The workflow mode wire vocabulary has one authority, and every generated selector derives its spelling from it

[briansrls]

Claim

The workflow mode wire vocabulary has one authority. Every GitHub-expression, option, disjunction, and receipt condition derives its mode spelling from that authority. Dashboard deployment remains explicitly outside the fleet-scope projection pending an observed, candidate-bound deployment request.

The duplication removed

Mode names were bare Strings in two independent places: fleet_converge_mode_options, and seventeen hand-written rows of "github.event.inputs.mode == '<name>'". Both halves ordinary Strings, so a rename could land in one and not the other with nothing to notice — §3's second-naming account in the shape no lens can see, because there is no type to disagree with.

FleetConvergeWorkflowMode is a closed fifteen-member vocabulary with one wire function; the options list, all fifteen step_if expressions, both disjunctions and the receipt-if derive from it.

Verified by the artifact itself

fleet-converge.yml is a registered generated artifact emitted from this module, so the derivation had to reproduce the committed bytes exactly. A silent spelling change in a workflow if: disables a job rather than failing loudly — byte agreement is the property that matters, and the witnesses settle it.

No wildcard

fleet_converge_mode_scope names all fifteen modes explicitly. _ => none would read the same today and undo the totality: a sixteenth mode would silently inherit "no scope" rather than forcing the projection to decide.

What none does not say

Optional carries one absence, and two facts land on it: modes inherently outside fleet convergence (spark, micro-VM, guest-image select other subjects), and a mode that belongs but whose observation contract is unbuilt — DashboardDeploy alone.

That distinction is declared in the annotation. It is not encoded in the result. A carrier separating them would be a different return type, and minting one here to record a gap would be vocabulary ahead of its consumer.

The "no second literal" claim, narrowed by the census

Each of the fifteen names still occurs twice in the module; the second occurrence is a step id. Those are a separate namespace, not a second spelling of one fact — evidence in the corpus: mode rlm_launch_deployment_receipt runs step id rlm_receipt. If ids derived from modes, that pair would have to match. Forcing a derivation would rename a step id (changing workflow output for a naming cleanup) or assert a relation that does not hold.

So: no second production literal for a mode's dispatch spelling.

Explicitly not claimed

• No FleetConvergeScope member added for dashboard deployment.
• No FleetConvergeRequest member added for dashboard deployment.
• Deploy does not use the ordinary plan/apply spine.

Adding the scope member compiles; the FleetConvergeRequest variant it obliges lights up nine match sites deriving a plan's baseline text, axis lines and refusal counters — and those modules are explicit that an absent row is itself a claim about the host. A deployment request carrying only a host renders a baseline of scope-and-host that apply re-observes and compares against nothing: a gate that cannot fail, worse than an absent one because it would be cited as the admission the deployment gained.

Evidence

workflow_dispatch_input_witness 12/12, including four new rows:

• fifteen members with fifteen distinct wire values — count alone would admit two members sharing a spelling, offering one option twice and making one mode unselectable;
• every dispatch option is a wire value of the vocabulary;
• a step condition is the wire value of the mode it selects, with a discriminator a constant projection fails;
• DashboardDeploy names no fleet scope while the three plan modes do, so a projection answering none for everything cannot pass.

Note: required-witnesses-floor on this branch inherits main's 7 CITED-DECLARATION-ABSENT findings in src/v2/lens/* and outside_modeled_guarantee_witness_test — none are this branch's files. The operator is repairing main separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_019iXPtAqzPaNBZbaaM5rxrY

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[briansrls]

Post-amend evidence, on the final head 21640ae3f

The earlier 12/12 was taken before the amend and is superseded — pre-amend diagnostic evidence only. Rerun on the exact pushed head, working tree verified identical to origin/deploy-scope:

check	result
workflow_dispatch_input_witness (12)	12/12 PASS
fleet_converge_workflow closure typecheck	zero diagnostics
generated-workflow fixed point	covered by the 8 pre-existing witnesses in that module, which pin the emitted fleet-converge.yml
dispatch-spelling census	below

The census, and it proves the namespace separation better than the argument did

Every mode has exactly one wire arm. Fourteen of fifteen carry a second literal — the step id:

plan                          wire_arm=1  total_literals=2
launch_environment_plan       wire_arm=1  total_literals=2
...
dashboard_deploy              wire_arm=1  total_literals=2
rlm_launch_deployment_receipt wire_arm=1  total_literals=1   <-- no second literal

rlm_launch_deployment_receipt is the one mode whose step id differs (rlm_receipt, line 955), and it is the one mode with no second literal.

If step ids were derived from mode names, all fifteen would show two. The mode whose id diverges is exactly the one that drops to one — so the second occurrence is the id namespace coinciding, not the dispatch spelling being duplicated. That is the evidence for the narrowed claim:

Every workflow mode's dispatch spelling has one modeled authority, and every generated workflow use derives from that authority.

It deliberately does not claim there are no legitimate appearances of those words in receipts, prose, data, or unrelated domains.

Still explicitly not claimed

• No FleetConvergeScope or FleetConvergeRequest member for dashboard deployment.
• Deploy does not use the ordinary plan/apply spine.
• The DashboardDeploy => none arm is explicit (no wildcard), and its annotation declares the missing ordinary-convergence scope rather than encoding it in none.

#6 remains open. Its next half needs a candidate-bound total member-decision baseline — not scope-and-host, and not effect_labels, which are a receipt projection: two different wrong unit documents both render write-unit <unit>, and two different stale revisions both render restart <unit>. MemberDecision preserves from and to, so Replace { from: A } and Replace { from: B } display identically while remaining distinct baselines — which is what lets apply refuse a stale plan.