Unblock orphaned gunbc#10600 (branch session/warm-ant-80-provenance): floor FloorDiscoveryRefused on a test-marked decl in dag/test/manual/emission_provenance_specimen_red.dag, plus stage0-mirrors lib.rs drift, plus three symbol citations

dag/gunbc/ci/ci_layer_roots.dag

@@ -1251,7 +1251,7 @@ fn bin_wet(entry: String, f: String) -> ScheduleWitnessEntry {
   ScheduleWitnessEntry { entry: entry, function: f, kind: ExecutionWitnessKind }
 }
 
-data v1_claim_scoped_witness_batch_deleted_note: String = "THE SCOPED WITNESS BATCH IS DELETED (2026-08-15), and with it the only ScopedWitnessBatch instance that ever existed. It ran five file-grain v1 claim entries under a dag plus src/v1 source-root envelope, in a sequential child worker, so the v1 compiler closure could be resolved without widening witness_layer_roots for everything else.\n\nWHY IT COULD NOT SURVIVE AFFECTED-SET SELECTION. It was the last SelectionApplied consumer on the required path, and its 720-second clamp was derived (PR #8259) from a measured 565-second wall on the assumption that unrelated PRs skip it. With selection deleted the two available readings were both wrong: run it every PR and the required floor grows by roughly nine minutes under a clamp basis that no longer describes it, or keep a selection mechanism alive for one batch. Its cost was also never really the witnesses — the same receipt measured about 390 seconds of closure materialization before the first witness line and about 30 seconds of witness evaluation, so it was paying a whole second subject preparation to check thirty rows.\n\nWHAT THIS NARROWS, stated rather than implied: the five entries under src/v1/tests/claim have NO executing consumer. They are not covered by ordinary discovery, whose roots are dag plus src/v2. Their generated stage0 emissions still compile into the seed crate, which is not execution. This is a real loss of coverage over v1 parser and namespace-binding behavior, taken deliberately as part of deleting the floor rather than discovered later, and it is NOT backstopped by any cadence — the cadence lane those rows might have moved to was refused for the same reason the per-PR slot was: a second subject envelope is the defect, not the schedule it runs on.\n\nRESTORATION: one prepared subject spanning dag, src/v1 and src/v2, at which point a separate envelope, a separate worker, a separate clamp and a separate receipt family all stop existing and these rows are ordinary discovery."
+data v1_claim_scoped_witness_batch_deleted_note: String = "THE SCOPED WITNESS BATCH IS DELETED (2026-08-15), and with it the only ScopedWitnessBatch instance that ever existed. It ran five file-grain v1 claim entries under a dag plus src/v1 source-root envelope, in a sequential child worker, so the v1 compiler closure could be resolved without widening witness_layer_roots for everything else.\n\nWHY IT COULD NOT SURVIVE AFFECTED-SET SELECTION. It was the last SelectionApplied consumer on the required path, and its 720-second clamp was derived (PR #8259) from a measured 565-second wall on the assumption that unrelated PRs skip it. With selection deleted the two available readings were both wrong: run it every PR and the required floor grows by roughly nine minutes under a clamp basis that no longer describes it, or keep a selection mechanism alive for one batch. Its cost was also never really the witnesses — the same receipt measured about 390 seconds of closure materialization before the first witness line and about 30 seconds of witness evaluation, so it was paying a whole second subject preparation to check thirty rows.\n\nWHAT THIS NARROWS, stated rather than implied: the entries under src/v1/tests/claim have NO executing consumer. They are not covered by ordinary discovery, whose roots are dag plus src/v2. Their generated stage0 emissions still compile into the seed crate, which is not execution. This is a real loss of coverage over v1 parser and namespace-binding behavior, taken deliberately as part of deleting the floor rather than discovered later, and it is NOT backstopped by any cadence — the cadence lane those rows might have moved to was refused for the same reason the per-PR slot was: a second subject envelope is the defect, not the schedule it runs on.\n\nRESTORATION: one prepared subject spanning dag, src/v1 and src/v2, at which point a separate envelope, a separate worker, a separate clamp and a separate receipt family all stop existing and these rows are ordinary discovery."
 
 // `witness_fold_src_v1_coverage_gap_note` STOOD HERE UNTIL 2026-09-02 AND IS RETIRED, NOT LOST.
 // It was a String declaring that the required witness fold does not reach src/v1 -- the fact

dag/gunbc/guarantee_stall/emission_apply_generic_r_uninstantiated_stall.dag

@@ -0,0 +1,22 @@
+module gunbc.guarantee_stall.emission_apply_generic_r_uninstantiated_stall
+
+import gunbc.guarantee_rung { Mitigatable, StructurallyImpossible }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+data emission_apply_generic_r_uninstantiated_stall: GuaranteeStall = GuaranteeStall {
+  subject: "std.emission_provenance keeps three monomorphic emission_apply_fragments / emission_apply_source_fragments / emission_apply_origin_read helpers whose bodies are identical (operation.apply(state)) because the single generic form fn emission_apply<R>(operation: EmissionAppendOperation<R>, state: R) -> R { operation.apply(state) } refuses at the public materialization boundary. emission_append_operations_compose<R> already calls .apply through unresolved R in the same file; the gap is R left uninstantiated at the public call sites, where join then sees Primitive() or Primitive(R) and the empty list literal is not a collection. This is not the dissolved claim that the operation-only fold is unbuilt language capability.",
+  current: Mitigatable,
+  ceiling: StructurallyImpossible,
+  blocker: AwaitsOneGrounding {
+    grounding: "generic emission_apply<R> at emission_contribution_read / emission_contribution_source / emission_contribution_origins typechecks, so join sees a collection and the empty argument is a collection."
+  },
+  population: BoundedPopulation { members: [
+    "std.emission_provenance.emission_apply_fragments",
+    "std.emission_provenance.emission_apply_source_fragments",
+    "std.emission_provenance.emission_apply_origin_read",
+    "std.emission_provenance.emission_contribution_read",
+    "std.emission_provenance.emission_contribution_source",
+    "std.emission_provenance.emission_contribution_origins"
+  ] },
+  next_rung_trigger: climbs_when(capability: "fn emission_apply<R>(operation: EmissionAppendOperation<R>, state: R) -> R used at emission_contribution_read, emission_contribution_source and emission_contribution_origins typechecks and those three controls execute -- SUFFICIENT FOR deleting the three monomorphic helpers. The discriminating refusal is emission_provenance.dag at those public sites: join cannot be resolved on Primitive() / Primitive(R), and the empty list literal's expected type is not a collection. A change that makes .apply well-typed through generic R only inside emission_append_operations_compose, or that specializes some other call site while these three still refuse, does not fire it.")
+}

dag/gunbc/guarantee_stall/emission_provenance_missing_consumer.dag

@@ -0,0 +1,22 @@
+module gunbc.guarantee_stall.emission_provenance_missing_consumer
+
+import gunbc.guarantee_rung { Mitigatable, StructurallyImpossible }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+data emission_provenance_missing_consumer: GuaranteeStall = GuaranteeStall {
+  subject: "std.emission_provenance defines EmissionContribution and its fold. An emitter path now constructs those values: `v2.compiler.emit_module` `emit_module_contribution` builds EmissionAuthoredFragment (the declaration separator, whose bytes are the literal declared at `emit_module_decl_separator`), EmissionSourceComposition (the module and family folds, one composition per declaration) and EmissionUnobservedFragment (`v2.compiler.emit` returns Medium<String>, so the origins of one declaration's emitted text are observed nowhere at that seam), and `emit_module_text`/`emit_family_text` DERIVE the emitted bytes from that tree rather than concatenating beside it. The required floor control is `v2.test.emit.emit_module_contribution`, which censuses all three arms through emission_contribution_fold, reads the tree through emission_contribution_read, joins the unobserved producer against `v2.compiler.emit` by identity, and measures the emitted bytes against a repeated-append reference. What remains unsatisfied is the specimen leg: the match-bound FreeMonoid-element map at `test.manual.emission_provenance_specimen_red` `emission_combined_read_preserves_content_order_and_origin_multiplicity` still does not compile under dag/test/claim, pending #10625.",
+  current: Mitigatable,
+  ceiling: StructurallyImpossible,
+  blocker: AwaitsOneGrounding {
+    grounding: "`test.manual.emission_provenance_specimen_red` `emission_combined_read_preserves_content_order_and_origin_multiplicity` compiles and runs as a required-floor test fn under dag/test/claim. The emitter-path leg of this stall is discharged by `v2.compiler.emit_module` `emit_module_contribution` and the executing control `v2.test.emit.emit_module_contribution`."
+  },
+  population: BoundedPopulation { members: [
+    "std.emission_provenance.EmissionAuthoredFragment",
+    "std.emission_provenance.EmissionSourceComposition",
+    "std.emission_provenance.EmissionUnobservedFragment",
+    "std.emission_provenance.emission_contribution_read",
+    "std.emission_provenance.emission_contribution_origins",
+    "test.manual.emission_provenance_specimen_red.emission_combined_read_preserves_content_order_and_origin_multiplicity"
+  ] },
+  next_rung_trigger: climbs_when(capability: "test.manual.emission_provenance_specimen_red emission_combined_read_preserves_content_order_and_origin_multiplicity compiles and runs as a required-floor test fn under dag/test/claim — a // annotation cannot discharge that move. The emitter-path leg this trigger also named is discharged: v2.compiler.emit_module emit_module_contribution constructs all three contribution arms from a real emitter path and v2.test.emit.emit_module_contribution is the required executing control that reads them through emission_contribution_read and censuses every arm through emission_contribution_fold.")
+}

dag/gunbc/guarantee_stall/emit_returns_medium_not_contribution_stall.dag

@@ -0,0 +1,20 @@
+module gunbc.guarantee_stall.emit_returns_medium_not_contribution_stall
+
+import gunbc.guarantee_rung { Mitigatable, StructurallyImpossible }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+data emit_returns_medium_not_contribution_stall: GuaranteeStall = GuaranteeStall {
+  subject: "v2.compiler.emit_module emit_module_contribution constructs EmissionContribution from the real emitter path, but v2.compiler.emit returns Medium<String> and reports no contribution structure, so the origins of each declaration's emitted text are unobserved at that seam. Every module and family contribution therefore reads EmissionOriginsIncomplete naming v2.compiler.emit, once per declaration. The bytes are observed and retained; only their origins are not.",
+  current: Mitigatable,
+  ceiling: StructurallyImpossible,
+  blocker: AwaitsOneGrounding {
+    grounding: "v2.compiler.emit returns an EmissionContribution rather than Medium<String>, so emit_module_decl_contribution can compose that contribution as a nested part instead of wrapping its bytes in EmissionUnobservedFragment."
+  },
+  population: BoundedPopulation { members: [
+    "v2.compiler.emit_module.emit_module_emit_unobserved_fragment",
+    "v2.compiler.emit_module.emit_module_decl_contribution",
+    "v2.compiler.emit_module.emit_module_contribution",
+    "v2.compiler.emit_module.emit_family_contribution"
+  ] },
+  next_rung_trigger: climbs_when(capability: "v2.compiler.emit returns an EmissionContribution rather than Medium<String>, SUFFICIENT FOR emit_module_decl_contribution to compose that contribution as a nested part instead of wrapping its bytes in EmissionUnobservedFragment -- at which point v2.test.emit.emit_module_contribution's arm census flips (unobserved 0, composition depth +1) and stays enrolled as the regression control rather than retiring. A change that merely reduces the NUMBER of unobserved fragments, or that observes origins for some other producer while emit still reports none, does not fire it.")
+}

dag/gunbc/guarantee_stall/roster.dag

@@ -12,6 +12,9 @@ module gunbc.guarantee_stall.roster
 import std.types { List, Bool }
 import v2.std.algebra { fold_list }
 import gunbc.guarantee_stall { GuaranteeStall }
+import gunbc.guarantee_stall.emission_provenance_missing_consumer { emission_provenance_missing_consumer }
+import gunbc.guarantee_stall.emit_returns_medium_not_contribution_stall { emit_returns_medium_not_contribution_stall }
+import gunbc.guarantee_stall.emission_apply_generic_r_uninstantiated_stall { emission_apply_generic_r_uninstantiated_stall }
 import gunbc.guarantee_stall.pre_resolve_entry_closure_module_identity_stall { pre_resolve_entry_closure_module_identity_stall }
 import gunbc.guarantee_stall.merge_admission_terminal_verdict_stall { merge_admission_terminal_verdict_stall }
 import gunbc.guarantee_stall.generated_artifact_registry_membership_stall { generated_artifact_registry_membership_stall }
@@ -215,6 +218,9 @@ data all_guarantee_stalls: List<GuaranteeStall> = [
   fn_index_depth_agreement_floor_enrollment_stall,
   wet_route_model_lags_seed_stall,
   eval_steps_outside_the_reading_coproduct_stall,
+  emission_provenance_missing_consumer,
+  emit_returns_medium_not_contribution_stall,
+  emission_apply_generic_r_uninstantiated_stall,
 ]
 
 // THE FOUR SUBJECTS RESTORED TO THE ROSTER, PINNED BY IDENTITY SO THEIR LOSS REFUSES.

dag/gunbc/recurring_failure_mode/match_bound_element_type_mask.dag

@@ -0,0 +1,17 @@
+module gunbc.recurring_failure_mode.match_bound_element_type_mask
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data match_bound_element_type_mask: RecurringFailureMode = RecurringFailureMode {
+  identity: "match_bound_element_type_mask" as NonEmptyStr,
+  receipts: [
+    "**A FreeMonoid<DeclarationRef> or FreeMonoid<ApplicationRow> bound by a match-arm pattern mask does not carry its element type into a lambda passed to a container method** — the element type arrives as the Empty variant of FreeMonoid, so `origin.decl_name` on `observed` (type FreeMonoid<DeclarationRef>) or `row.label` on `rows` (type FreeMonoid<ApplicationRow>) fails with `no field X on type Empty`. The same usage on a `let` binding from a field access type-checks correctly.",
+    "SPECIMEN 1 (gunbc#10600) — `EmissionOriginsIncomplete { observed, missing } => observed |> map(origin => origin.decl_name)` reports `no field 'decl_name' on type 'Empty'` at `test.manual.emission_provenance_specimen_red` `emission_combined_read_preserves_content_order_and_origin_multiplicity`. The `observed` variable is `FreeMonoid<DeclarationRef>` by the variant declaration. The declaration is an ordinary `fn`, not `test`-marked, so floor_discovery_fold_source does not enroll it or refuse TestMarkedDecl. It is retained as the discriminating measurement for when #10625's compiler repair lands; once it compiles, it can be moved into dag/test/claim as an executing required-floor witness.",
+    "SPECIMEN 2 (gunbc#10625) — `RowsPresent { rows } => rows |> any(row => row.label == \"kept\")` reports `no field 'label' on type 'Empty'` on #10625's algebra-receiver application and forwarding witnesses (the forwarding module carries it twice, including inside a nested `bound => match bound` arm showing the mask survives a whole-value rebind). The `rows` variable is `FreeMonoid<ApplicationRow>` by the variant declaration. #10625's repair preserves nominal generic applications at `v1.compiler.infer_patterns` `pattern_subject_from_node`; as of this writing #10625 is unmerged and its repair is unestablished.",
+    "CLASS BOUNDARIES, traced but not convicted: `match` evaluates the scrutinee (a coproduct), selects the variant arm, and binds field variables (including FreeMonoid<T> containers) into the arm's scope. The element type T survives into the binder's resolved type node, as evidenced by `let` bindings and function parameters resolving correctly. But when a lambda inside a method-call (map, any, all, filter) accesses the element — i.e., when the element passes through the ReceiverElement type variable in an algebra template — the type checker resolves it as the Empty variant of the container rather than the actual element type. This suggests the binder's element type is structurally expanded to Empty during some resolution step that `let` bindings skip. The lambda boundary IS the mask: measured by substituting `declaration_ref_display_key(ref: origin)` for `origin.decl_name` at `test.manual.emission_provenance_specimen_red` `emission_combined_read_preserves_content_order_and_origin_multiplicity` — both produce `no field X on type Empty` with different field names, confirming that any field access or function call on the element type inside the lambda fails identically, and the field name in the error is incidental.",
+    "INSTRUMENT BOUNDARY — three-way closure: (1) expected-red in this repository only ranges over claims that compile and return `false` at runtime; a claim that refuses to compile never reaches evaluation, so expected-red cannot enroll a compile-time failure. (2) A gunbc.rung_drop documents a lowered rung but does not suppress one — the file stays in discovery and the floor still reds. (3) An exclusion row would act as an escape hatch for a refusal the compiler produces, which DESIGN §5 forbids. Therefore: no instrument admits a non-compiling module into witness_discovery_scan_dirs, and the absence of an admitting instrument IS the refusal — the defect must be repaired (making the claim compile green) or the discriminating specimen must live outside the discovery corpus. This boundary is documented because gunbc#10600 first filed a rung_drop for a compile-time refusal (on manager instruction) before review 61678 established that no carrier admits one; the same error will recur for the next lane unless the three-way closure is stated explicitly. The specimen's assertion compares a display key (module_path::decl_name[::field_name]) rather than field-grain equality; a WholeDeclaration ref a::b and a NamedField ref a::b::c cannot collide because the separator is the same twice, but a contrived shape could in principle produce a false pass through key ambiguity. The narrowing is known and accepted — the open hazard is much narrower than the closed one (two lists matching on decl_name only) and chasing it further would be speculative hardening on an unexercised line.",
+    "RUNG FOUND: floor (compile-time refusal). CEILING: compiler-guarantee (a required executing control that rejects this class on any FreeMonoid<T> call site where T is a record type with named fields accessed in the lambda). NEXT-RUNG TRIGGER: an executing control that binds a FreeMonoid<DeclarationRef> by match-arm pattern, calls `map(r => r.decl_name)`, and expects `true` (green compile) followed by runtime identity assertion — the requested control is distinct from both PR workarounds and must establish the element type survives through algebra-template instantiation from a match-bound receiver.",
+  ],
+  evidence: [],
+}