From f5309e2e189eadeea4d64bafc7fc326b4f9f7338 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 20:38:39 +0000 Subject: [PATCH 1/6] =?UTF-8?q?The=20boundedness=20arm=20of=20the=20floor-?= =?UTF-8?q?cost=20trigger=20is=20a=20=C2=A74b(2)=20STALL=20awaiting=20one?= =?UTF-8?q?=20grounding,=20not=20unbuilt=20work?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gunbc#10260 corrected that row's conjunct (ii) to read INVARIANT OR BOUNDED BY CONSTRUCTION, and recorded that the invariance arm is measured and refuted while the boundedness arm is unestablished. It did not record WHY the boundedness arm has not moved, which §4b(2) obliges: a class below its ceiling must separate "cannot climb further" from "can climb after one grounding" from "can climb now but unbuilt". THE REACHABILITY RESULT, which is what decides the blocker. For observed pairwise ratios r1..rn with M = max(r1..rn), the evidence establishes only that every bound K valid for those observations satisfies K >= M. More samples may leave M unchanged or RAISE it; they cannot establish "for every admitted execution pair, ratio <= K". An observed maximum is a FLOOR on any valid bound, never a bound. So no measurement campaign discharges this arm — and a 12-run campaign reporting worst-observed 2.280x is exactly the artifact that would be offered for it. The drop row already said this of ONE measurement ("a maximum of 1.721 observed over one pair of attempts on one host pair is a FLOOR on the spread, not a bound on it"), but scoped to that measurement it reads as an invitation to sample more hosts. Stated generally here so it cannot. AwaitsOneGrounding, NOT ClimbableButUnbuilt: there is no closed admitted envelope with every basis-varying component accounted for, so the work is unspecifiable rather than merely unstarted. The four conjuncts are ONE conjunctive grounding and the trigger says so — a trigger satisfiable by any one of them would retire the row with the capability still dead, which is the §4b(3) grain mismatch arriving as a §4b(2) trigger. RUNGS DERIVED FROM THE DROP ROW RATHER THAN ASSERTED. current=Mitigatable because that row's TEMPORARY RUNG sentence ends "acceptance still fail-closed", so the failure surfaces as a typed refusal rather than a silent pass; had acceptance been permissive this would sit BELOW the ladder and the field would say so. ceiling=StructurallyGuaranteed and not Impossible because an execution exceeding a derived bound stays authorable — the climb removes the silent acceptance, not the ability to write the program. WHY A STALL AND NOT A SECOND DROP, in that row's own words: "PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from." Nothing was lost, so a drop's previous/temporary/reason fields have no answer here. Enrolled in all_guarantee_stalls (26 -> 27), which is what puts it inside every_stall_is_below_its_ceiling and every_stall_names_a_trigger. NOT added to restored_stalls, whose annotation states it is a presence-exactly-once pin over four previously-lost subjects and that "a new stall row must be admitted without editing this list". Adding the row without the roster entry was the specific failure this lane shipped once today on gunbc.recurring_failure_mode — the projection went silently unchanged — so the enrolment is verified by count rather than by having typed it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- dag/gunbc/guarantee_stall.dag | 53 +++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/dag/gunbc/guarantee_stall.dag b/dag/gunbc/guarantee_stall.dag index b21c47a3ffb..7dd176d3c8a 100644 --- a/dag/gunbc/guarantee_stall.dag +++ b/dag/gunbc/guarantee_stall.dag @@ -390,6 +390,58 @@ data gitattributes_committed_emit_drift_stall: GuaranteeStall = GuaranteeStall { next_rung_trigger: "node://adhoc-16f7520a-85f lands: identify the authority edit that introduced the drift, regenerate .gitattributes from that authority, and restore a required generated-artifact drift gate so later authority/artifact disagreement refuses" } +// NO MEASUREMENT CAMPAIGN CAN DISCHARGE THIS ARM, AND THAT IS WHY IT IS A STALL RATHER THAN UNBUILT +// WORK. `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` states that its restoration +// trigger's conjunct (ii) requires the cost basis to be INVARIANT OR BOUNDED BY CONSTRUCTION. The +// invariance arm is measured and REFUTED. This row is about the other arm, at its own subject grain +// -- not the whole disjunction, because collapsing the two is the exact defect gunbc#10260 repaired +// in that row's own text, and repeating it here would reintroduce it one file away. +// +// THE REACHABILITY RESULT, which is what makes the blocker AwaitsOneGrounding rather than +// ClimbableButUnbuilt. For observed pairwise ratios r1..rn with M = max(r1..rn), the evidence +// establishes only that every bound K valid for those observations satisfies K >= M. Adding samples +// may leave M unchanged or RAISE it; it cannot establish `for every admitted execution pair, ratio +// <= K`. So an observed maximum is a FLOOR on any valid bound, never a bound -- and a percentile, a +// confidence interval, or a long run of non-exceedances is not a substitute for a construction- +// derived one. The rung_drop row already says this of one measurement; what is recorded here is the +// general statement, so a future lane does not read that sentence as an invitation to sample more +// hosts. A 12-run campaign reporting a worst-observed 2.280x is exactly the artifact that would be +// offered, and it does not touch the arm. +// +// WHY THE PREREQUISITE IS A GROUNDING AND NOT AN IMPLEMENTATION: there is no closed admitted +// envelope with every basis-varying component accounted for, so the work is not a decided +// construction merely unstarted -- it is unspecifiable until that authority exists. The four +// conjuncts below are ONE conjunctive grounding, not four alternative routes, and the trigger says +// so, because a trigger satisfiable by any one of them would retire this row with the capability +// still dead -- the section 4b(3) grain mismatch, arriving here as a section 4b(2) trigger. +// +// CEILING IS GUARANTEED AND NOT IMPOSSIBLE: a bound derived from admitted components and caps is a +// proof from modeled structure, but an execution that exceeds it stays authorable. What the climb +// removes is the silent acceptance, not the ability to write the program. +// +// CURRENT IS MITIGATABLE, DERIVED FROM THE DROP ROW RATHER THAN ASSERTED HERE. That row's TEMPORARY +// RUNG sentence ends `acceptance still fail-closed`, so the failure this stall describes surfaces as +// a typed refusal on a measurement that is not a stable property of the claim -- the failure occurs +// and its harm is contained, which is rung one exactly. Had acceptance been permissive under an +// unqualifiable cost, this row would sit BELOW the ladder and the honest field would say so. +// +// AND WHY THIS IS A STALL RATHER THAN A SECOND DROP, which the drop row settles in its own words: +// `PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was +// never held, and saying it was would be inventing a rung to drop from.` Nothing was lost, so a +// drop's previous/temporary/reason fields have no answer here. The two rows are also different +// facts: the drop states the standing unavailability, this states that one named restoration +// conjunct is unreachable BY MEASUREMENT and what would reach it. +data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { + subject: "the BOUNDEDNESS-BY-CONSTRUCTION arm of conjunct (ii) of gunbc.rung_drop floor_cost_claim_qualification_unavailable's restoration trigger: repeated execution measurement cannot establish it, because every observed maximum is a LOWER bound on the smallest valid bound rather than an upper bound over the admitted envelope", + current: Mitigatable, + ceiling: StructurallyGuaranteed, + blocker: AwaitsOneGrounding { + grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" + }, + population: BoundedPopulation { members: Cons { head: "gunbc.floor_cost_distribution.FloorCostRow.eval_steps", tail: Cons { head: "gunbc.floor_cost_distribution.RunCost.eval_steps", tail: Cons { head: "gunbc.rung_drop.floor_cost_claim_qualification_unavailable", tail: Empty {} } } } }, + next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" +} + // THE WALL DEADLINE STILL CHARGES A SHARED-ARTIFACT FILL TO WHICHEVER CLAIM PAID IT, and this row // exists because a comment beside the code would go stale on the day the population changes while // this row cannot. The 2026-08-27 attribution ruling has now been applied to three homes one at a @@ -697,6 +749,7 @@ data all_guarantee_stalls: List = [ external_model_scope_live_cover_stall, observation_heartbeat_lockstep_stall, operation_argv_binding_wall_stall, + floor_cost_basis_boundedness_stall, ] // A STALL AT ITS CEILING IS NOT A STALL: the row would describe a class that already arrived, and From 51598018e55b7b110e8531fcd783748dc4489c52 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 23:29:14 +0000 Subject: [PATCH 2/6] The stall's own rung was inflated across a subject boundary, and its bounded population named a field that does not exist Both defects are the ones this row was written to be scrutinized for, found by review on the exact head and confirmed here against the corpus rather than against the prose that produced them. current: Mitigatable -> OutsideTheLadder. The Mitigatable field rested entirely on reading one clause of the parent drop row, `acceptance still fail-closed`, as though it spoke for this arm. It does not: that clause is about attempt safety and verdict availability, a neighbouring path. The deciding consumer, v2.workflow.required_floor.claim_safety_outcome, takes seven parameters, none of which is or derives from a construction-bound authority, and branches only on reached_verdict, then observed_cpu_ms against cpu_limit_ms, then observed_wall_ms against wall_limit_ms. The boundedness arm's absence therefore accompanies CompletedWithinSafetyLimits and CompletedPastSafetyLimit alike and no output varies with it, so a refusal there is evidence that one execution crossed an attempt-safety limit and never that the arm is missing. Nothing observes the arm and nothing blocks on it, so rung one is not occupied. DESIGN makes a class's current rung the minimum over its in-scope paths, so the fail-closed neighbour cannot raise this silent one -- and required_floor's own PREEMPTION-1 drop already applies exactly this standard one module away, ruling that limits which "observe nothing and block nothing at the moment the cost accrues" are not even mitigatable. The row now holds itself to the rule its neighbour states. gunbc.guarantee_rung carries OutsideTheLadder precisely so a stall's current rung can say it, and it orders strictly below Mitigatable, so stall_is_below_ceiling still holds against the unchanged StructurallyGuaranteed ceiling. The annotation claiming the field was "DERIVED FROM THE DROP ROW" is replaced. Nothing derived it; prose read prose, which is the shape DESIGN 5 names as specification-without-execution. The replacement cites the consumer and what its parameters and branches actually are. population named gunbc.floor_cost_distribution.RunCost.eval_steps, which is not a field: RunCost declares run and rows. A BoundedPopulation carrying a fictional member is not an identity join, so the bound was never real. It is replaced by the deciding consumer named above -- the site where the arm is in fact absent -- and all three members now resolve to declarations that exist. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- dag/gunbc/guarantee_stall.dag | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/dag/gunbc/guarantee_stall.dag b/dag/gunbc/guarantee_stall.dag index 7dd176d3c8a..3e3202ad2d6 100644 --- a/dag/gunbc/guarantee_stall.dag +++ b/dag/gunbc/guarantee_stall.dag @@ -419,11 +419,24 @@ data gitattributes_committed_emit_drift_stall: GuaranteeStall = GuaranteeStall { // proof from modeled structure, but an execution that exceeds it stays authorable. What the climb // removes is the silent acceptance, not the ability to write the program. // -// CURRENT IS MITIGATABLE, DERIVED FROM THE DROP ROW RATHER THAN ASSERTED HERE. That row's TEMPORARY -// RUNG sentence ends `acceptance still fail-closed`, so the failure this stall describes surfaces as -// a typed refusal on a measurement that is not a stable property of the claim -- the failure occurs -// and its harm is contained, which is rung one exactly. Had acceptance been permissive under an -// unqualifiable cost, this row would sit BELOW the ladder and the honest field would say so. +// CURRENT IS OutsideTheLadder, AND THE READING THAT MADE IT `Mitigatable` WAS RUNG INFLATION ACROSS A +// SUBJECT BOUNDARY. This row first cited the drop row's `acceptance still fail-closed` clause as +// though it spoke for THIS arm. It does not: that clause is about attempt safety and verdict +// availability, which are a neighbouring path. Read the deciding consumer instead of the prose -- +// `v2.workflow.required_floor.claim_safety_outcome` takes seven parameters, none of which is or +// derives from any construction-bound authority, and branches only on `reached_verdict`, then +// `observed_cpu_ms` against `cpu_limit_ms`, then `observed_wall_ms` against `wall_limit_ms`. So the +// absence of the boundedness arm accompanies `CompletedWithinSafetyLimits` and +// `CompletedPastSafetyLimit` ALIKE, and no output of that function varies with it. A refusal there is +// evidence that one execution crossed an attempt-safety limit, never that the arm is missing. +// +// Nothing observes this arm and nothing blocks on it, so no harm is contained at its own grain and +// rung one is not occupied. Section 4b makes a class's current rung the MINIMUM over its in-scope +// paths, so the fail-closed neighbour cannot raise this silent one. The same standard is already +// applied one module away: `v2.workflow.required_floor`'s PREEMPTION-1 drop rules that for an +// `OpaqueHostCallUnbounded` claim the two limits `are not even mitigatable -- they observe nothing +// and block nothing at the moment the cost accrues`. This row now holds itself to the rule its +// neighbour states rather than to a sentence quoted from a different subject. // // AND WHY THIS IS A STALL RATHER THAN A SECOND DROP, which the drop row settles in its own words: // `PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was @@ -433,12 +446,12 @@ data gitattributes_committed_emit_drift_stall: GuaranteeStall = GuaranteeStall { // conjunct is unreachable BY MEASUREMENT and what would reach it. data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { subject: "the BOUNDEDNESS-BY-CONSTRUCTION arm of conjunct (ii) of gunbc.rung_drop floor_cost_claim_qualification_unavailable's restoration trigger: repeated execution measurement cannot establish it, because every observed maximum is a LOWER bound on the smallest valid bound rather than an upper bound over the admitted envelope", - current: Mitigatable, + current: OutsideTheLadder, ceiling: StructurallyGuaranteed, blocker: AwaitsOneGrounding { grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" }, - population: BoundedPopulation { members: Cons { head: "gunbc.floor_cost_distribution.FloorCostRow.eval_steps", tail: Cons { head: "gunbc.floor_cost_distribution.RunCost.eval_steps", tail: Cons { head: "gunbc.rung_drop.floor_cost_claim_qualification_unavailable", tail: Empty {} } } } }, + population: BoundedPopulation { members: Cons { head: "gunbc.floor_cost_distribution.FloorCostRow.eval_steps", tail: Cons { head: "v2.workflow.required_floor.claim_safety_outcome", tail: Cons { head: "gunbc.rung_drop.floor_cost_claim_qualification_unavailable", tail: Empty {} } } } }, next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" } From e047126b6a0fac8e74d4f57db559e2bef236bff3 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 23:46:00 +0000 Subject: [PATCH 3/6] The population had no identity to name, so it is UncountedNotEnumerable rather than a list that reads as bounded Second review finding on this row, and the first repair of it was insufficient. Removing the nonexistent RunCost.eval_steps and substituting a real symbol kept the BoundedPopulation shape while the shape itself was the defect. The subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside the parent drop, so the arm has no typed subidentity a member list could name. The original list demonstrated that by failing: it mixed an instrument column, a deciding consumer, and the entire parent drop -- three different kinds of thing, none of them the arm. This module already rules on exactly this move. The Nat unification row declines a four-file BoundedPopulation because rendering it as bounded "would read as bounded while measuring the wrong property, which is the empty-observation narrow this carrier's second variant exists to prevent". That is what my list did, so the row now uses the variant that exists for it. The reason field records that the affected set is NOT infinite -- it is finite and derived per run as every required identity for which the CPU deadline is armed -- but that it is produced by execution rather than declared in source, so no enumeration written here would be true when written. It also names what would make a bounded carrier honest later: a typed split of the parent restoration trigger giving the arm an identity. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- dag/gunbc/guarantee_stall.dag | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dag/gunbc/guarantee_stall.dag b/dag/gunbc/guarantee_stall.dag index 3e3202ad2d6..917205c0f66 100644 --- a/dag/gunbc/guarantee_stall.dag +++ b/dag/gunbc/guarantee_stall.dag @@ -451,7 +451,9 @@ data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { blocker: AwaitsOneGrounding { grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" }, - population: BoundedPopulation { members: Cons { head: "gunbc.floor_cost_distribution.FloorCostRow.eval_steps", tail: Cons { head: "v2.workflow.required_floor.claim_safety_outcome", tail: Cons { head: "gunbc.rung_drop.floor_cost_claim_qualification_unavailable", tail: Empty {} } } } }, + population: UncountedNotEnumerable { + reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger that is authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable, so the arm has no typed subidentity for a member list to name. The list this row first carried proved that by failing: it mixed an instrument column (FloorCostRow.eval_steps), a deciding consumer (v2.workflow.required_floor.claim_safety_outcome) and the entire parent drop -- three different kinds of thing, none of them the arm, and one of them, RunCost.eval_steps, a field that does not exist. Rendering them as a BoundedPopulation read as bounded while measuring the wrong property, which is the narrow this carrier's second variant exists to prevent. The affected set is not infinite: it is finite and derived per run as every required identity for which the CPU deadline is armed. But that set is produced by execution rather than declared in source, so no enumeration written here would be true when written. A typed split of the parent restoration trigger would give the arm an identity and permit an honest bounded carrier; inventing a member does not", + }, next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" } From 76d67a57fa281e4c5722e9efbefc31bd4b55361e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Fri, 4 Sep 2026 03:38:49 +0000 Subject: [PATCH 4/6] The population's reason argued a future bound that its own exposure reading forbids, and misstated which list held the nonexistent field Third review round on this row, superseding an APPROVE on the same SHA. Both findings are correct and the second is a plain self-contradiction I wrote. THE CAUSAL AND FUTURE CLAIM DID NOT FOLLOW. The reason opened by making the arm's missing typed subidentity the cause of the population being unenumerable, and closed by saying a typed split of the parent trigger would therefore permit an honest bounded carrier. Under the exposure reading this carrier is declared for, neither holds. The same reason already identifies the population as every required identity for which the CPU deadline is armed, derived per run; giving the restoration arm a typed source identity makes the SUBJECT referable and does not enumerate those exposed identities. Naming the new arm identity as a member would repeat exactly the one-carrier-answers-for- the-whole-population move this field was rewritten to reject -- the move the neighbouring Nat unification row already refuses in this module, despite its own declaration half and four direct importers being enumerable. The honest future boundary is now stated as what it is: a typed PRODUCER of the exposed population at this grain, such as a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority enumerating every affected identity. Typing the parent arm may be worth doing independently; it is neither necessary nor sufficient for a BoundedPopulation here. THE REVISION HISTORY WAS SELF-CONTRADICTORY. It described a single list as containing the real instrument field FloorCostRow.eval_steps and then said one of that list's members was the nonexistent RunCost.eval_steps. Those were two successive lists. The first named the nonexistent field; the second substituted a real symbol and was still wrong because the SHAPE was the defect, not the bad member. Both revisions are now recorded separately, and the second is marked as the instructive one, since substituting a valid symbol into an invalid carrier repaired the symptom and left the error. Unchanged and still accepted by review: current OutsideTheLadder, the scoped negative, AwaitsOneGrounding and its four conjuncts, the StructurallyGuaranteed ceiling, the trigger, roster enrollment, and absence from restored_stalls. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- dag/gunbc/guarantee_stall.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/guarantee_stall.dag b/dag/gunbc/guarantee_stall.dag index 917205c0f66..d00b946c193 100644 --- a/dag/gunbc/guarantee_stall.dag +++ b/dag/gunbc/guarantee_stall.dag @@ -452,7 +452,7 @@ data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" }, population: UncountedNotEnumerable { - reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger that is authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable, so the arm has no typed subidentity for a member list to name. The list this row first carried proved that by failing: it mixed an instrument column (FloorCostRow.eval_steps), a deciding consumer (v2.workflow.required_floor.claim_safety_outcome) and the entire parent drop -- three different kinds of thing, none of them the arm, and one of them, RunCost.eval_steps, a field that does not exist. Rendering them as a BoundedPopulation read as bounded while measuring the wrong property, which is the narrow this carrier's second variant exists to prevent. The affected set is not infinite: it is finite and derived per run as every required identity for which the CPU deadline is armed. But that set is produced by execution rather than declared in source, so no enumeration written here would be true when written. A typed split of the parent restoration trigger would give the arm an identity and permit an honest bounded carrier; inventing a member does not", + reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable. The population this carrier reports is the EXPOSURE, not a roster of the source artifacts that carry or discuss the subject, and the exposed set here is every required identity for which the CPU deadline is armed, derived per run. That set is produced by execution rather than declared in source, so no authored list in this standing row would be true when written. It is finite, not mathematically infinite, and a run may well emit its own occurrence roster; what does not exist is a stable source-level authority this row could name. TWO EARLIER REVISIONS OF THIS FIELD WERE WRONG IN DIFFERENT WAYS, recorded because the second failure is the instructive one. The first list named gunbc.floor_cost_distribution.RunCost.eval_steps, a field that does not exist -- RunCost declares run and rows -- so its BoundedPopulation was not an identity join and the bound was never real. The second revision substituted a symbol that does exist, v2.workflow.required_floor.claim_safety_outcome, and was still wrong, because the defect was the SHAPE rather than the bad member: the list enumerated CARRIERS -- an instrument column, a deciding consumer, and the parent drop -- which is one-carrier-answers-for-the-whole-population, the move the neighbouring Nat unification row rejects in this same module even though its own declaration half and four direct importers are perfectly enumerable. THE FUTURE BOUNDARY IS NOT A TYPED SPLIT OF THE PARENT TRIGGER. Giving the arm a typed source identity would make the SUBJECT referable and may be worth doing on its own, but it neither enumerates the exposed required identities nor is needed to; naming that new arm identity here would repeat the same rejected move one level down. What would permit an honest BoundedPopulation is a typed PRODUCER of the exposed population at this grain -- a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority that enumerates every affected identity", }, next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" } From b34a73b1d3de6b81b891552652733798214e3e31 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Fri, 4 Sep 2026 06:15:38 +0000 Subject: [PATCH 5/6] The relocation falsified the row's own citation: "in this same module" became a lie when the row moved out of it The merge that re-homed this row into gunbc.guarantee_stall.floor_cost_basis_boundedness_stall was mechanically correct and left the prose alone -- which is the defect. The population reason cited the Nat-unification precedent as being "in this same module." That was true while both rows sat in the monolithic carrier and became FALSE the instant #10328 relocated them into sibling modules. A conflict is the notification, not the defect: the invalidated claim sat in a hunk that merged cleanly, so nothing refused. Repaired by citing the SYMBOL rather than a position, which is what DESIGN section 3 asks for independently of this merge -- a positional citation decays silently, and this one decayed within a single merge. The row now names gunbc.guarantee_stall.two_nat_authorities_stall and states the relationship that actually holds rather than a location: both rows use the same StallPopulation carrier, and that row's reason explicitly refuses to render its four direct importers as a BoundedPopulation because "one carrier answers for the whole population." Verified against that row rather than asserted: its population field is UncountedNotEnumerable and its reason contains that refusal and that count. The other positional phrasings in this row were checked and are NOT falsified by the move: "one file away" and "one module away" name gunbc.rung_drop and v2.workflow.required_floor, which were separate files before the relocation and remain so, and "the four conjuncts below" is same-row. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- .../guarantee_stall/floor_cost_basis_boundedness_stall.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag b/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag index 2a7df962426..598c359fe72 100644 --- a/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag +++ b/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag @@ -65,7 +65,7 @@ data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" }, population: UncountedNotEnumerable { - reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable. The population this carrier reports is the EXPOSURE, not a roster of the source artifacts that carry or discuss the subject, and the exposed set here is every required identity for which the CPU deadline is armed, derived per run. That set is produced by execution rather than declared in source, so no authored list in this standing row would be true when written. It is finite, not mathematically infinite, and a run may well emit its own occurrence roster; what does not exist is a stable source-level authority this row could name. TWO EARLIER REVISIONS OF THIS FIELD WERE WRONG IN DIFFERENT WAYS, recorded because the second failure is the instructive one. The first list named gunbc.floor_cost_distribution.RunCost.eval_steps, a field that does not exist -- RunCost declares run and rows -- so its BoundedPopulation was not an identity join and the bound was never real. The second revision substituted a symbol that does exist, v2.workflow.required_floor.claim_safety_outcome, and was still wrong, because the defect was the SHAPE rather than the bad member: the list enumerated CARRIERS -- an instrument column, a deciding consumer, and the parent drop -- which is one-carrier-answers-for-the-whole-population, the move the neighbouring Nat unification row rejects in this same module even though its own declaration half and four direct importers are perfectly enumerable. THE FUTURE BOUNDARY IS NOT A TYPED SPLIT OF THE PARENT TRIGGER. Giving the arm a typed source identity would make the SUBJECT referable and may be worth doing on its own, but it neither enumerates the exposed required identities nor is needed to; naming that new arm identity here would repeat the same rejected move one level down. What would permit an honest BoundedPopulation is a typed PRODUCER of the exposed population at this grain -- a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority that enumerates every affected identity", + reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable. The population this carrier reports is the EXPOSURE, not a roster of the source artifacts that carry or discuss the subject, and the exposed set here is every required identity for which the CPU deadline is armed, derived per run. That set is produced by execution rather than declared in source, so no authored list in this standing row would be true when written. It is finite, not mathematically infinite, and a run may well emit its own occurrence roster; what does not exist is a stable source-level authority this row could name. TWO EARLIER REVISIONS OF THIS FIELD WERE WRONG IN DIFFERENT WAYS, recorded because the second failure is the instructive one. The first list named gunbc.floor_cost_distribution.RunCost.eval_steps, a field that does not exist -- RunCost declares run and rows -- so its BoundedPopulation was not an identity join and the bound was never real. The second revision substituted a symbol that does exist, v2.workflow.required_floor.claim_safety_outcome, and was still wrong, because the defect was the SHAPE rather than the bad member: the list enumerated CARRIERS -- an instrument column, a deciding consumer, and the parent drop -- which is one-carrier-answers-for-the-whole-population, the move `gunbc.guarantee_stall.two_nat_authorities_stall` rejects under this same StallPopulation carrier even though its own declaration half and four direct importers are perfectly enumerable. THE FUTURE BOUNDARY IS NOT A TYPED SPLIT OF THE PARENT TRIGGER. Giving the arm a typed source identity would make the SUBJECT referable and may be worth doing on its own, but it neither enumerates the exposed required identities nor is needed to; naming that new arm identity here would repeat the same rejected move one level down. What would permit an honest BoundedPopulation is a typed PRODUCER of the exposed population at this grain -- a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority that enumerates every affected identity", }, next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" } From 4e7e6d222470b27746397ba16ffdc77fbc3632c5 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Fri, 4 Sep 2026 09:26:33 +0000 Subject: [PATCH 6/6] Third relocation, third falsified citation: the parent rung drop moved and this row still named its old carrier The merge that brought main to 8db3cdb0b6 split rung-drop rows one-per-file, the same cut #10328 made for stalls. `gunbc.rung_drop` is now the type/fold carrier and no longer declares the row; the parent lives at `gunbc.rung_drop.floor_cost_claim_qualification_unavailable`. This row asserted the old location three times -- in the annotation, in `subject`, and in the population `reason` -- and all three became false at the moment of the merge. THE ROW'S FILE WAS BYTE-IDENTICAL ACROSS THAT MERGE, WHICH IS EXACTLY WHY NOTHING REFUSED. This is the third instance of one class on this branch: a relocation somewhere else falsifies prose here, the hunk merges cleanly because nothing in this file changed, and no dependent can object because prose has no reverse edge. Verified rather than assumed: the relocated parent still carries standing: Standing and the same restoration trigger, so no reasoning is reopened -- only the address. FIXING INSTANCES WAS NOT WORKING, SO THIS COMMIT ALSO BRINGS THE CHECK. Every module-qualified symbol this row cites is now re-derived against the live corpus rather than re-read: each dotted name must resolve either to a module whose file declares it on line 1, or to a symbol declared inside its parent module. Run against this row, seven citations resolve and exactly one does not -- `gunbc.floor_cost_distribution.RunCost.eval_steps`, which is the field this row's own revision history cites PRECISELY BECAUSE IT DOES NOT EXIST. That single expected failure is the instrument's positive control: a check that came back uniformly green here would have been telling me nothing. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RDCRC6CKcQGBSx3JcaGe3V --- .../guarantee_stall/floor_cost_basis_boundedness_stall.dag | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag b/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag index 598c359fe72..d6fa6d98126 100644 --- a/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag +++ b/dag/gunbc/guarantee_stall/floor_cost_basis_boundedness_stall.dag @@ -4,7 +4,7 @@ import gunbc.guarantee_rung { OutsideTheLadder, StructurallyGuaranteed } import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, UncountedNotEnumerable } // NO MEASUREMENT CAMPAIGN CAN DISCHARGE THIS ARM, AND THAT IS WHY IT IS A STALL RATHER THAN UNBUILT -// WORK. `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` states that its restoration +// WORK. `gunbc.rung_drop.floor_cost_claim_qualification_unavailable` states that its restoration // trigger's conjunct (ii) requires the cost basis to be INVARIANT OR BOUNDED BY CONSTRUCTION. The // invariance arm is measured and REFUTED. This row is about the other arm, at its own subject grain // -- not the whole disjunction, because collapsing the two is the exact defect gunbc#10260 repaired @@ -58,14 +58,14 @@ import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, UncountedNotE // facts: the drop states the standing unavailability, this states that one named restoration // conjunct is unreachable BY MEASUREMENT and what would reach it. data floor_cost_basis_boundedness_stall: GuaranteeStall = GuaranteeStall { - subject: "the BOUNDEDNESS-BY-CONSTRUCTION arm of conjunct (ii) of gunbc.rung_drop floor_cost_claim_qualification_unavailable's restoration trigger: repeated execution measurement cannot establish it, because every observed maximum is a LOWER bound on the smallest valid bound rather than an upper bound over the admitted envelope", + subject: "the BOUNDEDNESS-BY-CONSTRUCTION arm of conjunct (ii) of gunbc.rung_drop.floor_cost_claim_qualification_unavailable's restoration trigger: repeated execution measurement cannot establish it, because every observed maximum is a LOWER bound on the smallest valid bound rather than an upper bound over the admitted envelope", current: OutsideTheLadder, ceiling: StructurallyGuaranteed, blocker: AwaitsOneGrounding { grounding: "a typed construction-bound authority for the declared basis and subject grain, consumed by the required-floor verdict at that same grain, which (1) closes the admitted execution envelope; (2) accounts for every component capable of changing the basis, by removing it from the measured subject, charging it to that subject, assigning it an enforced finite cap, or refusing the envelope; (3) derives a finite bound from those admitted components and caps rather than from an observed sample maximum; and (4) carries discriminating execution evidence over the admitted corner cases plus an over-bound control refused on the real acceptance path" }, population: UncountedNotEnumerable { - reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside gunbc.rung_drop floor_cost_claim_qualification_unavailable. The population this carrier reports is the EXPOSURE, not a roster of the source artifacts that carry or discuss the subject, and the exposed set here is every required identity for which the CPU deadline is armed, derived per run. That set is produced by execution rather than declared in source, so no authored list in this standing row would be true when written. It is finite, not mathematically infinite, and a run may well emit its own occurrence roster; what does not exist is a stable source-level authority this row could name. TWO EARLIER REVISIONS OF THIS FIELD WERE WRONG IN DIFFERENT WAYS, recorded because the second failure is the instructive one. The first list named gunbc.floor_cost_distribution.RunCost.eval_steps, a field that does not exist -- RunCost declares run and rows -- so its BoundedPopulation was not an identity join and the bound was never real. The second revision substituted a symbol that does exist, v2.workflow.required_floor.claim_safety_outcome, and was still wrong, because the defect was the SHAPE rather than the bad member: the list enumerated CARRIERS -- an instrument column, a deciding consumer, and the parent drop -- which is one-carrier-answers-for-the-whole-population, the move `gunbc.guarantee_stall.two_nat_authorities_stall` rejects under this same StallPopulation carrier even though its own declaration half and four direct importers are perfectly enumerable. THE FUTURE BOUNDARY IS NOT A TYPED SPLIT OF THE PARENT TRIGGER. Giving the arm a typed source identity would make the SUBJECT referable and may be worth doing on its own, but it neither enumerates the exposed required identities nor is needed to; naming that new arm identity here would repeat the same rejected move one level down. What would permit an honest BoundedPopulation is a typed PRODUCER of the exposed population at this grain -- a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority that enumerates every affected identity", + reason: "the subject is ONE ARM of conjunct (ii) of a restoration trigger authored as prose inside gunbc.rung_drop.floor_cost_claim_qualification_unavailable. The population this carrier reports is the EXPOSURE, not a roster of the source artifacts that carry or discuss the subject, and the exposed set here is every required identity for which the CPU deadline is armed, derived per run. That set is produced by execution rather than declared in source, so no authored list in this standing row would be true when written. It is finite, not mathematically infinite, and a run may well emit its own occurrence roster; what does not exist is a stable source-level authority this row could name. TWO EARLIER REVISIONS OF THIS FIELD WERE WRONG IN DIFFERENT WAYS, recorded because the second failure is the instructive one. The first list named gunbc.floor_cost_distribution.RunCost.eval_steps, a field that does not exist -- RunCost declares run and rows -- so its BoundedPopulation was not an identity join and the bound was never real. The second revision substituted a symbol that does exist, v2.workflow.required_floor.claim_safety_outcome, and was still wrong, because the defect was the SHAPE rather than the bad member: the list enumerated CARRIERS -- an instrument column, a deciding consumer, and the parent drop -- which is one-carrier-answers-for-the-whole-population, the move `gunbc.guarantee_stall.two_nat_authorities_stall` rejects under this same StallPopulation carrier even though its own declaration half and four direct importers are perfectly enumerable. THE FUTURE BOUNDARY IS NOT A TYPED SPLIT OF THE PARENT TRIGGER. Giving the arm a typed source identity would make the SUBJECT referable and may be worth doing on its own, but it neither enumerates the exposed required identities nor is needed to; naming that new arm identity here would repeat the same rejected move one level down. What would permit an honest BoundedPopulation is a typed PRODUCER of the exposed population at this grain -- a derivation joining a run's required-identity dispositions to the CpuDeadlineArmed policy, or another closed authority that enumerates every affected identity", }, next_rung_trigger: "the construction-bound authority named in this row's grounding EXISTS and is CONSUMED by the required-floor verdict at the declared subject grain, with its over-bound control refused on the real acceptance path; no volume of execution sampling retires this row, and a widening of the measurement campaign does not move it" }