECK EXISTS AT ALL: the red is unauthorable because there is no operation to call, and the repair is to add the question so the recorded value is examined. Both are permanently green and both read as coverage, which is why they are easy to conflate; a scope edit fixes neither, and a subject-shape edit fixes only the first. **BOUNDARY AGAINST specification-without-execution (DESIGN section 5), which is the general case rather than this class.** There a specification has no consumer. Here there IS a consumer, it executes on every run, and it is green -- what is missing is the interrogation of one field it already carries. The general rule 'find a real consumer green by execution' is satisfied by the defect, which is exactly why it does not catch it. **THREE RECEIPTS ON ONE LANE, gunbc#10264 and gunbc#10249, 2026-09-03.** (1) `tensor_parallel_rank` was recorded on every rank participant and examined by nothing, so a population claiming both workers were tensor-parallel rank 0 decided COHERENT under a law named after tensor parallelism. (2) `EvidenceRouteResolvedConfiguration`'s CAPTURE PAYLOAD FIELDS, and the grain matters because the outer value was not ignored: the response DISCRIMINANT was read, and reading it advanced the stage. What no operation examined were the three strings inside the capture, supplied from a public constructor, so `"garbage"`, `"0"` and `"anything"` rode through a refusal stage on the strength of the arm name alone. The unread subject is the payload, not the coproduct. (3) `VllmHealthCoverageFact.backend` was written once and read by nothing, beneath an annotation promising that a consumer asking about another backend 'gets no answer here rather than a borrowed one' -- the only reachable path was the Ray row, so a multiprocessing deployment would have read Ray's answer off it. **AND ONE THAT THIS ROW DECLINES, BECAUSE THE ROW'S OWN RECOGNITION RULE REFUSES IT.** `vllm_host_vantage(host:)` on the same lane looked like a fourth instance and was carried as one in the first draft of this row. It is not. Its annotation did overstate a wall -- it asserted that acquired provenance now cost 'a vantage per host rather than a keyword' when it cost one wrapper call per host -- but the host argument IS examined: it becomes the vantage's content and is carried into the provenance the annotation is about. Apply the rule in this row and it comes back negative, because an operation taking that value and returning a different answer because of it does exist. The defect there is a FREE CONSTRUCTOR conferring unearned authority, which is a different invalid state with a different repair: the fix was deleting the vocabulary because a wrapper over a bare host name earns nothing, not adding a question about an unread field. Recorded here rather than dropped silently, because a class that absorbs its neighbours stops ranking anything -- and a receipt its own recognition rule rejects is the first evidence that the boundary is real rather than asserted. **AND A SECOND CANDIDATE DECLINED, FROM AN INDEPENDENT LANE, RECORDED BECAUSE THE REFUSAL IS THE BOUNDARY WORKING TWICE.** A peer session's `OobeBrowserSessionReady` on gunbc#10254 was carried here as a fifth receipt on the strength of sounding alike. It is an UNINHABITED SUCCESS SURFACE: whole-tree resolution found no construction anywhere, so no field instance was ever produced and then ignored. That contradicts this row's own boundary sentence, which requires that a consumer EXISTS, executes on every run, and is green while one field it already carries goes uninterrogated -- there is no such consumer when the carrier cannot be built at all. The remedies diverge accordingly: an unread field needs a question that consumes it, an unproducible success surface needs a real construction path or the deletion of the advertised state. Two candidates from two lanes were admitted by resemblance and refused by the rule; that is the evidence that the rule is doing work. **THE CEILING IS STRUCTURAL AND THE TRIGGER IS A SWEEP, NOT ATTENTION.** Both lanes found instances only after independently repairing three or four smaller ones each, and both kept missing the next at the top of the type graph. The next rung is a lens over the Node tree asking, for every declared field of every record, whether any RESOLVED NON-CONSTRUCTION READ of it exists in its dependent production closure -- the same read the namespace authority already performs, so the analysis costs no substrate edit. Two properties of that question are load-bearing and neither is optional. It must be RESOLVED rather than textual, because a consumer may sit in another module or reach the field through an alias, and a grep that misses it would report inertness that is not there. And it must EXCLUDE CONSTRUCTION, because the constructor body reads every field by definition; a census counting that read finds no inert field anywhere and is permanently green -- the decoration this row's own ceiling warns about, one level up. The lens decides absence of a read; it does not decide influence, which is why the influence residue is scoped to the neighbour class above rather than promised here. Until that lens exists the class is mitigatable by review diligence, which both lanes have now measured to be insufficient. - **a per-argument exhaustive matrix cannot see a cross-argument relation, and it READS as exhaustive precisely because it is** (INVALID STATE: a gate function takes two independently derived arguments -- here `wet_route_gate_disposition(standing:admission:)`, whose `standing` came from one receipt envelope and whose `admission` came from a lease pinned to a DIFFERENT envelope. Every arm of `admission` was enumerated and refused correctly for that argument in isolation; every arm of `standing` likewise. The reachable OFF-DIAGONAL state -- lease-admits-A composed with standing-derived-from-B -- inhabits no single argument, so no per-argument enumeration contains it. HARM: the author reports the enumeration as complete, and the report is TRUE. That is what makes this worse than a false completeness claim: a false one is refuted by any counterexample within its stated domain, while a true one over an UNSTATED domain has no counterexample inside the domain it names, so the reader cannot separate `all cases of the argument` from `all cases of the decision`. SPECIMEN (gunbc#9725): five refusal arms of the bootstrap-lease admission were each shown going red under mutation, and `six arms of one argument is not the gate; the gate is the relation between two` was the correction. The repair was structural rather than another arm -- FUSE THE DOOR: the gate no longer accepts a pre-computed admission, it derives the admission itself from the envelope it is judging, so the mismatched pair has no constructor. RECOGNITION RULE: when a matrix is enumerated per argument, ask WHICH RELATIONS BETWEEN ARGUMENTS THE FUNCTION SIGNATURE ADMITS. If two parameters can be derived from different subjects, the product space -- not the union of the axes -- is the domain, and an axis-wise sweep is exhaustive over a projection of it. The tell is a decision function whose arguments are each independently derivable by a caller. THE NEIGHBOUR THIS IS NOT: [[check_subject_narrower_than_its_declared_claim]] is a subject mismatch that a reader can catch by comparing the claim to the check; here the claim and the check agree exactly, and the narrowing is in the DOMAIN both of them share. NEXT-RUNG TRIGGER, a capability and not an artifact: deriving a decision's dependent inputs INSIDE the decision rather than accepting them, wherever two parameters name the same subject -- which is the fused-door move generalized, and makes the off-diagonal unconstructible instead of merely unenumerated. RUNG FOUND AT: mechanically preventable, by a probe that had to be written to construct the state. CEILING: structurally impossible, and reached for this specimen.) - **a subject defined by a CLOSURE with no enumerable membership cannot be protected in advance, only violated in arrears** (INVALID STATE: a receipt, cache key, or admission is pinned to a digest computed over a TRANSITIVE CLOSURE -- here the wet lane's `semantic_subject`, over the per-entry closure of 23 routed witness entries plus `v2.workflow.floor_wet_route`. The digest is a perfectly good detector and a useless protector: it reports a MISMATCH AFTER THE FACT rather than a MEMBERSHIP LIST BEFORE it. HARM: a two-hour dispatch completed and its receipt arrived uncommittable as `ReceiptSubjectDifferent`, because a commit landed inside the closure after the run's head. The lane that would break such a subject cannot decide for itself whether its diff intersects one, so the only available discipline is asking the holder afterwards -- which is not a discipline, it is a post-mortem. THE VISIBLE SURFACE IS NOT THE SUBJECT, and reporting it as one is the same defect in a different costume: the wet subject's visible surface is 19 files, while the resolver's own lines report 47 modules and 1180 resolved items for ONE entry, reaching transitively into `src/v2/std/` and `src/v2/compiler/`. A lane can invalidate the receipt while touching none of the 19 and doing nothing wrong. A list handed a completeness property by the mere fact that it is a list is the trap; the resolver's numbers are what refute it, which is why they are quoted rather than estimated. THE CONSEQUENCE FOR ANNOUNCEMENTS, recorded because it is the half that fools the announcer: a hold announced over an unenumerable subject is not protection, and the artifact recording that the announcement happened is indistinguishable from the protection existing. A hold nobody can check is WORSE than no hold, because its holder then treats the subject as protected. SCOPE, and it is wider than the specimen: EVERY subject-pinned receipt in this repository has this hole; the others have not noticed because none has yet burned a long run to it. RECOGNITION RULE: when a digest pins a subject, ask WHETHER ANYTHING PRINTS THE SUBJECT'S MEMBERSHIP. If the only instrument that knows the membership is the comparison itself, the subject is detectable and not defendable, and any fence described over it is a request rather than a constraint. NEXT-RUNG TRIGGER, a capability and not an artifact: a producer that PRINTS the closure membership for a routed entry, SUFFICIENT that a lane can decide FOR ITSELF, BEFORE LANDING, whether its diff intersects a live subject. THE POINTED PART, CORRECTED ONCE ALREADY AND THE CORRECTION IS THE WHOLE VALUE: the set is not merely computed and discarded, it is COMPUTED, HELD, AND RETURNED TO THE CALLER. In `v1_compiler.claim_batch` `resolve_timed`, the resolved graph is bound, its `modules` and `item_registry` are read for their LENGTHS to print the `[resolve]` line, and the whole graph is then handed back to the caller. Nothing is thrown away except THE NAMES, and only at the `eprintln!`. So the missing thing is an EMITTER over a set the process already holds and the caller already receives -- not an analysis, not a resolver change. THIS DISTINCTION IS THE ROW'S RUNG HONESTY AND 4b(2) TURNS ON IT: `nobody can determine this in advance` and `nobody has printed it` are different claims. The first is a permanent ceiling under which every future lane pays the same cost again; the second is an unbuilt next rung one emitter away. Filed as the former this row would sound honest and be wrong, and would foreclose its own repair -- which is this very class applied to our own tooling, a claim about a population made by an instrument that never enumerated it. RUNG FOUND AT: mitigatable, and the mitigation is a message. CEILING: mechanically preventable -- membership is decidable and computed, but a lane's intersection with a LIVE subject depends on which runs are in flight, which is external state observed at a boundary.) @@ -215,3 +216,4 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **a guard that stops discriminating because its precondition moved is not a guard that failed -- it is one that was SILENTLY RETIRED, and it will keep reporting PASS forever** (INVALID STATE: a check is current, correct, and executing exactly as designed, and its answer has stopped carrying information because the condition it keys on is no longer reachable on the population it guards. Nothing is stale and nothing is broken. The check is dead and every consumer still reads its PASS as evidence. HARM: a failed check is loud and a retired one is indistinguishable from a healthy one, so the deficit never ranks for repair; worse, the guard continues to be CITED as coverage, and a second mechanism that would otherwise have been built is not built because this one is believed to exist.RECEIPT, MEASURED ON THIS REPOSITORY THE NIGHT THE ROUTE CHANGED: the generated-artifact merge driver refuses a projection only when BOTH SIDES have changed it since the merge base. gunbc#10302 delegated design-ledger regeneration to the heal job, and its declared repair route instructs the author to COMMIT THE PROVISIONAL BYTES. That commit MOVES THE MERGE BASE, after which only one side has changed the projection, so the driver has nothing left to refuse and reports a clean tree -- over a head that deletes rows from the ledger. THE REFUSAL WAS NOT DEFEATED, IT WAS DISCHARGED, BY THE VERY COMMIT THE ROUTE INSTRUCTS. Two pull requests sat in that state at once, one probing clean while deleting twenty-one rows.THE PART THAT MAKES IT A CLASS RATHER THAN A BUG IN ONE DRIVER: NOBODY WEAKENED ANYTHING. No rung was lowered, no waiver was written, no code in the driver was touched. A change elsewhere invalidated the driver's PREMISE, and DESIGN section 4b(3) governs DELIBERATE drops -- it has nothing to say about a guarantee that evaporates as a side effect. So this class of regression is structurally exempt from the mechanism built to catch regressions, which is why it can persist indefinitely with every roster and every gate reporting green.DISTINCT FROM THE STALE-TOOL CLASS, AND THE BOUNDARY IS CLEAN. A superseded tool executing in place of the current one is a VERSION fact and is repaired by installing the incoming copy. This is a PREMISE fact: the tool is the current one, it is correct, and it is running as designed. Different mechanism, different remedy, different row.ADJACENT TO THE NEVER-AUTHORABLE-RED CLASS AND DELIBERATELY NOT MERGED WITH IT, because the adjacency is the finding. DESIGN section 4b instructs an author to ask whether a check's RED is authorable BEFORE writing the check. That question has no owner once the check is written and shipped: this class is THE SAME QUESTION ASKED LATE, and nobody asks it late. A check whose RED was never authorable is born decorative and can be caught at review; a check whose RED was authorable and SILENTLY STOPPED BEING passes every review it ever had, because it was genuinely load-bearing at the moment it was approved. Same terminal state -- permanently green by construction -- reached from opposite ends.RECOGNITION RULE: FOR EVERY GUARD, NAME ITS PRECONDITION, THEN ASK WHAT WOULD MAKE THAT PRECONDITION PERMANENTLY FALSE AND WHETHER ANYTHING WOULD NOTICE. A guard whose precondition can be discharged by a ROUTINE, INSTRUCTED ACTION is not a guard, it is a coincidence detector. The sharpest form of the question is whether the route the guard protects is itself capable of satisfying the guard's escape condition, because a mechanism that disarms its own check is not a risk, it is a schedule.A SECOND-ORDER TRAP FOUND WHILE WRITING THIS ROW, AND THE REASON THE REPLACEMENT CHECK IS STATED AGAINST ZERO. The obvious replacement -- compare the projection against main and refuse on deletions -- was first written by declaring the observed deficit, twenty-one rows. Two hours later, with the branch untouched, it was twenty-three: THE DEFICIT IS A FUNCTION OF MAIN, NOT OF THE HEAD BEING JUDGED, so any declared count expires the next time an unrelated pull request lands. THE COUNT IS DATED, THE PREDICATE IS NOT. Zero is main-invariant and survives every main move, which is why the check must test against zero and never against a number someone measured.RUNG FOUND AT: mitigatable, and the mitigation is that a reviewer independently compared the projection to main instead of reading the guard's verdict. CEILING: structurally guaranteed -- a guard carrying its precondition as a declared, checkable fact rather than as an implicit property of how it is invoked admits a refusal when that precondition becomes unreachable, so no Accepted program contains a guard that has silently stopped discriminating. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot be satisfied by the instance that produced it: a guard declares the precondition under which its verdict carries information, AND the surrounding mechanism refuses when a guard is consulted on a population where that precondition cannot hold. Repairing the merge driver, or adding one deletion check to one gate, satisfies neither half and leaves every other guard in the tree exposed in exactly the same way. - **a receipt whose validity is denominated in the RAW CONTENT of a high-traffic closure has an expected lifetime SHORTER THAN ITS PRODUCTION TIME, so the wall it feeds is unreachable in practice and is therefore never exercised** (INVALID STATE: an admission gate is pinned to a digest ranging over the closure CONTENT of many entries, and producing the evidence that satisfies it takes hours while the surface it ranges over is edited in minutes. Every dispatch is invalidated before it returns. Nothing is silently wrong -- the gate REFUSES correctly, every time -- and that is precisely the harm: A WALL THAT CAN NEVER BE SATISFIED IS INDISTINGUISHABLE, IN THE LEDGER, FROM A WALL THAT HOLDS, while contributing no evidence about the property it guards. Its RED is permanent and its GREEN is unreachable, so it stops discriminating. MEASURED, NOT IMAGINED: on gunbc#9725 the wet-lane receipt cost 2h31m to produce and was pinned to a semantic-subject digest over the closures of eighteen routed self-host entries plus the wet-route module. Between the dispatch tree and the first run that reached a verdict, files INSIDE that closure moved, landed by UNRELATED pull requests, none of them the receipt's own author, and A SINGLE AFTERNOON'S ARRIVALS WERE ALREADY SUFFICIENT. THE COUNT IS DELIBERATELY NOT CARRIED HERE, and its absence is part of the finding: the first attempt to state it was taken from a file-level diff, overstated, and was corrected against the measured closure WITHIN THE SAME EVENING, before this row had even landed -- a transcribed measurement is unreachable from the thing that produced it, so it rots while nobody touches either end. Worse, the severity moved OPPOSITE to the count: fewer arriving files means a SMALLER surface was already enough, so a reader anchored on the number would have read the correction as good news. NAME THE INSTRUMENT INSTEAD, and re-derive rather than quote: enumerate the closure with `v1_compiler.bin.claim_batch` `--print-entry-closure` over the routed entries -- a non-evaluating mode that prints the population the RESOLVER retained, not an import re-walk -- and intersect it against the files changed since the dispatch tree. Run it beside a positive control whose membership is known, because an empty intersection and a dead instrument print the same thing. The gate refused with `subject-mismatch axis=semantic-subject`, the run was otherwise clean at 3596 planned, 3596 executed, 0 claims failed and 0 unexpected failures, and the receipt was dead. WHY THE OBVIOUS REMEDIES ARE NOT REMEDIES, both of which were proposed and priced before being rejected: FREEZING the surface asks an entire fleet to stop touching the most-trafficked module in the repository for the duration of one receipt, which purchases one landing by spending every other lane's night -- and the surface is high-traffic FOR THE SAME REASON it is in every closure, so the two halves of the problem are one fact. WAITING FOR A QUIET PERIOD does not fix the mechanism, it lowers the arrival rate until a dispatch gets lucky, and getting lucky is not a property of the mechanism -- WAITING IS THE TREADMILL RUN SLOWER. And WAIVING the axis to land the artifact would admit it by disabling the property it exists to establish; where a NEIGHBOURING axis is already waived under a declared drop, that waiver was sound ONLY BECAUSE this axis still held, so waiving both leaves not a weakened guarantee but none. RECOGNITION RULE: for any gate pinned to a digest, compute two quantities and compare them -- the TIME TO PRODUCE the evidence, and the MEAN TIME BETWEEN EDITS to the surface the digest ranges over. If production time exceeds the edit interval, the gate is unreachable and every refusal it emits is a scheduling artefact rather than a finding about the subject. The tell is a refusal whose remedy is `re-run it and hope`, and a ledger that reads as a held wall while its green has never once been observed. THE ROOT IS THE SUBJECT SURFACE, NOT THE SCHEDULE: a digest that ranges over raw file bytes makes every edit inside the closure -- including edits that change no semantics, per DESIGN section 4c -- move the subject, so the lifetime is denominated in the WRONG UNIT. RUNG FOUND AT: mitigatable, and the mitigation is a freeze nobody can grant. CEILING: structurally guaranteed -- a subject computed from what the routed entries semantically depend on cannot be moved by an edit those entries do not depend on. NEXT-RUNG TRIGGER, a capability and not an artifact: a receipt subject that ranges over the SEMANTIC DEPENDENCE of the routed entries -- the annotation-erased projection of exactly the declarations they reach -- rather than over the bytes of every file in their closure, so that the surface shrinks to what the evidence is actually about and the expected lifetime exceeds the production time by construction. NOT satisfied by a faster dispatch, a quieter window, or a wider waiver, each of which leaves the denominator unchanged.) - **a next-rung trigger naming a capability that had ALREADY SHIPPED when the row was written, so the class is born retired and its stall is permanent and invisible** (INVALID STATE: a class below its ceiling names a restoration or next-rung trigger, as section 4b(2) obliges it to, and the named capability was ALREADY PRESENT IN THE TREE AT FILING TIME. The trigger is therefore not a transition: there is no future event at which it becomes true, because it was never false. The row reads as tracked debt with a named exit and is in fact untracked -- nobody will retire it, because retiring it requires observing a change that already happened before anyone was watching. HARM: this is worse than an untriggered stall, because an untriggered stall at least presents as unfinished. A row with a satisfied trigger presents as COMPLETE WORK AWAITING AN EVENT, so it is skipped by exactly the audits that exist to find stalls, and the class it describes stays at its found rung indefinitely while the roster reports it as governed. THE GAP THAT ADMITS IT IS IN THE OBLIGATION ITSELF: section 4b(2) requires a class below ceiling to NAME its next-rung trigger and says nothing about that trigger being UNSATISFIED AT FILING TIME. Naming is checked by review and by the reader; satisfiability is checked by nobody.RECEIPT, AND IT IS THE STRONGEST KIND -- FOUND BY THE AUTHOR OF THE ROW WHILE WITHDRAWING IT, NOT BY AN AUDIT: session vivid-ibex-751 withdrew a finding of their own whose trigger read that the listing states its own truncation and total, against a capability that had shipped in gunbc#9648 a WEEK EARLIER. The trigger was true on the day it was written. Credit for the specimen is theirs and it is cited here as their withdrawal rather than as a third-party report, because the withdrawal is what makes it evidence: an author checking their own trigger against the tree is the only place this is currently caught.RECOGNITION RULE, DECIDABLE AND CHEAP, WHICH IS WHY THIS IS A ROW AND NOT A NOTE: a trigger whose named capability PREDATES THE ROW'S OWN EARLIEST RECEIPT. Both operands are already carried -- the capability has a landing commit and the row has its receipts -- so the comparison needs no judgement and no new authority. A class whose detection needs judgement gets detected once.ITS EXACT DUAL IS ALREADY ROSTERED AS restoration_promise_names_a_route_that_does_not_exist, AND THE PAIR IS THE FINDING RATHER THAN EITHER HALF. That row is a trigger naming a run, lane, cadence or sweep the tree DOES NOT CONTAIN; this row is a trigger naming a capability the tree ALREADY CONTAINS. NOT-YET and ALREADY are TWO WAYS a named condition fails to be a TRANSITION, and both leave a class untracked while it reads as tracked. THIS IS DELIBERATELY NOT WRITTEN AS AN EXHAUSTIVE PAIR, and the reason is this row's own subject turned on itself: a closed count over a population nobody enumerated is the defect rostered as selection_view_read_as_population, and TWO IS THE NUMBER OF ARMS THE ROSTER HAPPENS TO HOLD TONIGHT, not a proof that a third is unwritable. At least one further arm is already conceivable -- a trigger whose satisfaction is UNDECIDABLE, which is neither not-yet nor already and cannot fire for a third reason -- and it is unrostered because nobody has hit it, which is exactly the evidence a closed claim would have suppressed. The axis is offered as a DISCOVERED PAIR to search along, never as a partition to check membership against -- the first as a promise that can never fire, the second as tracking that fired before anyone was watching.WHY TWO ROWS AND NOT ONE ROW WITH TWO ARMS, STATED EXPLICITLY BECAUSE A READER LANDING ON THE PAIR WILL ASK AND AN UNSTATED ANSWER READS AS AN OVERSIGHT. The test applied is whether the REPAIRS diverge, and they do, in both the detection and the remedy. DETECTION: the dual is decided against THE TREE'S CONTENTS -- does the named route exist -- and is at ceiling 3 for exactly that reason; this row is decided against THE ROW'S OWN RECEIPT DATES, which the tree does not need to be consulted for at all. REMEDY: the dual is repaired by BUILDING THE ROUTE the trigger names, or by rescoping the promise to one that exists -- work outside the row. This row is repaired by RE-TRIAGING THE CLASS ITSELF, because a trigger that was already true means the class's current rung was never re-measured after the capability landed, so the row may be at ceiling already, may have climbed silently, or may be genuinely stalled for a different reason nobody has looked for -- work inside the row. Different evidence, different actor, different artifact touched. They are cited to each other rather than merged.THREE NEARBY ROWS THAT ARE NOT THIS ONE, RECORDED BECAUSE THE THIRD WILL BE RE-LITIGATED. self_authorized_dissolution is about a trigger offered as PERMISSION to create debt rather than as a lifecycle fact -- an authority question, not a satisfiability one, and a trigger can be validly authorized and still satisfied at birth. a_written_row_is_not_a_firing_mechanism is about a row STANDING IN FOR a mechanism -- and a trigger satisfied at birth may sit under a perfectly real, perfectly firing mechanism, which is what makes it invisible. predicate_vacuously_true_on_an_empty_domain is the closest in flavour and still a different subject: its domain is empty at EVALUATION time and its harm is a verdict read as evidence, whereas this is satisfied at FILING time and its harm is a transition that can never occur.RUNG FOUND AT: mitigatable, and the mitigation is that an author happens to check their own trigger against the tree while withdrawing something else. CEILING: structurally guaranteed -- a trigger carrying the capability it names, rather than prose describing it, admits a filing-time comparison against that capability's landing, so no Accepted program can file a row whose trigger is already discharged. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot itself be satisfied at birth: the trigger field is typed as a reference to the capability it names rather than as prose, AND the roster refuses a row whose referenced capability predates the row's own earliest receipt. Neither half alone is sufficient -- the typed reference without the refusal is a shape that permits the state, and the refusal without the typed reference has no operand to compare. +- **a refusal summary whose every counter reads clean, because the counters aggregate over a disposition set that does not contain the one that fired** (INVALID STATE: a run prints a terminal verdict beside a fixed set of counters, and the disposition that actually caused the refusal is not among them. Every number reads zero and the verdict reads REFUSED. The reader is handed a summary that is TRUE IN EVERY FIELD and answers a question adjacent to the one they asked, and the cause is on a different line that the summary does not point at. HARM, AND IT IS WORSE THAN FAILING TO EXPLAIN: the shape FORECLOSES the question. A refusal with four zeros beside it reads as a clean run that refused for no stated reason, which is the exact presentation most likely to be dismissed as flakiness and re-run -- and re-running until it passes is the laundering step that converts a real defect into an unrankable intermittency. A summary that said nothing would send the reader to the log; a summary that says zero four times tells them there is nothing to find. EVIDENCE, TWO INDEPENDENT INSTANCES IN ONE NIGHT ON TWO PULL REQUESTS WITH TWO DIFFERENT CAUSES: `required-floor: verdict=FloorRefused unexpected_failures=0 verdict_incomplete=0 non_verdict_unenrolled=0 stale_non_verdict=0` printed once above a wet-lane receipt subject-mismatch and once above a completed-over-cost refusal. Neither cause has a counter in that line; both were named on the line immediately preceding it. THE COUNTER THAT MOVED IS NOT MISSING FROM THE ARTIFACT -- IT IS IN A DIFFERENT LINE, and that is sharper than saying the cause is printed above the verdict. On a third instance the POPULATION line one row up carries `completed_over_cost_requirement=1` beside `claims_failed=0`, while the verdict line prints its own four zeros. So the verdict line is not silent and not wrong: it is a COMPLETE AND CORRECT SUMMARY OF THE WRONG POPULATION. That makes the class a SUBSET-SUMMARY rather than an omission, and it predicts the rest: ANY disposition outside the aggregation set produces the same four zeros. Two such dispositions are already known -- interrupted-before-verdict at the cpu deadline, and completed-over-cost-requirement -- so the set is under-inclusive in at least two directions rather than one, and the next arm will present identically. A RECEIPT FROM OUTSIDE CI, WHICH SHOWS THE SHAPE IS NOT A PROPERTY OF THIS ARTIFACT: a census column keyed on the interrupted arm counted 16 crossings of the cost line across 60 runs and was published; re-read over THE SAME 60 RUNS with both arms it is 22. The omitted arm was 16 runs ON ITS OWN -- the same size as the one counted, not a tail -- so a summary keyed to a proper subset of the dispositions can be wrong by ITS OWN MAGNITUDE while reading as a confident number. A FOURTH INSTANCE WITH NO SUMMARISATION STEP TO BLAME, WHICH IS WHY IT IS THE SHARPEST: comparing a branch to main by roster cardinality, both sides read 86 while the identity sets were DISJOINT BY ONE EACH WAY -- main carried a row the branch did not and the branch carried a row main did not. Equal totals, two rows apart, and a count comparison reads that as CONVERGED. Had the count been trusted the conclusion would have been that there was nothing to merge, and main's row would have been dropped on the next push with no conflict and nothing to look at. 86 IS NOT A WRONG NUMBER: it is a true statement about cardinality answering a question about membership, and the two coincide often enough that the exception lands exactly where it costs. Here there is no counter, no verdict line and no aggregation -- the whole failure is the substitution of a count for an identity join -- which shows the class is not a property of summary lines at all. THE RULE THAT COVERS ALL FOUR: compare identities, never any count, and compare them in BOTH directions, since a one-sided comparison cannot see what the other side has. THAT RULE IS DERIVED, NOT TALLIED, AND THE DERIVATION IS ONE LINE: WHENEVER TWO LANES EACH APPEND EXACTLY ONE ROW BETWEEN MERGES, THE CARDINALITIES AGREE BY CONSTRUCTION WHILE THE MEMBERSHIPS CANNOT. Count equality is therefore not weakest at the margin -- it is at its most confidently wrong exactly where it is most often reached for, and it carries information ONLY in the case nobody checks, when the two sides happen to append different amounts. A reader who takes away a warning to be careful with counts has taken the weaker statement; the instrument is not to be used on this question at all. THE THREE OCCURRENCES SEEN WHILE WRITING THIS ROW -- one branch at 86, 93 and 94 against main, each with one identity on each side the other lacked, twice on the pull request carrying this very row -- ARE ILLUSTRATIONS AND ARE EXPLICITLY NOT EVIDENCE FOR THE DERIVATION. The derivation PREDICTS them, and a tally a hypothesis predicts cannot also confirm it; counting them as confirmations would be this row's own class committed one level up, in the row that exists to condemn it. They are recorded because they show what the state LOOKS like to someone in the middle of a merge, not because three is a number that establishes anything. RECOGNITION RULE: WHEN A VERDICT IS A REFUSAL AND EVERY COUNTER BESIDE IT IS ZERO, THE COUNTER SET IS INCOMPLETE -- read it as evidence about the summary's coverage, never as evidence about the run. A partition that cannot represent the outcome that occurred is not reporting a clean run; it is reporting that it has nothing to say. THE GENERALISATION, WHICH THREE LANES REACHED SEPARATELY THE SAME NIGHT BY THREE DIFFERENT ROUTES: a key that names ONE ARM of a multi-armed disposition returns a confident, plausible, WRONG NEGATIVE for every case in the other arm. A census column keyed on the interrupted arm, a filter keyed on the deadline that raised it, and a counter keyed on one refusal class each answered cleanly and each missed the sibling arm. THE TELL IS NOT THE VALUE'S MAGNITUDE -- IT IS THAT THE KEY NAMES ONE ARM OF SOMETHING THAT HAS TWO. Ask what the OTHER arm is called before trusting a zero. THE SAME BOUNDARY APPEARS ONE LAYER DOWN, AND IT IS WHY TIGHTENING A NUMBER IS NEVER THE REPAIR. Offered a mechanical discriminator between the two arms -- an interrupted claim's `eval_steps` being pinned to a multiple of the 4096-step budget poll interval -- and measured over `required_floor_claim_cost.tsv` for one run's 3588 rows, it holds at sensitivity 9/9 and specificity 3578/3579. THAT ONE FALSE POSITIVE IS THE WHOLE ARGUMENT. A rule wrong once in 3579 is a HEURISTIC, and DESIGN section 5 forbids dressing a heuristic as a wall, so it may serve as a FORENSIC TELL for reading runs that already happened -- labelled with its measured error rate -- and may never be a check anything gates on. Set the two side by side: the verdict line is a CORRECT SUMMARY OF THE WRONG POPULATION; the step-count rule is a CORRECT RULE OVER THE WRONG GUARANTEE. Both read confidently, both are very nearly right, and NEITHER CAN BE MADE SAFE BY IMPROVING THE NUMBER -- only by changing what is asked. The repair is the same in both places and it is structural: make the two populations DIFFERENT CONSTRUCTORS, so no consumer has to infer which one a row is and no summary can aggregate over a set that omits one. RUNG FOUND AT: mitigatable, and the mitigation is that a reader happens to look one line up. CEILING: structurally impossible -- a summary derived from the SAME closed disposition coproduct the verdict is drawn from cannot omit an arm, because an unrepresented arm has no constructor. NEXT-RUNG TRIGGER, a capability and not an artifact: the summary line is projected from the terminal disposition's own exhaustive match rather than assembled from a hand-chosen list of counters, so adding a refusal arm without adding its counter fails to compile. NOT satisfied by adding the two missing counters, which repairs the instances and leaves every future arm exposed in exactly the same way.) From 5cbb01fcfd4dcea35820cb7e0db34dec6526d3a3 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Fri, 4 Sep 2026 18:11:54 +0000 Subject: [PATCH 7/9] chore: regenerate drifted generated artifacts (ci auto-heal) --- docs/design-failure-modes.md | 38 +++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 0fe57506814..9a0d3bda88e 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -48,6 +48,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `restoration_promise_names_a_route_that_does_not_exist` - `alias_resolution_collides_with_kernel_spelling` - `restored_bytes_reviewed_as_authorship` +- `stale_buffer_write_reverts_outside_its_own_diff` - `review_summary_inverts_roles_and_affirms_the_join` - `fabricated_debt` - `yaml_inline_comment_ingested_as_scalar_content` @@ -103,6 +104,14 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `receipt_subject_surface_outlives_its_own_production_time` - `trigger_satisfied_before_the_row_was_written` - `summary_counters_aggregate_over_a_disposition_set_the_verdict_is_not_in` +- `reachability_answered_is_consumed_as_protection_established` +- `by_name_evaluation_is_a_string_not_a_binding` +- `verification_bound_to_the_revision_it_started_on` +- `policy_mechanism_adjudicates_the_merge_that_supersedes_it` +- `denominator_moved_between_measurement_and_comparison` +- `absent_reads_identically_to_never_looked` +- `append_only_carrier_whose_serialization_shares_a_merge_region` +- `discriminating_arm_built_but_never_enrolled` --- @@ -115,7 +124,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. - **censored estimator drops its own tail** (an estimate of a variable is computed over the observations that SURVIVED a threshold on that same variable, so the sample structurally excludes its own extreme and the estimate is biased low with no bound. It is the neighbour of `instrument_output_read_as_subject_content` moved one step earlier: there a REPORT is complete for the reporter and read as complete for the consumer; here the truncation is in the ESTIMATOR'S OWN DOMAIN, and no amount of reading the instrument's output correctly recovers what the filter removed. SPECIMEN, both directions, 2026-09-01: the required floor's per-run cost inflation was estimated by pairing every claim that reported a cost in BOTH attempts of one tree -- median 1.053, p90 1.107. A claim that exceeds the cpu ceiling goes INTERRUPTED-BEFORE-VERDICT AND REPORTS NO COST, so the pairing dropped exactly the two most inflated observations; recovered from the ceiling itself, their inflation was at least 500/418 = 1.196, censored from above. THE SECOND HALF IS WHY THE ROW EXISTS: a peer lane, correcting a DIFFERENT defect in the same measurement, took the biased p90 by relay and derived an at-risk population of ONE -- an understatement arriving with the credibility of a retraction, which is the artifact nobody re-audits. Both counts were lower bounds and neither was labelled as one. RECOGNITION RULE: whenever an estimate is computed over rows that COMPLETED, RETURNED, PASSED, or were OBSERVED, ask what the incomplete rows would have contributed -- and if the incompleteness is caused by the very variable being estimated, the statistic is a floor and must be reported as one. The tell is a filter and an estimand naming the same quantity: cost estimated over rows that finished, latency over requests that did not time out, size over responses that were not truncated. REMEDY: report the censored bound rather than the sample statistic, and recover the excluded observations from the THRESHOLD they crossed, which is a real datum -- a row killed at 500ms is not missing, it is known to be above 500.) -- **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**) +- **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**)THE INHERITED-VIEW FORM: when a consumer takes its population from a structure someone else produced, ask whether that structure is the POPULATION or a SELECTION over it -- and treat a name like `references` or `declarations` beside an `entries` as the tell, since a filtered view and its source are usually siblings in one carrier.** THE REPAIR IS NOT TO SWITCH VIEWS: a consumer must declare its OWN total eligibility disposition over the source population, every member either in the subject or excluded by a NAMED cause, because silence from a view someone else built is exactly how a family disappears with nobody deciding it should -- and that holds even where the two agree today. RUNG FOUND AT: below the ladder, since the census reported a complete-looking population. EXECUTED EVIDENCE: the calibration witness's perturbation control -- deleting every appearance of one variant moves the observed count by zero, with both counts nonzero -- which is what makes the absence a control rather than an observation. - **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) - hollow alias (minimality ≠ grounding) - state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over "the input is wrong" and "this strategy had nothing to say about it", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal "(value: T) -> Outcome` with T FREE; `v2.compiler.07_target_carriers target_fidelity_quotient_optional` declares `-> Outcome>` and calls `outcome_accepted(Present { value: child })`, so T instantiates to `Optional` and THE SOURCE IS CORRECT. The Rust emitter nonetheless rendered `Some(child).expect("fail-closed: an optional value flowed into non-optional parameter 0 of outcome_accepted (empty Optional at runtime)")`. FOUR DEFECTS IN ONE LINE: it fires on a GENERIC formal where `Optional` is a legitimate instantiation rather than a cardinality escape, so the check does not know T is free; it substitutes a runtime panic for a compile-time judgment; the emitted code does NOT typecheck anyway (rustc E0308 expected `Option>` found `Rc`), so the mitigation buys nothing while standing where the wall belongs; and its own panic string calls itself `fail-closed`, which is 4b rung inflation inside a string literal — a diagnostic naming the discipline it violates is worse than a silent one because it will be cited as evidence the discipline holds. The coincidence that makes this a class and not a bug: `v1.compiler.infer declared_type_inhabitance` returned InhabitanceUndecidable{UndecidableOptionalCarrier} at that module s ONLY optional-carrier decline, 07_target_carriers.dag:128:24 parameter `value` — the same line the emitter mitigated. RUNG FOUND AT: 1 (mitigatable) on a seam whose CEILING is 3 (structurally guaranteed), since generic-formal instantiation is decidable from modeled structure. CONSEQUENCE WITH ITS OWN TRIGGER, deliberately NOT folded into this row: wiring the optional-carrier judgment is argued by this specimen but is a separate change, and its trigger is a producer at that seam that can distinguish a FREE type variable from a declared non-optional formal — until that exists the judgment would decline for the same reason it declines today.) - **a transport close is read as protocol completion** (a consumer of a streamed response decides the response is FINISHED because the connection ENDED, rather than because the protocol's own terminator arrived. Every partial answer then presents as a complete one, and the consumer reports success while holding a fragment. This is state-space conflation on the completion axis specifically -- `the bytes stopped` and `the sender said it was done` are two facts, and a stream has a third state, SEVERED, that a two-state reading cannot express. **SPECIMEN, measured 2026-09-01 by a peer session on its own routing layer.** A streaming SSE client accumulated `message_start`, then a long run of `content_block_delta`, and registered completion in `res.on('end')` UNCONDITIONALLY -- never checking that `content_block_stop`, `message_delta` carrying `stop_reason`, and `message_stop` had arrived. A stream severed after 364 thinking deltas therefore produced a well-formed response object containing an intro line and a heading, which the transcript recorded with a tidy `stop_reason` and the UI rendered faithfully as the model's answer. **EVERY LAYER DOWNSTREAM OF THE READING LAYER BEHAVED CORRECTLY, AND THAT IS WHY THE TRUNCATION PROPAGATED SILENTLY.** The reading layer did NOT behave correctly -- it is the defect, converting a transport termination into a protocol completion and minting a `stop_reason` no sender had emitted. What every layer BELOW it then did was faithful: the transcript recorded the object it was handed, and the UI rendered that object exactly. The distinction is the whole diagnostic value of the row -- a defect that hands its consumers a WELL-FORMED artifact recruits every correct layer beneath it into carrying the wrong answer, so correctness downstream is not evidence of correctness upstream. It is also why the class survived a full evening of investigation that cleared the UI, the parser, the token budget, and the serving stack in turn: each of those really was innocent, and each exoneration made the true location look less likely rather than more. **THE DIAGNOSIS WAS INVERTED FOR HOURS BY THE ARTIFACT THE DEFECT ITSELF PRODUCED.** The fabricated `stop_reason: end_turn` was read at face value as `the model chose to stop`, so the investigation was pointed at the model and at long-context serving -- a lead reinforced by a genuinely large KV allocation -- while the defect sat in the layer doing the reading. **RECOGNITION RULE: find the completion predicate and ask whether it names a PROTOCOL EVENT or a TRANSPORT EVENT.** `on('end')`, `on('close')`, process exit, EOF, a read returning zero, and `the socket closed` are transport; a terminator frame, a `done` member, a declared length satisfied, and a trailer are protocol. A consumer whose completion predicate is transport-shaped cannot distinguish a finished answer from a severed one, no matter what it does downstream. **THE SECOND HALF OF THE RULE IS ABOUT RECOVERY, AND IT IS WHY THE CLASS IS NOT MERELY A MISSING CHECK.** Neither the Messages API nor Ollama's compatibility layer carries a resumption protocol -- no sequence numbers, no cursor, no reattachable session -- so a severed stream cannot be resumed and the only recovery is re-issuing the whole request. A client that cannot DETECT truncation therefore cannot retry either, and the missing predicate silently removes the entire recovery arm rather than one diagnostic. **THE REMEDY IS ORDERED AND THE ORDER IS LOAD-BEARING**: make truncation a typed refusal FIRST, because until it is detectable a retry cannot be triggered and a fix cannot be verified; only then add re-issue. Adding retry first produces a client that retries the errors it can already see and silently accepts the ones it cannot. **GUNBC'S OWN EQUIVALENT PATH IS STRUCTURALLY IMMUNE, and the contrast is the useful part rather than a boast.** `gunbc.spark.serving_readback_parse` `spark_serving_parse_generate_done` reads completion from the response's OWN `done` member, and `spark_serving_parse_version_json` refuses a body it cannot parse with `SparkServingReadbackRefused` carrying a typed cause instead of collapsing to an absent reading. A severed body there produces a refusal, not a short answer -- the protocol terminator is the predicate, which is exactly the repair the specimen needs. **BOUNDED AGAINST NEIGHBOURS.** Against `empty_observation_narrow`: there an observation that could not express what changed renders as `nothing is affected`; here a PARTIAL observation renders as a COMPLETE one, so the count is plausible rather than empty and no zero draws attention. Against `absorbing_fallback`: that arm WIDENS on ignorance and is merely expensive; this arm reports a fragment as an answer and is silently wrong, which is below the ladder rather than on it. Against `unbacked_execution_claim`: there prose asserts a relation no authority backs; here a machine-generated artifact asserts a completion no protocol event backs, and it is more dangerous precisely because a `stop_reason` field reads as evidence.) -- **merge region excludes the shared tail** (a roster carrier whose rows are multi-line blocks ending in an identical suffix makes every two-lane append resolve WRONG BY DEFAULT. The three-way merge factors the shared suffix out of the conflict region, so the region holds two half-blocks above the markers and one tail below them, and the purely additive resolution -- delete the markers, keep both sides, which is the CORRECT resolution when the two appended rows are independent -- leaves the first row's closing lines belonging to the second. Specimen: this carrier, which conflicted on every integration of main across four merge bases in one session (2026-09-01) with a shared tail of `evidence: [],` and `}`; `gunbc.rung_drop` had the same shape with `}` alone. **THE CLASS IS LOUD, AND THAT IS THE HALF A REPORT OF IT WILL GET WRONG.** The first reading was that the severed row survives as a structurally broken declaration under which the natural check -- declared names against rostered names -- still passes, because both lists stay complete. Measured against a gunbc built at d0009ca531 on the resolved shape: it is a PARSE REFUSAL at the module index, `expected expression, found Eq`, because a `data` keyword cannot stand in record-field position. Nothing reaches the checks that reading worried about, so the cost is toil and not silent wrongness -- a load-bearing authority whose every integration lands a conflict whose natural resolution does not compile, hand-repaired each time. **RECOGNITION RULE: for a carrier two lanes append to, ask what suffix the appended units SHARE, because a conflict region never contains it -- whatever semantics live in that suffix are exactly what a resolution can drop.** THE REPAIR IS THE UNIT AND NOT A CHECK: make the appended unit one line, and the shared suffix is a blank separator carrying nothing. **SECOND, INDEPENDENT INSTANCE, AND IT RE-RAN THE MISREPORT THIS ROW WARNS ABOUT** (vivid-boar-481, 2026-09-01, integrating main on a later base than the one above): the severed identity was `sealing_property_erases_structure` and the recipient of its donated tail was `accepted_source_emits_uncompilable_target`, over the same `evidence: [],` and `}` suffix. The finder produced the naive both-sides resolution, spotted the fusion by AUDITING THE RESULTING DECLARATIONS rather than by any marker, repaired it -- and then reported that the fused file STILL PARSED and that nothing went red. That report was an inference from reading the text, never an execution, and compiling the reconstructed fused shape refused at `expected expression, found Eq`, the same diagnostic recorded above. So the row's corrected reading survived contact with a second lane, and the reading it corrects -- silent survival -- is what the second reporter independently reinvented before measuring. THE TRANSFERABLE PART IS THAT THE MISREPORT IS THE DEFAULT AND NOT A LAPSE: a reader who resolves the conflict, sees both rows present and no markers, and does not compile, will conclude 'parses fine' every time, because every visible signal available WITHOUT executing agrees with that conclusion. The audit that finds the fusion and the execution that establishes its cost are two different steps, and doing only the first is what produces a confident wrong report about severity.) +- **merge region excludes the shared tail** (a roster carrier whose rows are multi-line blocks ending in an identical suffix makes every two-lane append resolve WRONG BY DEFAULT. The three-way merge factors the shared suffix out of the conflict region, so the region holds two half-blocks above the markers and one tail below them, and the purely additive resolution -- delete the markers, keep both sides, which is the CORRECT resolution when the two appended rows are independent -- leaves the first row's closing lines belonging to the second. Specimen: this carrier, which conflicted on every integration of main across four merge bases in one session (2026-09-01) with a shared tail of `evidence: [],` and `}`; `gunbc.rung_drop` had the same shape with `}` alone. **THE CLASS IS LOUD, AND THAT IS THE HALF A REPORT OF IT WILL GET WRONG.** The first reading was that the severed row survives as a structurally broken declaration under which the natural check -- declared names against rostered names -- still passes, because both lists stay complete. Measured against a gunbc built at d0009ca531 on the resolved shape: it is a PARSE REFUSAL at the module index, `expected expression, found Eq`, because a `data` keyword cannot stand in record-field position. Nothing reaches the checks that reading worried about, so the cost is toil and not silent wrongness -- a load-bearing authority whose every integration lands a conflict whose natural resolution does not compile, hand-repaired each time. **RECOGNITION RULE: for a carrier two lanes append to, ask what suffix the appended units SHARE, because a conflict region never contains it -- whatever semantics live in that suffix are exactly what a resolution can drop.** THE REPAIR IS THE UNIT AND NOT A CHECK: make the appended unit one line, and the shared suffix is a blank separator carrying nothing. **SECOND, INDEPENDENT INSTANCE, AND IT RE-RAN THE MISREPORT THIS ROW WARNS ABOUT** (vivid-boar-481, 2026-09-01, integrating main on a later base than the one above): the severed identity was `sealing_property_erases_structure` and the recipient of its donated tail was `accepted_source_emits_uncompilable_target`, over the same `evidence: [],` and `}` suffix. The finder produced the naive both-sides resolution, spotted the fusion by AUDITING THE RESULTING DECLARATIONS rather than by any marker, repaired it -- and then reported that the fused file STILL PARSED and that nothing went red. That report was an inference from reading the text, never an execution, and compiling the reconstructed fused shape refused at `expected expression, found Eq`, the same diagnostic recorded above. So the row's corrected reading survived contact with a second lane, and the reading it corrects -- silent survival -- is what the second reporter independently reinvented before measuring. THE TRANSFERABLE PART IS THAT THE MISREPORT IS THE DEFAULT AND NOT A LAPSE: a reader who resolves the conflict, sees both rows present and no markers, and does not compile, will conclude 'parses fine' every time, because every visible signal available WITHOUT executing agrees with that conclusion. The audit that finds the fusion and the execution that establishes its cost are two different steps, and doing only the first is what produces a confident wrong report about severity. **THE ONE-LINE REPAIR IS HALF A REPAIR, AND THE OTHER HALF ARRIVED AS ITS OWN NIGHT OF CONFLICTS** (2026-09-03, `gunbc.rung_drop`, three lanes). Collapsing a row to one line removes the shared SUFFIX and with it the append hazard, and it converts the row into a multi-kilobyte single line -- so two lanes making LOGICALLY DISJOINT edits to ONE row, a `standing` flip and an `authored` extension, now collide on that line with certainty and with a diff no reviewer can read. Neither shape is safer than the other. They are the two halves of ONE deficit: the arbiter of a structured roster is text-level three-way merge, which sees lines and not declarations, so every line a carrier makes shared is a hazard and the only question is whether the sharing falls on appends or on edits. **CORRECTED RECOGNITION RULE: ask what LINE two independent authoring acts are forced to share, for BOTH acts a growth surface admits -- adding a unit and amending one.** THE REPAIR IS STILL THE UNIT AND STILL NOT A CHECK, but the unit is the FILE: one row per file makes both acts share nothing, and reduces the shared text to a roster of bare identifiers, one line each, where an append has no tail to lose and an amendment touches no roster line at all. **AND ONE FIELD PER LINE IS NOT ENOUGH, WHICH IS THE PART ONLY MEASUREMENT FOUND.** A three-way merge needs an UNCHANGED line between two changed regions to keep them apart, so two lanes editing ADJACENT fields conflict exactly as they did on one line. Measured with `git merge-file` on `floor_cut_heal`, a `standing` flip against an `authored` extension: one-line row, 1 conflict; one field per line with `standing` and `authored` adjacent, 1 conflict; the same fields separated by a blank line, 0 conflicts with both edits present. So the carrier unit is a line AND ITS SEPARATION, and a representation that merges is one where every independently amendable field is separated from its neighbours by a line no amendment touches. The roster still conflicts on a two-lane append -- measured, 2 regions -- but each region is a whole line on both sides with no shared suffix, so the additive resolution is correct and total, which is the property the one-line row bought and this shape keeps. Worked repair: `gunbc.rung_drop`, whose 30 rows are 30 files under `dag/gunbc/rung_drop/` enumerated by `gunbc.rung_drop.roster`. THE SHARED TEXT IS NOT ZERO AND THE HONEST COUNT IS THE ENUMERATIONS: a new drop still touches the roster line, and a new PROSE drop touches three further lists that exist only to keep the prose arm closed. Each is a whole line with no shared suffix, so each resolves additively -- which is the claim, and it is weaker than `disjoint edits no longer conflict`. What this does NOT establish is enforcement -- nothing refuses a second row added to one of those files, so the default is safe and the shape is not walled.) - **a construction-restricting property read as a structure-erasing one** (a declaration is annotated to RESTRICT how its inhabitants may be built, and a consumer that asks about the declaration's SHAPE treats the annotation as a reason to stop looking -- so the deliberate climb on the construction axis silently drops a rung on every axis decided by shape, with no declaration, because the two axes are read by different consumers. **THE INVERSION IS THE CLASS**: the annotation exists to make the carrier MORE distinct from its payload, and the consumer's response is to make it INDISTINGUISHABLE from everything. Recognition rule, keyed on the SHAPE and not on any one keyword: whenever a declaration-level marker is stored in a general side-channel -- a properties list, an attribute bag, a modifier set -- find every consumer that BRANCHES ON THAT CHANNEL BEING NON-EMPTY rather than on the specific marker, and ask what each of them would have answered had the marker been absent; a consumer that answers 'opaque', 'unknown', or 'skip' for the whole channel has conflated 'this declaration carries a marker I do not model' with 'this declaration has no structure', and every future marker inherits the same silence on arrival. **SPECIMEN, with the discriminating pair** (gunbc XL-0-FLOOR, 2026-09-01): `v2.compiler.normalized_tree` `NormalizedTree` was sealed by BL-1 from an alias for `Node` into a `sole_constructor` record so that a wrapper-retention drop would be unwritable. `sole_constructor` is carried as a PROPERTY on the declaration node (`v1.compiler.parse` `parsed_sole_constructor_properties`), and `v1.compiler.infer` `exposure_view_for_node` answered `OpaqueTypeHead` for any node whose properties list was non-empty -- so `nominal_product_head_name` answered the empty string for every sealed carrier, `nominal_product_inhabitance_refusal` short-circuited on the empty head, and `declared_type_inhabitance` fell through to `Inhabits`. `v2.compiler.source_authority` `normalized_source_ast_equal_witness` then bound a `NormalizedTree` at a formal declared `Node` and the compiler ACCEPTED it: the ordinary-floor violation DESIGN section 4b names as exact application bijection, below baseline. The discriminating pair is two record declarations identical to the token except for the word `sole_constructor` -- the sealed one compiled with zero diagnostics where the plain one refused. **WHY A CENSUS MISSED IT, which is the part that generalizes**: gunbc#8886 measured 285 sites behind the `v2.*` direct-call argument-type exemption, of which 148 were `Node` against `ResolvedTree`/`ParseTree` and siblings -- every one a transparent-ALIAS false positive. This shape never appears in that roster and could not have, because it is a TRUE positive the comparison relation cannot reach: the census enumerates what the relation REFUSES, so a defect the relation is blind to is invisible to the census by construction, and a large census reads as thorough coverage of exactly the region it cannot see. **THE MISDIAGNOSIS THIS CLASS INVITES, recorded because this lane was dispatched with it**: the silence sat inside a module the exemption covers, so the exemption was the obvious cause; refuting it took running the identical program in an ordinary module and on a tree with the exemption deleted, both of which stayed silent, while the same run showed the exemption's effect on a kernel red so the arms were provably live. A plausible nearby mechanism that is genuinely broken is the most expensive wrong answer available, because repairing it changes nothing and the repair reads as coverage. **Rung: mechanically preventable, and the ceiling for this class as a class is the same rung.** The repair makes one marker structure-preserving by positive establishment -- the parser builds the identical declaration node and only the properties list differs -- and every OTHER marker in that channel stays opaque and unmeasured, which is a named residue rather than a covered class. The next-rung trigger is a CAPABILITY: markers carried in the declaration's own type rather than in an untyped side-channel, so that a consumer branching on the channel cannot compile.) - **a two-reader disagreement census is blind to the case where BOTH readers are wrong together** (an instrument whose subject is DISAGREEMENT between two producers of one answer reports AGREEMENT as healthy, so the population where both answer the same WRONG thing is scored green and is invisible to it by construction. The trap is that such an instrument is commissioned precisely to adjudicate a known-defective population, and it can be structurally incapable of seeing that population while looking perfectly well-formed and producing rows. **SPECIMEN, measured 2026-09-01.** `v1.tests.claim.carrier_realization_census` records, per type-reference occurrence, the legacy short-circuit key and the strict authority answer, and reports where they diverge. Its calibration control -- stated in docs/plans/carrier-realization-arbiter-repair-design.md -- requires the diagnostic-producing `DivergesWithExactIdentity` subset to reproduce arm A 25 sites, joined by source declaration and enclosing declaration, never by line. Run over the transitive import closure of `src/v2/compiler/01_tokenize.dag`, the module that emits the file where every arm-A site lives contributed 76 rows: 74 Agrees, 2 IdentityUnavailable, ZERO divergences, and all 26 of its `String`-named rows Agree. Every divergence row in the closure sat in `v2.std.text`, the DECLARING module, in the opposite direction. Empty intersection with the population the control exists to find. **THE SHAPE OF THE ABSENCE IS THE DIAGNOSIS, and it is what distinguishes this class from an over-broad walk.** `gunbc#9900` predicted the walk might visit occurrences the emitter never renders; that defect shows the target population PLUS extras. This showed the target population NOT AT ALL. Same instrument, same rows, opposite conclusions -- and only the shape separates them. **WHY BOTH READERS AGREE THERE**, read off `v1.compiler.emit_rust` `checkpoint_table_bypasses_identity_note` REACHABILITY CORRECTION rather than executed here: the short-circuit returns the host spelling before consulting any authority, and the authority answers from `type_reference_decl_file`, whose fallback returns the file containing the REFERENCE. Two readers, one wrong answer, perfect agreement. **RECOGNITION RULE: any two-reader comparison cited as CORRECTNESS coverage.** A differential oracle, a twin fixture, a cross-check, a self-hosted-versus-seed comparison, an A/B over two emitters -- each answers `do these two concur`, and none answers `is the answer right`. Ask what a SHARED error would look like in its output; if the answer is `indistinguishable from health`, the instrument cannot be the correctness evidence, whatever else it is good for. **THE REMEDY IS A DIFFERENT ORACLE, NOT A REPAIR OF THIS ONE.** The adjudicating instrument has to reach OUTSIDE the pair of readers for its ground truth -- for this specimen, a census of agreement-at-a-wrong-answer joined against emitted-crate diagnostics. Widening the occurrence set, fixing the walk, or adding a third reader that shares the same defective input do not help, and the first two are what a reader who diagnosed this as an over-broad walk would have spent. **Bounded against `executed_conjunct_discriminates_nothing`**: there a live gated conjunct never meets a population that would falsify it, and one authored fixture retires it; here the instrument meets its population on every run and reports it as healthy, so no fixture over this instrument can retire it. **Bounded against `instrument_output_read_as_subject_content`**: there the instrument answers its own question faithfully and a consumer substitutes the subject; here the instrument answers ITS OWN question faithfully too, and the defect is that its question -- do the readers concur -- was never the question that was asked.) - **a census with an unresolvable fraction of its population reports a denominator it does not have** (an occurrence census that emits a third disposition for `could not determine` is honest at the row grain and misleading at the total grain: rows scored `identity unavailable` are neither agreements nor divergences, so any ratio taken over the reported total silently treats them as decided. **SPECIMEN, unowned and unexplained at filing (2026-09-01).** The `v1.tests.claim.carrier_realization_census` run over the `src/v2/compiler/01_tokenize.dag` closure produced 121 `IdentityUnavailable` rows -- roughly a tenth of its population. The earlier run recorded in docs/plans/carrier-realization-arbiter-repair-design.md, over the same subject module at the FRONT-END phase on 2026-08-21, reported `1142 rows: 1134 Agrees, 8 DivergesWithExactIdentity, 0 IdentityUnavailable`. Zero to a tenth, across a phase change nobody predicted it for. **BOTH RUNS ARE NAMED RATHER THAN THEIR NUMBERS INHERITED**: the earlier is the front-end-phase run the design itself later withdraws as measuring the wrong phase, and the later is the typed-graph census landed by `gunbc#9900`. They are not the same instrument and the pair is recorded to locate the question, not to compute a delta from. **RECOGNITION RULE: an instrument with a `cannot answer` disposition, whose consumers aggregate over the reported total.** Ask what fraction is undecided before reading any ratio, and treat the undecided fraction as a separate finding rather than as noise. **WHY IT IS FILED WITHOUT INVESTIGATION**: identity being unavailable is a different defect from the readers disagreeing, it has no owner, and it was found while running a control for an unrelated question. A row that records it with both runs named is what stops the next reader taking the census denominator at face value.) - **a restoration promise names a route that does not exist** (a mechanism withholds, defers or dormant-marks a population and tells the reader it becomes observable again under some named condition — and that condition names a RUN, LANE, CADENCE OR SWEEP the tree does not contain. Nothing refuses, because the promise is a string in a diagnostic rather than a citation anything resolves; the population is not silently dropped, which is what makes the class survive review — it is dropped WITH A RECEIPT, and the receipt is what stops anyone looking. **THE BOUNDARY AGAINST `unbacked_execution_claim` IS THE TENSE AND IT DECIDES THE REMEDY.** That class is prose asserting a relation that RUNS NOW; this is prose asserting a relation that WILL run — a future condition, so `git log --all -S` over the declaration form finds nothing to past-tense and the origin arms there do not apply. It is also not `absorbing_fallback`: nothing widens, the withhold is precise and correctly counted. It is 4b(3)'s trigger trap with the polarity inverted — there a trigger names LESS than the capability it restores and gets satisfied while the capability stays dead; here the trigger names a capability whose PRECONDITION IS ALREADY FALSE, so it can never be satisfied at all and the row waits forever in a state that reads as temporary. **SPECIMEN WITH A RECEIPT, measured 2026-09-01 on head 4c6c509e and unrepaired at authoring.** `v1_compiler.cli_run.required_floor_runner` `suppress_withheld` removes enrolled expected-red identities whose module sits outside the required gate, printing that their enrolment `becomes observable again when the gate roster admits the module or in the whole-corpus receipts run`. THAT RUN DOES NOT EXIST: the phrase occurs exactly once in the tree, inside the message that promises it, and the repository carries three workflows of which none is it. 39 identities across 23 modules sit under that promise. Each is enrolled on `v2.workflow.floor_expected_red`, whose own header states what an enrolment asserts — that the identity REACHES ITS SUBJECT AND ANSWERS, and that a row belongs there only while someone is fixing it — so every one of the 39 asserts `runs, fails, someone is fixing it` about a row no run reaches. The only surviving route by which one executes is the changed-witness override, i.e. somebody editing it. **THE POPULATION IS DERIVABLE AND IS DELIBERATELY NOT TRANSCRIBED HERE**: it is `v2.workflow.floor_expected_red` `floor_expected_red_roster` minus the identities whose module matches `v2.workflow.required_floor` `required_gate_prefixes` — two authorities and a set difference, so it re-derives instead of rotting. **THE SAME ROSTER'S HEADER ALREADY RECORDS THE ANCESTOR OF THIS MISTAKE**, which is why it is a class: 101 rows were held there as agreement while never reaching their subject, and were reclassified into `v2.workflow.floor_route_gap` on 2026-08-20 once `ExpectedRedArm` was taught to refuse `HostEffectRefused`, `HostToolUnresolved` and an interrupted budget. That repair closed the arm where a NON-VERDICT was read as agreement; this class is the same harm one step earlier, where a row never reaches an arm at all and a sentence promises it will. **RECOGNITION RULE: whenever a diagnostic says a withheld thing becomes observable again `in`/`under`/`by` some named run, grep the tree for that name and require an executing consumer — a workflow job, a scheduled entry point, an actuator argv. If the only occurrence is the promise itself, the population is dormant forever and the honest states are two: admit the row cannot be observed on any cadence, or delete the enrolment. **RUNG: 1 (mitigatable) — the withhold is counted and located, which is the whole of what holds. CEILING: 3, since `whether a named route exists` is decidable from the workflow and entry-point authorities the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: restoration conditions expressed as a resolvable citation to an executing consumer rather than as prose, so a promise naming no route fails to compile — writing this particular sentence better retires nothing.) - **an instrument resolves an alias, lands on a name that COLLIDES with a kernel spelling, and attributes the result to the kernel** (the reference under measurement is authored QUALIFIED and points at a type alias; the reader resolves the alias, arrives at the alias declaration's own name, and that name is also a kernel name -- so the row is attributed to the kernel identity, naming THE EXACT CARRIER THE QUALIFICATION WAS WRITTEN TO MOVE AWAY FROM. **IT DOES NOT FAIL TO ANSWER; IT ANSWERS CONFIDENTLY AND WRONGLY**, and that is the whole severity: a missing answer is visible to its consumer and an inverted one is not, so the two rank completely differently and only the second can be cited as evidence for the opposite of what holds. **Distinct from `instrument_output_read_as_subject_content`, and the boundary is worth stating because they were found in the same instrument in the same hour**: there a report is COMPLETE for the reporter and read as complete for the consumer, so the defect is in the READING; here the report is wrong on a specific row it does examine, so the defect is in the INSTRUMENT and no amount of careful reading recovers it. Also distinct from `hollow_alias`, which is about a second name minted for one concept: the alias here is legitimate modelling, and what fails is a reader of it. **SPECIMEN, with a discriminating probe executed on covered ground (2026-09-01, gunbc#9907 follow-up).** `v1.tests.claim.carrier_realization_census` reports, for two functions appended to `v2.compiler.tokenize` on adjacent lines with identical position kind, differing only in alias-versus-concrete: a param authored `std.determinism.Determinism` keeps its dotted name, while a param authored `v2.std.text.String` comes back as bare `String` attributed to ``. `v2.std.text` declares `type String = FreeMonoid`, so the alias name collides with the kernel spelling. Both probes produced rows (17661 -> 17663), which is what makes the negative half evidence rather than absence -- the positive control is the whole discriminator, and the same census had already produced a null result on an uncovered fixture whose emptiness was indistinguishable from confirmation. **CONSEQUENCE MEASURED, NOT IMAGINED**: read naively, the census contradicted the namespace wall about nine function declarations and would have been read as nine admission rows asserting a binding the carrier lacks, on a merged PR. The wall was right; the contradiction was this bug. **RUNG: MECHANICALLY PREVENTABLE AT BEST TODAY AND CURRENTLY UNENROLLED** -- the wrong answer is produced silently and nothing executes over it. The next-rung trigger is that two-line probe being ENROLLED as a discriminating RED in any covered module, which is cheap; a class whose RED is two lines and still does not execute has no excuse, and naming the cheapness is what makes it rank rather than sit. **Recognition rule**: wherever a reader resolves through an alias, ask whether the resolved name could collide with a name in a DIFFERENT namespace the reader also knows -- kernel, prelude, or ambient -- because at that point the reader cannot tell them apart and will pick one silently.) - **restored bytes reviewed as authorship** (a clobber repair returns content a prior PR already merged and a prior reviewer already accepted, but a diff has no way to say so: the restored lines are ADDED LINES, so a reviewer attributes them to the repairing PR and reviews them as new work. Specimen: gunbc#9937 restored two rows that gunbc#9868 had reverted off a stale base, and review 58203 filed REQUEST_CHANGES against a DESIGN section 6 transcribed-count defect in bytes that are character-for-character gunbc#9888's merged row -- a finding correct on its merits and misaddressed by one PR. **THE SECOND-ORDER EFFECT IS WHY THIS IS A CLASS AND NOT AN ANECDOTE: it makes clobber repairs EXPENSIVE TO LAND, which biases the fleet toward leaving clobbers standing.** The repairing lane inherits review debt for content it did not write, and the only way to discharge it inside the repair is to edit another lane's cells from a base lacking their context -- which is precisely the failure the repair exists to undo, committed a second time with better manners. RECOGNITION RULE: a diff whose added lines are byte-identical to a prior merged blob. It is DECIDABLE rather than a judgement call -- `cmp` against `git show :` answers it, and provenance for the whole region comes from `git log -S` naming the commit that added the text and the commit that removed it. THE REMEDY IS THE AUTHOR'S AND IT IS CHEAP: state the restoration ahead of the diff and carry the byte-identity receipt, so a reviewer meets provenance before content; without it the same finding is re-filed against the same bytes on every re-review, and the loop is paid for twice. A finding against restored bytes is well-formed and BINDS THE DESTINATION: provenance decides who answers it and in which diff, and never whether it is answered. **THE WRONG READING OF THIS ROW WAS AUTHORED AND REFUSED IN ITS OWN FILING** (review 58220): an earlier revision said such a finding 'belongs in its own diff', which reads as licence to merge a known defect behind an authorship argument -- DESIGN section 5's hard reject, and inverted, since a restoration is exactly the motion that puts the bytes back on main. What actually happened on the specimen is the rule: the reviewer's section 6 finding was correct, the repairing lane argued for routing it elsewhere, the owning manager OVERRULED that, and the defect was repaired inside the restoration under a ruling -- which is what made the edit a decision rather than one lane rewriting another's cells. Routing is a question about AUTHORITY and context, decided by whoever owns both lanes; the bytes are reviewed at their destination either way. **Rung: mitigatable** -- the author states the restoration and carries a byte-identity receipt, and a reviewer may still miss it. **Ceiling: mechanically preventable**, because the recognition rule is decidable: a tool that joins each added line against the merged blobs of the commits git log -S names can annotate a diff as restored before a human reads it. It is not structural -- nothing can make a restoration unwritable, nor should it. **Next-rung trigger, at capability grain: the review surface distinguishes restored bytes from authored bytes without the author asserting it**, since an author-supplied notice is exactly the evidence a tired or adversarial diff will omit. **THE RECEIPT MUST BE TAKEN AT THE DESTINATION AND NOT AT THE SOURCE, and that is the transferable half.** `cmp` decides the git case because it reads the bytes where they LANDED, not the bytes an author meant to send; the general shape is ANY step between assertion and delivery altering content while the delivery reports success -- and the step is not always the one a reader would blame first. Measured the same day in three places, and the THIRD one is a caution about naming the culprit too early: git's merge region dropped a row outside the conflict markers; a review read merged bytes as authored ones; and two sessions' messages arrived with a backticked identifier deleted and a dollar-variable replaced by a plausible shell path, which BOTH of them first attributed to the message transport. That attribution was wrong, and it was settled by measurement rather than by reasoning: a third session kept the local source of a sent message, read the delivered body back out of the store, and diffed them -- identical but for a trailing newline, with backticks, a backslash continuation and a dollar-brace token all intact. The corruption was in the SENDER'S OWN SHELL, expanding an inline double-quoted argument before the tool ever saw it, and the proposed remedy of banning backticks would have cost a real notation to avoid a hazard that lives in a construction nobody has to use. A deletion leaves a gap a reader might notice; a substitution leaves a syntactically fine claim that is simply false, which is why source-side confidence is not evidence at all.) +- **a stale-buffer write reverts another author's landed change, and the reversion is invisible in the reverting diff** (a whole-file write derived from a buffer that no longer matches the ref it is committed against silently drops whatever landed in between). **THE HARM IS THAT THE REVERSION IS UNREVIEWABLE BY CONSTRUCTION, not merely unnoticed:** a diff is computed against the state already lost, and the clobber is not part of the change, so the diff a careful author reviews looks EXACTLY like the change they intended. Specimen, and it ran in BOTH directions on one file inside one hour: on gunbc#10114, eae0ccae carried a new truncation section and zero of three corrections landed at b561d7c4; the repairing 9bdd91c3 carried all three corrections and zero of the truncation section. No commit on that branch carried both until afb2dd37. Two reviewers each read their own diff carefully and each missed the other's loss. **TWO DIFFERENT MECHANISMS, ONE CLASS**, which is why the row is about the buffer and not about scripting: one side was a script reading a stale working tree; the other was a hand edit from a REUSED worktree whose `git log` line printed the correct SHA while the file on disk did not match it -- so a correct-looking provenance check passed while the bytes were wrong. **RECOGNITION RULE, and it is the observable tell rather than a judgement:** a later diff shows a THIRD party's earlier hunk as a NEW change, which is impossible if that hunk survived. It is found by reading a diff for what it implies about the OTHER side, not for what it says about yours. **THE FLEET CONDITION THAT MAKES THIS LIKELIER HERE:** shared worktrees plus a shared git identity, so neither authorship nor a log line tells a reader whether the bytes in front of them are current -- `gunbc-ci-auto-heal` authors commits for many sessions, and a surprise commit on your own branch is not evidence of a stranger. Adjacent but NOT the same class as `restored_bytes_reviewed_as_authorship`: that row is about a clobber REPAIR being misread as authorship at REVIEW time; this is about the clobber being invisible in the clobberer's own diff at AUTHORING time -- different mechanism, different detection point, different repair. **Rung: mitigatable** -- caught after the fact, by inference, and only because someone read a diff against the wrong expectation. **Ceiling: mechanically preventable, and no higher, with the reason:** the invalid state stays writable because nothing structurally prevents a process from holding a stale buffer, and a write tool cannot know which content a caller MEANT to preserve. **Next-rung trigger, at capability grain: a file write asserts on the RESULT before committing it** -- every claim the artifact must carry is present in the buffer, so a missing marker fails closed rather than reverting. Deliberately NOT phrased as any lane adding such an assertion by hand: both lanes on the specimen built one AFTER the fact, and a trigger satisfied by one session's discipline retires the row while every other session stays exposed. The capability is the assertion being the DEFAULT in whatever writes files on this fleet.) - **a review summary that inverts real roles and then affirms the join** (a review names files that all exist, assigns each the wrong role, and closes by asserting the one property it was uniquely positioned to test. Specimen: review 58215 approved gunbc#9937 at `fafd2adc7e1` with *'restoration of two ledger rows to recurring_failure_mode.dag ... plus an accompanying prose update in the gap-analysis doc ... Diff is narrow and matches the PR title.'* The carrier held ONE added row, not two; that row was a NEW class row, not a restoration of anything; the actual restoration was the docs file it demoted to 'accompanying'; and the diff did NOT match the title, because the `.dag` file had been swept in by a staged-change leak the PR body never declared. **DISTINGUISH IT FROM A HALLUCINATED SUBJECT, which is the neighbouring failure and a much easier one:** review 58070 described a `match` arm that appeared nowhere in its diff, and an invention is refutable by grep. Here EVERY NOUN IS PRESENT IN THE TREE and only the relations between them are wrong, so the usual defence -- check that the cited things exist -- returns all-clear. **THE AFFIRMATION IS THE HARM AND NOT THE MISDESCRIPTION.** A lane cannot audit its own title-versus-diff agreement with fresh eyes; a reviewer can, and this one asserted that agreement in the exact PR where it failed. A review that stays silent on a property leaves the check undone; a review that affirms it wrongly marks the check DONE, which is worse and is why this is not merely a low-quality summary. RECOGNITION RULE, and it is decidable rather than a matter of reading care: join the changed-FILE set against what the title and body claim to change, at file grain, and refuse any file the body does not account for. That join is mechanical, needs no understanding of the diff, and would have fired here. **THE BACKSTOP QUESTION IS THE SECOND HALF OF THE ROW, and its answer is honest rather than comforting:** the leaked roster row carried no regenerated `DESIGN.md` or `docs/design-ledgers.md`, and by construction the required build lane's generated-artifact phase compares every `CommitRequired` projection against its authority, so it WOULD have refused. It did not get the chance -- that lane was CANCELLED on the leaked sha when the next push superseded it, and the leak was caught by the author re-reading the diff. So the backstop is real and was not what caught it, and a row claiming the gate held here would be asserting an execution that never ran. **Rung: mitigatable** -- the harm is contained only by a second reader noticing, and on the specimen the second reader was the author. **Ceiling: mechanically preventable**, and no higher: whether a summary DESCRIBES a diff correctly is not decidable, so no construction forbids the bad summary -- but the one clause that did the damage is decidable, because a changed-file set and a body are both machine-readable. **Next-rung trigger, at capability grain: no review verdict is admissible unless a changed-FILE-set join against the declared scope has executed and passed** -- not a reviewer instructed to check it, which is the same assertion that failed here, and not a lint on summary wording, which would ratchet the prose while leaving the join undone.) - **fabricated debt** (a declaration is authored for an exposure that does not exist, or that is already declared elsewhere, so the ledger grows a row whose trigger CANNOT FIRE because there is nothing to restore. It is the exact inverse of the unfiled gap and it is the more comfortable mistake: filing reads as diligence, the row survives review because every reviewer checks whether a declared drop is HONEST about its loss and none checks whether the loss is REAL, and the cost lands on whoever later tries to retire it. **THE HARM IS NOT MERELY CLUTTER, WHICH IS WHY IT IS A CLASS.** A drop is retired BY ITS TRIGGER AND BY NOTHING ELSE, so a row for a non-existent exposure is permanent by construction; it inflates the standing-drops list that DESIGN projects on every turn of every session, and the next reader plans against an exposure nobody has. A row DUPLICATING an existing declaration is worse still: it forks the single authority for one safety fact, so the two can be retired independently and the tree ends up asserting both that the class is dropped and that it is restored. **THE ORIGIN IS ALWAYS THE SAME, and naming it is the recognition rule: the population was read from a PARAGRAPH rather than measured from the tree.** A loss clause enumerates what was unguarded on the day it was written; capabilities return, get re-homed, or acquire their own declarations, and the sentence does not move. So the rule is: before authoring a drop, resolve every named item against the tree -- is this exposure live NOW, and does it already have a row? **TWO RECEIPTS, both caught before authoring, 2026-09-01, while splitting `gunbc.rung_drop` `floor_cut`'s six-capability loss into capability-grain rows.** (1) GENERATED-ARTIFACT DRIFT was on the loss clause's list and is RESTORED -- gunbc#9415 enrolled a required `generated-artifact` phase adjudicating every member of `committed_generated_artifacts`; the same paragraph elsewhere admits the phase took it off the list, so the row contradicted itself and a reader following the enumeration would have declared a drop for a live gate. It is now stated as a FRACTION, 1 of 7 discharged and 6 outstanding, because a population that shrinks silently cannot be checked. (2) THE PER-WITNESS EVAL DEADLINE was on the same list and ALREADY CARRIES ITS OWN DROP at `gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note`; a second row would have been the section 3 fork, and it is cited from the sibling rows rather than re-declared. Six items on the paragraph, five real rows. **NEIGHBOURS, and the boundaries are what keep this from absorbing them.** Distinct from `unbacked_execution_claim`: there prose asserts a live relation that no authority backs, and the subject EXISTS while the claim about it is false; here the subject itself is absent and the claim of loss is the fabrication. Distinct from `rung inflation`, which reports a class as SAFER than its evidence supports -- this reports the tree as MORE EXPOSED than it is, and both mislead the same reader in opposite directions. Distinct from `restoration_promise_names_a_route_that_does_not_exist`, which is a REAL exposure with an unsatisfiable trigger; this is an unreal exposure, and the two are found by the same question asked at different ends -- does the trigger name something that exists, and does the LOSS name something that exists. **RUNG: 1 (mitigatable) -- caught by a reader resolving the population, which is exactly what happened here and is not a mechanism. CEILING: 3, since `does this exposure exist` is decidable for any loss expressed as a citation to a mechanism rather than as prose. NEXT-RUNG TRIGGER, a CAPABILITY: a drop row whose lost capability is carried as a resolvable citation to the mechanism that provided it, so a row declaring the loss of something the tree still has -- or something another row already declares -- fails to compile. Enumerating populations more carefully by hand does not retire it; it only executes this row's recognition rule once more.) - **a YAML inline comment is ingested as scalar content** (a bounded YAML reader that does not model comment separation accepts `key: value # comment` and stores `value # comment` as the value, so a syntactically valid document is silently assigned the wrong tree. Measured 2026-09-01 against `extdeps.languages.yaml.ingest` `ingest_yaml_source`: a column-zero full-line comment and an indented full-line comment both refused loudly as malformed mapping entries; an inline trailing comment was accepted and reserialized as a quoted scalar containing the comment; a hash-leading line inside a block literal was accepted and preserved as content. The last arm is the discriminating control because generated workflow run blocks contain shell comments and issue references such as `#5828`; a line-wide hash filter would reject or delete real scalar content. Repair: full-line comments are skipped only at parser block boundaries, never in literal collection, while recognizable unquoted inline comments now produce `YamlIngestRejected` until lexical inline separation is modeled. **APPROXIMATION DIRECTION:** the temporary predicate intentionally over-refuses richer unquoted scalar forms containing separation-whitespace (space or tab) followed by hash that this bounded parser does not model, excludes double-quoted scalars, and never examines block-literal content; it does not claim full YAML comment lexing. Rung: mitigatable -- the silent wrong tree becomes a typed refusal. Ceiling: structurally guaranteed once comment separation is a lexical production in the YAML grammar, so comment bytes cannot enter scalar content except through quoted or block scalar productions. Next-rung trigger: inline YAML 1.2.2 comment separation modeled lexically rather than recognized by the temporary value-text refusal. -- **accepted source emits uncompilable target** (INVALID STATE: a .dag construction the front end accepts with zero blocking diagnostics, whose emission is a target program the target compiler refuses. The instance filed here is a coproduct's UNIT VARIANT standing in a NON-APPLIED TYPE POSITION -- a field, parameter or return type spelled with a constructor rather than a type. HARM: section 5 silent wrongness on the source-to-target path. gunbc says Accepted and hands over a program that cannot build, so the only wall that fires belongs to the target's compiler; where a target has no such wall, or where the emitted artifact is never compiled, nothing fires at all. Section 7 makes this the seed's floor and not the target's problem: the .dag graph is the authority and Rust is one realization, so 'rustc catches it' is exactly the outsourcing this project exists to end. THE SPECIMEN IS CARRIED IN THIS ROW RATHER THAN CITED, because the fixture that produced it was never committed to this repository (neat-otter-332, 2026-09-01). Its emitted artifacts are held by that lane's own receipts; no path is given here, since a path outside this repository is not a citation a later reader can resolve. Authored source, two modules: `scope.provider` declares `type Quantity = Time | Memory`; `scope.consumer` does `import scope.provider { Quantity, Time }`, `type NonApplied { value: Time }`, `fn field_as_quantity(subject: NonApplied) -> Quantity { subject.value }`. gunbc accepts it. DISTINGUISHING FACT, and the reason this class must not be read off the target's error code: WHAT rustc says is decided by what else the emitter minted, not by the source defect. Under the NARROW emitter classifier the consumer emits `pub use crate::scope_provider::{Quantity};` then `use crate::scope_provider::Quantity::{Time};` with no marker binding, and `pub struct NonApplied { pub value: Time }` refuses `error[E0573]: expected type, found variant Time` at `src/scope_consumer.rs:15:16` on `pub value: Time,`, label `not a type`, help `consider importing this struct instead`. Under the BROAD classifier the consumer instead emits `pub use crate::scope_provider::{Time};` beside `{Quantity}` -- the provider having emitted `pub enum Quantity { Time, Memory }` AND `pub struct Time;` -- so the field declaration COMPILES, and the refusal moves to the function: `error[E0308]: mismatched types` at `src/scope_consumer.rs:20:5` on `subject.value.clone()`, `expected Quantity, found Time`, against `expected Quantity because of return type`. INDEPENDENTLY REPRODUCED AT PARAMETER POSITION on this branch, 2026-09-01 on gunbc baeabbbf80, by a single-file source handed to the compiler: `type StampMode = StampClass | StampOther` with `fn take(stamp: StampClass) -> StampMode { stamp }`. `gunbc compile --target rust` exits 0 with 0 blocking errors, emits `pub fn take(stamp: StampClass) -> StampMode` beside `pub struct StampClass;`, and `cargo check` on the emitted crate refuses `E0308 expected StampMode, found StampClass`. One source defect; E0573, E0308-at-the-parent, and E0308-at-the-body depending on emission. THE MASK IS THE SHARP HALF, and it is fabricated plausible output rather than a lucky green: the broad classifier's marker import made the FIELD-ONLY source compile by substituting a distinct struct for a variant. It never preserved the modelled meaning, and extending the SAME accepted source across its declared parent boundary -- the function returning `Quantity` -- is what exposes it. So the narrow classifier's E0573 is this class becoming VISIBLE, not a regression the narrowing introduced. GENERAL FORM: a green obtained because the emitter manufactured a target-only entity for a source name is not evidence the source is well-typed, and the discriminator is to extend the source past the boundary the manufactured entity does not model. THE ONE .dag-SIDE SIGNAL IS ABOUT THE WRONG QUESTION: on the parameter reproduction the compile printed the ADVISORY `unlisted import use 'StampClass' (referenced but not in any import's name list)`. It fires because the name was not found among types -- the front end reached the exact fact that decides this case and reported it as import hygiene. It is not a partial wall: it is advisory, it names listing rather than type position, and the field specimen above IMPORTS `Time` explicitly, so it does not fire there at all (see `diagnostic_name_mechanism_silent`). RUNG FOUND AT: below the ladder, established by execution at the emission boundary -- the compile accepts and the emitted crate refuses. Section 4b's rung-1 mitigations are absent: nothing at the .dag boundary is typed, located or countable about this construction. CEILING: 4, structurally impossible, and the reason is that constructor identity and type identity are two distinct modelled facts whose membership is decidable from the coproduct declaration -- a variant name is reachable from that declaration as an ARM and never as a type, so the type-position slot has no constructor that admits it. No undecidable predicate is involved, so this is a wall now and not a ratchet. NEXT-RUNG TRIGGER, PHRASED AT CLASS GRAIN, phrased as the capability that retires the row rather than an artifact that would contribute to one: FRONT-END TYPE AGREEMENT for every construction whose emission carries a type obligation, sufficient that NO Accepted program emits a target program its compiler refuses on a type ground. That capability has one component per mechanism this row carries, and the row retires only when ALL of them hold: (i) type-position name resolution that consults the TYPE namespace alone and refuses a name resolving to a constructor with a located diagnostic, sufficient that no Accepted program contains a variant name in any non-applied type position -- field, parameter or return; (ii) arm-type agreement across a match, sufficient that no Accepted program mixes a coproduct constructor with a kernel literal across the arms of one match; (iii) agreement between the two renderings of an arrow at a call argument, sufficient that no Accepted program passes a function VALUE where the emitted parameter's rendering cannot accept it. Repairing any specimen, narrowing the emitter classifier, or adding a fixture satisfies less than any one component and retires no part of this row. WHY THE TRIGGER IS STATED THIS WAY, recorded because the row previously said otherwise and a reviewer was right to refuse it: the trigger read as (i) ALONE while the row's population had grown to three mechanisms, so satisfying it would have RETIRED THE ROW WHILE TWO OF ITS OWN DOCUMENTED FAILURES REMAINED AUTHORABLE -- DESIGN section 4b(3)'s grain mismatch exactly, a plural loss under a singular trigger. Noting the mismatch inside the row, which is what the function-value paragraph originally did, DOCUMENTS the defect rather than repairing it: a trigger that a row's own prose admits is too narrow is still the trigger the row will be retired by, since a drop is retired BY ITS TRIGGER AND BY NOTHING ELSE. RECOGNITION RULE: when the target compiler names a symbol at a type position, check whether that symbol is declared as an ARM of a coproduct in the source; if it is, the defect is in accepted .dag and the target compiler is the only wall that fired. SCOPE STATED RATHER THAN GENERALISED: executed for a unit arm at a field type and at a parameter type, Rust target only. Record-shaped arms, applied positions such as `List