Salvage the one orphaned row from gunbc#10292: a trigger that names a route while the capability stays dead

[gunbai-bot]

What

gunbc#10292 is not a stale duplicate of the gunbc#10206 carrier split. Its branch forked at cb0ec47e5d9 and carries its own copy of the split plus three later commits, so a plain diff against main scores the whole branch as behind and hides the one thing on it that never landed.

This PR re-homes that one thing onto today's split roster: the failure-mode row trigger_names_route_while_capability_remains_dead, plus its gunbc.recurring_failure_mode.roster entry and the two projected lines in docs/design-failure-modes.md.

The four amendments deliberately NOT re-applied

Each was checked against main rather than assumed stale:

#10292 amendment	Status on main	Why not re-applied
accepted_source_emits_uncompilable_target scope sentence	present, inside a receipt that has since grown	taking the branch's shorter form would DELETE later receipts
check_subject_narrower_than_its_declared_claim refutation sentence	present; main also carries an eighth form	same
namespace_wave_admission dissolution record for the split's two admission rows	present as NINETEENTH TRANSITION	the branch spells it TWENTIETH only because that branch carries an extra cohort
gunbc.recurring_failure_mode preamble wording	main says SEVERABLE, NOT TYPED and names the open §4c classification gap	the branch text says the parts are typed and the drift unwritable — restoring it is a §4b(1) rung inflation committed inside the file that warns against it

The row

Subject is v2.workflow.floor_expected_red chunk_23, whose removal trigger named container_element_nominal_brand_mismatch reaching the direct-call-argument position. That route was already present on main while the capability it was meant to restore was still dead, so the calibrated FreeMonoid<Node>-into-FreeMonoid<NormalizedTree> mismatch compiled clean. §4b(3) states the trigger hazard as doctrine; this row is the tree observation of it, and it bounds itself explicitly against restoration_promise_names_a_route_that_does_not_exist and reachability_read_as_occupancy.

One §3 amendment on top of the salvaged draft: the row's permanent-witness sentence named no symbol. It now names test.claim.record_literal_call_arg_handoff_witness record_literal_container_element_mismatch_at_call_arg_still_refuses — the assertion that counts blocking DeclaredTypeNotInhabited rows whose rendered subject is generic type argument.

Verification

• Every symbol the row cites re-checked as resolving on main: direct_call_generic_type_argument_inhabitance_diags, container_element_nominal_brand_mismatch, direct_call_arg_type_mismatch, nominal_call_arg_brand_mismatch, declared_type_inhabitance, DeclaredTypeNotInhabited, PositionGenericTypeArgument, chunk_23. gunbc#10226 is MERGED.
• docs/design-failure-modes.md is generated; the required lane's generated-artifact phase adjudicates it against gunbc.design_ledgers expected_design_failure_modes_md, which is the independent oracle here. Before deriving the new lines, the projection function was reproduced byte-for-byte against an already-committed row (premise_that_a_shared_subject_means_disagreement), so a drift red would be a real disagreement rather than a formatting guess.
• cargo fmt --all --check: clean (no Rust changed).

🤖 Generated with Claude Code

https://claude.ai/code/session_01FSjamJZnktJ59XsarNLyeH

Amended after review

• The citation named a module that does not exist. The row cited test.claim.record_literal_call_arg_handoff_witness_test; the file of that basename declares test.claim.record_literal_call_arg_handoff_witness — no _test on the module tail. I invented the identity from the filename while amending the row for §3, so the §3 repair produced a worse §3 violation: the original vague citation was unresolvable and obviously so, mine was unresolvable and looked authoritative. Fixed in the row and in the projection, since the receipt is copied into the generated markdown a reader actually reads.

• The name is not derivable from the path in either direction: of 1186 dag/test/claim/*_test.dag files, 749 drop _test from the module tail, 322 keep it, 115 do neither; and corpus-wide, 1354 of 4813 .dag modules have a whole directory segment absent from their identity. Line 1 of the file is the only authority. Every backticked dotted identifier in the row is now matched against git grep -h '^module ' -- '*.dag'; all three resolve.

• Heading said "three" over a four-row table. Corrected.

• The ceiling rung was named wrong, and codex review 59889 caught it. The row declared CEILING: 3 (mechanically preventable); DESIGN.md §4b numbers those differently — 2 is mechanically preventable, 3 is structurally guaranteed. A row whose whole subject is a grain mismatch between a stated loss and its trigger was carrying a grain mismatch between its own ceiling's number and its name. The number was right and the name wrong, resolved from the mechanism the row already described (a refusal derived from modeled structure is rung 3, not a gate that must stay enrolled), and the row now derives why it is not 4: §4b(1) reads a rung as the minimum across parts, and retirement also requires the discriminating witness to hold, which is executed evidence rather than a constructor.

[briansrls]

APPROVE at exact head fe18dd3a2c7aed0598cb68d3b95a49d0bfc070fe, reviewed against main@5d3be34278b26752144a20ba7e0df0c055beffd2.

The exact diff is one new recurring-failure row, one terminal import/list append, and its regenerated projection; no unrelated source change. The historical premise is corroborated by #10226: the named trigger became true for one loss subject while the broader invalid state remained authorable, so subject-bound retirement is the right class.

REST check-runs are fully terminal on this exact SHA: six success and one declared skip, including successful required-witnesses, required-witnesses-build, required-witnesses-floor, and heal-generated-artifacts. The qualified generated-artifact control refuses and the candidate is driver-clean against the named main snapshot.

The head trails current main by three commits, but all three are outside the recurring-failure row type, roster, and projection authority; they do not create a semantic composition gap for this cut. Main's 95-row population plus this unique terminal append yields the expected 96-row authority/projection population.

No request changes. Non-blocking body correction: the prose says “three amendments” immediately before a table containing four.

[briansrls]

APPROVE the source at exact head ffc8e0a053214df37793d668c05a828d988fab90, reviewed against main@6ef6a566cc14680e0359714e8abaf3e9a85a4dd9.

This supersedes my approval at fe18dd3a2c7. That head was not merely moved: it cited test.claim.record_literal_call_arg_handoff_witness_test, which is a filename-shaped name and not the module's declared identity. Commit 8038c42420a repairs the row to test.claim.record_literal_call_arg_handoff_witness; the named function exists there. The terminal merge commit then incorporates current main and resolves the roster/projection composition. The live diff remains the narrow cut: one 36-line recurring-failure row, one import/list append, and its two-line generated projection.

SOURCE VERDICT: APPROVE. MERGE ADMISSION: WITHHELD until the restarted check suite on this exact SHA is terminal with the required successes/declared skip and the head remains unchanged. GitHub currently reports the PR mergeable against the named base, but the exact-head substantive lanes are still running or queued.

Non-blocking body corrections: the PR body still uses the filename-shaped module identity with _test, and says “three amendments” immediately before a four-row table.

[briansrls]

APPROVE the source at exact head beba8442bb6d78a8afd14e3a2553e436c4598ebc.

The rung correction is substantive and correct. The row now says CEILING: 3 (structurally guaranteed), matching DESIGN 4b's numbering and the mechanism it describes: the subject-grain mismatch is rejected from modeled structure rather than by a detector that must remain enrolled. The explanation for not claiming rung 4 is also honest under the declared construction: retirement still depends on the discriminating witness holding at the named position, so the class minimum remains the execution-dependent half rather than the unconstructible identity-mismatch half.

The live diff remains the intended three-path cut: one new row, one import/list append, and its generated projection. GitHub reports 42 inserted lines on this head (38 in the row plus 2 roster plus 2 projection), so the separately reported +40 should not be used as a Git line-count receipt.

This is SOURCE APPROVAL only. Exact-head CI is nonterminal, and final composition must be computed from pinned current main and this unchanged head with the qualified merge-tree/driver oracle. Do not merge main into the branch merely because main moves while it waits.