From 5b1629783aa711dd16368b2cc714f2f29a40f6a3 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Mon, 7 Sep 2026 18:18:46 +0000 Subject: [PATCH 1/2] File the failure class #10560 repaired: a field carried on arms where it has no meaning Review 57275 on #10560 found that `CliWireResponse` was a record pairing a terminal-write projection with a `ProcessExit`, computed independently -- so a projection that REFUSED could carry `ExitSuccess`, and a verb printed nothing and reported success. It was reachable: an ESC byte in a commit message makes `project_terminal_write` refuse while the read itself answered fine. The repair was a coproduct whose refusal arm has no exit field to set. The repair landed; the class was never rostered, so nothing carries its recognition rule for the next carrier. It is its own row rather than an origin on a neighbour. Against `subject_and_its_digest_as_independent_parameters`: there the two fields are a value and a SUMMARY of it and the repair is derivation; here they are independent facts, one only defined when the other exists, and no derivation joins them. Against `kind_carried_but_its_fields_stay_optional`, which is the dual and is cross-cited: there an arm NEEDS a field the carrier does not guarantee and the repair REQUIRES it; here an arm carries a field it must not have and the repair DELETES it. Same law -- a carrier's field set belongs to its arms -- read from opposite ends, and filing either under the other would make one identity a nickname for both. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01VQ4iThiZ1B9LPB9ePr8qa9 --- ...arried_on_arms_where_it_has_no_meaning.dag | 24 +++++++++++++++++++ dag/gunbc/recurring_failure_mode/roster.dag | 2 ++ 2 files changed, 26 insertions(+) create mode 100644 dag/gunbc/recurring_failure_mode/field_carried_on_arms_where_it_has_no_meaning.dag diff --git a/dag/gunbc/recurring_failure_mode/field_carried_on_arms_where_it_has_no_meaning.dag b/dag/gunbc/recurring_failure_mode/field_carried_on_arms_where_it_has_no_meaning.dag new file mode 100644 index 00000000000..34baf0cd3f5 --- /dev/null +++ b/dag/gunbc/recurring_failure_mode/field_carried_on_arms_where_it_has_no_meaning.dag @@ -0,0 +1,24 @@ +module gunbc.recurring_failure_mode.field_carried_on_arms_where_it_has_no_meaning + +import std.types { NonEmptyStr } +import gunbc.recurring_failure_mode { RecurringFailureMode } + +data field_carried_on_arms_where_it_has_no_meaning: RecurringFailureMode = RecurringFailureMode { + identity: "field_carried_on_arms_where_it_has_no_meaning" as NonEmptyStr, + + receipts: [ + "INVALID STATE: a carrier is a RECORD whose fields are computed independently, and one field is meaningful on only SOME of the situations the carrier represents. Because the record has no arms, that field must be given a value in every situation -- including the ones where it denotes nothing -- so the author supplies whatever the type admits, and the resulting pairing is a claim nobody made and nothing refuses. The two fields are not a value and a summary of it (which is `subject_and_its_digest_as_independent_parameters`), so no derivation joins them; they are independent facts, one of which is only defined WHEN THE OTHER EXISTS.", + + "RECEIPT, review 57275 on gunbc#10560, in gunbc.cli_wire. CliWireResponse was `{ write: TerminalWriteProjection, exit: ProcessExit }`. A projection that REFUSED could therefore be paired with `ExitSuccess`, so a verb printed NOTHING and reported SUCCESS -- the fail-open DESIGN section 5 forbids outright, at the output boundary where an operator's only signal is the exit status. It was reachable and not theoretical: a commit message is an unrestricted `String` on `CommitLogRow` and is rendered directly into a log row, so a message carrying an ESC byte makes `project_terminal_write` refuse while the READ answered fine.", + + "WHAT THE RECORD GOT RIGHT AND WHERE IT OVERREACHED, because the repair is not `derive the exit from the bytes`. Bytes and exit status genuinely ARE two facts -- a refused repository must print its diagnostic AND exit nonzero -- which is why the printable arm still carries its own ProcessExit. What does not follow, and what the record asserted BY ITS SHAPE, is that the exit is independent of whether there are bytes AT ALL. `the exit is not derivable from what the bytes SAY` and `the exit is unconstrained by WHETHER there are bytes` are different claims; the first is true and the second is false. Conflating them is what makes this class survive review: the defence of the record is a true sentence about a neighbouring question.", + + "THE REPAIR IS SUBTRACTION, WHICH IS WHY IT IS NOT THE OPTIONAL-PAYLOAD ROW. `CliWireResponse` is now `CliWirePrintable { bytes, exit } | CliWireUnprintable { cause }`. The refusal arm has no exit field TO SET to success, so the illegal pairing is not validated, it is unwritable -- construction over validation, DESIGN section 4b rung 4, with no check to run because there is nothing to check. Contrast `gunbc.recurring_failure_mode.kind_carried_but_its_fields_stay_optional`, the dual: there an arm NEEDS a field the carrier does not guarantee and the repair REQUIRES it; here an arm carries a field it must not have and the repair DELETES it. Same law -- a carrier's field set belongs to its arms -- read from opposite ends, and filing either under the other would make one identity a nickname for both.", + + "RECOGNITION RULE, and it is asked of the CARRIER rather than of any call site: for every field of a record, enumerate the situations the record represents and name what the field MEANS in each. A situation where the honest answer is `nothing` is an arm the record is missing, and the value currently supplied there is a fabrication with a type. The tell that survives longest is a field whose only defensible value on some situation is a NEUTRAL-LOOKING one -- success, zero, empty -- because that is the value a reader who sorts, thresholds or branches on the field will read as a measurement rather than as an absence.", + + "CEILING structurally impossible, and this instance REACHED it, so what is enrolled here is the class rather than a stall. NEXT-RUNG TRIGGER for the corpus population, a capability and not an artifact: a census that, for each record carrier, resolves the situations its producers can be in and refuses a field that is unconstrained on one of them -- which is the same fold `kind_carried_but_its_fields_stay_optional` names from its end, and neither row retires until it can ask both directions.", + ], + + evidence: [], +} diff --git a/dag/gunbc/recurring_failure_mode/roster.dag b/dag/gunbc/recurring_failure_mode/roster.dag index 32d65d05e03..d62e5112f6c 100644 --- a/dag/gunbc/recurring_failure_mode/roster.dag +++ b/dag/gunbc/recurring_failure_mode/roster.dag @@ -28,6 +28,7 @@ import gunbc.recurring_failure_mode.parallel_representation_debt { parallel_repr import gunbc.recurring_failure_mode.internal_review_finds_missing_tests_external { internal_review_finds_missing_tests_external } import gunbc.recurring_failure_mode.unmarked_workaround { unmarked_workaround } import gunbc.recurring_failure_mode.self_authorized_dissolution { self_authorized_dissolution } +import gunbc.recurring_failure_mode.field_carried_on_arms_where_it_has_no_meaning { field_carried_on_arms_where_it_has_no_meaning } import gunbc.recurring_failure_mode.positional_citation { positional_citation } import gunbc.recurring_failure_mode.bound_shaped_closure { bound_shaped_closure } import gunbc.recurring_failure_mode.authority_substitution { authority_substitution } @@ -350,4 +351,5 @@ data recurring_failure_mode_roster: List = [ docs_markdown_projections_have_no_completing_actuator, type_name_field_carries_rendered_value, capability_arrives_outside_the_converged_path, + field_carried_on_arms_where_it_has_no_meaning, ] From b12e67aba3c5e517ccea91e370393ebbea831f1a Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Mon, 7 Sep 2026 18:37:25 +0000 Subject: [PATCH 2/2] chore: regenerate drifted generated artifacts (ci auto-heal) Ledger-Repair-Judged: docs/design-failure-modes.md Ledger-Rows-Repaired: docs/design-failure-modes.md field_carried_on_arms_where_it_has_no_meaning Ledger-Repair-Judged: docs/design-rung-drops.md --- docs/design-failure-modes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 24a8ced774c..e1c73471b6a 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -172,6 +172,7 @@ The exact `RecurringFailureMode.identity` population, which no other projection - `docs_markdown_projections_have_no_completing_actuator` - `type_name_field_carries_rendered_value` - `capability_arrives_outside_the_converged_path` +- `field_carried_on_arms_where_it_has_no_meaning` --- @@ -359,3 +360,4 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **generated `docs/*.md` ledger projections have no ProcessExit actuator and no regen coverage, so an EDIT to a still-present row can sit in the authority, absent from the projection, with every completing instrument green** (INVALID STATE: `gunbc.recurring_failure_mode` is the authority; `docs/design-failure-modes.md` is the projection DESIGN.md points readers at. `expected_design_failure_modes_md` returns `String`. The refusal exits 2 with EMPTY STDOUT and interpolates the rendered value into the diagnostic on stderr: classify_exit's non-variant arm is type_name: ctx.format_value(other). Executed: wise-badger-902, EXIT=2, stdout 0 bytes, stderr 578588 bytes opening with the markdown heading; quick-heron-85, proj3.err 1062137 bytes, same delimiters. The enrolled control `non_process_exit_refuses_rather_than_printing_and_succeeding` forbids print-AND-SUCCEED, and holds. The content is therefore obtainable ONLY by scraping a half-megabyte stderr diagnostic between delimiters that are message prose (returned-open-quote and not-ProcessExit-close-quote), unversioned and enrolled by nothing. Extractable only by scraping an unversioned diagnostic — which is why the ProcessExit regen is the repair. `claim_executor --required-regen` compares only `is_compared_generated_basename` = ends_with .rs into `target/stage0-regen-candidate`. HARM: three rows can be edited in `.dag` after the last projection and nothing that exits 0 will say the markdown is stale. The meaning-fork in the field named type_name is a separate row, `type_name_field_carries_rendered_value`, not this class. SPECIMEN, measured by another lane while regenerating the projection, 2026-09-06: `instrument_answers_outside_its_domain`, `stale_claim_survives_its_own_correct_edit`, and `native_stack_recursion_unbounded_over_corpus_shaped_structure` had been edited in their authorities after the doc was last projected and had grown by 2349, 5519 and 1152 characters. Regenerating carried the repairs through. On origin/main as of 3531d30bb82 those three `.dag` files are older than `docs/design-failure-modes.md` (`81686f7bea8`), so CURRENT main is not claimed still stale; the class is that nothing completing could have said so while they were. SPECIMEN, review 58567 on gunbc#9864, on the host comment above `exit_status_for_class`: a relocation dropped the `status: refused — printing the value and exiting 0 would report success for a run whose outcome is unknown.` sentence while the comment claimed byte-for-byte equivalence. The doc lied, not the code. The sentence was restored rather than the claim weakened. That is this class on a different pair: an authority and its projection disagreeing with nothing completing to say so, and a real specimen rather than an injected literal. INCIDENT, not a fixture and not a perturbation ordered for this PR, produced by quick-heron-85 without looking for this class, commit b1c6378c6d: their authority row unresolved_callee_conflated_with_dispatched_elsewhere was UNPARSEABLE for a full commit. An authored receipt contained a quoted phrase using bare double quotes inside a double-quoted string; the string terminated early and the parser refused undefined variable this and undefined variable leaf. THE AUTHORITY DID NOT COMPILE, so docs/design-failure-modes.md kept rendering the previous vintage while presenting as current. They found it only by running the projection; reading the row does not surface the break. This PR's gate would go red on that commit because an unparseable authority makes the projector refuse — from the committed markdown alone, STALE bytes and an UNBUILDABLE authority are indistinguishable. THIS ROW IS THE DETECTOR GAP. The quoting injury that silently disabled the row they were filing is a neighbouring class they are filing separately; its next-rung trigger is string escaping in the .dag lexer. This gate makes that injury loud; it does not make it unwritable. Do not read this row as closing that class. THE IDENTITY-JOIN CORRECTION, which is the transferable part and which corrects a rule this project holds. Completeness is an identity join, not a count equality — and AN IDENTITY JOIN OVER ROW NAMES WOULD HAVE REPORTED THAT FILE COMPLETE AND CORRECT: every identity present, none missing, none extra. The drift was pure EDIT. Only a regenerated byte diff sees an edit. Worse: a first pass comparing line SETS read the three as REORDERINGS, because the changed rows shared an 80-character prefix with their old text, so the cheap check does not merely miss the drift, it manufactures a benign explanation for it. An identity join proves MEMBERSHIP, not CONTENT. THE TWO NEIGHBOURS THIS IS NOT. `authority_merges_unprotected_while_its_projection_is_guarded` is MERGE POLARITY: the generated projection is driver-bound while the hand-authored authority is not. Adjacent files, distinct defect — this row is the absence of a completing actuator or content gate, reachable with no merge in sight. `green_reported_over_a_population_the_instrument_does_not_own` is a split of actuators whose GREEN is read as covering the half it does not enumerate; that climb joined registry-projections to stage0-mirrors inside one required phase, and still does not give `gunbc run` a ProcessExit projector for the markdown, nor put `.md` in `--required-regen`. RECOGNITION RULE: when a generated file is what readers are pointed at, ask (1) whether any `ProcessExit` entry writes those exact bytes and exits 0, (2) whether regen's compared population includes that path, and (3) whether the gate compares CONTENT, not row-name membership. A complete identity set of names is not a content agreement. RUNG FOUND AT: outside the ladder until a completing content agreement exists — silent wrongness, not a weak wall. After a ProcessExit projector and a required content compare execute, mechanically preventable: the stale file remains writable. CEILING: structurally guaranteed when membership of every committed generated `docs/` path in a content-agreement adjudicator is derived from `gunbc.generated_artifact` `committed_generated_artifacts`, so omitting the arm is a compile refusal. NEXT-RUNG TRIGGER, a capability: required-run dispatch consumes a content agreement — byte identity of generated vs committed — over every committed generated artifact whose location directory is `docs`, derived from the registry so adding a committed `docs/` path without that agreement will not compile. A trigger naming one command, one test file, or `docs_projection_gate.dag` is less than the capability and would fire while edit-only drift can still sit uncompared.) - **a field named type_name holds a type name on three arms and a fully rendered value on the fourth** (INVALID STATE: ExitClass::NotProcessExit is one spelling whose payload field is called type_name. `classify_exit` Variant arms that are not ProcessExit put ctx.resolve of the variant type symbol, or ProcessExit plus the unknown variant, into it — an actual type or variant name. The final other arm puts ctx.format_value of the non-variant value — the rendered value — into the same field. `exit_status_for_class` interpolates that field into the returned-quote slot with no second match, so every refusal path reads one name for two facts. HARM: a reader of the interpolation site infers the field's contents from its NAME and concludes a String projector yields the word String; a reader of the producer and a live stderr file concludes the markdown body is in the diagnostic. Both readings of adjacent code are correct; the name is a third surface and it lied. SPECIMEN, 2026-09-06, executed both ways. clever-otter-298 read `exit_status_for_class` and the enrolled control `non_process_exit_refuses_rather_than_printing_and_succeeding` (which constructs NotProcessExit with a fixture type_name Bool and never goes through `classify_exit`) and asserted the diagnostic names the type. wise-badger-902 read the interpolation site and ruled the same. quick-heron-85 held proj3.err at 1062137 bytes. The manager then RAN the projector: EXIT=2, stdout 0 bytes, stderr 578588 bytes opening with the markdown. The field name said type; the field held format_value. WHY THE FORK SURVIVED, and it is a section 4b evidence gap not a naming smell. `non_process_exit_refuses_rather_than_printing_and_succeeding` hand-constructs ExitClass::NotProcessExit with type_name the literal Bool and starts from an already-classified value. It never calls `classify_exit`. Nothing executing joins the field's name to its contents on the non-variant path — the only enrolled evidence feeds the field a literal that matches its name, which is exactly the input that cannot discriminate. The control's RED is unauthorable for this defect, so it was permanently green over the case that mattered and got cited as coverage. A field carrying two facts is ordinary; a field carrying two facts with a control that only ever sees one of them is why three of us read adjacent code correctly and reached three answers. THIS IS NOT `docs_markdown_projections_have_no_completing_actuator`. That row is the absence of a ProcessExit actuator and a content gate over generated `docs/*.md`. This row is a meaning fork inside `ExitClass`, reachable with no docs file in sight. Neighbour `meaning_fork` is the generic class; this instance is filed because the fork sat in the struct every refusal path reads and produced the three-way contradiction. Neighbour `diagnostic_name_mechanism_silent` is a diagnostic NAME silent about its predicate; here the FIELD name is accurate for three arms and false for the fourth. RECOGNITION RULE: when a field is named for a kind of contents, read every constructor, not the interpolation site. If one constructor writes a different kind, the name has forked. RUNG FOUND AT: mitigatable — the wrong inference is a human reading; the runtime still refuses with exit 2 and does not print-and-succeed. CEILING: structurally impossible when `NotProcessExit` cannot be constructed with a rendered value under a field named for a type — two variants, or a field named for what it actually holds. NEXT-RUNG TRIGGER, a capability: `ExitClass` distinguishes a type-name refusal from a rendered-value refusal in the type, so interpolating one as the other will not compile.) - **a host holds a capability that no modeled path put there, so every later green on that host is uninterpretable.** INVALID STATE: a host answers ready for some capability while the convergence that is supposed to be the only way that capability arrives has not delivered it. The harm is not the capability -- it usually works -- it is that a receipt naming the host can no longer distinguish the modeled path working from a hand-run answering, and the ambiguity is permanent and travels with every future citation of that host. DISTINGUISHING FACTS, against neighbours it is easy to file as. It is not `execution_provenance_loss`: there an observation may never have run, whereas here the observation runs and reports faithfully -- the host really does hold the capability. It is not `head_landed_by_hand_before_its_own_verification_reported`: that is an artifact landing uncertified, this is DURABLE HOST STATE whose origin is unrecorded. The tell is a convergence that reports `already satisfied` for a host it never satisfied. THE STRUCTURAL CAUSE IS A CAPABILITY AUTHORIZED BY ONE MODULE, DISCLAIMED BY ANOTHER, AND EXECUTED BY NEITHER, which is DESIGN section 6's out-of-band actuation wearing convergence vocabulary. `gunbc.runner.runner_host_grants` emits EnsureSupplementaryGroupMembership and `runner_host_sudoers_content` renders permission to run its argv; `gunbc.runner_microvm_host_ready` explicitly disclaims applying it, naming the result 'a hole an operator falls into once per host, by hand'. A modeled capability with no executor is a manual step, and the roster row that grants it makes the manual step look converged. SPECIMEN A, srv2 KVM (2026-09-05): an operator ran `sudo usermod -aG kvm ghrunner` by hand, the argv already rendered at provisioning/srv2/gunbc-ghrunner.sudoers. srv2 has read kvm=writable ever since while every sibling host reads present-not-writable. The module's own annotation recording the earlier measurement went stale at that moment and COULD NOT GO RED, because DESIGN section 4c says no Accepted program reads an annotation; it was caught only because someone asked whether the grant was converged. SPECIMEN B, srv1 Firecracker (2026-09-06, this row's occasion): a session ran the modeled `runner_microvm_host_converge_wet` by hand on srv1, which installed Firecracker v1.16.1-aarch64 into the executor-owned root -- 30 paths under ~/.local/share/gunbc-firecracker, the root directory itself created by the run, so nothing pre-existed. It was digest-verified, idempotent, and spent no host grant, and it was STILL wrong: srv1 is the canary of record, and its capability would not have come from the host-image path that is supposed to own it. THE RULING, AND WHY DECLARING THE DEVIATION WAS REJECTED AS THE WEAKER ARM. The first recommendation was to keep the install and write it down. The operator overrode it: declaring makes the ambiguity legible but leaves every later srv1 receipt carrying a provenance caveat forever, whereas removing it makes the question stop existing. CONVERGENCE IS ONLY MEANINGFUL IF IT IS THE ONLY WAY STATE ARRIVES. Specimen B was reverted the same day -- the enumerated tree removed and nothing adjacent touched -- and the honest post-revert state is that srv1 cannot run a guest, which is what makes the convergence gap visible instead of papered over. RUNG FOUND AT: BELOW THE FLOOR, which is not a rung -- DESIGN section 4b puts silent wrongness outside the ladder and forbids it outright, and that is where both specimens sit. Nothing executed distinguishes a converged capability from a hand-placed one: `runner_microvm_host_ready` observes WHETHER the host holds a capability and never WHAT PLACED IT, so a hand-run host and a converged host produce byte-identical standing. The srv2 specimen is the measured proof -- the writability persisted from 2026-09-05 through every subsequent standing read, the annotation recording the pre-hand-run measurement went stale at that instant and could not go red because no Accepted program reads one, and it surfaced only when a human asked whether the grant was converged. The srv1 specimen adds that the converge itself reports success without recording that its operator was a hand session. Provenance has no mechanism at all, not a weak one. CEILING, DERIVED AND DIFFERENT FOR TWO HOST SHAPES, so a single number would be dishonest. On a host whose runtime root is reconstructed from a repository-built image at every boot, the ceiling is STRUCTURALLY IMPOSSIBLE: no persistent root survives to hold a capability the image did not place, so the invalid state has no constructor and the question stops being askable rather than being checked. On a MUTABLE persistent host the ceiling is MECHANICALLY PREVENTABLE and no higher, because an operator holding sudo can always place state -- the best reachable is an observation that refuses a capability it cannot attribute, which depends on that check executing and staying enrolled. Per DESIGN section 4b(1) a class's rung is the MINIMUM across its in-scope paths, so while any mutable host remains in the population the class's attainable ceiling is mechanically preventable, and the structural arm is available only to the hosts that stop being mutable. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT, stated at the grain of the loss. The loss is plural -- every host, every capability -- so a trigger naming one host or one grant would be satisfied while the class stayed dead. FROM BELOW-THE-FLOOR TO MECHANICALLY PREVENTABLE: a host-standing observation that reports, for each capability, the identity of the converge run that placed it, such that a capability with no attributable placing run is a typed refusal rather than a ready standing. That is the whole capability; a receipt that merely RECORDS provenance without refusing on its absence does not reach it, because the srv2 specimen was already recorded in prose and still could not go red. FROM MECHANICALLY PREVENTABLE TO STRUCTURALLY IMPOSSIBLE, and only for hosts that reach it: a runtime root reconstructed from a repository-built image on every boot, so that no capability persists that the image did not place. Naming a specific host-image pull request would be naming an artifact; what discharges this row is the property that a rebooted host cannot carry unattributed capability, whichever change delivers it. THE APPLIER IS BUILT AND UNREACHABLE, NOT MISSING, AND THE DISTINCTION DECIDES THE REPAIR. This row's first draft implied the executing half had to be written. It does not: `gunbc.executor_privileged_apply apply_executor_privileged_operations_wet` exists, elevates with `sudo -n` so an uncovered command REFUSES instead of hanging on a prompt no automated converge will answer, and renders its argv through the SAME `executor_privileged_operation_argv` the sudoers line is rendered from -- so what is permitted and what is executed are one fact by construction rather than by review. It has ZERO callers anywhere in the corpus, test modules included; the only other occurrence is a decl_ref citation. So DESIGN section 4b(2)'s three-way split lands on its strongest arm -- not `cannot climb`, not `can climb after one grounding`, but CAN CLIMB NOW WITH THE MECHANISM ALREADY WRITTEN -- and the remaining work is one wiring into the converge path. Recording this is load-bearing because the opposite reading sends the next author to build a second applier beside the first, which is precisely the argv fork that module's own annotation says it exists to prevent. AND THE REASON IT HAS NO CALLER IS ITSELF A NAMED CLASS, WHICH IS WHY THE WIRING NEVER HAPPENED. The module was not deferred pending an ownership decision and it is not a half-finished design: #10628 introduced it WHOLE, expressly to close this gap -- that commit's own account is that `executor_privileged_operation_argv` had no production consumer, that `runner_host_privileged_operations` fed only the sudoers renderer, and that this module 'closes it, and executes THE SAME argv function' -- and then landed it without the caller it was written for. That is DESIGN section 3c exactly, down to the tell that section lists in its own words: consumption described in the PR body but absent from the diff. So the repair that was supposed to end this class was itself an instance of a neighbouring one, and the two facts are the same fact: 'one wiring remains' and 'a section 3c dangling consumer' describe the same missing edge, but only the second says WHY it is missing and therefore why waiting will not produce it. REPAIR, IN PREFERENCE ORDER: bake the capability into a host image so the question cannot be asked, or close it in fleet converge. NOT an applier bolted beside the disclaiming module, and never the sudoers argv by hand -- that converts a modeled hole into a second undeclared deviation, which is how specimen A was produced. The reviewer's question for any host-capability claim: which run put it there, and can you name it. +- INVALID STATE: a carrier is a RECORD whose fields are computed independently, and one field is meaningful on only SOME of the situations the carrier represents. Because the record has no arms, that field must be given a value in every situation -- including the ones where it denotes nothing -- so the author supplies whatever the type admits, and the resulting pairing is a claim nobody made and nothing refuses. The two fields are not a value and a summary of it (which is `subject_and_its_digest_as_independent_parameters`), so no derivation joins them; they are independent facts, one of which is only defined WHEN THE OTHER EXISTS.RECEIPT, review 57275 on gunbc#10560, in gunbc.cli_wire. CliWireResponse was `{ write: TerminalWriteProjection, exit: ProcessExit }`. A projection that REFUSED could therefore be paired with `ExitSuccess`, so a verb printed NOTHING and reported SUCCESS -- the fail-open DESIGN section 5 forbids outright, at the output boundary where an operator's only signal is the exit status. It was reachable and not theoretical: a commit message is an unrestricted `String` on `CommitLogRow` and is rendered directly into a log row, so a message carrying an ESC byte makes `project_terminal_write` refuse while the READ answered fine.WHAT THE RECORD GOT RIGHT AND WHERE IT OVERREACHED, because the repair is not `derive the exit from the bytes`. Bytes and exit status genuinely ARE two facts -- a refused repository must print its diagnostic AND exit nonzero -- which is why the printable arm still carries its own ProcessExit. What does not follow, and what the record asserted BY ITS SHAPE, is that the exit is independent of whether there are bytes AT ALL. `the exit is not derivable from what the bytes SAY` and `the exit is unconstrained by WHETHER there are bytes` are different claims; the first is true and the second is false. Conflating them is what makes this class survive review: the defence of the record is a true sentence about a neighbouring question.THE REPAIR IS SUBTRACTION, WHICH IS WHY IT IS NOT THE OPTIONAL-PAYLOAD ROW. `CliWireResponse` is now `CliWirePrintable { bytes, exit } | CliWireUnprintable { cause }`. The refusal arm has no exit field TO SET to success, so the illegal pairing is not validated, it is unwritable -- construction over validation, DESIGN section 4b rung 4, with no check to run because there is nothing to check. Contrast `gunbc.recurring_failure_mode.kind_carried_but_its_fields_stay_optional`, the dual: there an arm NEEDS a field the carrier does not guarantee and the repair REQUIRES it; here an arm carries a field it must not have and the repair DELETES it. Same law -- a carrier's field set belongs to its arms -- read from opposite ends, and filing either under the other would make one identity a nickname for both.RECOGNITION RULE, and it is asked of the CARRIER rather than of any call site: for every field of a record, enumerate the situations the record represents and name what the field MEANS in each. A situation where the honest answer is `nothing` is an arm the record is missing, and the value currently supplied there is a fabrication with a type. The tell that survives longest is a field whose only defensible value on some situation is a NEUTRAL-LOOKING one -- success, zero, empty -- because that is the value a reader who sorts, thresholds or branches on the field will read as a measurement rather than as an absence.CEILING structurally impossible, and this instance REACHED it, so what is enrolled here is the class rather than a stall. NEXT-RUNG TRIGGER for the corpus population, a capability and not an artifact: a census that, for each record carrier, resolves the situations its producers can be in and refuses a field that is unconstrained on one of them -- which is the same fold `kind_carried_but_its_fields_stay_optional` names from its end, and neither row retires until it can ask both directions.