From 300d230d370dafe434e7e784b1a21cab649983af Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Sat, 5 Sep 2026 15:14:59 +0000 Subject: [PATCH 1/3] Record claim-edit policy transitions omitted from cost reports --- ...ion_policy_outside_reported_cost_delta.dag | 31 +++++++++++++++++++ dag/gunbc/recurring_failure_mode/roster.dag | 2 ++ 2 files changed, 33 insertions(+) create mode 100644 dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag diff --git a/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag b/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag new file mode 100644 index 00000000000..fcae597138b --- /dev/null +++ b/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag @@ -0,0 +1,31 @@ +module gunbc.recurring_failure_mode.claim_edit_changes_execution_policy_outside_reported_cost_delta + +import std.types { NonEmptyStr } +import gunbc.recurring_failure_mode { RecurringFailureMode } + +data claim_edit_changes_execution_policy_outside_reported_cost_delta: RecurringFailureMode = RecurringFailureMode { + identity: "claim_edit_changes_execution_policy_outside_reported_cost_delta" as NonEmptyStr, + + receipts: [ + "**a claim edit changes execution or adjudication policy outside the reported cost delta** (INVALID STATE: a cost-change report accounts for the claims the author intended to optimize while omitting execution-membership or policy transitions induced by other changed test declarations. HARM: correct per-claim savings and a green semantic gate support a net-saving conclusion that the complete run contradicts. The gate and the report answer different questions; approval of the former does not establish the latter. ", + + "DISTINGUISHING MECHANISM: `floor_diff_edits_from_line_ranges` attributes changed lines to test declarations. `v2.workflow.required_floor` `required_floor_disposition_with_changed_selection` replaces the ordinary disposition with `PlannedAsChangedWitness`. For an otherwise withheld `DeclinedCostDebt` identity, this starts execution. `changed_witness_cost_policy` returns `ChangedCostDebtVerdictOnly` only at the intersection of changed-witness selection AND `floor_cost_debt_holds`; `changed_witness_cpu_deadline` then selects `CpuDeadlineObservedOnly`. An ordinary changed witness retains its enforced CPU deadline. Wall deadlines, semantic failures and missing cost observations still block. This is the declared changed-cost-debt policy, not a defect in admission and not a waiver for every edited claim. ", + + "SPECIMEN gunbc#10538: an incidental parameterization rewrote `v2.test.claim.dag_acceptance` `acceptance_translate_row_is_determinate`, activating its existing cost-debt identity. Main run 33954515928 and PR run 33955309905, artifact `required-floor-claim-cost`, reconcile as follows: six intended claims 473,469 -> 39,777 eval_steps (-433,692, 91.6%); the added execution +981,055 steps, with 2,072 observed cpu_ms and a passing verdict; four other common-row deltas net -5. Corpus 20,508,599 -> 21,055,957, net +547,358, with one added executed identity and none dropped. Three approvals preceded the corpus reconciliation. The repair restored the production helper and this test body verbatim while giving the two intended identity-only claims a separate fixture; it did not weaken the production subject or change its roster. ", + + "THE POLICY WAS ANNOUNCED, NOT SILENT: run 33955309905 reported `withhold_overridden_for_changed_verdict=1` against `enrolled=419`, named the overridden identity, emitted its `floor-cost-debt-observation`, and printed its `changed-witness` standing as `planned-and-passed-with-cost-debt-observed`. The configured CPU line was 500ms; 100ms was the optimization objective. The author and review omitted an available transition from their accounting. Calling this a hidden waiver would erase the evidence that distinguishes the reporting failure from an admission failure. ", + + "SECOND COST RECEIPT, reported by the wave coordinator for gunbc#10530: `v2.test.claim.rust_crate_partition_witness` `witness_partition_perturbation_member_coverage_holds` was activated at 291,316 eval_steps / 261 observed cpu_ms; one approval and a request to land preceded the reconciliation. Its CPU observation is below 500ms, so this receipt establishes the missed execution addition, not an over-deadline verdict admitted by the waiver. ", + + "CONTRASTING RECEIPT gunbc#10542: editing `v2.test.execution.emit_on_demand_family_crate_witness` `family_crate_one_build_members_warm_holds`, `family_crate_member_change_cold_rebuild_holds` and `family_crate_dispatch_change_cold_rebuild_holds` made their existing route gaps blocking under changed-witness admission. Run 33956888387 and baseline 33954515928 both contain the same 3,510 executed identities; the three outcomes remain `host_effect_refused` at `emit_host_native_cache_evict` / `FilesystemRemoval`. CI refused with `route-gap-before-verdict`; it did not waive that failure. The whole family-module change was withdrawn, including its helper changes. `floor_route_gap` and `floor_expected_red` already EXECUTE their enrolled identities, whereas ordinary `floor_cost_debt` membership withholds execution. Their union is not a dormant population, and an unchanged executed-identity set alone cannot detect an adjudication transition. ", + + "RECOGNITION AND CURRENT MITIGATION: bind baseline and candidate to immutable run subjects, join every identity in both cost and disposition receipts, list added and dropped executions, retain outcome and changed-witness policy transitions, and reconcile common-row deltas plus additions minus removals to the complete corpus total. Report the intended subset separately. Treat unavailable or censored costs as such, never as exact zeros. This manual reconciliation exposed the cost receipts; the existing changed-witness gate itself detected the route-gap receipt. Restoring an unintended source edit is a scope correction; moving it into a helper merely to avoid selection is not a repair. ", + + "RUNG FOUND AT: mitigatable for the cost-report boundary. Complete run products and explicit policy diagnostics exist, and manual reconciliation detected the discrepancy, but no executed evidence here establishes that cost reports must consume that reconciliation. CEILING: mechanically preventable for report completeness, because finite identity sets, dispositions and exact step deltas are decidable at the receipt boundary. Whether a newly executed claim was intended or its additional coverage is worth its cost remains an author/operator judgment, outside that mechanical guarantee; this row does not propose overriding the declared verdict-only policy. NEXT TRIGGER: a cost-change reporting consumer that binds both run subjects, refuses incomplete or unreconciled accounting, and publishes execution and adjudication transitions beside the total. It must discriminate both a newly admitted debt identity and an unchanged-membership route-gap transition, with an unchanged-policy positive control; an added warning alone is insufficient. ", + + "BOUNDARY AGAINST NEIGHBORS: `non_execution_undifferentiated_by_what_it_silenced` concerns missing purpose information for checks that do not reach a verdict; this class concerns edits changing execution or adjudication while the cost report preserves the author's old scope. `selection_view_read_as_population` concerns a selected view promoted to a population; this instance additionally requires a source-edit-induced admission/policy transition and a report that reconciles those transitions across two run subjects. The distinct repair is transition accounting, not purpose ranking or a different cost threshold.)", + + ], + + evidence: [], +} diff --git a/dag/gunbc/recurring_failure_mode/roster.dag b/dag/gunbc/recurring_failure_mode/roster.dag index f3dba3295eb..67934fcef3d 100644 --- a/dag/gunbc/recurring_failure_mode/roster.dag +++ b/dag/gunbc/recurring_failure_mode/roster.dag @@ -152,6 +152,7 @@ import gunbc.recurring_failure_mode.one_disposition_defined_jointly_by_independe import gunbc.recurring_failure_mode.wait_keyed_on_a_resource_whose_arrivals_outpace_its_service { wait_keyed_on_a_resource_whose_arrivals_outpace_its_service } import gunbc.recurring_failure_mode.emitter_residual_renders_inert_text { emitter_residual_renders_inert_text } import gunbc.recurring_failure_mode.kind_carried_but_its_fields_stay_optional { kind_carried_but_its_fields_stay_optional } +import gunbc.recurring_failure_mode.claim_edit_changes_execution_policy_outside_reported_cost_delta { claim_edit_changes_execution_policy_outside_reported_cost_delta } data recurring_failure_mode_roster: List = [ a_type_name_asserts_an_algebra_the_arithmetic_does_not_carry, @@ -295,4 +296,5 @@ data recurring_failure_mode_roster: List = [ wait_keyed_on_a_resource_whose_arrivals_outpace_its_service, emitter_residual_renders_inert_text, kind_carried_but_its_fields_stay_optional, + claim_edit_changes_execution_policy_outside_reported_cost_delta, ] From 397bc9a0dff978c9026e59eb217f151af38293df Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Sat, 5 Sep 2026 16:16:39 +0000 Subject: [PATCH 2/3] Cite cost instruments instead of transcribing measurements --- ...es_execution_policy_outside_reported_cost_delta.dag | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag b/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag index fcae597138b..06ab7bfcfbd 100644 --- a/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag +++ b/dag/gunbc/recurring_failure_mode/claim_edit_changes_execution_policy_outside_reported_cost_delta.dag @@ -11,15 +11,15 @@ data claim_edit_changes_execution_policy_outside_reported_cost_delta: RecurringF "DISTINGUISHING MECHANISM: `floor_diff_edits_from_line_ranges` attributes changed lines to test declarations. `v2.workflow.required_floor` `required_floor_disposition_with_changed_selection` replaces the ordinary disposition with `PlannedAsChangedWitness`. For an otherwise withheld `DeclinedCostDebt` identity, this starts execution. `changed_witness_cost_policy` returns `ChangedCostDebtVerdictOnly` only at the intersection of changed-witness selection AND `floor_cost_debt_holds`; `changed_witness_cpu_deadline` then selects `CpuDeadlineObservedOnly`. An ordinary changed witness retains its enforced CPU deadline. Wall deadlines, semantic failures and missing cost observations still block. This is the declared changed-cost-debt policy, not a defect in admission and not a waiver for every edited claim. ", - "SPECIMEN gunbc#10538: an incidental parameterization rewrote `v2.test.claim.dag_acceptance` `acceptance_translate_row_is_determinate`, activating its existing cost-debt identity. Main run 33954515928 and PR run 33955309905, artifact `required-floor-claim-cost`, reconcile as follows: six intended claims 473,469 -> 39,777 eval_steps (-433,692, 91.6%); the added execution +981,055 steps, with 2,072 observed cpu_ms and a passing verdict; four other common-row deltas net -5. Corpus 20,508,599 -> 21,055,957, net +547,358, with one added executed identity and none dropped. Three approvals preceded the corpus reconciliation. The repair restored the production helper and this test body verbatim while giving the two intended identity-only claims a separate fixture; it did not weaken the production subject or change its roster. ", + "SPECIMEN gunbc#10538: an incidental parameterization rewrote `v2.test.claim.dag_acceptance` `acceptance_translate_row_is_determinate`, activating its existing cost-debt identity. Reconcile main run 33954515928 against PR run 33955309905 using artifact `required-floor-claim-cost`: the intended claims became cheaper, but the added execution outweighed those savings and the complete corpus became more expensive. That claim passed above the configured CPU line under the declared verdict-only policy. Approvals preceded the corpus reconciliation. The repair restored the production helper and this test body verbatim while giving the intended identity-only claims a separate fixture; it did not weaken the production subject or change its roster. ", - "THE POLICY WAS ANNOUNCED, NOT SILENT: run 33955309905 reported `withhold_overridden_for_changed_verdict=1` against `enrolled=419`, named the overridden identity, emitted its `floor-cost-debt-observation`, and printed its `changed-witness` standing as `planned-and-passed-with-cost-debt-observed`. The configured CPU line was 500ms; 100ms was the optimization objective. The author and review omitted an available transition from their accounting. Calling this a hidden waiver would erase the evidence that distinguishes the reporting failure from an admission failure. ", + "THE POLICY WAS ANNOUNCED, NOT SILENT: the log of run 33955309905 reports the override population in `withhold_overridden_for_changed_verdict` beside `enrolled`, names the overridden identity, emits its `floor-cost-debt-observation`, and publishes its `changed-witness` standing. The run's configured CPU line and the wave's lower optimization objective are different boundaries. The author and review omitted an available transition from their accounting. Calling this a hidden waiver would erase the evidence that distinguishes the reporting failure from an admission failure. ", - "SECOND COST RECEIPT, reported by the wave coordinator for gunbc#10530: `v2.test.claim.rust_crate_partition_witness` `witness_partition_perturbation_member_coverage_holds` was activated at 291,316 eval_steps / 261 observed cpu_ms; one approval and a request to land preceded the reconciliation. Its CPU observation is below 500ms, so this receipt establishes the missed execution addition, not an over-deadline verdict admitted by the waiver. ", + "SECOND COST RECEIPT, reported by the wave coordinator for gunbc#10530 from its required-floor cost artifact: `v2.test.claim.rust_crate_partition_witness` `witness_partition_perturbation_member_coverage_holds` was activated; approval and a request to land preceded the reconciliation. Its observed CPU cost was below the configured deadline, so this receipt establishes the missed execution addition, not an over-deadline verdict admitted by the waiver. ", - "CONTRASTING RECEIPT gunbc#10542: editing `v2.test.execution.emit_on_demand_family_crate_witness` `family_crate_one_build_members_warm_holds`, `family_crate_member_change_cold_rebuild_holds` and `family_crate_dispatch_change_cold_rebuild_holds` made their existing route gaps blocking under changed-witness admission. Run 33956888387 and baseline 33954515928 both contain the same 3,510 executed identities; the three outcomes remain `host_effect_refused` at `emit_host_native_cache_evict` / `FilesystemRemoval`. CI refused with `route-gap-before-verdict`; it did not waive that failure. The whole family-module change was withdrawn, including its helper changes. `floor_route_gap` and `floor_expected_red` already EXECUTE their enrolled identities, whereas ordinary `floor_cost_debt` membership withholds execution. Their union is not a dormant population, and an unchanged executed-identity set alone cannot detect an adjudication transition. ", + "CONTRASTING RECEIPT gunbc#10542: editing `v2.test.execution.emit_on_demand_family_crate_witness` `family_crate_one_build_members_warm_holds`, `family_crate_member_change_cold_rebuild_holds` and `family_crate_dispatch_change_cold_rebuild_holds` made their existing route gaps blocking under changed-witness admission. Run 33956888387 and baseline 33954515928 contain identical executed-identity sets; the named claims' outcomes remain `host_effect_refused` at `emit_host_native_cache_evict` / `FilesystemRemoval`. CI refused with `route-gap-before-verdict`; it did not waive that failure. The whole family-module change was withdrawn, including its helper changes. `floor_route_gap` and `floor_expected_red` already EXECUTE their enrolled identities, whereas ordinary `floor_cost_debt` membership withholds execution. Their union is not a dormant population, and an unchanged executed-identity set alone cannot detect an adjudication transition. ", - "RECOGNITION AND CURRENT MITIGATION: bind baseline and candidate to immutable run subjects, join every identity in both cost and disposition receipts, list added and dropped executions, retain outcome and changed-witness policy transitions, and reconcile common-row deltas plus additions minus removals to the complete corpus total. Report the intended subset separately. Treat unavailable or censored costs as such, never as exact zeros. This manual reconciliation exposed the cost receipts; the existing changed-witness gate itself detected the route-gap receipt. Restoring an unintended source edit is a scope correction; moving it into a helper merely to avoid selection is not a repair. ", + "INSTRUMENT AND CURRENT MITIGATION: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane witnesses` produces the run receipts through `v1.cli_run` `write_required_floor_claim_cost_tsv` and `write_required_floor_disposition_tsv`, published as `required_floor_claim_cost.tsv` and `required_floor_disposition.tsv`. The wave's reconciliation was a manual identity join of those run products, not a repository-enforced reconciliation producer. RECOGNITION: bind baseline and candidate to immutable run subjects, join every identity in both receipts, list added and dropped executions, retain outcome and changed-witness policy transitions, and reconcile common-row deltas plus additions minus removals to the complete corpus total. Report the intended subset separately. Treat unavailable or censored costs as such, never as exact zeros. This manual reconciliation exposed the cost receipts; the existing changed-witness gate itself detected the route-gap receipt. Restoring an unintended source edit is a scope correction; moving it into a helper merely to avoid selection is not a repair. ", "RUNG FOUND AT: mitigatable for the cost-report boundary. Complete run products and explicit policy diagnostics exist, and manual reconciliation detected the discrepancy, but no executed evidence here establishes that cost reports must consume that reconciliation. CEILING: mechanically preventable for report completeness, because finite identity sets, dispositions and exact step deltas are decidable at the receipt boundary. Whether a newly executed claim was intended or its additional coverage is worth its cost remains an author/operator judgment, outside that mechanical guarantee; this row does not propose overriding the declared verdict-only policy. NEXT TRIGGER: a cost-change reporting consumer that binds both run subjects, refuses incomplete or unreconciled accounting, and publishes execution and adjudication transitions beside the total. It must discriminate both a newly admitted debt identity and an unchanged-membership route-gap transition, with an unchanged-policy positive control; an added warning alone is insufficient. ", From d41d396a29a71ca5a26c0dc296de210e08a07414 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Sat, 5 Sep 2026 17:11:55 +0000 Subject: [PATCH 3/3] chore: regenerate drifted generated artifacts (ci auto-heal) Ledger-Repair-Judged: docs/design-failure-modes.md Ledger-Rows-Repaired: docs/design-failure-modes.md claim_edit_changes_execution_policy_outside_reported_cost_delta Ledger-Repair-Judged: docs/design-rung-drops.md --- docs/design-failure-modes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 2e6bdf35870..6064d026228 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -147,6 +147,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `kind_carried_but_its_fields_stay_optional` - `population_selector_that_cannot_admit_a_counterexample` - `dissolution_trigger_cites_a_mechanism_that_is_later_deleted` +- `claim_edit_changes_execution_policy_outside_reported_cost_delta` --- @@ -307,3 +308,4 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - INVALID STATE: a carrier gains a positive KIND variant while the fields that kind implies stay OPTIONAL on the same carrier, so a consumer that matches the kind still cannot reach the payload without an unwrap. The kind answers WHICH construct this is and answers nothing about what the construct contains, yet the climb reads as if it had closed both -- which is the shape of DESIGN section 4b(1) rung inflation, because the honest rung is the MINIMUM across the paths and the field path did not move.RECEIPT, 2026-09-04, in v1.std.core Node. Node gained module_item_kind carrying ParsedModuleItemKind, stamped by the parse item constructors, which dissolved the emit-side predicates that decided an item's kind from the ABSENCE of fields. Node.body and Node.type_annotation stayed `Node?`, because Node is one carrier for items and expressions alike and an expression has no body. So a ModuleItemFunction whose body is Absent, or a ModuleItemDataValue with no declared type, remains fully AUTHORABLE, and twelve dispatch sites across the three emitters that previously used is_function_item / is_data_def_item as PROOF THAT AN UNWRAP WAS SAFE now match on the optional field and refuse when it is Absent. The refusal is real and it is a wall, not a construction.THE DISTINGUISHING FACT is that the surviving guard reads as leftover ceremony rather than as load-bearing. A reviewer who accepts the kind as authoritative sees `match item.body { Present ... Absent => refuse }` under `ModuleItemFunction =>` and reads the Absent arm as unreachable -- and deleting it, or replacing it with an unwrap, is a one-line edit that no test names. The tell is a coproduct arm whose body immediately reaches for a field the coproduct does not guarantee.CEILING AND NEXT-RUNG TRIGGER. Ceiling STRUCTURALLY IMPOSSIBLE, DESIGN section 4b rung 4; current rung MECHANICALLY PREVENTABLE for the field-presence half, while the kind half sits at rung 4. THE TRIGGER IS THE CAPABILITY AND NOT AN ARTIFACT: a per-kind item carrier in which each kind's implied payload is NON-OPTIONAL BY CONSTRUCTION -- a function item whose body is a `Node` and not a `Node?`, a data item whose declared type and value are both required -- so that a kind-stamped item with a missing payload has no constructor and the Absent arms have no RED to catch. Anything less than that, including a check that every stamped item carries its fields, is a validator standing where construction was available and does not retire this row.RECOGNITION RULE: when a positive variant lands on a shared carrier, ask which fields that variant IMPLIES and whether they are still optional on the carrier. If they are, the climb covered the classification axis only; report the rung for that axis and name the payload axis separately. A single carrier serving several variants is the structural reason the payload cannot be tightened in place, so this row and the carrier split are the same work seen from two ends. - **a population selector that cannot admit a counterexample** (the population under study is enumerated by a LEXICAL PROXY FOR THE PREDICATE being asked, so the selector and the evidence are one object. Every member is then found to satisfy the claim -- not because the claim holds, but because no member that would refute it was reachable by the query that defined membership. The output is a CATEGORICAL VERDICT that is UNFALSIFIABLE BY CONSTRUCTION: no member of that population could have come back the other way. **THE ONE-QUESTION REVIEW TEST, and it is the reason to key the row on this rather than on the cause: WHAT MEMBER OF THIS POPULATION COULD HAVE FALSIFIED THE CLAIM?** If the answer is none, the query was structurally incapable of returning the negative and the verdict carries no information. The question costs one sentence and is askable before any result is read, which is when it is worth asking. **THE BOUNDARY AGAINST `selection_view_read_as_population`, the nearest row, and it fails to fire here.** There membership is a property of THE MEASUREMENT -- the set moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. Here membership is a STABLE PROPERTY OF THE SUBJECT: the files matching a token do not move with load or with the instrument. Every recognition rule that row offers is silent on this one, which is why it needs its own. **THE BOUNDARY AGAINST `censored_estimator_drops_its_own_tail`, which is the other near miss.** Censoring drops an EXTREME and biases an ESTIMATE low with no bound, so the excluded region is a tail. Here the excluded region is THE ENTIRE COMPLEMENT, and its members are not extreme -- they are the ONLY POSSIBLE COUNTEREXAMPLES. The output is not a biased number but a categorical capability verdict, so there is no estimator to debias and no bound to state; the repair is to re-derive the population, not to recover a tail. **THE BOUNDARY AGAINST `corroboration_without_an_independent_derivation_axis`, filed the same night from the same specimen, and they are two classes rather than one.** That row is about WHEN A SECOND READING IS EVIDENCE AT ALL: two readers agree, the agreement is counted as confirmation, and both ran the same query over the same lexical projection -- two signatures, one evidence lineage. It applies with a perfectly sound population; two people can share a lineage reading a log, a dashboard or a diff. THE DISCRIMINATOR IS WHERE THE DEFECT LIVES, not decidability -- AN EARLIER DRAFT OF THIS PARAGRAPH SAID DECIDABILITY AND CLAIMED THIS CLASS WAS DECIDABLE WITH CEILING 3, WHICH THE CEILING PARAGRAPH BELOW WITHDRAWS ON EVIDENCE; the two statements stood in one file at once, which is the single-authority defect this roster exists to catch. Both classes are undecidable in general: whether a selector can admit a counterexample is a question about the semantic relation between two expressions, and whether two readings share an evidence lineage is a question about how two people arrived at them. What separates them is the SUBJECT -- this class is a defect in HOW A POPULATION WAS CONSTRUCTED, which leaves a trace in a declared enumeration and is therefore partly reachable by construction over a declared sub-population; that one is a property of the RELATIONSHIP BETWEEN TWO READERS, which no artifact records at all, so it carries ceiling 1 and declares no trigger. **A repair that closes either leaves the other untouched:** deriving the population independently does not make a second reader's agreement informative, and changing the second reader's axis does not un-derive the population. They co-occurred here because one specimen exhibited both. **AND AGAINST THE SELF-REFERENCE FAMILY** (`admission_predicate_evidenced_from_inside_its_own_subject`, `self_authorized_dissolution`, `predicate_vacuously_true_on_an_empty_domain`, `repair_enumerates_its_own_blast_radius_by_inspection`): each is about a SUBJECT supplying its own admission. This is about a POPULATION supplying its own verdict, which is a different object -- the subject here is perfectly ordinary and it is the enumeration that is circular. **SPECIMEN WITH A RECEIPT, measured 2026-09-04 across gunbc#10388's scaffold escalation, and it is filed as a PAIR because the second half is what makes it a class rather than an incident.** The question was whether bounded pagination is modelled in this repository. The population used was the files matching `default_per_page`, seven of them. That token is a LEXICAL PROXY for the predicate: it names a page-SIZE default, and every route that pages WITHOUT importing it -- a reflective host bridge, an endpoint carrying its own page parameter -- was unreachable by the query that defined the population. So the verdict `bounded pagination is established` could not have come back any other way. The truth, established later by reading operation graphs rather than tokens: `extdeps.github` DOES declare a page-SIZE parameter and DOES bind it into the request query -- `pulls.dag` carries `per_page: Int = default_per_page` in an operation input and `query: { state: state, per_page: per_page }` on the wire, across seven files -- and it contains NO PAGE FOLD ANYWHERE: no cursor advance, no link-header read, no continuation loop, no terminal closure. `type Pagination` is declared with ZERO consumers. **THE PARAMETER'S PRESENCE IS WHAT MADE THE PROXY CREDIBLE, and that is a stronger statement than the capability being absent.** The population was not selected by a token that meant nothing; it was selected by a token that meant something ADJACENT AND REAL, which is the only reason two readers believed it. A proxy nobody would adopt is not a hazard -- the dangerous proxy is the one that is genuinely about the neighbourhood of the predicate. **THE SECOND HALF: TWO ANALYSTS REPRODUCED ONE EVIDENCE LINEAGE AND READ IT AS CORROBORATION.** The second reader deliberately refused to relay the first's claim and re-measured independently -- and re-measured THE SAME SUBJECT WITH THE SAME TOKEN THROUGH THE SAME LEXICAL PROJECTION, making the same unstated substitution of `page size is configurable` for `continuation is consumed until closure`. One lineage, two signatures, and the agreement was read as confirmation. It then reached an operator escalation as a seconded premise, which is worse than one analyst being wrong: a second confirms a first without adding information. **A SECOND READING CORROBORATES ONLY WHEN IT CHANGES A LOAD-BEARING DERIVATION AXIS** -- operation-graph reachability, an executing transition, a controlled mutation. Any one of the three was cheap here and would have returned the truth on the first pass. **THREE CLAIMS WERE TREATED AS ONE, which is the specific substitution to watch for at an external boundary: page SIZE configured, cursor SHAPE declared, and continuation CLOSURE executed are independent.** A declared carrier proves the second and neither of the others; a configured size parameter proves the first and neither of the others. Reading any one as the conjunction is how the proxy gets adopted in the first place. **THE SEAL, and it is why per-member discipline does not repair this: `one disposition per member` is satisfiable with the predicate never executed.** A caller can map members to fabricated satisfied rows and obtain perfect cardinality and perfect key coverage over a population that was itself derived from the proxy. So the fix is not a count and not a coverage join: PROVENANCE MUST LIVE IN THE CONSTRUCTOR -- no path from a member, a file path, a symbol occurrence or a count to a disposition, and only the executor mints one. That is a structural statement rather than a discipline, which is the form that survives a reviewer who agrees with it and then does not do it. **RUNG: NONE ESTABLISHED BY EXECUTED EVIDENCE, and the earlier draft of this paragraph claimed 1 (mitigatable) on the strength of the class being nameable and the review question being one sentence.** That was rung inflation and it is withdrawn. DESIGN section 4b defines rung 1 as harm CONTAINED -- by total operations, typed outcomes, bounds, rollback, isolation -- and names a plan, a diagnostic variant and an inert lens as establishing nothing. A recognition rule is none of those. Nothing in this repository refuses, bounds or isolates a population selected by a proxy for its own predicate; what actually happened in every receipt above is that a PEER ASKED, which is attention rather than mechanism, and 4b(1) explicitly does not count it. The receipts are executed evidence that the class OCCURS and that review sometimes catches it -- they are not evidence of containment, and reading them as a rung is the same substitution this row is about. **THE HONEST POSITION IS THAT THE CLASS IS CURRENTLY UNCONTAINED**, which is worse than sitting at rung 1 and is the reason it ranks for a climb at all. **CEILING, AND THE PREVIOUSLY DECLARED ONE WAS WRONG IN A WAY THE SPECIMEN ON THIS ROW REFUTES.** The earlier draft claimed ceiling 3, decidable because whether a population's enumerating expression SHARES A SYMBOL with the predicate evaluated over it is a static question over the same `Node` graph a lens reads. Run that procedure against the receipt directly above it: the selector keyed on `default_per_page` while the claim was about CONTINUATION AND FOLD EXECUTION. Those expressions share no symbol and need not, so the proposed decider does not fire on the specimen that motivated the row -- a check permanently green on its own founding case, which is the decoration 4b warns is worse than absent because it will be cited as coverage. **THE GENERAL PROPERTY IS NOT DECIDABLE**: whether a selector can admit a counterexample to a claim is a question about the SEMANTIC relationship between two expressions, not their syntax, so by section 5's triage this class is a ratchet, not a wall, and no amount of static reading makes it one. **CEILING: 1 (mitigatable). THE EARLIER DRAFT'S 2 IS WITHDRAWN ON REVIEW 60734, WHICH IS RIGHT, AND IS RIGHT FOR A REASON THIS ROW ALREADY CONTAINED.** Rung 2 requires a mechanism that RELIABLY EXPOSES AND BLOCKS the class. The constructor discipline this row used to name as its trigger does neither: an executor can evaluate every member of a proxy-selected population perfectly honestly while every counterexample stays outside the enumeration, so the verdict is unfalsifiable exactly as it was and nothing has been exposed. That capability is real, but it guarantees a DIFFERENT property -- that no disposition exists which nothing executed -- and pricing it as this class's ceiling was the substitution this row is named after, committed by this row. What contains THIS harm is narrower: a verdict must not be readable as broader than the enumeration it was taken over. That is containment rather than prevention, which is rung 1. **NEXT-RUNG TRIGGER, AND IT NAMES THE CAPABILITY THAT REACHES THE CEILING, not a stronger one borrowed from another class.** A claim carrier that binds a verdict to the enumeration it was evaluated over, and refuses to render or aggregate that verdict unless the subject enumeration travels with it. That contains the harm this class actually does: a verdict taken over a proxy-selected population stops being readable as a claim about the population the reader has in mind, because the carrier will not state it unqualified. **WHY THE CEILING STOPS THERE, stated so no later author reads this row as promising a wall:** whether a selector CAN admit a counterexample to a claim is a question about the semantic relationship between two expressions, not their syntax. DESIGN section 5 triages that as a ratchet forever, and the never-trap is exactly the move of letting a ratchet wear a wall-shaped ceiling. **AND WHAT IS DELIBERATELY NOT CLAIMED HERE:** the constructor discipline described in the seal above -- provenance in the constructor, dispositions mintable only by an executor -- remains a worthwhile capability, and it is NOT this row's trigger. It closes FABRICATED DISPOSITIONS, a different invalid state with a different subject. Citing this row as coverage for that class, or that capability as a climb of this one, is the same conflation running in the other direction. - **a dissolution trigger cites a MECHANISM by name, that mechanism is later deleted, and nothing points back -- so the scaffold it governs becomes permanent while still reading as tracked** (INVALID STATE: a declared scaffold or rung drop names its exit as a mechanism -- a lens, a gate, a cadence, a flag -- and the citation is CORRECT WHEN WRITTEN. A later lane deletes that mechanism for its own good reasons, and the deletion is complete and reviewed at ITS end. The trigger is not a consumer of the deleted symbol -- it is prose naming it -- so no compile refuses, no census counts it, and the scaffold now carries an exit condition that can never occur. HARM: the row keeps presenting as temporary debt with a named exit, which is exactly the presentation that removes it from every audit that looks for stalls; DESIGN section 4b(2)'s separation of `cannot climb further` from `can climb after one grounding` silently reclassifies the row into the first category without anyone deciding that. DISTINGUISHING FACTS, and they are what make this its own class rather than an instance of the two neighbours: (1) THE TENSE AND THE DIRECTION OF INVALIDATION. `restoration_promise_names_a_route_that_does_not_exist` is a promise whose named route NEVER EXISTED, discoverable by grepping the tree at the moment the promise is read; `trigger_satisfied_before_the_row_was_written` is a trigger already TRUE at authoring. Here the trigger was both real and unsatisfied when written, and a THIRD PARTY's edit made it unreachable afterwards, so neither of those rows' origin arms applies and neither of their remedies finds it. (2) THE DELETING LANE IS BLAMELESS AND CANNOT SEE IT. A mechanism's deletion PR reviews the mechanism's consumers -- imports, calls, roster membership -- and a trigger citing it is none of those, so the class is invisible from the only side that knows the deletion is happening. This is DESIGN section 3's positional-citation defect moved from `file:line` to `mechanism-name`: a citation that decays because the thing it names is edited elsewhere. SPECIMEN, MEASURED 2026-09-05 AT HEAD 4da9c1a3fdd AND UNREPAIRED AT FILING: `v2.compiler.self_host.candidate_generation` carries `SCAFFOLD: feature:medium_structure_containment` over `direct_rust_door_cargo_toml`, the hand-authored Cargo manifest literal the direct Rust door writes. The cited lens WAS DELETED IN #6831, stated by two independent surviving carriers -- `v2.std.compilers.target_model` `target_text_carrier_scaffold_note` (`The retired no-smuggled-programs / medium_structure_containment lens (#6831) is not live enforcement`) and `gunbc.plans.self_applying_lenses` (`medium_structure_containment / no-smuggled-programs was deleted in #6831`). The name occurs three times in the corpus and NOT ONCE as a live declaration: the annotation that cites it, and the two carriers recording its death. THE SECOND HALF OF THE SPECIMEN IS WHAT MAKES THE REPAIR NON-COSMETIC: the same annotation's `dissolve-on` SENTENCE names a different and real capability -- emit the manifest through the target-model / serialize_target path or a cited Toml medium carrier -- and THAT capability does not exist either, measured: there is no TOML authority anywhere under `src/v2/extdeps/formats` (json, sql, spice, icestorm_pcf) or `extdeps/languages`. So a reader who repairs only the dead NAME still holds a trigger nobody can satisfy; the honest repair states the capability and prices it as absent. RUNG FOUND AT: 1, mitigatable. Nothing silent is produced -- the scaffold is declared and its content is honest about being a literal -- and the only thing containing the harm is that a reader may notice the cited mechanism is gone. CEILING: 3, structurally guaranteed. A trigger that cites a repository symbol is a CITATION, and DESIGN section 3's standing rule already requires citations to name symbols the namespace authority can resolve; a trigger citing a symbol that no longer resolves is decidable by the same `Node`-tree read that decides any stale name, so an `Accepted` program need not contain one. NOT 4: the trigger is prose and a trigger naming a capability in words rather than a symbol is legitimate and must stay writable, so the invalid state remains authorable and the guarantee is a refusal rather than an absent constructor. NEXT-RUNG TRIGGER, at capability grain: dissolution and restoration triggers carrying their cited mechanism as a RESOLVED DECLARATION REFERENCE rather than as free text, so deleting the mechanism reddens every trigger that names it in the deleting lane's own build -- sufficient because the failure is precisely that the deleting lane cannot see the citation, and a convention that authors should check would be satisfied while the capability stayed dead. WHAT IS HARDER TO DO NOW THAN BEFORE THIS ROW WAS FILED: NOTHING, and this row is reported UNREMEDIED on that basis, per `a_written_row_is_not_a_firing_mechanism`. The one friction delivered with it is local and expires: the specimen's own trigger text is rewritten in the same change to name the absent capability instead of the deleted lens.) +- **a claim edit changes execution or adjudication policy outside the reported cost delta** (INVALID STATE: a cost-change report accounts for the claims the author intended to optimize while omitting execution-membership or policy transitions induced by other changed test declarations. HARM: correct per-claim savings and a green semantic gate support a net-saving conclusion that the complete run contradicts. The gate and the report answer different questions; approval of the former does not establish the latter. DISTINGUISHING MECHANISM: `floor_diff_edits_from_line_ranges` attributes changed lines to test declarations. `v2.workflow.required_floor` `required_floor_disposition_with_changed_selection` replaces the ordinary disposition with `PlannedAsChangedWitness`. For an otherwise withheld `DeclinedCostDebt` identity, this starts execution. `changed_witness_cost_policy` returns `ChangedCostDebtVerdictOnly` only at the intersection of changed-witness selection AND `floor_cost_debt_holds`; `changed_witness_cpu_deadline` then selects `CpuDeadlineObservedOnly`. An ordinary changed witness retains its enforced CPU deadline. Wall deadlines, semantic failures and missing cost observations still block. This is the declared changed-cost-debt policy, not a defect in admission and not a waiver for every edited claim. SPECIMEN gunbc#10538: an incidental parameterization rewrote `v2.test.claim.dag_acceptance` `acceptance_translate_row_is_determinate`, activating its existing cost-debt identity. Reconcile main run 33954515928 against PR run 33955309905 using artifact `required-floor-claim-cost`: the intended claims became cheaper, but the added execution outweighed those savings and the complete corpus became more expensive. That claim passed above the configured CPU line under the declared verdict-only policy. Approvals preceded the corpus reconciliation. The repair restored the production helper and this test body verbatim while giving the intended identity-only claims a separate fixture; it did not weaken the production subject or change its roster. THE POLICY WAS ANNOUNCED, NOT SILENT: the log of run 33955309905 reports the override population in `withhold_overridden_for_changed_verdict` beside `enrolled`, names the overridden identity, emits its `floor-cost-debt-observation`, and publishes its `changed-witness` standing. The run's configured CPU line and the wave's lower optimization objective are different boundaries. The author and review omitted an available transition from their accounting. Calling this a hidden waiver would erase the evidence that distinguishes the reporting failure from an admission failure. SECOND COST RECEIPT, reported by the wave coordinator for gunbc#10530 from its required-floor cost artifact: `v2.test.claim.rust_crate_partition_witness` `witness_partition_perturbation_member_coverage_holds` was activated; approval and a request to land preceded the reconciliation. Its observed CPU cost was below the configured deadline, so this receipt establishes the missed execution addition, not an over-deadline verdict admitted by the waiver. CONTRASTING RECEIPT gunbc#10542: editing `v2.test.execution.emit_on_demand_family_crate_witness` `family_crate_one_build_members_warm_holds`, `family_crate_member_change_cold_rebuild_holds` and `family_crate_dispatch_change_cold_rebuild_holds` made their existing route gaps blocking under changed-witness admission. Run 33956888387 and baseline 33954515928 contain identical executed-identity sets; the named claims' outcomes remain `host_effect_refused` at `emit_host_native_cache_evict` / `FilesystemRemoval`. CI refused with `route-gap-before-verdict`; it did not waive that failure. The whole family-module change was withdrawn, including its helper changes. `floor_route_gap` and `floor_expected_red` already EXECUTE their enrolled identities, whereas ordinary `floor_cost_debt` membership withholds execution. Their union is not a dormant population, and an unchanged executed-identity set alone cannot detect an adjudication transition. INSTRUMENT AND CURRENT MITIGATION: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane witnesses` produces the run receipts through `v1.cli_run` `write_required_floor_claim_cost_tsv` and `write_required_floor_disposition_tsv`, published as `required_floor_claim_cost.tsv` and `required_floor_disposition.tsv`. The wave's reconciliation was a manual identity join of those run products, not a repository-enforced reconciliation producer. RECOGNITION: bind baseline and candidate to immutable run subjects, join every identity in both receipts, list added and dropped executions, retain outcome and changed-witness policy transitions, and reconcile common-row deltas plus additions minus removals to the complete corpus total. Report the intended subset separately. Treat unavailable or censored costs as such, never as exact zeros. This manual reconciliation exposed the cost receipts; the existing changed-witness gate itself detected the route-gap receipt. Restoring an unintended source edit is a scope correction; moving it into a helper merely to avoid selection is not a repair. RUNG FOUND AT: mitigatable for the cost-report boundary. Complete run products and explicit policy diagnostics exist, and manual reconciliation detected the discrepancy, but no executed evidence here establishes that cost reports must consume that reconciliation. CEILING: mechanically preventable for report completeness, because finite identity sets, dispositions and exact step deltas are decidable at the receipt boundary. Whether a newly executed claim was intended or its additional coverage is worth its cost remains an author/operator judgment, outside that mechanical guarantee; this row does not propose overriding the declared verdict-only policy. NEXT TRIGGER: a cost-change reporting consumer that binds both run subjects, refuses incomplete or unreconciled accounting, and publishes execution and adjudication transitions beside the total. It must discriminate both a newly admitted debt identity and an unchanged-membership route-gap transition, with an unchanged-policy positive control; an added warning alone is insufficient. BOUNDARY AGAINST NEIGHBORS: `non_execution_undifferentiated_by_what_it_silenced` concerns missing purpose information for checks that do not reach a verdict; this class concerns edits changing execution or adjudication while the cost report preserves the author's old scope. `selection_view_read_as_population` concerns a selected view promoted to a population; this instance additionally requires a source-edit-induced admission/policy transition and a report that reconciles those transitions across two run subjects. The distinct repair is transition accounting, not purpose ranking or a different cost threshold.)