A refusal is only a refusal if it survives its caller: file the class a correct producer and a re-absorbing consumer produce together

dag/gunbc/recurring_failure_mode/incidental_denominator_as_wall.dag

@@ -37,6 +37,13 @@ data incidental_denominator_as_wall: RecurringFailureMode = RecurringFailureMode
 
     "Beside it sat a second, CALLER-LESS installer, `install_candidate_paths`, equally unguarded and invisible to review because a crate-wide dead-code allow kept it compiling: an unguarded operation with no consumer still reads as sanctioned precedent for the next author. ",
 
+
+    "**SECOND RECEIPT (2026-09-04), AND IT GENERALIZES THE ROW PAST MUTATING OPERATIONS TO IDENTITY KEYS.** gunbc#10337 keys brand declaration identity on `span.file` plus the authored name. Reviewed as a section 3 violation -- a String nickname beside `std.decl_ref.DeclarationRef` -- and offered as a bounded disposition on the ground that the key is FILE-keyed where the authority is MODULE-keyed. Measured before admitting the debt: across dag/ and src/v2, 4754 `.dag` files carry ZERO files declaring more than one module, with a control confirming the regex matches. File to module is therefore INJECTIVE and `span.file` IS identity-equivalent to a module path, so the offered gap does not exist and the drop row was refused rather than written. ",
+
+    "**But the equivalence is a CORPUS PROPERTY, not a structural guarantee, and that is this row's shape rather than a fact about modules.** Nothing makes a two-module file unwritable; no authority declares the one-module-per-file relation; no diagnostic fires if it is broken. So an identity key is correct today because of an invariant whose owner does not know it is load-bearing, and it would dissolve silently the first time a file declares two modules -- a change nobody would read as touching brand identity. The generalization: the row is not about DESTRUCTION, it is about CORRECTNESS RESTING ON A COINCIDENCE, and the mutating-bytes framing of the first receipt is one instance of it. ",
+
+    "Recognition rule extended to this form: when a key, join or identity comparison is sound, ask WHICH UNSTATED INVARIANT makes it sound, then name the authority that enforces that invariant. If the answer is 'nothing does, it just happens to hold', the soundness is a coincidence with no authority, no diagnostic and no test -- exactly the state this row names. The next-rung trigger for THIS instance is a wall refusing a second module declaration in one file, which would convert the coincidence into a structural guarantee. ",
+
     "**Recognition rule: for every operation that mutates authoritative bytes, ask what it would do if handed the worst member of the population its input is DRAWN FROM — not the population it is called with today — then name the function that forbids that member and the question that function was written to answer. ",
 
     "If those two questions differ, the wall is incidental and the operation has none.** The remedy is an admission at the mutation boundary itself, over the whole roster before the first byte moves and refusing rather than skipping, since a per-item skip re-exports the same silence one layer in; and it is honestly a mechanically-preventable rung, whose ceiling is structural impossibility once the plan projects a typed surface identity instead of a `List<String>`. ",

dag/gunbc/recurring_failure_mode/refusal_reabsorbed_by_intermediate_default.dag

@@ -0,0 +1,26 @@
+module gunbc.recurring_failure_mode.refusal_reabsorbed_by_intermediate_default
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data refusal_reabsorbed_by_intermediate_default: RecurringFailureMode = RecurringFailureMode {
+  identity: "refusal_reabsorbed_by_intermediate_default" as NonEmptyStr,
+
+  receipts: [
+    "**a refusal is only a refusal if it SURVIVES ITS CALLER -- a producer can be correct at its inability boundary while the composed path still fabricates an answer** (INVALID STATE: a producer returns its typed empty or refusal at an explicit inability boundary, and an intermediate consumer reads that outcome as permission to substitute a default, a nickname, a shallower identity, or an empty-success. The composed path widens even though the producing site is correct in isolation. HARM: the fabricated value reaches a judgment site that believes it is comparing real data, so a mismatch that should have been loud is silently admitted -- section 5's forbidden state, reached by a route in which no single frame did anything obviously wrong.)",
+
+    "WHY SITE-LOCAL REVIEW IS STRUCTURALLY BLIND TO IT, WHICH IS THE WHOLE REASON IT IS A CLASS. Inspection at the producer sees the intended refusal. A unit test at the producer sees the intended refusal. A reviewer reading the diff that ADDS the refusal sees a correct refusal being added. Only following the outcome through EVERY consumer reveals that a later frame absorbs it and recreates an answer -- and nothing in the producer's diff points at the frame that will do so. The defect is not in any line you would think to look at.",
+
+    "MEASURED INSTANCE, gunbc#10146: carried_structural_type_name was repaired to return empty at its depth-16 ceiling -- correct, and correct in isolation. Its PARENT FRAME converted that empty back to `here`, so declared_alias_target_matches_produced continued to receive a fabricated shallow identity and alias admission continued to succeed. The first repair was therefore indistinguishable from no repair at the only site that decides, and it was caught on a full-path reread rather than at the edit. THE FIRST FIX WAS ITSELF AN INSTANCE OF THE CLASS IT WAS FIXING.",
+
+    "DISTINGUISHING WITNESS, and note that it must assert at the JUDGMENT SITE and not at the producer: construct a chain that reaches the inability boundary, then assert AT THE FINAL JUDGMENT SITE that no fallback identity or value is admitted and the typed refusal or loud mismatch survives unchanged. A witness that asserts at the producer passes against both the broken and the repaired composition and therefore discriminates nothing.",
+
+    "REPAIR RULE: A REFUSAL IS ABSORBING ACROSS THE FULL CALLER CHAIN. Consumers may propagate a typed cause or enrich it; none may translate it into a default, a nickname, a shallower identity, an empty-success, or an acceptance. The rule is stated over the chain rather than over any frame, because every frame in the observed instance was locally defensible.",
+
+    "BOUNDARY AGAINST THE ABSORBING-FALLBACK ROW, WHICH IS ADJACENT AND NOT THE SAME. There, a FAILURE ARM widens instead of refusing -- the producer is the defect, and the repair is to make that arm refuse. Here the producer ALREADY REFUSES CORRECTLY and a CONSUMER undoes it. Different site, different repair, and no single capability retires both: making failure arms refuse does nothing about a caller that re-absorbs a correct refusal.",
+
+    "RUNG FOUND AT: mitigatable, and the mitigation was a human performing a full-path reread after a review flagged the site. CEILING: structurally guaranteed -- a typed refusal whose absorption by a consumer is not expressible cannot appear in an Accepted program, and the decidable fact is whether any frame maps a refusal outcome onto a non-refusal value. NEXT-RUNG TRIGGER, stated as a CAPABILITY and deliberately not as an artifact: the compiler can decide, for a producer's refusal outcome, whether every consumer on every path either propagates it or refuses -- and refuses the program when one converts it to a value. Adding the depth-ceiling witness, or repairing this one parent frame, satisfies none of that and leaves every other producer-consumer pair in the tree exposed identically.",
+  ],
+
+  evidence: [],
+}

dag/gunbc/recurring_failure_mode/roster.dag

@@ -117,6 +117,8 @@ import gunbc.recurring_failure_mode.absent_reads_identically_to_never_looked { a
 import gunbc.recurring_failure_mode.append_only_carrier_whose_serialization_shares_a_merge_region { append_only_carrier_whose_serialization_shares_a_merge_region }
 import gunbc.recurring_failure_mode.located_refusal_renders_its_span_in_the_wrong_units { located_refusal_renders_its_span_in_the_wrong_units }
 import gunbc.recurring_failure_mode.dispatch_correctness_resting_on_arm_order { dispatch_correctness_resting_on_arm_order }
+import gunbc.recurring_failure_mode.refusal_reabsorbed_by_intermediate_default { refusal_reabsorbed_by_intermediate_default }
+import gunbc.recurring_failure_mode.upstream_carrier_substituted_for_the_consumer_selected_subject { upstream_carrier_substituted_for_the_consumer_selected_subject }
 import gunbc.recurring_failure_mode.discriminating_arm_built_but_never_enrolled { discriminating_arm_built_but_never_enrolled }
 
 data recurring_failure_mode_roster: List<RecurringFailureMode> = [
@@ -226,5 +228,7 @@ data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   append_only_carrier_whose_serialization_shares_a_merge_region,
   located_refusal_renders_its_span_in_the_wrong_units,
   dispatch_correctness_resting_on_arm_order,
+  refusal_reabsorbed_by_intermediate_default,
+  upstream_carrier_substituted_for_the_consumer_selected_subject,
   discriminating_arm_built_but_never_enrolled,
 ]

dag/gunbc/recurring_failure_mode/upstream_carrier_substituted_for_the_consumer_selected_subject.dag

@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.upstream_carrier_substituted_for_the_consumer_selected_subject
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data upstream_carrier_substituted_for_the_consumer_selected_subject: RecurringFailureMode = RecurringFailureMode {
+  identity: "upstream_carrier_substituted_for_the_consumer_selected_subject" as NonEmptyStr,
+
+  receipts: [
+    "**the producer's countable artifact is not necessarily the consumer's subject** (INVALID STATE: a claim about a downstream consumer's behaviour, coverage or resource use is derived from an UPSTREAM CARRIER because that carrier is easy to inspect or count, while no receipt binds the carrier to the exact subject or event the consumer actually processed -- and the carrier-to-consumer mapping may transform, suppress, coalesce, repeat or fan out. HARM: every measurement of the carrier can be perfectly pinned and perfectly correct, and the conclusion about the consumer still false, because the two name different objects. The error survives arbitrary care applied to the wrong side of the boundary.)",
+
+    "THIS IS AN IDENTITY SUBSTITUTION ACROSS A CONSUMPTION BOUNDARY, AND NOT A PROXY METRIC BEING IMPRECISE. The distinction is load-bearing: an imprecise proxy is improved by measuring it better, which is exactly the move that entrenches this defect. Measuring the carrier harder produces a more confident statement about an object nobody asked about.",
+
+    "MEASURED INSTANCE ONE -- branch tree substituted for the CI subject. A required workflow runs on `pull_request`, so its subject is the COMPOSED tree T = merge(M, H), never the branch head H. A projection census run on H reported 96/96/96 and was reported as a live safety gap in what CI would accept. Re-measured on T: merge-tree CLEAN, every row present, the relation covering the case exactly. The H-side measurement was TRUE OF H and was never a statement about the consumer. The consumer transforms the carrier before judging it.",
+
+    "MEASURED INSTANCE TWO -- head SHAs substituted for paid validation epochs. Merge latency was modelled as raw head count times one CI cycle. The mapping is not a bijection in either direction: a head superseded before its run starts consumes ZERO started executions (the workflow groups by PR with cancel-in-progress false, so several pushes collapse into one pending member), while retries and separate events can make one head consume more than one. Measured across live PRs, started-runs / distinct-heads ranged 0.29 to 0.88 and was never 1. The resource is consumed by STARTED epochs; heads are merely what is easy to count.",
+
+    "DISTINGUISHING WITNESS, and it must be taken on the CONSUMER'S side: name the exact subject the consumer processed -- the composed tree's oid, the started run's id -- and assert the claim against THAT, not against the artifact the producer emitted. A witness that measures the carrier passes identically whether or not the substitution occurred, and therefore discriminates nothing.",
+
+    "RECOGNITION RULE, phrased so it fires before the measurement is taken: ask WHAT OBJECT THE CONSUMER ACTUALLY READS, and whether any receipt binds your measured artifact to it. If the consumer transforms, filters, batches or supersedes its input, the carrier is a different object and no amount of rigour on the carrier repairs the inference. The tell is a sentence of the form 'I measured X, therefore the consumer of X will Y' with no step establishing that the consumer's subject IS X.",
+
+    "BOUNDARY AGAINST instrument_output_read_as_subject_content, WHICH IS ADJACENT AND NOT THE SAME: there a SET is derived from a report whose COMPLETENESS is a property of the reporting tool, and the repair is to know the tool's coverage. Here the carrier may be reported completely and correctly, and the defect is that the consumer's subject is a TRANSFORMATION of it. Knowing your instrument's coverage perfectly does not tell you that CI checks out a merge commit.",
+
+    "RUNG FOUND AT: mitigatable, and the mitigation was re-measuring on the consumer's subject after a peer challenged the inference -- twice, both times catching a claim already stated as a finding. CEILING: mechanically preventable -- whether a claimed subject is the one a named consumer processes is decidable wherever the consumer's subject is itself an identified artifact (a run id, a tree oid). NEXT-RUNG TRIGGER, stated as a CAPABILITY and not as an artifact: a receipt that binds each measurement to the identified subject the consumer processed, so a claim measured on the carrier cannot be stated about the consumer without the join failing loudly. Re-measuring either instance by hand satisfies none of that and leaves every other producer-consumer pair unbound.",
+  ],
+
+  evidence: [],
+}