diff --git a/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag b/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag
new file mode 100644
index 00000000000..398e0ad87e9
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/right_censored_cost_read_as_exact.dag
@@ -0,0 +1,38 @@
+module gunbc.recurring_failure_mode.right_censored_cost_read_as_exact
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data right_censored_cost_read_as_exact: RecurringFailureMode = RecurringFailureMode {
+  identity: "right_censored_cost_read_as_exact" as NonEmptyStr,
+
+  receipts: [
+    "**a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. ",
+
+    "WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. ",
+
+    "AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. ",
+
+    "RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. ",
+
+    "THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. ",
+
+    "SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. ",
+
+    "RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. ",
+
+    "IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ",
+
+    "ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. ",
+
+    "NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. ",
+
+    "THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. ",
+
+    "A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. ",
+
+    "THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.)",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/roster.dag b/dag/gunbc/recurring_failure_mode/roster.dag
index 578aaaf254d..1246d507408 100644
--- a/dag/gunbc/recurring_failure_mode/roster.dag
+++ b/dag/gunbc/recurring_failure_mode/roster.dag
@@ -104,6 +104,7 @@ import gunbc.recurring_failure_mode.content_digest_makes_annotations_semanticall
 import gunbc.recurring_failure_mode.subject_and_its_digest_as_independent_parameters { subject_and_its_digest_as_independent_parameters }
 import gunbc.recurring_failure_mode.a_written_row_is_not_a_firing_mechanism { a_written_row_is_not_a_firing_mechanism }
 import gunbc.recurring_failure_mode.required_evidence_absent_reads_as_evidence_of_pass { required_evidence_absent_reads_as_evidence_of_pass }
+import gunbc.recurring_failure_mode.right_censored_cost_read_as_exact { right_censored_cost_read_as_exact }
 
 data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   censored_estimator_drops_its_own_tail,
@@ -199,4 +200,5 @@ data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   subject_and_its_digest_as_independent_parameters,
   a_written_row_is_not_a_firing_mechanism,
   required_evidence_absent_reads_as_evidence_of_pass,
+  right_censored_cost_read_as_exact,
 ]
diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md
index 10399e86be6..edf1e982968 100644
--- a/docs/design-failure-modes.md
+++ b/docs/design-failure-modes.md
@@ -97,6 +97,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection
 - `subject_and_its_digest_as_independent_parameters`
 - `a_written_row_is_not_a_firing_mechanism`
 - `required_evidence_absent_reads_as_evidence_of_pass`
+- `right_censored_cost_read_as_exact`
 
 ---
 
@@ -205,3 +206,4 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit
 - **a value and a summary of it -- a digest, a count, a view, an annotation -- placed side by side without a join can disagree silently, and the corroboration the reader believes they are getting was never computed** (INVALID STATE: a signature takes a value AND a summary of that value as two peer arguments -- `envelope` beside `envelope_digest`, `roster_identities` beside `roster_digest` -- with no arm relating them. The signature admits a digest of something OTHER than the value beside it; nothing refuses; and every downstream guarantee that cites the digest is then citing a summary of a different object, while reading exactly like a guarantee about the value. DISTINGUISHING FACTS: the two arguments are supplied by the same caller from the same site TODAY, so the pairing is held by lexical proximity rather than by anything the type system or a fold can see; the defect is constructible without touching a single caller, by supplying a correct digest of a different subject. EVIDENCE, TWO INSTANCES IN ONE MODULE, which is what makes it a class rather than a coincidence: `v2.workflow.floor_wet_route` `wet_route_gate_disposition_for_receipt` carries BOTH the envelope/digest pair and the roster-identities/roster-digest pair. The first was demonstrated live -- `v2.test.floor_wet_route` `wet_lease_admits_an_envelope_whose_content_the_digest_does_not_name` constructs an envelope whose content the pinned digest does not name, and the lease gate ADMITS. THE SAME DEFECT READ FROM THE OTHER END: agreement among derived views is vacuous when the views share one reader. A projection was nearly shipped with a row silently deleted because FOUR derived views agreed, all fed by a single reader -- one source feeding many views made agreement carry no information, exactly as a digest and its subject being independent lets them disagree unnoticed. THE THIRD FACE, AND THE ONE THAT SURVIVED REVIEW LONGEST: PROSE ADJACENCY IS NOT A JOIN EITHER. `wet_route_identity_rows_block_with_publication` carried an annotation stating that EXACTLY TWO per-identity classes are waived under a valid publication transaction, three lines above a body that returned false unconditionally and waived FOUR -- so `no_verdict`, the ABSENCE of a verdict, was converted into a green merge path. The prose and the code disagreed by a factor of two IN THE SAME FUNCTION and FOUR APPROVALS READ PAST IT. An annotation is not checked against the body it sits above by anything: it READS as documentation and FUNCTIONS as an assertion, and by DESIGN section 4c no `Accepted` program can read one, so nothing in the toolchain will ever disagree with it. Provider count is not attention -- four approvals is not four readings of that function. AND FIELD ADJACENCY IS NOT A JOIN EITHER, which is the same claim one scale down: in `v1_compiler.bin.claim_batch`'s two pre-execution refusal arms the annotation two lines above `WetReceiptIdentityRow` was RIGHT, and the neighbouring fields `observed_entry_rel` and `observed_function` were RIGHT -- Optional, and correctly None on exactly those arms -- and `wall_ms`, two fields later in the SAME STRUCT LITERAL, fabricates a 0 for a duration nothing measured. PROXIMITY TO A CORRECT THING IS NOT CORRECTNESS: a reader scanning that literal gets three signals of care and one fabrication, with nothing in the text distinguishing them. And 0 is the WORST available fabricated value for that field rather than a neutral placeholder, because it is THE FASTEST OBSERVABLE EXECUTION -- so a consumer that averages, thresholds or ranks on wall_ms without first branching on the outcome wire reads the ABSENCE of a measurement as the BEST measurement in the corpus. An anomalous-looking fabrication is found by whoever first sorts the column; this one sorts to the top and is found by nobody. All three faces are one defect: A JOIN THAT WAS NEVER MADE, so the corroboration a reader believes they are getting was never computed. RECOGNITION RULE: whenever a parameter list contains a value and a summary, hash, count, digest or identity OF that value, ask what refuses when they disagree. If the answer is nothing, the summary is unverified input wearing the costume of a derived fact. The mirror question for agreement: when N sources agree, ask how many INDEPENDENT reads produced them; if the answer is one, the agreement is a copy agreeing with itself. THE REPAIR, already built once and therefore not speculative: DERIVE THE DIGEST FROM THE VALUE AT THE POINT THE VALUE IS OBTAINED, NEVER ACCEPT IT AS A PEER PARAMETER. The seed`s `read_wet_receipt_envelope` now returns the decoded envelope and the digest of the bytes it decoded FROM, in one call, so the two cannot name different objects; its control `carried_digest_names_the_bytes_the_envelope_was_decoded_from` rewrites the file between reads and asserts the carried digest still names its own bytes. RUNG FOUND AT: mitigatable -- a comment and a caller convention. CEILING: structurally impossible, because a digest produced by the same operation that produces the value has no constructor that lets it name a different one. NEXT-RUNG TRIGGER, a capability: a carrier type that pairs a value with a digest DERIVED at construction, so no signature anywhere can accept the two separately -- the `.dag` instances named in `gunbc.guarantee_stall` `wet_route_model_lags_seed_stall` are the population that trigger retires.)
 - **a written rule is how a LATER READER learns what happened; it is not how a PRESENT AUTHOR is stopped, so a ledger that grows without changing what is easy to type buys documentation and no prevention** (INVALID STATE: a failure class is answered by APPENDING A ROW -- to this roster, to a stall roster, to an annotation -- and the row is then counted as the remedy. The class recurs anyway, because at the moment of authoring the dangerous form is still the shortest thing to type and nothing costs more when it is chosen. RECOGNITION RULE, which is the whole row: after filing, ask WHAT IS NOW HARDER TO DO THAN IT WAS BEFORE. If the honest answer is nothing, the filing was a RECORD and not a REPAIR, the class rung did not move, and it must be reported as UNREMEDIED rather than as covered. WHY IT IS NOT MERELY WEAK BUT ACTIVELY MISLEADING: a filed class gets CITED AS COVERAGE, so a reviewer meeting it reads it as handled and the filing converts an open deficit into a closed-looking one while leaving the deficit exactly where it was -- a DESIGN section 4b(1) rung wearing a 4b(2) costume, which is this ledger own version of rung inflation. An unrepaired filing is therefore WORSE than no filing, not equal to it. WHY THE RECALL DOES NOT FIRE: a rule filed under its SUBJECT MATTER is retrieved by thinking about that subject matter, and an author executing a step attends to THE GOAL, not the class of the step. Nothing in `retire the superseded poller` cues `I am about to type a pattern that can match myself`. THE TEST RUN ON A REAL POPULATION THE SAME NIGHT IT WAS WRITTEN, AND IT CAME BACK MOSTLY NEGATIVE: across ten class-filings required in one day, the identity-join rows made nothing harder (`sort -u` is exactly as easy to type as `sort`); the prose-adjacency, field-adjacency and digest-beside-subject rows made nothing harder (no lens refuses a digest passed beside its subject, and that signature is still the natural one to write); the empty-reading rows made nothing harder (the short read is still shorter than the head-filtered one, which is precisely why four people reached for it). ONE of the ten changed what is easy, and IT WAS NOT A FILING: a schema hazard was answered by computing the affected population and commenting on each of the five pull requests about to hit it, delivering friction to five named authors rather than prose to a ledger. A second was initially scored as a climb and the correction is the sharper result: the carrier ALREADY HAD THE RIGHT SHAPE and nothing about it was built that day; what the day produced was the DISCOVERY that a wrong thing was writable beside it, because an author wrote a fabricated previous-rung into a drop row, A REGEN RAN GREEN OVER IT, and a reader happened to look at the field. NO MECHANISM WAS WATCHING. Corrected score: ONE push-friction instance that expires when five pull requests land, ZERO climbs, ONE discovery -- and the discovery is the least repeatable item in the list, since the next occurrence is written where nobody is reading and the green regen is identical. A LUCKY READ IS NOT COVERAGE. THE TWO KINDS OF FRICTION ARE NOT INTERCHANGEABLE AND ONLY ONE COMPOUNDS: PUSH friction is delivered to named authors at the moment of impact and EXPIRES when their changes land; PULL-PROOF friction removes the constructor, so nothing needs delivering to anyone ever again. A day producing one of each must not report two. THE CONCLUSION THE AUDIT FORCES, STRONGER THAN THIS ROW STARTED: retrieval-by-recall is not a mechanism that becomes adequate at a smaller ledger size -- IT IS THE WRONG MECHANISM AT ANY SIZE, because the retrieval cue never arrives regardless of how few rows there are. Every row real deliverable is THE FRICTION, and the prose is its RECEIPT rather than its product. RUNG FOUND AT: mitigatable, and this row is an instance of what it describes, which is why it carries a trigger rather than resting on having been written. CEILING: structurally impossible for any class whose dangerous form can be removed from the vocabulary entirely -- an unwritable form needs no rule. NEXT-RUNG TRIGGER, a capability and not an artifact: for each filed class, a named ARTEFACT OF FRICTION -- a lens that refuses the shape, a carrier with no unsafe constructor, a wrapper shorter to invoke than the raw form -- so that a filing arrives WITH a change in what is easy, and the obligation is symmetric: whoever ASKS for a row owes the friction artefact or the plain sentence that nothing got harder and the class stands UNREMEDIED.)
 - **a gate that admits when its required evidence has not reported, because the admission arm keys on OBSERVED FAILURE rather than on OBSERVED SUCCESS.** INVALID STATE: a required check exists, is correctly configured, and is consulted -- and the consulting arm asks `has anything reported a failure` where the guarantee needs `has everything reported a success`. Between those two questions sits the state where nothing has reported at all, and it is admitted. HARM, AND THE REASON THE CLASS SURVIVES REVIEW: every artifact reads as present and correct. The gate is enumerated in the required roster, it is active, it blocks a reported failure exactly as advertised, and a reader auditing the configuration finds no drift -- because there is none. The defect is in the QUANTIFIER, and a quantifier has no configuration surface to inspect. DISTINGUISHING FACT, AND IT IS THE RACE RATHER THAN ANY FIELD: the class is only reachable inside the window between the evidence being DEMANDED and the evidence ARRIVING, so it is invisible to any observation taken after that window closes -- afterwards the check has reported, the record looks ordinary, and only the ORDER of two timestamps distinguishes an admitted merge from a blocked one. RECOGNITION RULE: for every gate, find the arm that admits and read what it is quantified over. If it enumerates the evidence that HAS arrived and asks a property of each, the empty enumeration admits. If it enumerates the evidence that is REQUIRED and asks each for a success, it refuses. The two spellings are one word apart and behave identically on every input except the one the class lives in. DISTINCT FROM `absorbing_fallback`: that arm WIDENS when it cannot compute an answer and is at least loud about doing work; this arm NARROWS to the empty set and is silent, because a fold over nothing returns its seed and nobody wrote the seed down as a decision. **SPECIMEN (eager-bear-107, gunbc#10236, 2026-09-03), and it landed a break rather than merely permitting one.** The pull request pushed head d8cd3034 at 19:49:33Z, GitHub created its `witnesses` run at 19:49:40Z, and the merge completed at 19:49:43Z -- three seconds after run creation, before any job of it reported. That run then concluded with `required-witnesses-build` and `required-witnesses-floor` both FAILURE, and the head it certified nothing about landed on main as cfe19ea7, adding two duplicate declarations to THIS MODULE that refused main at resolve until a repair pull request landed. WHICH LANE CAUGHT IT IS PART OF THE FILING, because the two main flakes are separable in this evidence and a reader who conflates them loses that: on the post-merge main run at cfe19ea7 the duplicates reddened `required-witnesses-build` while `required-witnesses-floor` was GREEN, so the break is not the cost class this repository's other main flake belongs to and cannot be waved away as more floor variance. THE DETECTING LANE WORKED AND WAS TWENTY MINUTES LATE, which is the shape of this class rather than an aggravating detail: `required-witnesses-build` refused the duplicates correctly -- `generated-artifact CarrierRefused cause=resolve`, the authority declining to answer -- and its job completed at 20:04:14Z against a merge at 19:49:43Z, an unadjudicated interval of twenty minutes and thirty-one seconds. NOTHING WAS MISROUTED AND NO LANE WAS MISSING. **A RETRACTION IS RECORDED HERE BECAUSE THE MISREADING IS ITSELF AN INSTANCE OF A ROSTERED CLASS.** An earlier revision of this row said the catcher was `heal-generated-artifacts` and that it was event-conditional, on the evidence that heal FAILED on the pull-request run and was SKIPPED on the main run of identical content. The job graph refutes it: heal died at step 2, `Checkout triggering branch head`, at 19:52:01Z, with `Regenerate every committed generated artifact` SKIPPED -- the regenerator never ran, so heal detected nothing, and it failed because the merge had deleted the branch head it wanted three seconds after the run was created. A downstream consequence of the merge was read as a detection of the defect. That is `green_reported_over_a_population_the_instrument_does_not_own` inverted -- a RED reported over a population the instrument never reached -- and the recognition rule transfers exactly: A JOB'S CONCLUSION IS NOT EVIDENCE ABOUT THE SUBJECT IT IS NAMED FOR UNTIL ITS STEP RECORD SHOWS IT REACHED THE STEP THAT JUDGES. It survived four readers passing a narrative and was caught by one who read the job graph. Ruleset 16178731 carried zero divergence from `gunbc.repo_ruleset` desired state throughout. Over the forty most recently merged pull requests, six had no `witnesses` run that completed successfully on their own head before `merged_at`. **THE SAME SHAPE IN THIS REPOSITORY'S OWN MODEL, which is what makes it a class and not an incident:** `gunbc.merge_lifecycle` `merge_enabled` folded `policy_admits` over the receipts found for a head from `init: false`, so the absent-receipt verdict was a caller-local constant standing in for a policy fact. There the seed was the SAFE answer and the harm was the mirror image -- the live behavior became unrepresentable, no witness could go red on it, and the module named a policy stronger than the live one as live for two months. RUNG FOUND AT: mitigatable, and only by human habit. CEILING: structurally guaranteed -- the merge queue construction makes the queued ref's run a precondition of landing rather than a fact observed beside it. NEXT TRIGGER: `gunbc.guarantee_stall` `merge_admission_terminal_verdict_stall`. FILED AS A STALL AND NOT A RUNG DROP: a 4b(3) drop asserts a REGRESSION and nothing regressed -- GitHub's rule has evaluated reported check runs this way since the ruleset was created, so the capability was never held and a previous rung would be invented. What existed was 4b(1) inflation, corrected by making the live policy representable.
+- **a right-censored cost read as an exact one** (an instrument stops because a POLICY THRESHOLD fired before the subject completed, and the figure it emits is a LOWER BOUND on the true cost. Carried in the same field, column or type as a completed measurement, it is then summed, ranked, compared against a line, or deflated into a budget as though it were the cost. WHAT MAKES IT INVISIBLE IS THAT THE BOUND LOOKS LIKE DATA: it has the right units, the right magnitude and the right shape, so nothing about the value marks it as incomplete. AND THE MAGNITUDE IS APPROXIMATELY THE CEILING THAT STOPPED IT, which inverts every ranking built on it. A preempted row reports a figure near the budget, so it sorts ABOVE genuinely expensive completed rows and a 'worst observed' derived from the population describes THE CEILING, NOT THE MACHINE. The remedy sized from it is then sized against a policy constant that the operator chose, wearing the authority of a measurement. RECOGNITION RULE: WHEREVER A COST, DURATION, SIZE OR COUNT CAN BE TRUNCATED BY A DEADLINE, BUDGET, RETRY CAP, PAGE LIMIT OR TIMEOUT, ASK WHETHER THE STOPPED CASE AND THE COMPLETED CASE INHABIT THE SAME CARRIER. If one field, column or constructor holds both, the conflation has already happened and no consumer can undo it -- the information distinguishing them was destroyed at the write, not at the read. The tell is a field named for the quantity (`cpu_ms`) rather than for the measurement's completeness, beside a separate flag nobody joins to it. THIS IS THE INVERSE OPERATION OF `censored_estimator_drops_its_own_tail` AND THE TWO MUST NOT BE MERGED. There, censored observations are EXCLUDED from an estimate and the statistic is biased low with no bound; here a censored observation is INCLUDED and read as exact. Dropping the tail and admitting the tail as a point are opposite mistakes over the same population, and a repair for one is not a repair for the other -- a system can and did commit both about the same artifact. It is also distinct from `window_rendered_subject_misattribution`: there a correctly-measured figure is attributed to the wrong subject; here the subject is right and the figure is not a measurement at all. SPECIMEN, gunbc#10210. `required_floor_claim_cost.tsv` carried one `cpu_ms` column for every claim. A claim the per-claim CPU deadline preempted goes INTERRUPTED-BEFORE-VERDICT and reports where the POLL OBSERVED THE CEILING -- 500ms against a 500ms budget, or 502ms -- while a completed claim reports its cost. The floor cost distribution's bands, percentiles, worst-row and inflation pairing consumed the column undifferentiated, so the implied-budget derivation deflated a ceiling by a ratio computed partly from ceilings. RUNG FOUND AT: BELOW THE FLOOR, WHICH IS NOT RUNG 1 AND THE DISTINCTION IS THE POINT. Rung 1 requires harm CONTAINED by total operations, typed outcomes, bounds, rollback or isolation. A column rendering a bound and a completion under one name contains nothing: it does not refuse, bound or prevent, and a censored value consumed where an exact cost is read is a FABRICATED PLAUSIBLE OUTPUT, which DESIGN section 4b places outside the ladder and forbids outright. This row was first filed claiming `mitigatable` and that was refused by review; the correction is recorded because the inflated reading was written by the author of the repair, inside the change that fixed it. IT IS EXPLICITLY NOT THE *OUTSIDE THE MODELED GUARANTEE* BOUNDARY ONE SENTENCE AWAY IN DESIGN. The cost is measured and then misrepresented; it is neither external, nor undecidable, nor unstated intent. A class that reaches the ladder only by ceasing to fabricate has not climbed a rung -- it has become eligible to be ranked. ATTAINABLE CEILING: STRUCTURALLY IMPOSSIBLE, because membership is decidable at the WRITE. The instrument always knows which arm it took -- it stopped the subject itself -- so the distinction is available at the moment the row is produced and needs no inference at any consumer. A carrier with disjoint constructors makes the conflated state unconstructible rather than merely refused. NEXT-RUNG TRIGGER, AND IT IS THE WHOLE PAIRING RATHER THAN ANY ONE OF ITS PARTS. Each half alone is satisfiable while the class stays alive, which is why a trigger naming less than all four is a trigger that retires the row while the harm persists: (i) DISJOINT CONSTRUCTORS, so a bound and a completion cannot inhabit one value; (ii) DISJOINT WIRE FIELD NAMES, because a shared column re-fuses them at the artifact boundary no matter how the in-memory type is shaped, and a consumer projecting that column gets an empty cell rather than a figure near the ceiling; (iii) EVERY ARITHMETIC CONSUMER REQUIRING THE EXACT TYPE IN ITS SIGNATURE, so summing, ranking or deflating a bound is a compile refusal rather than a discipline; and (iv) A DYNAMIC MIXED POPULATION THAT REFUSES RATHER THAN FILTERING, because silently dropping the censored members is `censored_estimator_drops_its_own_tail` -- the repair for one failure mode arriving as the other. THE FOURTH CLAUSE IS THE ONE AUTHORS OMIT, and omitting it converts this class into its inverse in a single edit that looks like a fix. A GUARD THAT EXCLUDES THE CENSORED POPULATION BY A CORRELATED PROXY IS NOT THIS REPAIR AND IS `incidental_denominator_as_wall`. In the specimen a verdict-absence flag very nearly separates the two populations, because a deadline-preempted claim also reaches no verdict -- but the axes are independent by construction: an unwound claim reaches no verdict with EXACT clocks, and a claim can reach its verdict while its cost is a bound. A witness keyed to the proxy stays green under a fold that reads the bound as a cost, because its fixture is excluded before the cost is consulted, so the proxy guard also DEFEATS THE EVIDENCE that would detect the class. THE REPAIR IS THEREFORE TWO ROWS, EACH FIXING ONE INPUT AND VARYING THE OTHER, and one of them alone proves nothing about the axis it is named for.)