From cd9b6e7b6bbd77543842c82937d9ca13b9f0b22e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Tue, 8 Sep 2026 12:12:58 +0000 Subject: [PATCH 1/4] An empty domain has two origins, and only one of them is a boundary A receipt on `predicate_vacuously_true_on_an_empty_domain`, filed as a follow-up rather than pushed onto an open PR at a decision gate. THE ROW'S TAXONOMY OF WHERE THE VACUOUS CASE COMES FROM -- "the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk" -- is every entry a boundary of a REAL SEQUENCE that ran out. The second origin is not a boundary at all: THE READ FAILED. That is a swallowed error wearing a boundary's shape, and no care about sequence ends anticipates it. SPECIMEN, measured. A verification script required every sentence an authority GAINED between two commits to appear in the regenerated projection -- a sound check, carrying a negative control. It was pointed at a SHA that did not exist, because that SHA had been ASSERTED IN A MESSAGE RATHER THAN READ BACK FROM THE PRODUCER. Re-derived on the same nonexistent SHA: `git show` writes ZERO BYTES and exits 128. The reader ignored the exit code and returned "", the splitter produced the empty set, and "every sentence appears" held vacuously and reported all authored content present. Zero versus zero compares equal. IT IS A CHAIN OF TWO ROSTERED CLASSES, which is why it is one receipt with a cross-link and not two rows. `empty_capture_read_as_clean_result` fired FIRST and says why the set was empty -- a failed read consumed as content, the same shape as its own `gh run view` specimen. This row fired SECOND and says why empty produced PASS. Two guards, each defective in a way the other made invisible. WHERE IT APPEARS is the transferable part: exactly when verifying an artifact identity you were TOLD rather than READ. A fabricated, stale or mistyped identity does not fail at the verifier -- it fails at the read, silently, and reaches the predicate as an empty domain indistinguishable from a real one. The repair is two cheap obligations: assert on the read so a failed fetch refuses instead of returning empty, and carry a positive control so a non-discriminating matcher cannot report a pass. Verified: projection regenerated, and re-running the generator on the committed tree leaves no diff. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MuB8wHjijaFwNoyzm78stF --- .../predicate_vacuously_true_on_an_empty_domain.dag | 8 ++++++++ docs/design-failure-modes.md | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag index 4656221df5b..50eecfb5a53 100644 --- a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag +++ b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag @@ -101,6 +101,14 @@ data predicate_vacuously_true_on_an_empty_domain: RecurringFailureMode = Recurri "**THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. ", "**WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. ", + + "A BOUNDARY SOURCE THIS ROW DOES NOT LIST, AND IT IS NOT A BOUNDARY AT ALL (2026-09-08). The taxonomy above -- `the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk` -- is every entry a boundary of a REAL SEQUENCE that ran out. AN EMPTY DOMAIN HAS A SECOND ORIGIN: THE READ FAILED. That one is not a boundary condition wearing an unusual shape, it is a SWALLOWED ERROR wearing one, and no amount of care about sequence ends will anticipate it. ", + + "THE SPECIMEN, and the two guards each hid the other. A verification script checked that every sentence an authority GAINED between two commits appears in the regenerated projection -- a sound check, with a negative control. It was pointed at a commit SHA that did not exist, because the SHA had been asserted in a message rather than read back from the producer. `git show ` writes ZERO BYTES to stdout and exits 128; the reader ignored the exit code and returned the empty string; the sentence splitter produced the empty set from it; and `every sentence appears` then held VACUOUSLY and reported all authored content present. Measured on the same nonexistent SHA afterwards: zero bytes captured, exit 128. ZERO VERSUS ZERO COMPARES EQUAL, and the script reported a pass about a commit that was never read. ", + + "IT IS A CHAIN OF TWO ROSTERED CLASSES AND NEITHER ALONE EXPLAINS IT, which is why the receipt is filed here with a cross-link rather than twice. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY: a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure -- the same shape as its own `gh run view` specimen, exit code discarded, zero bytes read as a finding of nothing. This row fired SECOND and says WHY EMPTY PRODUCED PASS: the universal is satisfied by the identity element over the domain the first failure manufactured. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. ", + + "WHERE IT APPEARS, which is the transferable part rather than the specimen: this origin shows up exactly when VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale, or mistyped identity does not fail loudly at the verifier -- it fails at the READ, silently, and arrives at the predicate as an empty domain indistinguishable from a real one. THE REPAIR IS TWO OBLIGATIONS AND BOTH ARE CHEAP: assert on the read so a failed fetch REFUSES instead of returning empty, and carry a positive control so an empty or non-discriminating matcher cannot report a pass. The first makes the empty domain unreachable from this origin; the second catches every other origin. ", ], evidence: [], diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 024d251fa7b..c271e41dd40 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -261,7 +261,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an unhandled state falls to the NOT-YET arm, so a settled answer is reported as a pending one** (a fold reduces a producer's conclusion set to a verdict with an arm per state it knows and a default for the rest, and the default it falls to is NOT-YET-TERMINAL. A state the producer really can emit, but the fold has no arm for, is therefore rendered as STILL WAITING -- and waiting is the one disposition that never resolves, because nothing further is coming. THE DISGUISE IS THE WHOLE DEFECT: an unhandled state normally announces itself by producing a wrong answer, and this one produces NO answer, which is indistinguishable from the fold working correctly over a subject that has not finished. SPECIMEN, 2026-09-02, gunbc PR 10086: `dashboard-ops reviews` reported ready:false with requirement `checks` failing and checks_state `pending`, AT THE SAME INSTANT that GitHub reported the head CLEAN and mergeStateStatus admitted a merge -- and the merge was then taken on GitHub's word, with no override, and was correct. Every job in the run had a terminal conclusion: five `pass` and one `skipping`. The skip is the unhandled state -- a GitHub NEUTRAL, which is a THIRD conclusion beside success and failure -- and the readiness fold, carrying arms for the first two, dropped it into not-yet-terminal. THE MECHANISM IS NOT LAG AND THAT IS THE POINT: the two are the same field with the same value, and only one of them is discharged by waiting. RECOGNITION RULE, and it is the load-bearing part because the status field cannot answer it: when a readiness or aggregate verdict says NOT YET, do not wait on the verdict -- NAME THE SPECIFIC ROW THAT IS NON-TERMINAL AND ASK WHETHER IT CAN EVER BECOME TERMINAL. A row already sitting in a terminal state the fold does not recognise never will, so patience is not a remedy for it and no amount of it produces new information. The falsifier is cheap and available at every such moment: read the producer's own per-row conclusions beside the fold's summary. If every row is terminal and the summary is not, the summary has an arm missing. WHY THIS LOCATION IS WORSE THAN A LOG READER, which is the reason it is ranked rather than merely filed: this is the instrument that decides whether WORK IS DONE. A log reader that under-reports costs a diagnosis and the next reader recovers it; a readiness fold that under-reports costs the MERGE, and it fails in the direction that LOOKS LIKE CAUTION, so nobody overrides it and nobody is embarrassed by it. THE COUNTERFACTUAL IS WHAT MAKES THE ROW ACTIONABLE: a reader following the dashboard alone would still be waiting on a pull request that had been mergeable for an hour -- and would read their own patience as diligence, which is the one failure mode that generates no complaint from the person suffering it. WHY THIS IS NOT `empty_capture_read_as_clean_result`, its nearest neighbour and the class the same session had just extended: that class is about a CAPTURE that is empty, where the reader holds no observation and believes they hold one. Here the observation is complete and correct at every input -- five passes and a skip, all present, all read -- and the loss is in the REDUCTION over them. Merging the two would repeat exactly the defect that produced this row's neighbour, a recognition rule too broad to catch a second instance of its own subject: `size the artifact before grepping it` is the surviving rule there and it is silent here, because the artifact is the right size and says the right thing. WHY THIS IS NOT `state_space_conflation`, the honest neighbour on the other side: all three of that class's forms are defects in a domain THIS TREE MODELS -- an `Option` overloaded past two meanings, a prose dichotomy over three states, a real state carried as an ad-hoc spelling -- and each of their recognition rules ends in ADD THE CONSTRUCTOR OR THE ARM. That repair is unavailable here: the conclusion set is GitHub's and the fold is the dashboard's, neither of which this repository owns, so the actionable rule has to be one a READER can execute against an instrument they cannot edit. That is why the rule above is a discriminator rather than a modelling instruction, and it is the whole reason this is its own row. RUNG FOUND AT: silent wrongness for any consumer of the summary field alone, since the fold reports a value that is not merely imprecise but WRONG about whether the subject can still change, and offers no signal that an input was unrecognised. It is mitigatable for a reader who applies the rule above, which is diligence rather than a mechanism. CEILING: outside the modeled guarantee for the dashboard's own fold, which this repository does not own and can only observe; for the equivalent folds gunbc DOES own, structurally impossible, because a reduction over a CLOSED conclusion set is exactly the case DESIGN section 4's exhaustive match makes unwritable -- a state with no arm fails to compile rather than defaulting. NEXT-RUNG TRIGGER for the part we own: every gunbc fold over a third-party status or conclusion set ingesting that set as a closed coproduct in `extdeps/` with a variant per documented state, so an unmodeled state is a typed, located refusal at the boundary rather than a silent fall-through -- and NOT a default arm that maps the unknown to pending, which is this row's defect re-authored one layer down.) - **a salience instrument blind to the record it sizes** (a change's SIZE IN THE DIFF is read to decide how much attention it deserves, and for one class of artifact that number is wrong by orders of magnitude, so a substantive edit is allocated a trivial edit's scrutiny. The instrument is not merely inaccurate, it is a SALIENCE instrument -- read FIRST, to decide where to look -- which is why the error does damage a plainly wrong number would not: nobody checks a figure they have already used to decide the thing is not worth checking. SPECIMEN, 2026-09-02, gunbc#10044: `git diff --stat -- dag/gunbc/rung_drop.dag` reported `1 insertion(+), 1 deletion(-)` for an edit adding 15,286 bytes, because every `RungDrop` in that corpus is ONE VERY LONG LINE. Three consecutive independent reviews described that hunk as a small wording tweak; a fourth, earlier one attributed it to `direct_call_arg_seam_v2_exemption`, A ROW THE DIFF DOES NOT TOUCH, because git's `@@` header names the declaration PRECEDING the hunk and the edited record is a single line. So one representation produced two distinct review failures -- under-sizing and misattribution -- and n=3 on the first within one pull request. THE APPROVALS WERE NOT WRONG ON WHAT THEY READ: each verdict is defensible over the prose rows the same diff carries, which render normally. What the count concealed is that the PR had three approvals and NO review coverage of the half that carried the receipt. A review tally is a claim about attention, and this instrument silently redirects attention before any reviewer forms a judgment. RUNG FOUND AT: silent wrongness, which is not a rung -- the misallocation leaves no trace, produces a green, and is indistinguishable from a reviewer who looked and found nothing. CEILING: mechanically preventable. The size of a record's diff can be made to track the size of its content, which is a representation question and decidable; it does not reach structural impossibility because nothing stops a future record from being authored as one long line again. NEXT-RUNG TRIGGER, AND IT IS DELIBERATELY NOT 'REVIEWERS SHOULD LOOK HARDER': a representation in which a record's diff size tracks its content size -- the long-line record broken across lines so a diff has hunks proportional to the change, or a review surface that reads the generated projection (`docs/design-failure-modes.md` renders the same content as prose and diffs legibly) rather than the `.dag` line. 'Look harder' is advice, and advice is what a class gets when nobody wants to pay for the fix; it also cannot be discharged, since every reviewer meets the same instrument. RECOGNITION RULE: when a review's description of a hunk is smaller than the hunk, check whether the artifact's line structure and the change's content structure agree. Where one record is one line, EVERY size signal derived from lines -- the diffstat, the hunk header, a line-count budget, a review-effort heuristic -- is answering about the file's shape rather than the change's. The tell is a reviewer citing the enclosing declaration rather than the edited one.) - **ambient process state read by a concurrent reader** (a fact that is really a PARAMETER is instead read from a mutable cell the whole process shares -- the working directory, an env var, a global -- while the runtime schedules concurrent readers of it, so the answer a reader gets depends on which writer last ran and the wrong answer is SILENT: the read succeeds, returns a well-formed value, and is simply about a different subject than the reader meant. INVALID STATE: any reader resolving a relative name against ambient state that a concurrent writer may move mid-read. WHY IT SURVIVES REVIEW: each site is locally correct -- it sets the state to the right value before its own work and restores it after -- and the defect exists only in the PRODUCT of sites, which no single diff shows. SPECIMEN (PR #10024, v1_compiler.cli_run): 38 forward set_current_dir sites in one test binary that cargo runs multi-threaded, with the idiom prior = current_dir(); chdir(ws); work; chdir(prior) -- so one test's RESTORE hands the cwd back while a sibling is mid-read. The victim population is not the writers, it is every non-ignored test in the binary that resolves a relative path during the window; the file's own entry_admission_tests note already records the measurement, a DIFFERENT pair of tests failing on each run of identical code (4/1 then 3/2). Seven of the sites were reachable from the required unit lane and in all seven the chdir was DEAD -- every consumer already took an explicit root -- i.e. residue from an unfinished parameterisation, which is the expected shape once the migration is half done. THE CENSUS THAT MATTERS IS REACHABILITY, NOT THE LITERAL AND THE RANGE THAT MATTERS IS THE POPULATION'S, NOT THE FILE'S: the first cut of that gate scanned the one file its author was editing while declaring the whole lane as its subject, which is a selection view read as a population and puts the reported rung above the executed evidence (DESIGN section 4b(1) reads a class's rung as the MINIMUM across in-scope paths). Widening it to every source file of the lane's crate cost a change of input plus a linear-time call extractor -- the per-name matcher is quadratic in lines times declarations and does not survive the wider corpus -- and it surfaced a second trap immediately: resolving cross-file call edges by BARE NAME merges every declaration of a shared spelling, and this crate declares main 18 times, so one production seed bridged into hundreds of unrelated tests. That arm is the absorbing fallback again, in the guard built to catch it. What survives is intra-file edges plus cross-file edges only for names declared exactly once, with the ambiguous remainder pinned by IDENTITY rather than assumed empty. Six forms of the same defect were found in this one guard; they are rostered as their own class at check_subject_narrower_than_its_declared_claim, which this row is a specimen of rather than an authority for: all seven reached the mutation through a helper, so a body-local grep for the call is green over every instance of the class and stays green the moment a writer is moved one call deeper -- the guard must close transitively over call edges. A SECOND, DISTINCT ARM, kept apart because it has a different remedy: memoizing a value DERIVED from the ambient state (workspace_root's OnceLock over a .git-ancestor walk from cwd) freezes whichever writer won the race for the whole process. On this specimen that arm's population is EMPTY -- every forward site targets the checkout root and 37 of 38 force the memo from the pristine cwd one line above their own call -- so it is reported UNSUPPORTED rather than disproven (see a_structural_possibility_is_not_an_occurring_phenomenon); ONE chdir to a non-checkout path arms it, and a fixture that runs git init is such a path. RUNG: found BELOW the ladder, since a redirected read is a silently wrong answer with no typed refusal anywhere. CEILING 4, structurally impossible, and decidable: state passed as a parameter has no shared cell to race on, so the invalid state has no constructor. The intermediate rung is a reachability gate over the guarded population (no_gating_test_reaches_a_process_cwd_mutator), which keeps the state ABSENT but not unwritable; its next-rung trigger is the capability that every reader in the population resolves from an explicitly passed root, after which the ambient write has no consumer and the call can be removed rather than merely counted. REVIEW TELL: a diff that sets shared process state and restores it, in code the runtime may run concurrently -- the restore is the tell, because it is what makes the site look self-contained. -- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. +- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A BOUNDARY SOURCE THIS ROW DOES NOT LIST, AND IT IS NOT A BOUNDARY AT ALL (2026-09-08). The taxonomy above -- `the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk` -- is every entry a boundary of a REAL SEQUENCE that ran out. AN EMPTY DOMAIN HAS A SECOND ORIGIN: THE READ FAILED. That one is not a boundary condition wearing an unusual shape, it is a SWALLOWED ERROR wearing one, and no amount of care about sequence ends will anticipate it. THE SPECIMEN, and the two guards each hid the other. A verification script checked that every sentence an authority GAINED between two commits appears in the regenerated projection -- a sound check, with a negative control. It was pointed at a commit SHA that did not exist, because the SHA had been asserted in a message rather than read back from the producer. `git show ` writes ZERO BYTES to stdout and exits 128; the reader ignored the exit code and returned the empty string; the sentence splitter produced the empty set from it; and `every sentence appears` then held VACUOUSLY and reported all authored content present. Measured on the same nonexistent SHA afterwards: zero bytes captured, exit 128. ZERO VERSUS ZERO COMPARES EQUAL, and the script reported a pass about a commit that was never read. IT IS A CHAIN OF TWO ROSTERED CLASSES AND NEITHER ALONE EXPLAINS IT, which is why the receipt is filed here with a cross-link rather than twice. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY: a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure -- the same shape as its own `gh run view` specimen, exit code discarded, zero bytes read as a finding of nothing. This row fired SECOND and says WHY EMPTY PRODUCED PASS: the universal is satisfied by the identity element over the domain the first failure manufactured. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. WHERE IT APPEARS, which is the transferable part rather than the specimen: this origin shows up exactly when VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale, or mistyped identity does not fail loudly at the verifier -- it fails at the READ, silently, and arrives at the predicate as an empty domain indistinguishable from a real one. THE REPAIR IS TWO OBLIGATIONS AND BOTH ARE CHEAP: assert on the read so a failed fetch REFUSES instead of returning empty, and carry a positive control so an empty or non-discriminating matcher cannot report a pass. The first makes the empty domain unreachable from this origin; the second catches every other origin. - **a check's subject is narrower than the claim it is cited for** (EVERY DEGREE OF FREEDOM IN A CHECK'S SUBJECT -- which call sites, which spellings, which lexical states, which domain, which files -- is a place its coverage can silently be narrower than the population it is read as covering. INVALID STATE: an executing, reached, green check whose declared subject is a strict superset of the population its implementation actually ranges over. RUNG: outside the ladder, because the gap is invisible from the check's own result -- a wall whose range is too narrow is green for the same reason a wall over a clean corpus is green, and DESIGN section 4b(1) reads a class's rung as the MINIMUM across its in-scope paths, so a check like this INFLATES the rung of everything it is cited for. THE ROUTE IS WHAT MAKES IT INVISIBLE: the narrowing is never a decision, it is the shape of the first implementation -- an author edits one file, so the scanner reads one file; the corpus spells the call one way, so the seed matches one spelling; the fixture has no raw strings, so the projection has no raw-string state; the window is never short, so the universal is never vacuous. Each is locally reasonable and none is written down, which is why the gap survives the review that reads the check's LOGIC and never asks what its INPUT was. SPECIMEN, and the reason this is a class rather than a bug: ONE guard in PR #10033 carried SIX instances -- (1) a body-local grep for the mutator, defeated by moving the call one helper deeper; (2) a seed matching only the fully-qualified path, defeated by `use std::env;`; (3) a lexical projection with no raw-string state, so an unbalanced brace in a fixture silently shifted every containment decision after it; (4) `take(n).all(..)`, vacuously true over a short remainder (rostered as predicate_vacuously_true_on_an_empty_domain); (5) a scan ranging over ONE FILE while the scope declaration claimed every test the required lane runs -- found by review, not by the author; and (6) after widening, cross-file call edges resolved by BARE NAME, which merges every declaration of a shared spelling (18 `main`s in that crate) and bridged one production seed into hundreds of unrelated tests. Four were found by the author, one by review, one by the widening itself, and the sixth is the mirror of the fifth: over-broad and under-broad are the same defect measured in opposite directions, and both are reported as coverage. RECOGNITION RULE: name the check's SUBJECT and the check's RANGE as two separate sentences, then ask what is in the first and not the second. If the answer is anything, the claim is the narrower one until the range is widened. The review-side tell is a scope comment that quantifies (`every test`, `all modules`, `any call site`) beside an implementation that names ONE input. BOUNDED AGAINST TWO NEIGHBOURS. selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population, arriving as the fix for a real objection; here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it. incidental_denominator_as_wall is a guard that holds by an upstream coincidence that genuinely holds; here the guard holds over a population it never read. CEILING 3, structurally guaranteed and decidable, BUT SCOPED TO THIS CLASS'S EXECUTING FORMS AND NOT TO THE CLASS (scope amended when the ninth form landed): a check whose subject is a VALUE it receives rather than a scope its implementation re-derives cannot range over less than it claims, because the claim and the range are then one object. That derivation needs an executing check with an input. Every form above it is one, so the limit was never visible and the ceiling read as belonging to the class when it belongs to a sub-case: where the subject is a WRITTEN SURFACE a human is supposed to read completely, the claim and the range stay TWO objects and cannot inherit this ceiling. The ninth form below is that sub-case and carries no rung of its own. NEXT-RUNG TRIGGER, named as a capability: the guarded population is passed to the check as a constructed value carrying its own extent, sufficient that no check can name a subject its input does not contain. WHAT IS NOT CLAIMED: that widening always wins. Narrowing the DECLARATION to match the range is equally honest and is sometimes correct -- what is forbidden is leaving the two different, and the choice between them is a cost measurement, not a preference. On this specimen widening cost one change of input plus one linear-time rewrite of a quadratic edge builder, and the wider check ran FASTER than the narrow one, which is what settled it.) A SEVENTH FORM, AND THE FIRST WHERE THE NARROWING IS AN AXIS OF THE COMPARISON RATHER THAN A RANGE OF INPUTS (2026-09-03). The six above narrow WHICH INPUTS a check sees; this one narrows WHAT IT COMPARES, so it is invisible even over a complete corpus. `v1_compiler.behavioral_receipt_host` `behavioral_differential` is cited as the executing evidence for DESIGN section 7 behavioural equivalence, and its own doc comment cites section 7 by name. What it RANGES OVER is the seed-Rust versus emitted-Rust axis: `generate_receipt_driver` emits a Rust main that prints each planned call, and the differential runs that ONE driver twice -- against the tree as committed, then after the candidate overwrites its mirror and the crate is rebuilt. Both transcripts come from COMPILED RUST BINARIES, so any property the two realizations SHARE is unobservable to it by construction, however clean the corpus. THE DISCRIMINATING INSTANCE IS NOT THIS ROW'S TO STATE, AND CITING IT RATHER THAN RESTATING IT IS THE POINT (amended 2026-09-03). The interpreter-versus-emitted evaluation divergence has an owner with better evidence than prose: `realization_arms_diverge_on_whether_the_program_refuses`, filed by gunbc#10139, which carries the source reading in both directions AND an EXECUTED red -- `fn guarded_division(n: Int) -> Bool { n != 0 && (100 / n) > 1 }`, run and dated, explicitly not asserted. An earlier draft of this receipt described that divergence in its own words. That would have been a second authority for a fact this ledger already owns, committed inside the row about subjects narrower than their claims, which is the specimen writing itself. WHAT IS THIS ROW'S OWN SUBJECT is the other half and a different fact: THE INSTRUMENT CANNOT SEE IT. Both of `behavioral_differential`'s arms are compiled Rust, so they share the target's evaluation semantics and agree with each other -- wrongly, together -- on exactly the inputs where that cited class occurs. The divergence is #10139's; the blindness of the equivalence instrument to it is this row's. THE REVIEW TELL FOR THIS FORM: ask what the two sides of a comparison SHARE, not what the check ranges over -- a differential between two realizations of one target cannot see a property of that target. The ordinary tell, a green over a population nobody checked, is unavailable here: this instrument is green for a reason no input can change. ONE NEIGHBOUR CHECKED AND EXCLUDED, so the next reader does not re-derive it: `v2.compiler.emit_host` `run_test_claim_emit_vs_eval` IS enrolled on the required floor and DOES pair an executed emitted answer with an interpreted one, with a positive control and a discriminating negative. But it evaluates `expected_eval_root` while host-running the emitted `claim_input_root` -- two different roots -- so it is an ORACLE comparison and the interpreter never evaluates the expression the target runs. Its subject excludes same-expression evaluation divergence structurally, not by coverage. THE AUTHOR'S OWN INSTANCE, recorded because it happened while filing this: the first draft claimed NO required phase pairs an interpreted answer with an emitted-and-executed one, derived by enumerating the closed five-variant `RequiredCiPhase` and then asserting what its members execute without reading them. The population was closed; the claim about its members was never checked -- a real enumeration, divided by nothing. It was refuted by the very rows that refused the pull request being worked on.AN EIGHTH FORM, AND THE FIRST WHERE THE BLIND SPOT IS NOT ARBITRARY BUT CORRELATED WITH RECENCY (2026-09-03, tidy-koi-619 on gunbc#10106, with warm-seal-35 as the finder). Every form above treats the narrowing as ARBITRARY -- 'never a decision, the shape of the first implementation'. When the narrowed axis is a DIRECTION over a time-ordered subject, the narrowing stops being arbitrary and starts tracking recency, which makes it strictly worse than a random miss. THE INSTANCE: a squash-merged branch survives as a divergent-looking branch and auto-opens a pull request that would REVERT main. Diagnosing gunbc#10242 I enumerated what a merge would wrongly RE-ADD -- 47 namespace admissions consumed by their own merge, plus three files deleted on main -- and concluded, in the comment closing it, 'there is no file where this branch carries content main wants'. THAT SENTENCE IS TRUE. Its subject is one direction; its reading is completeness. The 54 differing paths were 43 common-but-differing, 3 branch-only which a merge RE-ADDS, and 8 main-only which a merge DELETES -- and the deletion category, which the sweep never ranged over, contained a witness test that had landed twenty minutes earlier. WHY RECENCY MAKES IT WORSE: the newest work on main is NECESSARILY in the merge-would-delete category, because the more recently something landed the more certain it is to be absent from a superseded branch. So this sweep's blind spot is not spread evenly over the population -- it concentrates on exactly the rows that are newest, least recoverable, and least likely to be noticed missing, since nobody is yet watching for the absence of a thing that landed twenty minutes ago. A check whose miss probability rises with the value of what is missed is a different economic object from one that misses uniformly, and the review tell is different too: it is not 'what population did this range over' but 'is the missed set correlated with anything, and with what'. RECOGNITION RULE FOR THIS FORM: when a check's subject is a COMPARISON between two states, name both directions as separate sentences and range over both -- present-on-A-absent-on-B and present-on-B-absent-on-A are two populations, and a size or presence heuristic run one way answers only one of them. WHY IT IS FILED HERE AND NOT AS ITS OWN CLASS: three instances arrived within one day from three unrelated angles -- a record comparator that could not parse a parameterized constructor and so reported None == None as agreement on the `standing` field; an assert-count-is-1 guard over a citation sweep that held because the PATTERN was narrow rather than because the file was clean; and this one-directional diff sweep. The author's first instinct was to mint a new class around the sentence 'a check that does not state its own denominator cannot be distinguished from a complete one'. That sentence is this row's INVALID STATE restated, so a new row would have been a second authority for a rostered fact -- the DESIGN section 2 failed decomposition, committed inside the ledger that exists to prevent it, which is the same self-demonstration the seventh form records. The class was already here; only the recency observation was new. A NINTH FORM, WHERE THE SUBJECT ITSELF MOVED UNDER THE CHECK (2026-09-05, adjudicated in jolly-dove-86, measured on gunbc#10552). It is numbered ninth because this row already carried an eighth; the brief that commissioned it said eighth, and the row is the authority on its own count. STATEMENT: a repair changes the SUBJECT that the earlier observation described. Completeness and correctness must be established against the FINAL SUBJECT, with the selection boundary explicit; finding the newly inserted wording is not that establishment. THE REASONING UNDER IT: checked revision A, plus edit A to B, does not equal checked revision B, without a preservation argument or a renewed inspection. The escape clause is not decoration -- RENEWED INSPECTION DISCHARGES IT, and reading the final text once IS an adjudication. No impossibility is claimed here: an earlier draft said such a sweep can never close, and that was refuted, because renewed reading is the only mechanism that actually works. RUNG: this form carries NONE. It is the sub-case the amended ceiling above excludes -- the subject is a written surface, so no input can be constructed to carry its extent, and the claim and the range remain two objects. SPECIMEN ONE, three reviews that ranged over less than the row they reviewed: 5120939460, 5121228544 and 5121282475, none of which reached `test.claim.phantom_marker_type_argument_identity_witness` -- the file the row under repair CITES -- where two corrected-away formulations stood verbatim. The enumeration found them; no reviewer did. SPECIMEN TWO, and it is what fixes the UNIT of repair: a repair landed at the QUOTED text, left the FRAMING sentence directly above it standing, and left a dependent two paragraphs BELOW it standing too -- one that never quoted the premise it rested on (`a trigger whose owner has ceased to exist is retired by nothing at all`). That dependent contained none of the repair's search terms precisely because it RESTED on the premise rather than quoting it. So the unit of repair is the ENTAILMENT NEIGHBOURHOOD of the premise -- framing above, dependents below, sibling surfaces -- and it is BIDIRECTIONAL. A phrase-keyed sweep is keyed on quotation, and entailment does not quote. REFUSED TRIGGER, recorded WITH its reason so it is not re-proposed: `enroll the sweep in CI`. Mechanisation moves the INVOCATION, not the SUBJECT -- the same incomplete phrase search would execute reliably over the same incomplete subject, so the trigger would fire while the capability stayed dead, which is exactly the DESIGN section 4b(3) grain mismatch between a loss sentence and its trigger. Rung 2 needs an adequate subject definition, a valid checking relation AND a consumer; automation supplies only the third. THE NEIGHBOUR CHECKED AND EXCLUDED, using that row's own bounding text: selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population. Here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it, which is this row's invariant, so the form is filed here and not minted. The corroborating receipt from the row's own repair day: a phrase-keyed sweep certified that repair clean and missed four survivors, because the live one read `WHAT ACTUALLY HOLDS THIS CLASS AT 2` and matched none of the guessed patterns. The form applies to writing the form. **THE SAME INVARIANT AT WITNESS GRAIN, WHERE THE DECLARED CLAIM IS AN ANNOTATION AND THE RANGE IS THE EXECUTED SPECIMEN (deep-carp-676, gunbc#10602, 2026-09-05).** A claim's note names the mutation it is aimed at, and that sentence is read by every later author as the class's coverage -- but nothing checks that the specimen REACHES the mutated code. Four instances in one lane, each measured rather than reasoned about: two SCM staging claims named `candidate_inherited_from_base` answering the empty corpus while their specimens left the stage POINTER PRESENT, so they never entered the inheritance path at all and stayed GREEN under exactly that mutation; two others were annotated as covering the v4-predecessor-document and post-checkout routes while constructing the post-normalization envelope by hand, bypassing the decoder and the checkout that define those routes. AND THE SAME SHAPE ONE LEVEL UP, IN THE INSTRUMENT: a sweep certifying seven modules clean had passed `--functions __probe__`, and the tool exits 2 on an unresolvable function name BEFORE resolving anything -- so `no diagnostics reported` was `no resolution was attempted`. The wrapper was repaired to assert three facts separately (exit 0, the resolve phase REACHED, no diagnostics) and was then checked with a must-fail control, because an instrument that cannot go red is not evidence about the subject it is pointed at. THE RECOGNITION RULE TRANSFERS WITHOUT CHANGE and gains one imperative: name the claim's DECLARED subject and its EXECUTED subject as two sentences -- and where the declared subject is a mutation, RUN THE MUTATION. A named mutation that leaves the claim green is not a weak control, it is a false coverage statement, and it is worse than no annotation because the next author reads it as a wall. - **a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.) - **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation. From 833d9f5c76edaf30ae6423e0828a92965cae56b2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Tue, 8 Sep 2026 12:25:56 +0000 Subject: [PATCH 2/4] Withdraw the false premise; keep only the locus and the chain, both verified The reviewer found that this receipt's PREMISE was historically false, and it was: the row already owns the upstream-failure generator, at sentence 166 on origin/main, in stronger words than the receipt proposed -- "A SECOND AND WORSE GENERATOR ... THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA" and it already carries a failed-read instance. So "a boundary source this row does not list" and "an empty domain has a second origin" are false and are removed, along with every sentence resting on them. HOW THE FALSE PREMISE GOT IN, recorded in the receipt rather than fixed silently: its author grepped this row for ONE SENTENCE -- the taxonomy line -- and reasoned about the row from it, having never read the row. That is the artifact-verification defect rostered at `green_reported_over_a_population_the_instrument_does_not_own`, committed while filing a receipt about verification. WHAT SURVIVES, each checked against origin/main before being re-asserted rather than taken on report: THE LOCUS is new. The generator paragraph describes a pipeline STAGE failing open. Here nothing failed -- the pipeline was pointed at a subject that did not exist, a SHA asserted in a message rather than read back from the producer. `git show` on it writes zero bytes and exits 128. The locus is: verifying an artifact identity you were TOLD rather than READ. THE CHAIN is new. `empty_capture_read_as_clean_result` is named nowhere in this row (checked), and the generator paragraph describes emptiness arising WITHIN one procedure rather than handed across a class boundary. AND THE REPAIR IS CORRECTED TO THIS ROW'S OWN DOCTRINE, which the first draft contradicted. "Assert the read succeeded" is the artifact-grained guard this row has refused twice already -- one more guarded site, validation, the empty state still in the procedure. The construction- grained repair at this locus is to stop accepting a TOLD identity: resolve the subject from its producer, so a name denoting nothing cannot enter and the empty domain has no constructor from this origin. The positive control stays, orthogonal, because it covers every other origin. Verified: regen clean, and re-running the generator on the committed tree leaves no diff. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MuB8wHjijaFwNoyzm78stF --- .../predicate_vacuously_true_on_an_empty_domain.dag | 8 ++++---- docs/design-failure-modes.md | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag index 50eecfb5a53..dab6d70b4d8 100644 --- a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag +++ b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag @@ -102,13 +102,13 @@ data predicate_vacuously_true_on_an_empty_domain: RecurringFailureMode = Recurri "**WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. ", - "A BOUNDARY SOURCE THIS ROW DOES NOT LIST, AND IT IS NOT A BOUNDARY AT ALL (2026-09-08). The taxonomy above -- `the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk` -- is every entry a boundary of a REAL SEQUENCE that ran out. AN EMPTY DOMAIN HAS A SECOND ORIGIN: THE READ FAILED. That one is not a boundary condition wearing an unusual shape, it is a SWALLOWED ERROR wearing one, and no amount of care about sequence ends will anticipate it. ", + "A LOCUS FOR THE UPSTREAM-FAILURE GENERATOR ABOVE, AND A CHAIN ACROSS TWO ROWS (2026-09-08). This receipt claims NOTHING about a new generator: the paragraph above already owns the empty domain produced by an upstream failure rather than by a boundary in the data, in stronger words than this one, and an earlier draft of THIS receipt asserted it as a gap that row did not list. THAT WAS FALSE AND IS RECORDED AS FALSE, because its author read one grepped sentence of this row rather than the row -- which is the artifact-verification defect rostered at [[green_reported_over_a_population_the_instrument_does_not_own]], committed while filing here. What survives is narrower and was checked against this row at origin/main before being written: a LOCUS the generator paragraph does not name, and a CHAIN this roster does not draw. ", - "THE SPECIMEN, and the two guards each hid the other. A verification script checked that every sentence an authority GAINED between two commits appears in the regenerated projection -- a sound check, with a negative control. It was pointed at a commit SHA that did not exist, because the SHA had been asserted in a message rather than read back from the producer. `git show ` writes ZERO BYTES to stdout and exits 128; the reader ignored the exit code and returned the empty string; the sentence splitter produced the empty set from it; and `every sentence appears` then held VACUOUSLY and reported all authored content present. Measured on the same nonexistent SHA afterwards: zero bytes captured, exit 128. ZERO VERSUS ZERO COMPARES EQUAL, and the script reported a pass about a commit that was never read. ", + "THE LOCUS: THE EMPTINESS CAME FROM A NAME THAT RESOLVED TO NOTHING, not from a stage that failed. The generator paragraph describes a pipeline stage failing open into an empty result. Here nothing in the pipeline failed -- the pipeline was pointed at a subject that did not exist. A verification script required every sentence an authority GAINED between two commits to appear in the regenerated projection, a sound check carrying a negative control, and was handed a commit SHA that had been ASSERTED IN A MESSAGE RATHER THAN READ BACK FROM THE PRODUCER. Measured on that same nonexistent SHA: `git show` writes ZERO BYTES to stdout and exits 128. The reader discarded the exit code, the splitter produced the empty set, and the universal held vacuously over a commit that was never read. SO THE LOCUS IS: VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale or mistyped identity never fails at the verifier; it fails at the resolution, silently, and arrives as an empty domain indistinguishable from a real one. ", - "IT IS A CHAIN OF TWO ROSTERED CLASSES AND NEITHER ALONE EXPLAINS IT, which is why the receipt is filed here with a cross-link rather than twice. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY: a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure -- the same shape as its own `gh run view` specimen, exit code discarded, zero bytes read as a finding of nothing. This row fired SECOND and says WHY EMPTY PRODUCED PASS: the universal is satisfied by the identity element over the domain the first failure manufactured. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. ", + "THE CHAIN, AND IT IS THE PART NO SINGLE ROW CARRIES: two rostered classes fired in sequence and neither alone explains the pass. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY -- a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure, which is that row's own `gh run view` specimen with a different syscall. This row fired SECOND and says WHY EMPTY PRODUCED PASS. Checked before claiming it: this row does not name that one anywhere, and the generator paragraph describes emptiness arising WITHIN one procedure rather than being handed across a class boundary. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. ", - "WHERE IT APPEARS, which is the transferable part rather than the specimen: this origin shows up exactly when VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale, or mistyped identity does not fail loudly at the verifier -- it fails at the READ, silently, and arrives at the predicate as an empty domain indistinguishable from a real one. THE REPAIR IS TWO OBLIGATIONS AND BOTH ARE CHEAP: assert on the read so a failed fetch REFUSES instead of returning empty, and carry a positive control so an empty or non-discriminating matcher cannot report a pass. The first makes the empty domain unreachable from this origin; the second catches every other origin. ", + "AND THE REPAIR IS THE ONE THIS ROW ALREADY PRESCRIBES, NOT THE ONE THAT FIRST SUGGESTED ITSELF -- stated because the tempting fix here is precisely what this row has now refused three times. `Assert that the read succeeded before splitting` is the artifact-grained guard: one more guarded site, validation, leaving the empty state in the procedure. THE CONSTRUCTION-GRAINED REPAIR AT THIS LOCUS IS TO STOP ACCEPTING AN IDENTITY THAT WAS TOLD: resolve the subject from the producer -- read the head back -- so a name that denotes nothing cannot enter the procedure at all, and the empty domain has no constructor from this origin. The positive control remains necessary and orthogonal, since it is what catches every other origin, and this row's standing reasoning about why a per-site guard is not the fix applies here unchanged. ", ], evidence: [], diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index c271e41dd40..70bf1e4dcac 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -261,7 +261,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an unhandled state falls to the NOT-YET arm, so a settled answer is reported as a pending one** (a fold reduces a producer's conclusion set to a verdict with an arm per state it knows and a default for the rest, and the default it falls to is NOT-YET-TERMINAL. A state the producer really can emit, but the fold has no arm for, is therefore rendered as STILL WAITING -- and waiting is the one disposition that never resolves, because nothing further is coming. THE DISGUISE IS THE WHOLE DEFECT: an unhandled state normally announces itself by producing a wrong answer, and this one produces NO answer, which is indistinguishable from the fold working correctly over a subject that has not finished. SPECIMEN, 2026-09-02, gunbc PR 10086: `dashboard-ops reviews` reported ready:false with requirement `checks` failing and checks_state `pending`, AT THE SAME INSTANT that GitHub reported the head CLEAN and mergeStateStatus admitted a merge -- and the merge was then taken on GitHub's word, with no override, and was correct. Every job in the run had a terminal conclusion: five `pass` and one `skipping`. The skip is the unhandled state -- a GitHub NEUTRAL, which is a THIRD conclusion beside success and failure -- and the readiness fold, carrying arms for the first two, dropped it into not-yet-terminal. THE MECHANISM IS NOT LAG AND THAT IS THE POINT: the two are the same field with the same value, and only one of them is discharged by waiting. RECOGNITION RULE, and it is the load-bearing part because the status field cannot answer it: when a readiness or aggregate verdict says NOT YET, do not wait on the verdict -- NAME THE SPECIFIC ROW THAT IS NON-TERMINAL AND ASK WHETHER IT CAN EVER BECOME TERMINAL. A row already sitting in a terminal state the fold does not recognise never will, so patience is not a remedy for it and no amount of it produces new information. The falsifier is cheap and available at every such moment: read the producer's own per-row conclusions beside the fold's summary. If every row is terminal and the summary is not, the summary has an arm missing. WHY THIS LOCATION IS WORSE THAN A LOG READER, which is the reason it is ranked rather than merely filed: this is the instrument that decides whether WORK IS DONE. A log reader that under-reports costs a diagnosis and the next reader recovers it; a readiness fold that under-reports costs the MERGE, and it fails in the direction that LOOKS LIKE CAUTION, so nobody overrides it and nobody is embarrassed by it. THE COUNTERFACTUAL IS WHAT MAKES THE ROW ACTIONABLE: a reader following the dashboard alone would still be waiting on a pull request that had been mergeable for an hour -- and would read their own patience as diligence, which is the one failure mode that generates no complaint from the person suffering it. WHY THIS IS NOT `empty_capture_read_as_clean_result`, its nearest neighbour and the class the same session had just extended: that class is about a CAPTURE that is empty, where the reader holds no observation and believes they hold one. Here the observation is complete and correct at every input -- five passes and a skip, all present, all read -- and the loss is in the REDUCTION over them. Merging the two would repeat exactly the defect that produced this row's neighbour, a recognition rule too broad to catch a second instance of its own subject: `size the artifact before grepping it` is the surviving rule there and it is silent here, because the artifact is the right size and says the right thing. WHY THIS IS NOT `state_space_conflation`, the honest neighbour on the other side: all three of that class's forms are defects in a domain THIS TREE MODELS -- an `Option` overloaded past two meanings, a prose dichotomy over three states, a real state carried as an ad-hoc spelling -- and each of their recognition rules ends in ADD THE CONSTRUCTOR OR THE ARM. That repair is unavailable here: the conclusion set is GitHub's and the fold is the dashboard's, neither of which this repository owns, so the actionable rule has to be one a READER can execute against an instrument they cannot edit. That is why the rule above is a discriminator rather than a modelling instruction, and it is the whole reason this is its own row. RUNG FOUND AT: silent wrongness for any consumer of the summary field alone, since the fold reports a value that is not merely imprecise but WRONG about whether the subject can still change, and offers no signal that an input was unrecognised. It is mitigatable for a reader who applies the rule above, which is diligence rather than a mechanism. CEILING: outside the modeled guarantee for the dashboard's own fold, which this repository does not own and can only observe; for the equivalent folds gunbc DOES own, structurally impossible, because a reduction over a CLOSED conclusion set is exactly the case DESIGN section 4's exhaustive match makes unwritable -- a state with no arm fails to compile rather than defaulting. NEXT-RUNG TRIGGER for the part we own: every gunbc fold over a third-party status or conclusion set ingesting that set as a closed coproduct in `extdeps/` with a variant per documented state, so an unmodeled state is a typed, located refusal at the boundary rather than a silent fall-through -- and NOT a default arm that maps the unknown to pending, which is this row's defect re-authored one layer down.) - **a salience instrument blind to the record it sizes** (a change's SIZE IN THE DIFF is read to decide how much attention it deserves, and for one class of artifact that number is wrong by orders of magnitude, so a substantive edit is allocated a trivial edit's scrutiny. The instrument is not merely inaccurate, it is a SALIENCE instrument -- read FIRST, to decide where to look -- which is why the error does damage a plainly wrong number would not: nobody checks a figure they have already used to decide the thing is not worth checking. SPECIMEN, 2026-09-02, gunbc#10044: `git diff --stat -- dag/gunbc/rung_drop.dag` reported `1 insertion(+), 1 deletion(-)` for an edit adding 15,286 bytes, because every `RungDrop` in that corpus is ONE VERY LONG LINE. Three consecutive independent reviews described that hunk as a small wording tweak; a fourth, earlier one attributed it to `direct_call_arg_seam_v2_exemption`, A ROW THE DIFF DOES NOT TOUCH, because git's `@@` header names the declaration PRECEDING the hunk and the edited record is a single line. So one representation produced two distinct review failures -- under-sizing and misattribution -- and n=3 on the first within one pull request. THE APPROVALS WERE NOT WRONG ON WHAT THEY READ: each verdict is defensible over the prose rows the same diff carries, which render normally. What the count concealed is that the PR had three approvals and NO review coverage of the half that carried the receipt. A review tally is a claim about attention, and this instrument silently redirects attention before any reviewer forms a judgment. RUNG FOUND AT: silent wrongness, which is not a rung -- the misallocation leaves no trace, produces a green, and is indistinguishable from a reviewer who looked and found nothing. CEILING: mechanically preventable. The size of a record's diff can be made to track the size of its content, which is a representation question and decidable; it does not reach structural impossibility because nothing stops a future record from being authored as one long line again. NEXT-RUNG TRIGGER, AND IT IS DELIBERATELY NOT 'REVIEWERS SHOULD LOOK HARDER': a representation in which a record's diff size tracks its content size -- the long-line record broken across lines so a diff has hunks proportional to the change, or a review surface that reads the generated projection (`docs/design-failure-modes.md` renders the same content as prose and diffs legibly) rather than the `.dag` line. 'Look harder' is advice, and advice is what a class gets when nobody wants to pay for the fix; it also cannot be discharged, since every reviewer meets the same instrument. RECOGNITION RULE: when a review's description of a hunk is smaller than the hunk, check whether the artifact's line structure and the change's content structure agree. Where one record is one line, EVERY size signal derived from lines -- the diffstat, the hunk header, a line-count budget, a review-effort heuristic -- is answering about the file's shape rather than the change's. The tell is a reviewer citing the enclosing declaration rather than the edited one.) - **ambient process state read by a concurrent reader** (a fact that is really a PARAMETER is instead read from a mutable cell the whole process shares -- the working directory, an env var, a global -- while the runtime schedules concurrent readers of it, so the answer a reader gets depends on which writer last ran and the wrong answer is SILENT: the read succeeds, returns a well-formed value, and is simply about a different subject than the reader meant. INVALID STATE: any reader resolving a relative name against ambient state that a concurrent writer may move mid-read. WHY IT SURVIVES REVIEW: each site is locally correct -- it sets the state to the right value before its own work and restores it after -- and the defect exists only in the PRODUCT of sites, which no single diff shows. SPECIMEN (PR #10024, v1_compiler.cli_run): 38 forward set_current_dir sites in one test binary that cargo runs multi-threaded, with the idiom prior = current_dir(); chdir(ws); work; chdir(prior) -- so one test's RESTORE hands the cwd back while a sibling is mid-read. The victim population is not the writers, it is every non-ignored test in the binary that resolves a relative path during the window; the file's own entry_admission_tests note already records the measurement, a DIFFERENT pair of tests failing on each run of identical code (4/1 then 3/2). Seven of the sites were reachable from the required unit lane and in all seven the chdir was DEAD -- every consumer already took an explicit root -- i.e. residue from an unfinished parameterisation, which is the expected shape once the migration is half done. THE CENSUS THAT MATTERS IS REACHABILITY, NOT THE LITERAL AND THE RANGE THAT MATTERS IS THE POPULATION'S, NOT THE FILE'S: the first cut of that gate scanned the one file its author was editing while declaring the whole lane as its subject, which is a selection view read as a population and puts the reported rung above the executed evidence (DESIGN section 4b(1) reads a class's rung as the MINIMUM across in-scope paths). Widening it to every source file of the lane's crate cost a change of input plus a linear-time call extractor -- the per-name matcher is quadratic in lines times declarations and does not survive the wider corpus -- and it surfaced a second trap immediately: resolving cross-file call edges by BARE NAME merges every declaration of a shared spelling, and this crate declares main 18 times, so one production seed bridged into hundreds of unrelated tests. That arm is the absorbing fallback again, in the guard built to catch it. What survives is intra-file edges plus cross-file edges only for names declared exactly once, with the ambiguous remainder pinned by IDENTITY rather than assumed empty. Six forms of the same defect were found in this one guard; they are rostered as their own class at check_subject_narrower_than_its_declared_claim, which this row is a specimen of rather than an authority for: all seven reached the mutation through a helper, so a body-local grep for the call is green over every instance of the class and stays green the moment a writer is moved one call deeper -- the guard must close transitively over call edges. A SECOND, DISTINCT ARM, kept apart because it has a different remedy: memoizing a value DERIVED from the ambient state (workspace_root's OnceLock over a .git-ancestor walk from cwd) freezes whichever writer won the race for the whole process. On this specimen that arm's population is EMPTY -- every forward site targets the checkout root and 37 of 38 force the memo from the pristine cwd one line above their own call -- so it is reported UNSUPPORTED rather than disproven (see a_structural_possibility_is_not_an_occurring_phenomenon); ONE chdir to a non-checkout path arms it, and a fixture that runs git init is such a path. RUNG: found BELOW the ladder, since a redirected read is a silently wrong answer with no typed refusal anywhere. CEILING 4, structurally impossible, and decidable: state passed as a parameter has no shared cell to race on, so the invalid state has no constructor. The intermediate rung is a reachability gate over the guarded population (no_gating_test_reaches_a_process_cwd_mutator), which keeps the state ABSENT but not unwritable; its next-rung trigger is the capability that every reader in the population resolves from an explicitly passed root, after which the ambient write has no consumer and the call can be removed rather than merely counted. REVIEW TELL: a diff that sets shared process state and restores it, in code the runtime may run concurrently -- the restore is the tell, because it is what makes the site look self-contained. -- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A BOUNDARY SOURCE THIS ROW DOES NOT LIST, AND IT IS NOT A BOUNDARY AT ALL (2026-09-08). The taxonomy above -- `the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk` -- is every entry a boundary of a REAL SEQUENCE that ran out. AN EMPTY DOMAIN HAS A SECOND ORIGIN: THE READ FAILED. That one is not a boundary condition wearing an unusual shape, it is a SWALLOWED ERROR wearing one, and no amount of care about sequence ends will anticipate it. THE SPECIMEN, and the two guards each hid the other. A verification script checked that every sentence an authority GAINED between two commits appears in the regenerated projection -- a sound check, with a negative control. It was pointed at a commit SHA that did not exist, because the SHA had been asserted in a message rather than read back from the producer. `git show ` writes ZERO BYTES to stdout and exits 128; the reader ignored the exit code and returned the empty string; the sentence splitter produced the empty set from it; and `every sentence appears` then held VACUOUSLY and reported all authored content present. Measured on the same nonexistent SHA afterwards: zero bytes captured, exit 128. ZERO VERSUS ZERO COMPARES EQUAL, and the script reported a pass about a commit that was never read. IT IS A CHAIN OF TWO ROSTERED CLASSES AND NEITHER ALONE EXPLAINS IT, which is why the receipt is filed here with a cross-link rather than twice. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY: a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure -- the same shape as its own `gh run view` specimen, exit code discarded, zero bytes read as a finding of nothing. This row fired SECOND and says WHY EMPTY PRODUCED PASS: the universal is satisfied by the identity element over the domain the first failure manufactured. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. WHERE IT APPEARS, which is the transferable part rather than the specimen: this origin shows up exactly when VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale, or mistyped identity does not fail loudly at the verifier -- it fails at the READ, silently, and arrives at the predicate as an empty domain indistinguishable from a real one. THE REPAIR IS TWO OBLIGATIONS AND BOTH ARE CHEAP: assert on the read so a failed fetch REFUSES instead of returning empty, and carry a positive control so an empty or non-discriminating matcher cannot report a pass. The first makes the empty domain unreachable from this origin; the second catches every other origin. +- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A LOCUS FOR THE UPSTREAM-FAILURE GENERATOR ABOVE, AND A CHAIN ACROSS TWO ROWS (2026-09-08). This receipt claims NOTHING about a new generator: the paragraph above already owns the empty domain produced by an upstream failure rather than by a boundary in the data, in stronger words than this one, and an earlier draft of THIS receipt asserted it as a gap that row did not list. THAT WAS FALSE AND IS RECORDED AS FALSE, because its author read one grepped sentence of this row rather than the row -- which is the artifact-verification defect rostered at [[green_reported_over_a_population_the_instrument_does_not_own]], committed while filing here. What survives is narrower and was checked against this row at origin/main before being written: a LOCUS the generator paragraph does not name, and a CHAIN this roster does not draw. THE LOCUS: THE EMPTINESS CAME FROM A NAME THAT RESOLVED TO NOTHING, not from a stage that failed. The generator paragraph describes a pipeline stage failing open into an empty result. Here nothing in the pipeline failed -- the pipeline was pointed at a subject that did not exist. A verification script required every sentence an authority GAINED between two commits to appear in the regenerated projection, a sound check carrying a negative control, and was handed a commit SHA that had been ASSERTED IN A MESSAGE RATHER THAN READ BACK FROM THE PRODUCER. Measured on that same nonexistent SHA: `git show` writes ZERO BYTES to stdout and exits 128. The reader discarded the exit code, the splitter produced the empty set, and the universal held vacuously over a commit that was never read. SO THE LOCUS IS: VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale or mistyped identity never fails at the verifier; it fails at the resolution, silently, and arrives as an empty domain indistinguishable from a real one. THE CHAIN, AND IT IS THE PART NO SINGLE ROW CARRIES: two rostered classes fired in sequence and neither alone explains the pass. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY -- a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure, which is that row's own `gh run view` specimen with a different syscall. This row fired SECOND and says WHY EMPTY PRODUCED PASS. Checked before claiming it: this row does not name that one anywhere, and the generator paragraph describes emptiness arising WITHIN one procedure rather than being handed across a class boundary. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. AND THE REPAIR IS THE ONE THIS ROW ALREADY PRESCRIBES, NOT THE ONE THAT FIRST SUGGESTED ITSELF -- stated because the tempting fix here is precisely what this row has now refused three times. `Assert that the read succeeded before splitting` is the artifact-grained guard: one more guarded site, validation, leaving the empty state in the procedure. THE CONSTRUCTION-GRAINED REPAIR AT THIS LOCUS IS TO STOP ACCEPTING AN IDENTITY THAT WAS TOLD: resolve the subject from the producer -- read the head back -- so a name that denotes nothing cannot enter the procedure at all, and the empty domain has no constructor from this origin. The positive control remains necessary and orthogonal, since it is what catches every other origin, and this row's standing reasoning about why a per-site guard is not the fix applies here unchanged. - **a check's subject is narrower than the claim it is cited for** (EVERY DEGREE OF FREEDOM IN A CHECK'S SUBJECT -- which call sites, which spellings, which lexical states, which domain, which files -- is a place its coverage can silently be narrower than the population it is read as covering. INVALID STATE: an executing, reached, green check whose declared subject is a strict superset of the population its implementation actually ranges over. RUNG: outside the ladder, because the gap is invisible from the check's own result -- a wall whose range is too narrow is green for the same reason a wall over a clean corpus is green, and DESIGN section 4b(1) reads a class's rung as the MINIMUM across its in-scope paths, so a check like this INFLATES the rung of everything it is cited for. THE ROUTE IS WHAT MAKES IT INVISIBLE: the narrowing is never a decision, it is the shape of the first implementation -- an author edits one file, so the scanner reads one file; the corpus spells the call one way, so the seed matches one spelling; the fixture has no raw strings, so the projection has no raw-string state; the window is never short, so the universal is never vacuous. Each is locally reasonable and none is written down, which is why the gap survives the review that reads the check's LOGIC and never asks what its INPUT was. SPECIMEN, and the reason this is a class rather than a bug: ONE guard in PR #10033 carried SIX instances -- (1) a body-local grep for the mutator, defeated by moving the call one helper deeper; (2) a seed matching only the fully-qualified path, defeated by `use std::env;`; (3) a lexical projection with no raw-string state, so an unbalanced brace in a fixture silently shifted every containment decision after it; (4) `take(n).all(..)`, vacuously true over a short remainder (rostered as predicate_vacuously_true_on_an_empty_domain); (5) a scan ranging over ONE FILE while the scope declaration claimed every test the required lane runs -- found by review, not by the author; and (6) after widening, cross-file call edges resolved by BARE NAME, which merges every declaration of a shared spelling (18 `main`s in that crate) and bridged one production seed into hundreds of unrelated tests. Four were found by the author, one by review, one by the widening itself, and the sixth is the mirror of the fifth: over-broad and under-broad are the same defect measured in opposite directions, and both are reported as coverage. RECOGNITION RULE: name the check's SUBJECT and the check's RANGE as two separate sentences, then ask what is in the first and not the second. If the answer is anything, the claim is the narrower one until the range is widened. The review-side tell is a scope comment that quantifies (`every test`, `all modules`, `any call site`) beside an implementation that names ONE input. BOUNDED AGAINST TWO NEIGHBOURS. selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population, arriving as the fix for a real objection; here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it. incidental_denominator_as_wall is a guard that holds by an upstream coincidence that genuinely holds; here the guard holds over a population it never read. CEILING 3, structurally guaranteed and decidable, BUT SCOPED TO THIS CLASS'S EXECUTING FORMS AND NOT TO THE CLASS (scope amended when the ninth form landed): a check whose subject is a VALUE it receives rather than a scope its implementation re-derives cannot range over less than it claims, because the claim and the range are then one object. That derivation needs an executing check with an input. Every form above it is one, so the limit was never visible and the ceiling read as belonging to the class when it belongs to a sub-case: where the subject is a WRITTEN SURFACE a human is supposed to read completely, the claim and the range stay TWO objects and cannot inherit this ceiling. The ninth form below is that sub-case and carries no rung of its own. NEXT-RUNG TRIGGER, named as a capability: the guarded population is passed to the check as a constructed value carrying its own extent, sufficient that no check can name a subject its input does not contain. WHAT IS NOT CLAIMED: that widening always wins. Narrowing the DECLARATION to match the range is equally honest and is sometimes correct -- what is forbidden is leaving the two different, and the choice between them is a cost measurement, not a preference. On this specimen widening cost one change of input plus one linear-time rewrite of a quadratic edge builder, and the wider check ran FASTER than the narrow one, which is what settled it.) A SEVENTH FORM, AND THE FIRST WHERE THE NARROWING IS AN AXIS OF THE COMPARISON RATHER THAN A RANGE OF INPUTS (2026-09-03). The six above narrow WHICH INPUTS a check sees; this one narrows WHAT IT COMPARES, so it is invisible even over a complete corpus. `v1_compiler.behavioral_receipt_host` `behavioral_differential` is cited as the executing evidence for DESIGN section 7 behavioural equivalence, and its own doc comment cites section 7 by name. What it RANGES OVER is the seed-Rust versus emitted-Rust axis: `generate_receipt_driver` emits a Rust main that prints each planned call, and the differential runs that ONE driver twice -- against the tree as committed, then after the candidate overwrites its mirror and the crate is rebuilt. Both transcripts come from COMPILED RUST BINARIES, so any property the two realizations SHARE is unobservable to it by construction, however clean the corpus. THE DISCRIMINATING INSTANCE IS NOT THIS ROW'S TO STATE, AND CITING IT RATHER THAN RESTATING IT IS THE POINT (amended 2026-09-03). The interpreter-versus-emitted evaluation divergence has an owner with better evidence than prose: `realization_arms_diverge_on_whether_the_program_refuses`, filed by gunbc#10139, which carries the source reading in both directions AND an EXECUTED red -- `fn guarded_division(n: Int) -> Bool { n != 0 && (100 / n) > 1 }`, run and dated, explicitly not asserted. An earlier draft of this receipt described that divergence in its own words. That would have been a second authority for a fact this ledger already owns, committed inside the row about subjects narrower than their claims, which is the specimen writing itself. WHAT IS THIS ROW'S OWN SUBJECT is the other half and a different fact: THE INSTRUMENT CANNOT SEE IT. Both of `behavioral_differential`'s arms are compiled Rust, so they share the target's evaluation semantics and agree with each other -- wrongly, together -- on exactly the inputs where that cited class occurs. The divergence is #10139's; the blindness of the equivalence instrument to it is this row's. THE REVIEW TELL FOR THIS FORM: ask what the two sides of a comparison SHARE, not what the check ranges over -- a differential between two realizations of one target cannot see a property of that target. The ordinary tell, a green over a population nobody checked, is unavailable here: this instrument is green for a reason no input can change. ONE NEIGHBOUR CHECKED AND EXCLUDED, so the next reader does not re-derive it: `v2.compiler.emit_host` `run_test_claim_emit_vs_eval` IS enrolled on the required floor and DOES pair an executed emitted answer with an interpreted one, with a positive control and a discriminating negative. But it evaluates `expected_eval_root` while host-running the emitted `claim_input_root` -- two different roots -- so it is an ORACLE comparison and the interpreter never evaluates the expression the target runs. Its subject excludes same-expression evaluation divergence structurally, not by coverage. THE AUTHOR'S OWN INSTANCE, recorded because it happened while filing this: the first draft claimed NO required phase pairs an interpreted answer with an emitted-and-executed one, derived by enumerating the closed five-variant `RequiredCiPhase` and then asserting what its members execute without reading them. The population was closed; the claim about its members was never checked -- a real enumeration, divided by nothing. It was refuted by the very rows that refused the pull request being worked on.AN EIGHTH FORM, AND THE FIRST WHERE THE BLIND SPOT IS NOT ARBITRARY BUT CORRELATED WITH RECENCY (2026-09-03, tidy-koi-619 on gunbc#10106, with warm-seal-35 as the finder). Every form above treats the narrowing as ARBITRARY -- 'never a decision, the shape of the first implementation'. When the narrowed axis is a DIRECTION over a time-ordered subject, the narrowing stops being arbitrary and starts tracking recency, which makes it strictly worse than a random miss. THE INSTANCE: a squash-merged branch survives as a divergent-looking branch and auto-opens a pull request that would REVERT main. Diagnosing gunbc#10242 I enumerated what a merge would wrongly RE-ADD -- 47 namespace admissions consumed by their own merge, plus three files deleted on main -- and concluded, in the comment closing it, 'there is no file where this branch carries content main wants'. THAT SENTENCE IS TRUE. Its subject is one direction; its reading is completeness. The 54 differing paths were 43 common-but-differing, 3 branch-only which a merge RE-ADDS, and 8 main-only which a merge DELETES -- and the deletion category, which the sweep never ranged over, contained a witness test that had landed twenty minutes earlier. WHY RECENCY MAKES IT WORSE: the newest work on main is NECESSARILY in the merge-would-delete category, because the more recently something landed the more certain it is to be absent from a superseded branch. So this sweep's blind spot is not spread evenly over the population -- it concentrates on exactly the rows that are newest, least recoverable, and least likely to be noticed missing, since nobody is yet watching for the absence of a thing that landed twenty minutes ago. A check whose miss probability rises with the value of what is missed is a different economic object from one that misses uniformly, and the review tell is different too: it is not 'what population did this range over' but 'is the missed set correlated with anything, and with what'. RECOGNITION RULE FOR THIS FORM: when a check's subject is a COMPARISON between two states, name both directions as separate sentences and range over both -- present-on-A-absent-on-B and present-on-B-absent-on-A are two populations, and a size or presence heuristic run one way answers only one of them. WHY IT IS FILED HERE AND NOT AS ITS OWN CLASS: three instances arrived within one day from three unrelated angles -- a record comparator that could not parse a parameterized constructor and so reported None == None as agreement on the `standing` field; an assert-count-is-1 guard over a citation sweep that held because the PATTERN was narrow rather than because the file was clean; and this one-directional diff sweep. The author's first instinct was to mint a new class around the sentence 'a check that does not state its own denominator cannot be distinguished from a complete one'. That sentence is this row's INVALID STATE restated, so a new row would have been a second authority for a rostered fact -- the DESIGN section 2 failed decomposition, committed inside the ledger that exists to prevent it, which is the same self-demonstration the seventh form records. The class was already here; only the recency observation was new. A NINTH FORM, WHERE THE SUBJECT ITSELF MOVED UNDER THE CHECK (2026-09-05, adjudicated in jolly-dove-86, measured on gunbc#10552). It is numbered ninth because this row already carried an eighth; the brief that commissioned it said eighth, and the row is the authority on its own count. STATEMENT: a repair changes the SUBJECT that the earlier observation described. Completeness and correctness must be established against the FINAL SUBJECT, with the selection boundary explicit; finding the newly inserted wording is not that establishment. THE REASONING UNDER IT: checked revision A, plus edit A to B, does not equal checked revision B, without a preservation argument or a renewed inspection. The escape clause is not decoration -- RENEWED INSPECTION DISCHARGES IT, and reading the final text once IS an adjudication. No impossibility is claimed here: an earlier draft said such a sweep can never close, and that was refuted, because renewed reading is the only mechanism that actually works. RUNG: this form carries NONE. It is the sub-case the amended ceiling above excludes -- the subject is a written surface, so no input can be constructed to carry its extent, and the claim and the range remain two objects. SPECIMEN ONE, three reviews that ranged over less than the row they reviewed: 5120939460, 5121228544 and 5121282475, none of which reached `test.claim.phantom_marker_type_argument_identity_witness` -- the file the row under repair CITES -- where two corrected-away formulations stood verbatim. The enumeration found them; no reviewer did. SPECIMEN TWO, and it is what fixes the UNIT of repair: a repair landed at the QUOTED text, left the FRAMING sentence directly above it standing, and left a dependent two paragraphs BELOW it standing too -- one that never quoted the premise it rested on (`a trigger whose owner has ceased to exist is retired by nothing at all`). That dependent contained none of the repair's search terms precisely because it RESTED on the premise rather than quoting it. So the unit of repair is the ENTAILMENT NEIGHBOURHOOD of the premise -- framing above, dependents below, sibling surfaces -- and it is BIDIRECTIONAL. A phrase-keyed sweep is keyed on quotation, and entailment does not quote. REFUSED TRIGGER, recorded WITH its reason so it is not re-proposed: `enroll the sweep in CI`. Mechanisation moves the INVOCATION, not the SUBJECT -- the same incomplete phrase search would execute reliably over the same incomplete subject, so the trigger would fire while the capability stayed dead, which is exactly the DESIGN section 4b(3) grain mismatch between a loss sentence and its trigger. Rung 2 needs an adequate subject definition, a valid checking relation AND a consumer; automation supplies only the third. THE NEIGHBOUR CHECKED AND EXCLUDED, using that row's own bounding text: selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population. Here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it, which is this row's invariant, so the form is filed here and not minted. The corroborating receipt from the row's own repair day: a phrase-keyed sweep certified that repair clean and missed four survivors, because the live one read `WHAT ACTUALLY HOLDS THIS CLASS AT 2` and matched none of the guessed patterns. The form applies to writing the form. **THE SAME INVARIANT AT WITNESS GRAIN, WHERE THE DECLARED CLAIM IS AN ANNOTATION AND THE RANGE IS THE EXECUTED SPECIMEN (deep-carp-676, gunbc#10602, 2026-09-05).** A claim's note names the mutation it is aimed at, and that sentence is read by every later author as the class's coverage -- but nothing checks that the specimen REACHES the mutated code. Four instances in one lane, each measured rather than reasoned about: two SCM staging claims named `candidate_inherited_from_base` answering the empty corpus while their specimens left the stage POINTER PRESENT, so they never entered the inheritance path at all and stayed GREEN under exactly that mutation; two others were annotated as covering the v4-predecessor-document and post-checkout routes while constructing the post-normalization envelope by hand, bypassing the decoder and the checkout that define those routes. AND THE SAME SHAPE ONE LEVEL UP, IN THE INSTRUMENT: a sweep certifying seven modules clean had passed `--functions __probe__`, and the tool exits 2 on an unresolvable function name BEFORE resolving anything -- so `no diagnostics reported` was `no resolution was attempted`. The wrapper was repaired to assert three facts separately (exit 0, the resolve phase REACHED, no diagnostics) and was then checked with a must-fail control, because an instrument that cannot go red is not evidence about the subject it is pointed at. THE RECOGNITION RULE TRANSFERS WITHOUT CHANGE and gains one imperative: name the claim's DECLARED subject and its EXECUTED subject as two sentences -- and where the declared subject is a mutation, RUN THE MUTATION. A named mutation that leaves the claim green is not a weak control, it is a false coverage statement, and it is worse than no annotation because the next author reads it as a wall. - **a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.) - **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation. From 5a164b2485753f17022cf900ea90d0eb2d551881 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Tue, 8 Sep 2026 12:41:23 +0000 Subject: [PATCH 3/4] Reduce to the composition edge; cite the denominator rule rather than fork it The reviewer's full decomposition against current main: one thing survives, two do not. SURVIVES -- THE COMPOSITION EDGE. Main already owns the general sequence (an upstream failure manufactures an empty domain, a downstream universal certifies it). What it does not say is that on this measured incident the two legs have DIFFERENT rostered owners firing in sequence: `empty_capture_read_as_clean_result` owns the refusing read consumed as content, this row owns the universal over the resulting empty domain. Two rostered classes composing is a RELATION, not another class. DOES NOT SURVIVE -- the artifact-identity subcase. It explains why THIS read refused; it changes no mechanism, recognition rule or repair, and wrong paths, wrong windows and refusing reads are already covered. The bad SHA stays as specimen provenance only. DOES NOT SURVIVE -- the novelty claim, withdrawn in the previous commit. WHICH ABSENCE ROW OWNS LEG ONE is now stated, because three absence rows touch this incident: the discriminator is whether the read SIGNALLED failure. Exit 128 is a swallowed refusal, which is `empty_capture_read_as_clean_result`. `absent_reads_identically_to_never_looked` is the case where nothing errors and the instrument never reached its subject -- which is why its specimens are a wrong path, a wrong window and a wrong directory rather than a non-zero exit. THE SECOND OBLIGATION IS CITED, NOT RE-DERIVED, and the earlier wording was weaker than the rule it paraphrased. "A positive control catches every other origin" is false: a matcher can pass a synthetic control while the actual checked domain stays empty, since the control proves only that the MATCHER discriminates. The correct obligation is a POSITIVE DENOMINATOR ON THE ACTUAL DOMAIN -- already rostered as `absent_reads_identically_to_never_looked`'s tell, and already this row's own next-rung trigger. Restating it here would have forked a repair that has an authority. AND THE SPLIT IS ONLY HONEST WITH THIS SAID: either guard alone would have prevented this exact false pass. Both are required to repair the COMPOSED CHAIN rather than this instance -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. One hole closable twice, and a chain needing both ends held. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MuB8wHjijaFwNoyzm78stF --- .../predicate_vacuously_true_on_an_empty_domain.dag | 8 ++++---- docs/design-failure-modes.md | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag index dab6d70b4d8..730b1350e3e 100644 --- a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag +++ b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag @@ -102,13 +102,13 @@ data predicate_vacuously_true_on_an_empty_domain: RecurringFailureMode = Recurri "**WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. ", - "A LOCUS FOR THE UPSTREAM-FAILURE GENERATOR ABOVE, AND A CHAIN ACROSS TWO ROWS (2026-09-08). This receipt claims NOTHING about a new generator: the paragraph above already owns the empty domain produced by an upstream failure rather than by a boundary in the data, in stronger words than this one, and an earlier draft of THIS receipt asserted it as a gap that row did not list. THAT WAS FALSE AND IS RECORDED AS FALSE, because its author read one grepped sentence of this row rather than the row -- which is the artifact-verification defect rostered at [[green_reported_over_a_population_the_instrument_does_not_own]], committed while filing here. What survives is narrower and was checked against this row at origin/main before being written: a LOCUS the generator paragraph does not name, and a CHAIN this roster does not draw. ", + "A COMPOSITION EDGE: THE FIRST LEG OF THIS ROW'S UPSTREAM-FAILURE GENERATOR HAS ITS OWN ROSTERED OWNER (2026-09-08). The paragraph above already owns the general sequence -- an upstream failure manufactures an empty domain and the downstream universal certifies it -- and an earlier draft of this receipt wrongly claimed that sequence as new, having grepped ONE sentence of this row instead of reading it. What is recorded here is narrower and is a RELATION rather than a class: on a measured incident the two legs are owned by DIFFERENT rostered rows firing in sequence. `git show ` EXITED 128 and yielded empty stdout; the exit status was discarded and the empty bytes were split into an empty sentence set; the universal `every sentence the authority gained appears in the projection` then held vacuously and certified a commit that was never read. [[empty_capture_read_as_clean_result]] owns the FIRST failure -- a refusing read consumed as content. This row owns the SECOND -- the universal over the resulting empty domain returning true. NEITHER CLASS ALONE EXPLAINS THE INCIDENT. The bad SHA is provenance for the specimen and nothing more: it explains why this particular read refused, and it changes no mechanism, recognition rule or repair, since wrong paths, wrong windows and refusing reads are all already covered. ", - "THE LOCUS: THE EMPTINESS CAME FROM A NAME THAT RESOLVED TO NOTHING, not from a stage that failed. The generator paragraph describes a pipeline stage failing open into an empty result. Here nothing in the pipeline failed -- the pipeline was pointed at a subject that did not exist. A verification script required every sentence an authority GAINED between two commits to appear in the regenerated projection, a sound check carrying a negative control, and was handed a commit SHA that had been ASSERTED IN A MESSAGE RATHER THAN READ BACK FROM THE PRODUCER. Measured on that same nonexistent SHA: `git show` writes ZERO BYTES to stdout and exits 128. The reader discarded the exit code, the splitter produced the empty set, and the universal held vacuously over a commit that was never read. SO THE LOCUS IS: VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale or mistyped identity never fails at the verifier; it fails at the resolution, silently, and arrives as an empty domain indistinguishable from a real one. ", + "WHICH ABSENCE ROW OWNS THE FIRST LEG, since three of them touch this incident and a reader needs the discriminator: it turns on WHETHER THE READ SIGNALLED FAILURE. Here it did -- exit 128, a refusal that was swallowed -- which is [[empty_capture_read_as_clean_result]], whose subject is a well-formed refusal travelling on a channel nobody kept. [[absent_reads_identically_to_never_looked]] is the case where NOTHING ERRORS and the instrument simply never reached its subject, which is why its specimens are a wrong path, a wrong window and a wrong directory rather than a non-zero exit. ", - "THE CHAIN, AND IT IS THE PART NO SINGLE ROW CARRIES: two rostered classes fired in sequence and neither alone explains the pass. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY -- a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure, which is that row's own `gh run view` specimen with a different syscall. This row fired SECOND and says WHY EMPTY PRODUCED PASS. Checked before claiming it: this row does not name that one anywhere, and the generator paragraph describes emptiness arising WITHIN one procedure rather than being handed across a class boundary. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. ", + "THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED and this receipt does not restate it as its own: [[absent_reads_identically_to_never_looked]] carries it as its tell -- a zero accepted without anything establishing that the instrument resolved its subject, no denominator, no positive control, no assertion that the read was non-empty -- and this row's own next-rung trigger names the positive denominator as the capability. ", - "AND THE REPAIR IS THE ONE THIS ROW ALREADY PRESCRIBES, NOT THE ONE THAT FIRST SUGGESTED ITSELF -- stated because the tempting fix here is precisely what this row has now refused three times. `Assert that the read succeeded before splitting` is the artifact-grained guard: one more guarded site, validation, leaving the empty state in the procedure. THE CONSTRUCTION-GRAINED REPAIR AT THIS LOCUS IS TO STOP ACCEPTING AN IDENTITY THAT WAS TOLD: resolve the subject from the producer -- read the head back -- so a name that denotes nothing cannot enter the procedure at all, and the empty domain has no constructor from this origin. The positive control remains necessary and orthogonal, since it is what catches every other origin, and this row's standing reasoning about why a per-site guard is not the fix applies here unchanged. ", + "AND THE SPLIT IS ONLY HONEST WITH THIS SAID, because without it a reader takes one: EITHER GUARD ALONE WOULD HAVE PREVENTED THIS EXACT FALSE PASS. The positive denominator would have rejected the zero-sentence domain with the read failure still swallowed, and preserving the read would have refused before any domain existed. Both are required to repair the COMPOSED CHAIN rather than this instance of it -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. It is not two guards for two holes; it is one hole closable twice, and a chain that needs both of its ends held. ", ], evidence: [], diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index 70bf1e4dcac..feffa1158a1 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -261,7 +261,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an unhandled state falls to the NOT-YET arm, so a settled answer is reported as a pending one** (a fold reduces a producer's conclusion set to a verdict with an arm per state it knows and a default for the rest, and the default it falls to is NOT-YET-TERMINAL. A state the producer really can emit, but the fold has no arm for, is therefore rendered as STILL WAITING -- and waiting is the one disposition that never resolves, because nothing further is coming. THE DISGUISE IS THE WHOLE DEFECT: an unhandled state normally announces itself by producing a wrong answer, and this one produces NO answer, which is indistinguishable from the fold working correctly over a subject that has not finished. SPECIMEN, 2026-09-02, gunbc PR 10086: `dashboard-ops reviews` reported ready:false with requirement `checks` failing and checks_state `pending`, AT THE SAME INSTANT that GitHub reported the head CLEAN and mergeStateStatus admitted a merge -- and the merge was then taken on GitHub's word, with no override, and was correct. Every job in the run had a terminal conclusion: five `pass` and one `skipping`. The skip is the unhandled state -- a GitHub NEUTRAL, which is a THIRD conclusion beside success and failure -- and the readiness fold, carrying arms for the first two, dropped it into not-yet-terminal. THE MECHANISM IS NOT LAG AND THAT IS THE POINT: the two are the same field with the same value, and only one of them is discharged by waiting. RECOGNITION RULE, and it is the load-bearing part because the status field cannot answer it: when a readiness or aggregate verdict says NOT YET, do not wait on the verdict -- NAME THE SPECIFIC ROW THAT IS NON-TERMINAL AND ASK WHETHER IT CAN EVER BECOME TERMINAL. A row already sitting in a terminal state the fold does not recognise never will, so patience is not a remedy for it and no amount of it produces new information. The falsifier is cheap and available at every such moment: read the producer's own per-row conclusions beside the fold's summary. If every row is terminal and the summary is not, the summary has an arm missing. WHY THIS LOCATION IS WORSE THAN A LOG READER, which is the reason it is ranked rather than merely filed: this is the instrument that decides whether WORK IS DONE. A log reader that under-reports costs a diagnosis and the next reader recovers it; a readiness fold that under-reports costs the MERGE, and it fails in the direction that LOOKS LIKE CAUTION, so nobody overrides it and nobody is embarrassed by it. THE COUNTERFACTUAL IS WHAT MAKES THE ROW ACTIONABLE: a reader following the dashboard alone would still be waiting on a pull request that had been mergeable for an hour -- and would read their own patience as diligence, which is the one failure mode that generates no complaint from the person suffering it. WHY THIS IS NOT `empty_capture_read_as_clean_result`, its nearest neighbour and the class the same session had just extended: that class is about a CAPTURE that is empty, where the reader holds no observation and believes they hold one. Here the observation is complete and correct at every input -- five passes and a skip, all present, all read -- and the loss is in the REDUCTION over them. Merging the two would repeat exactly the defect that produced this row's neighbour, a recognition rule too broad to catch a second instance of its own subject: `size the artifact before grepping it` is the surviving rule there and it is silent here, because the artifact is the right size and says the right thing. WHY THIS IS NOT `state_space_conflation`, the honest neighbour on the other side: all three of that class's forms are defects in a domain THIS TREE MODELS -- an `Option` overloaded past two meanings, a prose dichotomy over three states, a real state carried as an ad-hoc spelling -- and each of their recognition rules ends in ADD THE CONSTRUCTOR OR THE ARM. That repair is unavailable here: the conclusion set is GitHub's and the fold is the dashboard's, neither of which this repository owns, so the actionable rule has to be one a READER can execute against an instrument they cannot edit. That is why the rule above is a discriminator rather than a modelling instruction, and it is the whole reason this is its own row. RUNG FOUND AT: silent wrongness for any consumer of the summary field alone, since the fold reports a value that is not merely imprecise but WRONG about whether the subject can still change, and offers no signal that an input was unrecognised. It is mitigatable for a reader who applies the rule above, which is diligence rather than a mechanism. CEILING: outside the modeled guarantee for the dashboard's own fold, which this repository does not own and can only observe; for the equivalent folds gunbc DOES own, structurally impossible, because a reduction over a CLOSED conclusion set is exactly the case DESIGN section 4's exhaustive match makes unwritable -- a state with no arm fails to compile rather than defaulting. NEXT-RUNG TRIGGER for the part we own: every gunbc fold over a third-party status or conclusion set ingesting that set as a closed coproduct in `extdeps/` with a variant per documented state, so an unmodeled state is a typed, located refusal at the boundary rather than a silent fall-through -- and NOT a default arm that maps the unknown to pending, which is this row's defect re-authored one layer down.) - **a salience instrument blind to the record it sizes** (a change's SIZE IN THE DIFF is read to decide how much attention it deserves, and for one class of artifact that number is wrong by orders of magnitude, so a substantive edit is allocated a trivial edit's scrutiny. The instrument is not merely inaccurate, it is a SALIENCE instrument -- read FIRST, to decide where to look -- which is why the error does damage a plainly wrong number would not: nobody checks a figure they have already used to decide the thing is not worth checking. SPECIMEN, 2026-09-02, gunbc#10044: `git diff --stat -- dag/gunbc/rung_drop.dag` reported `1 insertion(+), 1 deletion(-)` for an edit adding 15,286 bytes, because every `RungDrop` in that corpus is ONE VERY LONG LINE. Three consecutive independent reviews described that hunk as a small wording tweak; a fourth, earlier one attributed it to `direct_call_arg_seam_v2_exemption`, A ROW THE DIFF DOES NOT TOUCH, because git's `@@` header names the declaration PRECEDING the hunk and the edited record is a single line. So one representation produced two distinct review failures -- under-sizing and misattribution -- and n=3 on the first within one pull request. THE APPROVALS WERE NOT WRONG ON WHAT THEY READ: each verdict is defensible over the prose rows the same diff carries, which render normally. What the count concealed is that the PR had three approvals and NO review coverage of the half that carried the receipt. A review tally is a claim about attention, and this instrument silently redirects attention before any reviewer forms a judgment. RUNG FOUND AT: silent wrongness, which is not a rung -- the misallocation leaves no trace, produces a green, and is indistinguishable from a reviewer who looked and found nothing. CEILING: mechanically preventable. The size of a record's diff can be made to track the size of its content, which is a representation question and decidable; it does not reach structural impossibility because nothing stops a future record from being authored as one long line again. NEXT-RUNG TRIGGER, AND IT IS DELIBERATELY NOT 'REVIEWERS SHOULD LOOK HARDER': a representation in which a record's diff size tracks its content size -- the long-line record broken across lines so a diff has hunks proportional to the change, or a review surface that reads the generated projection (`docs/design-failure-modes.md` renders the same content as prose and diffs legibly) rather than the `.dag` line. 'Look harder' is advice, and advice is what a class gets when nobody wants to pay for the fix; it also cannot be discharged, since every reviewer meets the same instrument. RECOGNITION RULE: when a review's description of a hunk is smaller than the hunk, check whether the artifact's line structure and the change's content structure agree. Where one record is one line, EVERY size signal derived from lines -- the diffstat, the hunk header, a line-count budget, a review-effort heuristic -- is answering about the file's shape rather than the change's. The tell is a reviewer citing the enclosing declaration rather than the edited one.) - **ambient process state read by a concurrent reader** (a fact that is really a PARAMETER is instead read from a mutable cell the whole process shares -- the working directory, an env var, a global -- while the runtime schedules concurrent readers of it, so the answer a reader gets depends on which writer last ran and the wrong answer is SILENT: the read succeeds, returns a well-formed value, and is simply about a different subject than the reader meant. INVALID STATE: any reader resolving a relative name against ambient state that a concurrent writer may move mid-read. WHY IT SURVIVES REVIEW: each site is locally correct -- it sets the state to the right value before its own work and restores it after -- and the defect exists only in the PRODUCT of sites, which no single diff shows. SPECIMEN (PR #10024, v1_compiler.cli_run): 38 forward set_current_dir sites in one test binary that cargo runs multi-threaded, with the idiom prior = current_dir(); chdir(ws); work; chdir(prior) -- so one test's RESTORE hands the cwd back while a sibling is mid-read. The victim population is not the writers, it is every non-ignored test in the binary that resolves a relative path during the window; the file's own entry_admission_tests note already records the measurement, a DIFFERENT pair of tests failing on each run of identical code (4/1 then 3/2). Seven of the sites were reachable from the required unit lane and in all seven the chdir was DEAD -- every consumer already took an explicit root -- i.e. residue from an unfinished parameterisation, which is the expected shape once the migration is half done. THE CENSUS THAT MATTERS IS REACHABILITY, NOT THE LITERAL AND THE RANGE THAT MATTERS IS THE POPULATION'S, NOT THE FILE'S: the first cut of that gate scanned the one file its author was editing while declaring the whole lane as its subject, which is a selection view read as a population and puts the reported rung above the executed evidence (DESIGN section 4b(1) reads a class's rung as the MINIMUM across in-scope paths). Widening it to every source file of the lane's crate cost a change of input plus a linear-time call extractor -- the per-name matcher is quadratic in lines times declarations and does not survive the wider corpus -- and it surfaced a second trap immediately: resolving cross-file call edges by BARE NAME merges every declaration of a shared spelling, and this crate declares main 18 times, so one production seed bridged into hundreds of unrelated tests. That arm is the absorbing fallback again, in the guard built to catch it. What survives is intra-file edges plus cross-file edges only for names declared exactly once, with the ambiguous remainder pinned by IDENTITY rather than assumed empty. Six forms of the same defect were found in this one guard; they are rostered as their own class at check_subject_narrower_than_its_declared_claim, which this row is a specimen of rather than an authority for: all seven reached the mutation through a helper, so a body-local grep for the call is green over every instance of the class and stays green the moment a writer is moved one call deeper -- the guard must close transitively over call edges. A SECOND, DISTINCT ARM, kept apart because it has a different remedy: memoizing a value DERIVED from the ambient state (workspace_root's OnceLock over a .git-ancestor walk from cwd) freezes whichever writer won the race for the whole process. On this specimen that arm's population is EMPTY -- every forward site targets the checkout root and 37 of 38 force the memo from the pristine cwd one line above their own call -- so it is reported UNSUPPORTED rather than disproven (see a_structural_possibility_is_not_an_occurring_phenomenon); ONE chdir to a non-checkout path arms it, and a fixture that runs git init is such a path. RUNG: found BELOW the ladder, since a redirected read is a silently wrong answer with no typed refusal anywhere. CEILING 4, structurally impossible, and decidable: state passed as a parameter has no shared cell to race on, so the invalid state has no constructor. The intermediate rung is a reachability gate over the guarded population (no_gating_test_reaches_a_process_cwd_mutator), which keeps the state ABSENT but not unwritable; its next-rung trigger is the capability that every reader in the population resolves from an explicitly passed root, after which the ambient write has no consumer and the call can be removed rather than merely counted. REVIEW TELL: a diff that sets shared process state and restores it, in code the runtime may run concurrently -- the restore is the tell, because it is what makes the site look self-contained. -- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A LOCUS FOR THE UPSTREAM-FAILURE GENERATOR ABOVE, AND A CHAIN ACROSS TWO ROWS (2026-09-08). This receipt claims NOTHING about a new generator: the paragraph above already owns the empty domain produced by an upstream failure rather than by a boundary in the data, in stronger words than this one, and an earlier draft of THIS receipt asserted it as a gap that row did not list. THAT WAS FALSE AND IS RECORDED AS FALSE, because its author read one grepped sentence of this row rather than the row -- which is the artifact-verification defect rostered at [[green_reported_over_a_population_the_instrument_does_not_own]], committed while filing here. What survives is narrower and was checked against this row at origin/main before being written: a LOCUS the generator paragraph does not name, and a CHAIN this roster does not draw. THE LOCUS: THE EMPTINESS CAME FROM A NAME THAT RESOLVED TO NOTHING, not from a stage that failed. The generator paragraph describes a pipeline stage failing open into an empty result. Here nothing in the pipeline failed -- the pipeline was pointed at a subject that did not exist. A verification script required every sentence an authority GAINED between two commits to appear in the regenerated projection, a sound check carrying a negative control, and was handed a commit SHA that had been ASSERTED IN A MESSAGE RATHER THAN READ BACK FROM THE PRODUCER. Measured on that same nonexistent SHA: `git show` writes ZERO BYTES to stdout and exits 128. The reader discarded the exit code, the splitter produced the empty set, and the universal held vacuously over a commit that was never read. SO THE LOCUS IS: VERIFYING AN ARTIFACT IDENTITY YOU WERE TOLD RATHER THAN READ. A fabricated, stale or mistyped identity never fails at the verifier; it fails at the resolution, silently, and arrives as an empty domain indistinguishable from a real one. THE CHAIN, AND IT IS THE PART NO SINGLE ROW CARRIES: two rostered classes fired in sequence and neither alone explains the pass. [[empty_capture_read_as_clean_result]] fired FIRST and says WHY THE SET WAS EMPTY -- a failed read whose refusal travelled on a channel nobody kept, consumed as content rather than as a failure, which is that row's own `gh run view` specimen with a different syscall. This row fired SECOND and says WHY EMPTY PRODUCED PASS. Checked before claiming it: this row does not name that one anywhere, and the generator paragraph describes emptiness arising WITHIN one procedure rather than being handed across a class boundary. TWO GUARDS, EACH DEFECTIVE IN A WAY THE OTHER MADE INVISIBLE. AND THE REPAIR IS THE ONE THIS ROW ALREADY PRESCRIBES, NOT THE ONE THAT FIRST SUGGESTED ITSELF -- stated because the tempting fix here is precisely what this row has now refused three times. `Assert that the read succeeded before splitting` is the artifact-grained guard: one more guarded site, validation, leaving the empty state in the procedure. THE CONSTRUCTION-GRAINED REPAIR AT THIS LOCUS IS TO STOP ACCEPTING AN IDENTITY THAT WAS TOLD: resolve the subject from the producer -- read the head back -- so a name that denotes nothing cannot enter the procedure at all, and the empty domain has no constructor from this origin. The positive control remains necessary and orthogonal, since it is what catches every other origin, and this row's standing reasoning about why a per-site guard is not the fix applies here unchanged. +- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A COMPOSITION EDGE: THE FIRST LEG OF THIS ROW'S UPSTREAM-FAILURE GENERATOR HAS ITS OWN ROSTERED OWNER (2026-09-08). The paragraph above already owns the general sequence -- an upstream failure manufactures an empty domain and the downstream universal certifies it -- and an earlier draft of this receipt wrongly claimed that sequence as new, having grepped ONE sentence of this row instead of reading it. What is recorded here is narrower and is a RELATION rather than a class: on a measured incident the two legs are owned by DIFFERENT rostered rows firing in sequence. `git show ` EXITED 128 and yielded empty stdout; the exit status was discarded and the empty bytes were split into an empty sentence set; the universal `every sentence the authority gained appears in the projection` then held vacuously and certified a commit that was never read. [[empty_capture_read_as_clean_result]] owns the FIRST failure -- a refusing read consumed as content. This row owns the SECOND -- the universal over the resulting empty domain returning true. NEITHER CLASS ALONE EXPLAINS THE INCIDENT. The bad SHA is provenance for the specimen and nothing more: it explains why this particular read refused, and it changes no mechanism, recognition rule or repair, since wrong paths, wrong windows and refusing reads are all already covered. WHICH ABSENCE ROW OWNS THE FIRST LEG, since three of them touch this incident and a reader needs the discriminator: it turns on WHETHER THE READ SIGNALLED FAILURE. Here it did -- exit 128, a refusal that was swallowed -- which is [[empty_capture_read_as_clean_result]], whose subject is a well-formed refusal travelling on a channel nobody kept. [[absent_reads_identically_to_never_looked]] is the case where NOTHING ERRORS and the instrument simply never reached its subject, which is why its specimens are a wrong path, a wrong window and a wrong directory rather than a non-zero exit. THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED and this receipt does not restate it as its own: [[absent_reads_identically_to_never_looked]] carries it as its tell -- a zero accepted without anything establishing that the instrument resolved its subject, no denominator, no positive control, no assertion that the read was non-empty -- and this row's own next-rung trigger names the positive denominator as the capability. AND THE SPLIT IS ONLY HONEST WITH THIS SAID, because without it a reader takes one: EITHER GUARD ALONE WOULD HAVE PREVENTED THIS EXACT FALSE PASS. The positive denominator would have rejected the zero-sentence domain with the read failure still swallowed, and preserving the read would have refused before any domain existed. Both are required to repair the COMPOSED CHAIN rather than this instance of it -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. It is not two guards for two holes; it is one hole closable twice, and a chain that needs both of its ends held. - **a check's subject is narrower than the claim it is cited for** (EVERY DEGREE OF FREEDOM IN A CHECK'S SUBJECT -- which call sites, which spellings, which lexical states, which domain, which files -- is a place its coverage can silently be narrower than the population it is read as covering. INVALID STATE: an executing, reached, green check whose declared subject is a strict superset of the population its implementation actually ranges over. RUNG: outside the ladder, because the gap is invisible from the check's own result -- a wall whose range is too narrow is green for the same reason a wall over a clean corpus is green, and DESIGN section 4b(1) reads a class's rung as the MINIMUM across its in-scope paths, so a check like this INFLATES the rung of everything it is cited for. THE ROUTE IS WHAT MAKES IT INVISIBLE: the narrowing is never a decision, it is the shape of the first implementation -- an author edits one file, so the scanner reads one file; the corpus spells the call one way, so the seed matches one spelling; the fixture has no raw strings, so the projection has no raw-string state; the window is never short, so the universal is never vacuous. Each is locally reasonable and none is written down, which is why the gap survives the review that reads the check's LOGIC and never asks what its INPUT was. SPECIMEN, and the reason this is a class rather than a bug: ONE guard in PR #10033 carried SIX instances -- (1) a body-local grep for the mutator, defeated by moving the call one helper deeper; (2) a seed matching only the fully-qualified path, defeated by `use std::env;`; (3) a lexical projection with no raw-string state, so an unbalanced brace in a fixture silently shifted every containment decision after it; (4) `take(n).all(..)`, vacuously true over a short remainder (rostered as predicate_vacuously_true_on_an_empty_domain); (5) a scan ranging over ONE FILE while the scope declaration claimed every test the required lane runs -- found by review, not by the author; and (6) after widening, cross-file call edges resolved by BARE NAME, which merges every declaration of a shared spelling (18 `main`s in that crate) and bridged one production seed into hundreds of unrelated tests. Four were found by the author, one by review, one by the widening itself, and the sixth is the mirror of the fifth: over-broad and under-broad are the same defect measured in opposite directions, and both are reported as coverage. RECOGNITION RULE: name the check's SUBJECT and the check's RANGE as two separate sentences, then ask what is in the first and not the second. If the answer is anything, the claim is the narrower one until the range is widened. The review-side tell is a scope comment that quantifies (`every test`, `all modules`, `any call site`) beside an implementation that names ONE input. BOUNDED AGAINST TWO NEIGHBOURS. selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population, arriving as the fix for a real objection; here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it. incidental_denominator_as_wall is a guard that holds by an upstream coincidence that genuinely holds; here the guard holds over a population it never read. CEILING 3, structurally guaranteed and decidable, BUT SCOPED TO THIS CLASS'S EXECUTING FORMS AND NOT TO THE CLASS (scope amended when the ninth form landed): a check whose subject is a VALUE it receives rather than a scope its implementation re-derives cannot range over less than it claims, because the claim and the range are then one object. That derivation needs an executing check with an input. Every form above it is one, so the limit was never visible and the ceiling read as belonging to the class when it belongs to a sub-case: where the subject is a WRITTEN SURFACE a human is supposed to read completely, the claim and the range stay TWO objects and cannot inherit this ceiling. The ninth form below is that sub-case and carries no rung of its own. NEXT-RUNG TRIGGER, named as a capability: the guarded population is passed to the check as a constructed value carrying its own extent, sufficient that no check can name a subject its input does not contain. WHAT IS NOT CLAIMED: that widening always wins. Narrowing the DECLARATION to match the range is equally honest and is sometimes correct -- what is forbidden is leaving the two different, and the choice between them is a cost measurement, not a preference. On this specimen widening cost one change of input plus one linear-time rewrite of a quadratic edge builder, and the wider check ran FASTER than the narrow one, which is what settled it.) A SEVENTH FORM, AND THE FIRST WHERE THE NARROWING IS AN AXIS OF THE COMPARISON RATHER THAN A RANGE OF INPUTS (2026-09-03). The six above narrow WHICH INPUTS a check sees; this one narrows WHAT IT COMPARES, so it is invisible even over a complete corpus. `v1_compiler.behavioral_receipt_host` `behavioral_differential` is cited as the executing evidence for DESIGN section 7 behavioural equivalence, and its own doc comment cites section 7 by name. What it RANGES OVER is the seed-Rust versus emitted-Rust axis: `generate_receipt_driver` emits a Rust main that prints each planned call, and the differential runs that ONE driver twice -- against the tree as committed, then after the candidate overwrites its mirror and the crate is rebuilt. Both transcripts come from COMPILED RUST BINARIES, so any property the two realizations SHARE is unobservable to it by construction, however clean the corpus. THE DISCRIMINATING INSTANCE IS NOT THIS ROW'S TO STATE, AND CITING IT RATHER THAN RESTATING IT IS THE POINT (amended 2026-09-03). The interpreter-versus-emitted evaluation divergence has an owner with better evidence than prose: `realization_arms_diverge_on_whether_the_program_refuses`, filed by gunbc#10139, which carries the source reading in both directions AND an EXECUTED red -- `fn guarded_division(n: Int) -> Bool { n != 0 && (100 / n) > 1 }`, run and dated, explicitly not asserted. An earlier draft of this receipt described that divergence in its own words. That would have been a second authority for a fact this ledger already owns, committed inside the row about subjects narrower than their claims, which is the specimen writing itself. WHAT IS THIS ROW'S OWN SUBJECT is the other half and a different fact: THE INSTRUMENT CANNOT SEE IT. Both of `behavioral_differential`'s arms are compiled Rust, so they share the target's evaluation semantics and agree with each other -- wrongly, together -- on exactly the inputs where that cited class occurs. The divergence is #10139's; the blindness of the equivalence instrument to it is this row's. THE REVIEW TELL FOR THIS FORM: ask what the two sides of a comparison SHARE, not what the check ranges over -- a differential between two realizations of one target cannot see a property of that target. The ordinary tell, a green over a population nobody checked, is unavailable here: this instrument is green for a reason no input can change. ONE NEIGHBOUR CHECKED AND EXCLUDED, so the next reader does not re-derive it: `v2.compiler.emit_host` `run_test_claim_emit_vs_eval` IS enrolled on the required floor and DOES pair an executed emitted answer with an interpreted one, with a positive control and a discriminating negative. But it evaluates `expected_eval_root` while host-running the emitted `claim_input_root` -- two different roots -- so it is an ORACLE comparison and the interpreter never evaluates the expression the target runs. Its subject excludes same-expression evaluation divergence structurally, not by coverage. THE AUTHOR'S OWN INSTANCE, recorded because it happened while filing this: the first draft claimed NO required phase pairs an interpreted answer with an emitted-and-executed one, derived by enumerating the closed five-variant `RequiredCiPhase` and then asserting what its members execute without reading them. The population was closed; the claim about its members was never checked -- a real enumeration, divided by nothing. It was refuted by the very rows that refused the pull request being worked on.AN EIGHTH FORM, AND THE FIRST WHERE THE BLIND SPOT IS NOT ARBITRARY BUT CORRELATED WITH RECENCY (2026-09-03, tidy-koi-619 on gunbc#10106, with warm-seal-35 as the finder). Every form above treats the narrowing as ARBITRARY -- 'never a decision, the shape of the first implementation'. When the narrowed axis is a DIRECTION over a time-ordered subject, the narrowing stops being arbitrary and starts tracking recency, which makes it strictly worse than a random miss. THE INSTANCE: a squash-merged branch survives as a divergent-looking branch and auto-opens a pull request that would REVERT main. Diagnosing gunbc#10242 I enumerated what a merge would wrongly RE-ADD -- 47 namespace admissions consumed by their own merge, plus three files deleted on main -- and concluded, in the comment closing it, 'there is no file where this branch carries content main wants'. THAT SENTENCE IS TRUE. Its subject is one direction; its reading is completeness. The 54 differing paths were 43 common-but-differing, 3 branch-only which a merge RE-ADDS, and 8 main-only which a merge DELETES -- and the deletion category, which the sweep never ranged over, contained a witness test that had landed twenty minutes earlier. WHY RECENCY MAKES IT WORSE: the newest work on main is NECESSARILY in the merge-would-delete category, because the more recently something landed the more certain it is to be absent from a superseded branch. So this sweep's blind spot is not spread evenly over the population -- it concentrates on exactly the rows that are newest, least recoverable, and least likely to be noticed missing, since nobody is yet watching for the absence of a thing that landed twenty minutes ago. A check whose miss probability rises with the value of what is missed is a different economic object from one that misses uniformly, and the review tell is different too: it is not 'what population did this range over' but 'is the missed set correlated with anything, and with what'. RECOGNITION RULE FOR THIS FORM: when a check's subject is a COMPARISON between two states, name both directions as separate sentences and range over both -- present-on-A-absent-on-B and present-on-B-absent-on-A are two populations, and a size or presence heuristic run one way answers only one of them. WHY IT IS FILED HERE AND NOT AS ITS OWN CLASS: three instances arrived within one day from three unrelated angles -- a record comparator that could not parse a parameterized constructor and so reported None == None as agreement on the `standing` field; an assert-count-is-1 guard over a citation sweep that held because the PATTERN was narrow rather than because the file was clean; and this one-directional diff sweep. The author's first instinct was to mint a new class around the sentence 'a check that does not state its own denominator cannot be distinguished from a complete one'. That sentence is this row's INVALID STATE restated, so a new row would have been a second authority for a rostered fact -- the DESIGN section 2 failed decomposition, committed inside the ledger that exists to prevent it, which is the same self-demonstration the seventh form records. The class was already here; only the recency observation was new. A NINTH FORM, WHERE THE SUBJECT ITSELF MOVED UNDER THE CHECK (2026-09-05, adjudicated in jolly-dove-86, measured on gunbc#10552). It is numbered ninth because this row already carried an eighth; the brief that commissioned it said eighth, and the row is the authority on its own count. STATEMENT: a repair changes the SUBJECT that the earlier observation described. Completeness and correctness must be established against the FINAL SUBJECT, with the selection boundary explicit; finding the newly inserted wording is not that establishment. THE REASONING UNDER IT: checked revision A, plus edit A to B, does not equal checked revision B, without a preservation argument or a renewed inspection. The escape clause is not decoration -- RENEWED INSPECTION DISCHARGES IT, and reading the final text once IS an adjudication. No impossibility is claimed here: an earlier draft said such a sweep can never close, and that was refuted, because renewed reading is the only mechanism that actually works. RUNG: this form carries NONE. It is the sub-case the amended ceiling above excludes -- the subject is a written surface, so no input can be constructed to carry its extent, and the claim and the range remain two objects. SPECIMEN ONE, three reviews that ranged over less than the row they reviewed: 5120939460, 5121228544 and 5121282475, none of which reached `test.claim.phantom_marker_type_argument_identity_witness` -- the file the row under repair CITES -- where two corrected-away formulations stood verbatim. The enumeration found them; no reviewer did. SPECIMEN TWO, and it is what fixes the UNIT of repair: a repair landed at the QUOTED text, left the FRAMING sentence directly above it standing, and left a dependent two paragraphs BELOW it standing too -- one that never quoted the premise it rested on (`a trigger whose owner has ceased to exist is retired by nothing at all`). That dependent contained none of the repair's search terms precisely because it RESTED on the premise rather than quoting it. So the unit of repair is the ENTAILMENT NEIGHBOURHOOD of the premise -- framing above, dependents below, sibling surfaces -- and it is BIDIRECTIONAL. A phrase-keyed sweep is keyed on quotation, and entailment does not quote. REFUSED TRIGGER, recorded WITH its reason so it is not re-proposed: `enroll the sweep in CI`. Mechanisation moves the INVOCATION, not the SUBJECT -- the same incomplete phrase search would execute reliably over the same incomplete subject, so the trigger would fire while the capability stayed dead, which is exactly the DESIGN section 4b(3) grain mismatch between a loss sentence and its trigger. Rung 2 needs an adequate subject definition, a valid checking relation AND a consumer; automation supplies only the third. THE NEIGHBOUR CHECKED AND EXCLUDED, using that row's own bounding text: selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population. Here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it, which is this row's invariant, so the form is filed here and not minted. The corroborating receipt from the row's own repair day: a phrase-keyed sweep certified that repair clean and missed four survivors, because the live one read `WHAT ACTUALLY HOLDS THIS CLASS AT 2` and matched none of the guessed patterns. The form applies to writing the form. **THE SAME INVARIANT AT WITNESS GRAIN, WHERE THE DECLARED CLAIM IS AN ANNOTATION AND THE RANGE IS THE EXECUTED SPECIMEN (deep-carp-676, gunbc#10602, 2026-09-05).** A claim's note names the mutation it is aimed at, and that sentence is read by every later author as the class's coverage -- but nothing checks that the specimen REACHES the mutated code. Four instances in one lane, each measured rather than reasoned about: two SCM staging claims named `candidate_inherited_from_base` answering the empty corpus while their specimens left the stage POINTER PRESENT, so they never entered the inheritance path at all and stayed GREEN under exactly that mutation; two others were annotated as covering the v4-predecessor-document and post-checkout routes while constructing the post-normalization envelope by hand, bypassing the decoder and the checkout that define those routes. AND THE SAME SHAPE ONE LEVEL UP, IN THE INSTRUMENT: a sweep certifying seven modules clean had passed `--functions __probe__`, and the tool exits 2 on an unresolvable function name BEFORE resolving anything -- so `no diagnostics reported` was `no resolution was attempted`. The wrapper was repaired to assert three facts separately (exit 0, the resolve phase REACHED, no diagnostics) and was then checked with a must-fail control, because an instrument that cannot go red is not evidence about the subject it is pointed at. THE RECOGNITION RULE TRANSFERS WITHOUT CHANGE and gains one imperative: name the claim's DECLARED subject and its EXECUTED subject as two sentences -- and where the declared subject is a mutation, RUN THE MUTATION. A named mutation that leaves the claim green is not a weak control, it is a false coverage statement, and it is worse than no annotation because the next author reads it as a wall. - **a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.) - **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation. From a600f2b86322d413f40f732680cae684c05a2ce5 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Tue, 8 Sep 2026 12:57:26 +0000 Subject: [PATCH 4/4] The specificity relation, not a false discriminator; cite this row's own trigger Two of the three findings are corrections to claims this receipt asserted about other rows without reading them. (1) THE DISCRIMINATOR WAS FALSE. The receipt said the boundary between `absent_reads_identically_to_never_looked` and its specialization is WHETHER THE READ SIGNALLED FAILURE, with the parent as the no-error case. THE PARENT'S OWN TEXT REFUTES IT: it carries arms that are LOUD -- "ALL THREE ARMS ARE LOUD -- stderr, non-zero exit" -- and its sharper statement is that THE SILENCE WAS MANUFACTURED BY THE READER'S FILTER. The false boundary came from reading three specimen LABELS instead of the row, which is this ledger's own artifact-verification defect committed against its own roster, for the second time on this PR. The actual relation is SPECIFICITY, and the specialization states it itself: `empty_capture_read_as_clean_result` is a specialization of that parent, narrowed to the mechanism where the refusal is well-formed and honest and simply travels on a CHANNEL NOBODY KEPT. This specimen matches that narrower mechanism -- exit 128 on a channel the reader discarded -- so it is cited to the specialization because the specialization is more specific, NOT because a test separates the classes. (2) THE CITATION TARGET WAS WRONG. Obligation (2) was cited to `absent_reads_identically_to_never_looked`. It belongs to THIS row's own next-rung trigger, which already names the positive denominator as its capability. The parent's denominator-and-control language establishes THAT THE READER REACHED ITS SUBJECT -- a different fact, at a different point in the pipeline, from THE NON-EMPTINESS OF THE DOWNSTREAM PREDICATE'S ACTUAL CHECKED DOMAIN. Collapsing them is how one obligation gets taken for the other and neither gets built. The either-guard-alone distinction is unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MuB8wHjijaFwNoyzm78stF --- .../predicate_vacuously_true_on_an_empty_domain.dag | 4 ++-- docs/design-failure-modes.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag index 730b1350e3e..a4ef8c41b2e 100644 --- a/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag +++ b/dag/gunbc/recurring_failure_mode/predicate_vacuously_true_on_an_empty_domain.dag @@ -104,9 +104,9 @@ data predicate_vacuously_true_on_an_empty_domain: RecurringFailureMode = Recurri "A COMPOSITION EDGE: THE FIRST LEG OF THIS ROW'S UPSTREAM-FAILURE GENERATOR HAS ITS OWN ROSTERED OWNER (2026-09-08). The paragraph above already owns the general sequence -- an upstream failure manufactures an empty domain and the downstream universal certifies it -- and an earlier draft of this receipt wrongly claimed that sequence as new, having grepped ONE sentence of this row instead of reading it. What is recorded here is narrower and is a RELATION rather than a class: on a measured incident the two legs are owned by DIFFERENT rostered rows firing in sequence. `git show ` EXITED 128 and yielded empty stdout; the exit status was discarded and the empty bytes were split into an empty sentence set; the universal `every sentence the authority gained appears in the projection` then held vacuously and certified a commit that was never read. [[empty_capture_read_as_clean_result]] owns the FIRST failure -- a refusing read consumed as content. This row owns the SECOND -- the universal over the resulting empty domain returning true. NEITHER CLASS ALONE EXPLAINS THE INCIDENT. The bad SHA is provenance for the specimen and nothing more: it explains why this particular read refused, and it changes no mechanism, recognition rule or repair, since wrong paths, wrong windows and refusing reads are all already covered. ", - "WHICH ABSENCE ROW OWNS THE FIRST LEG, since three of them touch this incident and a reader needs the discriminator: it turns on WHETHER THE READ SIGNALLED FAILURE. Here it did -- exit 128, a refusal that was swallowed -- which is [[empty_capture_read_as_clean_result]], whose subject is a well-formed refusal travelling on a channel nobody kept. [[absent_reads_identically_to_never_looked]] is the case where NOTHING ERRORS and the instrument simply never reached its subject, which is why its specimens are a wrong path, a wrong window and a wrong directory rather than a non-zero exit. ", + "WHY LEG ONE IS CITED TO THE SPECIALIZATION AND NOT TO ITS PARENT, and an earlier draft of this paragraph got the reason wrong. It claimed the boundary was WHETHER THE READ SIGNALLED FAILURE, with the parent as the no-error case. THAT IS FALSE AND THE PARENT SAYS SO IN ITS OWN TEXT: [[absent_reads_identically_to_never_looked]] carries arms that are LOUD -- stderr, non-zero exit -- and its sharper statement is that THE SILENCE WAS MANUFACTURED BY THE READER'S FILTER. The false discriminator came from reading three specimen LABELS instead of the row, which is this ledger's own artifact-verification defect committed against its own roster. THE ACTUAL RELATION IS SPECIFICITY, stated by the specialization itself: [[empty_capture_read_as_clean_result]] is a specialization of that parent, narrowed to the mechanism where THE REFUSAL IS WELL-FORMED AND HONEST AND SIMPLY TRAVELS ON A CHANNEL NOBODY KEPT. This specimen matches that narrower mechanism -- exit 128 on a channel the reader discarded -- so it is cited to the specialization because the specialization is more specific, not because any test separates the two classes. ", - "THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED and this receipt does not restate it as its own: [[absent_reads_identically_to_never_looked]] carries it as its tell -- a zero accepted without anything establishing that the instrument resolved its subject, no denominator, no positive control, no assertion that the read was non-empty -- and this row's own next-rung trigger names the positive denominator as the capability. ", + "THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED ON THIS ROW and this receipt does not restate it as its own: THIS ROW'S OWN NEXT-RUNG TRIGGER names the positive denominator as the capability -- every completion or coverage predicate requiring one, so a zero-size population refuses as not-yet-started rather than passing as settled. AND IT IS DELIBERATELY NOT CITED TO [[absent_reads_identically_to_never_looked]], which an earlier draft did: that row's denominator-and-control language establishes THAT THE READER REACHED ITS SUBJECT, which is a different fact at a different point in the pipeline from THE NON-EMPTINESS OF THE DOWNSTREAM PREDICATE'S ACTUAL CHECKED DOMAIN. Collapsing the two is how one obligation gets taken for the other and neither gets built. ", "AND THE SPLIT IS ONLY HONEST WITH THIS SAID, because without it a reader takes one: EITHER GUARD ALONE WOULD HAVE PREVENTED THIS EXACT FALSE PASS. The positive denominator would have rejected the zero-sentence domain with the read failure still swallowed, and preserving the read would have refused before any domain existed. Both are required to repair the COMPOSED CHAIN rather than this instance of it -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. It is not two guards for two holes; it is one hole closable twice, and a chain that needs both of its ends held. ", ], diff --git a/docs/design-failure-modes.md b/docs/design-failure-modes.md index feffa1158a1..068057a3549 100644 --- a/docs/design-failure-modes.md +++ b/docs/design-failure-modes.md @@ -261,7 +261,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **an unhandled state falls to the NOT-YET arm, so a settled answer is reported as a pending one** (a fold reduces a producer's conclusion set to a verdict with an arm per state it knows and a default for the rest, and the default it falls to is NOT-YET-TERMINAL. A state the producer really can emit, but the fold has no arm for, is therefore rendered as STILL WAITING -- and waiting is the one disposition that never resolves, because nothing further is coming. THE DISGUISE IS THE WHOLE DEFECT: an unhandled state normally announces itself by producing a wrong answer, and this one produces NO answer, which is indistinguishable from the fold working correctly over a subject that has not finished. SPECIMEN, 2026-09-02, gunbc PR 10086: `dashboard-ops reviews` reported ready:false with requirement `checks` failing and checks_state `pending`, AT THE SAME INSTANT that GitHub reported the head CLEAN and mergeStateStatus admitted a merge -- and the merge was then taken on GitHub's word, with no override, and was correct. Every job in the run had a terminal conclusion: five `pass` and one `skipping`. The skip is the unhandled state -- a GitHub NEUTRAL, which is a THIRD conclusion beside success and failure -- and the readiness fold, carrying arms for the first two, dropped it into not-yet-terminal. THE MECHANISM IS NOT LAG AND THAT IS THE POINT: the two are the same field with the same value, and only one of them is discharged by waiting. RECOGNITION RULE, and it is the load-bearing part because the status field cannot answer it: when a readiness or aggregate verdict says NOT YET, do not wait on the verdict -- NAME THE SPECIFIC ROW THAT IS NON-TERMINAL AND ASK WHETHER IT CAN EVER BECOME TERMINAL. A row already sitting in a terminal state the fold does not recognise never will, so patience is not a remedy for it and no amount of it produces new information. The falsifier is cheap and available at every such moment: read the producer's own per-row conclusions beside the fold's summary. If every row is terminal and the summary is not, the summary has an arm missing. WHY THIS LOCATION IS WORSE THAN A LOG READER, which is the reason it is ranked rather than merely filed: this is the instrument that decides whether WORK IS DONE. A log reader that under-reports costs a diagnosis and the next reader recovers it; a readiness fold that under-reports costs the MERGE, and it fails in the direction that LOOKS LIKE CAUTION, so nobody overrides it and nobody is embarrassed by it. THE COUNTERFACTUAL IS WHAT MAKES THE ROW ACTIONABLE: a reader following the dashboard alone would still be waiting on a pull request that had been mergeable for an hour -- and would read their own patience as diligence, which is the one failure mode that generates no complaint from the person suffering it. WHY THIS IS NOT `empty_capture_read_as_clean_result`, its nearest neighbour and the class the same session had just extended: that class is about a CAPTURE that is empty, where the reader holds no observation and believes they hold one. Here the observation is complete and correct at every input -- five passes and a skip, all present, all read -- and the loss is in the REDUCTION over them. Merging the two would repeat exactly the defect that produced this row's neighbour, a recognition rule too broad to catch a second instance of its own subject: `size the artifact before grepping it` is the surviving rule there and it is silent here, because the artifact is the right size and says the right thing. WHY THIS IS NOT `state_space_conflation`, the honest neighbour on the other side: all three of that class's forms are defects in a domain THIS TREE MODELS -- an `Option` overloaded past two meanings, a prose dichotomy over three states, a real state carried as an ad-hoc spelling -- and each of their recognition rules ends in ADD THE CONSTRUCTOR OR THE ARM. That repair is unavailable here: the conclusion set is GitHub's and the fold is the dashboard's, neither of which this repository owns, so the actionable rule has to be one a READER can execute against an instrument they cannot edit. That is why the rule above is a discriminator rather than a modelling instruction, and it is the whole reason this is its own row. RUNG FOUND AT: silent wrongness for any consumer of the summary field alone, since the fold reports a value that is not merely imprecise but WRONG about whether the subject can still change, and offers no signal that an input was unrecognised. It is mitigatable for a reader who applies the rule above, which is diligence rather than a mechanism. CEILING: outside the modeled guarantee for the dashboard's own fold, which this repository does not own and can only observe; for the equivalent folds gunbc DOES own, structurally impossible, because a reduction over a CLOSED conclusion set is exactly the case DESIGN section 4's exhaustive match makes unwritable -- a state with no arm fails to compile rather than defaulting. NEXT-RUNG TRIGGER for the part we own: every gunbc fold over a third-party status or conclusion set ingesting that set as a closed coproduct in `extdeps/` with a variant per documented state, so an unmodeled state is a typed, located refusal at the boundary rather than a silent fall-through -- and NOT a default arm that maps the unknown to pending, which is this row's defect re-authored one layer down.) - **a salience instrument blind to the record it sizes** (a change's SIZE IN THE DIFF is read to decide how much attention it deserves, and for one class of artifact that number is wrong by orders of magnitude, so a substantive edit is allocated a trivial edit's scrutiny. The instrument is not merely inaccurate, it is a SALIENCE instrument -- read FIRST, to decide where to look -- which is why the error does damage a plainly wrong number would not: nobody checks a figure they have already used to decide the thing is not worth checking. SPECIMEN, 2026-09-02, gunbc#10044: `git diff --stat -- dag/gunbc/rung_drop.dag` reported `1 insertion(+), 1 deletion(-)` for an edit adding 15,286 bytes, because every `RungDrop` in that corpus is ONE VERY LONG LINE. Three consecutive independent reviews described that hunk as a small wording tweak; a fourth, earlier one attributed it to `direct_call_arg_seam_v2_exemption`, A ROW THE DIFF DOES NOT TOUCH, because git's `@@` header names the declaration PRECEDING the hunk and the edited record is a single line. So one representation produced two distinct review failures -- under-sizing and misattribution -- and n=3 on the first within one pull request. THE APPROVALS WERE NOT WRONG ON WHAT THEY READ: each verdict is defensible over the prose rows the same diff carries, which render normally. What the count concealed is that the PR had three approvals and NO review coverage of the half that carried the receipt. A review tally is a claim about attention, and this instrument silently redirects attention before any reviewer forms a judgment. RUNG FOUND AT: silent wrongness, which is not a rung -- the misallocation leaves no trace, produces a green, and is indistinguishable from a reviewer who looked and found nothing. CEILING: mechanically preventable. The size of a record's diff can be made to track the size of its content, which is a representation question and decidable; it does not reach structural impossibility because nothing stops a future record from being authored as one long line again. NEXT-RUNG TRIGGER, AND IT IS DELIBERATELY NOT 'REVIEWERS SHOULD LOOK HARDER': a representation in which a record's diff size tracks its content size -- the long-line record broken across lines so a diff has hunks proportional to the change, or a review surface that reads the generated projection (`docs/design-failure-modes.md` renders the same content as prose and diffs legibly) rather than the `.dag` line. 'Look harder' is advice, and advice is what a class gets when nobody wants to pay for the fix; it also cannot be discharged, since every reviewer meets the same instrument. RECOGNITION RULE: when a review's description of a hunk is smaller than the hunk, check whether the artifact's line structure and the change's content structure agree. Where one record is one line, EVERY size signal derived from lines -- the diffstat, the hunk header, a line-count budget, a review-effort heuristic -- is answering about the file's shape rather than the change's. The tell is a reviewer citing the enclosing declaration rather than the edited one.) - **ambient process state read by a concurrent reader** (a fact that is really a PARAMETER is instead read from a mutable cell the whole process shares -- the working directory, an env var, a global -- while the runtime schedules concurrent readers of it, so the answer a reader gets depends on which writer last ran and the wrong answer is SILENT: the read succeeds, returns a well-formed value, and is simply about a different subject than the reader meant. INVALID STATE: any reader resolving a relative name against ambient state that a concurrent writer may move mid-read. WHY IT SURVIVES REVIEW: each site is locally correct -- it sets the state to the right value before its own work and restores it after -- and the defect exists only in the PRODUCT of sites, which no single diff shows. SPECIMEN (PR #10024, v1_compiler.cli_run): 38 forward set_current_dir sites in one test binary that cargo runs multi-threaded, with the idiom prior = current_dir(); chdir(ws); work; chdir(prior) -- so one test's RESTORE hands the cwd back while a sibling is mid-read. The victim population is not the writers, it is every non-ignored test in the binary that resolves a relative path during the window; the file's own entry_admission_tests note already records the measurement, a DIFFERENT pair of tests failing on each run of identical code (4/1 then 3/2). Seven of the sites were reachable from the required unit lane and in all seven the chdir was DEAD -- every consumer already took an explicit root -- i.e. residue from an unfinished parameterisation, which is the expected shape once the migration is half done. THE CENSUS THAT MATTERS IS REACHABILITY, NOT THE LITERAL AND THE RANGE THAT MATTERS IS THE POPULATION'S, NOT THE FILE'S: the first cut of that gate scanned the one file its author was editing while declaring the whole lane as its subject, which is a selection view read as a population and puts the reported rung above the executed evidence (DESIGN section 4b(1) reads a class's rung as the MINIMUM across in-scope paths). Widening it to every source file of the lane's crate cost a change of input plus a linear-time call extractor -- the per-name matcher is quadratic in lines times declarations and does not survive the wider corpus -- and it surfaced a second trap immediately: resolving cross-file call edges by BARE NAME merges every declaration of a shared spelling, and this crate declares main 18 times, so one production seed bridged into hundreds of unrelated tests. That arm is the absorbing fallback again, in the guard built to catch it. What survives is intra-file edges plus cross-file edges only for names declared exactly once, with the ambiguous remainder pinned by IDENTITY rather than assumed empty. Six forms of the same defect were found in this one guard; they are rostered as their own class at check_subject_narrower_than_its_declared_claim, which this row is a specimen of rather than an authority for: all seven reached the mutation through a helper, so a body-local grep for the call is green over every instance of the class and stays green the moment a writer is moved one call deeper -- the guard must close transitively over call edges. A SECOND, DISTINCT ARM, kept apart because it has a different remedy: memoizing a value DERIVED from the ambient state (workspace_root's OnceLock over a .git-ancestor walk from cwd) freezes whichever writer won the race for the whole process. On this specimen that arm's population is EMPTY -- every forward site targets the checkout root and 37 of 38 force the memo from the pristine cwd one line above their own call -- so it is reported UNSUPPORTED rather than disproven (see a_structural_possibility_is_not_an_occurring_phenomenon); ONE chdir to a non-checkout path arms it, and a fixture that runs git init is such a path. RUNG: found BELOW the ladder, since a redirected read is a silently wrong answer with no typed refusal anywhere. CEILING 4, structurally impossible, and decidable: state passed as a parameter has no shared cell to race on, so the invalid state has no constructor. The intermediate rung is a reachability gate over the guarded population (no_gating_test_reaches_a_process_cwd_mutator), which keeps the state ABSENT but not unwritable; its next-rung trigger is the capability that every reader in the population resolves from an explicitly passed root, after which the ambient write has no consumer and the call can be removed rather than merely counted. REVIEW TELL: a diff that sets shared process state and restores it, in code the runtime may run concurrently -- the restore is the tell, because it is what makes the site look self-contained. -- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A COMPOSITION EDGE: THE FIRST LEG OF THIS ROW'S UPSTREAM-FAILURE GENERATOR HAS ITS OWN ROSTERED OWNER (2026-09-08). The paragraph above already owns the general sequence -- an upstream failure manufactures an empty domain and the downstream universal certifies it -- and an earlier draft of this receipt wrongly claimed that sequence as new, having grepped ONE sentence of this row instead of reading it. What is recorded here is narrower and is a RELATION rather than a class: on a measured incident the two legs are owned by DIFFERENT rostered rows firing in sequence. `git show ` EXITED 128 and yielded empty stdout; the exit status was discarded and the empty bytes were split into an empty sentence set; the universal `every sentence the authority gained appears in the projection` then held vacuously and certified a commit that was never read. [[empty_capture_read_as_clean_result]] owns the FIRST failure -- a refusing read consumed as content. This row owns the SECOND -- the universal over the resulting empty domain returning true. NEITHER CLASS ALONE EXPLAINS THE INCIDENT. The bad SHA is provenance for the specimen and nothing more: it explains why this particular read refused, and it changes no mechanism, recognition rule or repair, since wrong paths, wrong windows and refusing reads are all already covered. WHICH ABSENCE ROW OWNS THE FIRST LEG, since three of them touch this incident and a reader needs the discriminator: it turns on WHETHER THE READ SIGNALLED FAILURE. Here it did -- exit 128, a refusal that was swallowed -- which is [[empty_capture_read_as_clean_result]], whose subject is a well-formed refusal travelling on a channel nobody kept. [[absent_reads_identically_to_never_looked]] is the case where NOTHING ERRORS and the instrument simply never reached its subject, which is why its specimens are a wrong path, a wrong window and a wrong directory rather than a non-zero exit. THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED and this receipt does not restate it as its own: [[absent_reads_identically_to_never_looked]] carries it as its tell -- a zero accepted without anything establishing that the instrument resolved its subject, no denominator, no positive control, no assertion that the read was non-empty -- and this row's own next-rung trigger names the positive denominator as the capability. AND THE SPLIT IS ONLY HONEST WITH THIS SAID, because without it a reader takes one: EITHER GUARD ALONE WOULD HAVE PREVENTED THIS EXACT FALSE PASS. The positive denominator would have rejected the zero-sentence domain with the read failure still swallowed, and preserving the read would have refused before any domain existed. Both are required to repair the COMPOSED CHAIN rather than this instance of it -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. It is not two guards for two holes; it is one hole closable twice, and a chain that needs both of its ends held. +- **a predicate vacuously true on an empty domain** (a universally-quantified check -- `all`, `every`, `iter().all(..)`, a for-loop that only ever narrows a flag, a SQL NOT EXISTS -- is satisfied by the IDENTITY ELEMENT when its domain is empty, so the check answers TRUE about a population it never examined. INVALID STATE: a guard whose verdict is read as evidence while its domain is empty, with nothing establishing that the domain was non-empty. WHY IT SURVIVES REVIEW, and this is what separates it from an ordinary off-by-one: the code READS as a check, it EXECUTES, it is REACHED, and on every input a reviewer imagines the domain is non-empty and the predicate genuinely discriminates. The vacuous case is not a value in the data -- IT IS PRODUCED BY A BOUNDARY, so it appears only at the end of a line, the end of a buffer, a remainder shorter than the window, an empty selection, the last chunk. Those are exactly the inputs a hand-written fixture omits, and exactly the inputs a real corpus eventually contains. SPECIMEN (PR #10033, measured): a raw-string scanner tested its closing delimiter with `chars[i+1..].iter().take(hashes).all(|h| *h == '#')`. Over a remainder shorter than `hashes` that iterator yields fewer items and `all` is vacuously TRUE, so a quote near end-of-line closes a hash-delimited raw string that is still open, and the rest of the fixture is handed back to the code scanner -- reintroducing the very brace-depth skew the raw-string handling existed to prevent, silently and in the UNDER-approximating direction. The repair is a length bound, not a different predicate: `i + 1 + hashes <= len` conjoined with the same `all`, which leaves the zero-hash case (a raw string with no hashes) trivially satisfied as it must be. RECOGNITION RULE, and it generalises past scanners: A PREDICATE THAT IS TRUE ON THE EMPTY CASE IS NOT A CHECK UNTIL ITS DOMAIN IS PROVEN NON-EMPTY. Ask of every universal: what does this return when the collection is empty, and can the boundary produce empty? If the answer is TRUE and YES, the domain bound is part of the predicate and its absence is the defect. BOUNDED AGAINST THREE NEIGHBOURS, none of whose recognition rules find it. `executed_conjunct_discriminates_nothing` is about a CORPUS that never constructs the falsifying population, so its remedy is a fixture; here the falsifying population is unconstructable at the boundary by the shape of the quantifier itself, and the remedy is a bound on the domain. `empty_observation_narrow` is an OBSERVATION that could not express what changed being rendered as a verdict -- one layer up, about evidence rather than about a predicate's truth value. `incidental_denominator_as_wall` is a guard that holds by a coincidence upstream that genuinely holds; here nothing holds at all, the guard simply returns TRUE. RUNG: found OUTSIDE the ladder, because the wrong answer is silent and well-formed -- the check reports satisfaction. CEILING 4 and decidable per-site: a windowed comparison whose window length is carried in its type cannot be asked about a short remainder. The intermediate rung is an executed control that exercises the BOUNDARY case specifically, asserted on a synthetic input rather than on the live corpus, so it keeps discriminating power when the corpus changes. **RECEIPT 2026-09-03 (jolly-ferret-412, gunbc#10141), AND THE EMPTINESS CAME FROM A PARSE DEFECT RATHER THAN AN EMPTY POPULATION.** Building the required floor's refused-carrier overlap wall, I joined every admitted cross-claim share key's observed consumer modules against each refused row's carriers to prove the wall would not red main, and reported all six keys clean against all four refused rows. The join captured nothing. The regex was `cache=... key=(\S+).*modules=(\S+)` and the ledger line carries `consumer_modules=53` BEFORE it carries `modules=a,b,c` -- `consumer_modules=` ends in `modules=`, so the non-greedy match took the COUNT and every intersection was against a set holding the single token `53`. Every key read clean because nothing was ever compared. The floor then refused on a real overlap standing in that same ledger, and in the main-vintage run I had also declared clean. **WHY THIS VARIANT MATTERS SEPARATELY: the domain was NOT empty.** The population existed, the stream was right, and the instrument took the wrong token out of it -- so every review question about whether the population might be empty answers reassuringly, and the emptiness is one field name away rather than anywhere a reader would look. Every ledger-joining instrument in this repository parses a field out of a rendered line, so the recurrence surface is the whole class of them. **RECOGNITION RULE FOR THIS VARIANT: anchor a field capture on its delimiter (` modules=`, never `modules=`), because any field name can be a SUFFIX of another; and before citing a join that found nothing, plant a positive -- intersect against a value you know is in the data and confirm it comes back.** A join whose only output is `clean` has not been shown to compare anything. **STRUCTURAL FIX, LANDED WITH THE SPECIMEN rather than only written down:** the wall now refuses `PureProducerShareObservedCarriersVacuous` when fills were recorded and not one carries a consuming module, so an empty observed domain is a typed refusal instead of a clean verdict, and its RED is enrolled beside the wall's own. The refused side of the same join was already asserted at decode -- a refused row with an empty carrier set refuses there, because it could never fire.**RECEIPT 2026-09-04 (vivid-ibex-751, gunbc#10311), THE `.is_empty()` FORM: A COMPLETION PREDICATE WHOSE EMPTINESS IS INDISTINGUISHABLE FROM ITS SATISFACTION.** This variant was first written as a separate row, `completion_predicate_satisfied_by_the_empty_population`, and that was a re-invention refused at review: `nothing outstanding` over a population of nothing is the SAME identity-element coincidence as a universal quantifier over an empty domain, and it has the same recognition rule and the same remedy. It is recorded here as a variant because the QUANTIFIER IS INVISIBLE IN IT -- there is no `all`, no `every`, no loop for a reader to interrogate, only a conjunction of `.is_empty()` terms, so the question this row tells you to ask has nothing syntactic to attach to. WHAT MAKES THE `.is_empty()` FORM WORSE THAN THE `all` FORM is that it fails toward DONE at exactly the moment someone is waiting: the population is empty precisely when work has just started or a head has just been pushed. SPECIMEN: `claim_executor` `required_floor_outcome_is_clean` is a conjunction of ELEVEN `.is_empty()` terms with no denominator anywhere in it, and zero planned claims satisfies all eleven and returns clean. THE ADJACENT SITE ALREADY REFUSES THE CLASS IN WRITING, which is what makes the pair the argument: `required_floor_runner`'s expected-red roster decode refuses `ExpectedRedRosterEmpty` at zero identities, stating that an empty roster makes the partition-sum and did-not-execute checks vacuous, and naming the shape as `a read failure quietly wearing the same face as success`. **THE PROTECTION CITED IN THE CODE IS TRUE AND VACUOUS IN EXACTLY THE CASE IT NAMES.** `run_required_floor` is documented as refusing when planned, executed and terminal identity counts disagree, `so a silently short roster cannot report as a pass`. At zero that invariant reads `0 == 0 + 0`: it holds, it is advertised as the cover for a short roster, and it is satisfied by the roster being absent entirely. STRUCTURAL VACUITY IS ESTABLISHED; REACHABILITY IS NOT -- whether any route drives the floor to a zero planned population is untraced, and a `FloorDiscoveryRefused` arm may close every one of them. THREE FURTHER RECEIPTS FROM LANE TOOLING IN ONE EVENING, ALL FAILING TOWARD DONE: a `case` partition over a check conclusion where running checks rendered EMPTY and the catch-all arm was TERMINAL, reporting SETTLED with five checks in progress; a monitor printing `pending=0 failing=[]` for a pull request whose rollup was empty, written an HOUR AFTER that first instance was written up and using the corrected predicate; and a watch whose condition was `no pending checks`, satisfied by NO CHECKS AT ALL on a just-force-pushed head, reporting CONCLUDED forty minutes early. **TWO OF THE THREE WERE WRITTEN AFTER THIS ROW EXISTED, WHICH IS WHAT DECIDES THE REMEDY.** Knowing the class did not protect the next instrument either author wrote, so the remedy does not belong in anyone's attention -- it belongs in the predicate. **RECEIPT 2026-09-05 (vivid-ibex-751, gunbc#10345), THE REGISTRATION FORM: THE EMPTY DOMAIN WAS THE SUBJECT'S OWN REGISTRATION, AND TWO PARTIES VERIFIED PROPERTIES OF IT WITHOUT EITHER CHECKING THAT IT EXISTED.** A merge took the base's roster verbatim and re-applied two identities on top; the re-application edited the WORKING TREE and was never staged, and a merge commits the INDEX, so the base's roster landed and both registrations were absent from the commit. The row files were present and unimported: 117 rostered against 119 row files. Seven verification joins ran and all seven passed. **THE PRIOR VARIANTS OF THIS ROW ARE MACHINE PREDICATES; THIS ONE IS A DELIBERATE MANUAL AUDIT BY TWO PARTIES, WHICH IS WHY IT IS RECORDED SEPARATELY.** There was no `all`, no `.is_empty()`, and no instrument to interrogate -- just two readers each enumerating a population that did not contain the missing thing. The author's joins asked whether every ROSTERED identity has a row file: true, and vacuous, because an unregistered row file is outside the roster, and the roster IS the population being enumerated. The reviewer's gate asked what identities the head ADDS to the roster do in the projection: true, and vacuous, because the added set was empty. **THE TWO AUDITS WERE COMPLEMENTARY AND BOTH LANDED ON THE SAME EMPTY SET FROM OPPOSITE SIDES, AND BOTH REPORTED CLEAN AND CONFIDENT -- THE CONFIDENCE IS THE TELL, NOT THE PASS.** **THE REMEDY FOR THE REGISTRATION FORM IS TWO INDEPENDENT ARMS, EITHER ONE SUFFICIENT, AND THE INCIDENT REQUIRED BOTH TO BE ABSENT -- WHICH IS THE USEFUL ENGINEERING STATEMENT RATHER THAN `AUDIT MORE CAREFULLY`.** The REVERSE JOIN would have caught it even measured on the wrong artifact: `comm -13 roster files` asks whether every ROW FILE is rostered, whose population is the files rather than the roster, so an unregistered file cannot hide in it. One direction finds rostered-with-no-file; only the other finds file-with-no-roster, and a roster-scoped check can never report the second. The INDEX READ would have caught it even in one direction: `git show :path` before committing and `git show :` after, because `git checkout -- ` STAGES while a subsequent edit does NOT, and a commit takes the index -- so a verification reading the working tree measures a CANDIDATE and not the SUBJECT, and on this path the two silently differed. **THE UNSTAGED EDIT IS AN ORDINARY SLIP THAT WILL RECUR FOREVER; WHAT MADE IT AN INCIDENT IS THAT NOTHING DOWNSTREAM COULD SEE IT.** The row is about the invisibility, not the omission, which is what decides where the remedy goes: into the predicate's DIRECTION and its SUBJECT, never into anyone's care. **NEXT TRIGGER FOR THIS VARIANT, NAMED AS THE CAPABILITY AND WITH WHAT IT MUST BE SUFFICIENT FOR:** every completion or coverage predicate on the required floor requires a POSITIVE DENOMINATOR, so a zero-size population refuses as NOT-YET-STARTED rather than passing as settled -- sufficient for no `FloorClean` verdict being derivable from an empty planned population. Adding one guard at `claims_planned` is the artifact-grained version and discharges nothing: it leaves the class alive at every predicate nobody has enumerated.**A SECOND AND WORSE GENERATOR, 2026-09-05, gunbc#10545: THE EMPTY DOMAIN PRODUCED BY AN UPSTREAM FAILURE RATHER THAN BY A BOUNDARY IN THE DATA.** The scanner specimen above produces its vacuous case from an input-shaped edge -- a remainder shorter than a window -- which loses ONE assertion. This generator loses the assertion AND the fault it was standing over: a pipeline stage fails open into an empty result, every downstream universal then passes vacuously, and THE CHECK THAT WOULD HAVE SURFACED THE ORIGINAL FAILURE INSTEAD CERTIFIES IT. The emptiness is not an edge case in the subject; it is a SYMPTOM OF AN UNRELATED DEFECT, and the vacuous check is what hides it. **FOUR INSTANCES IN ONE PR, THREE OF THEM IN ASSERTIONS WRITTEN TO CATCH THIS EXACT CLASS.** The subject was a Step 0 calibration instrument whose whole purpose is finding distinctions that die before their consumer. (i) A POSITIVE CONTROL passed an empty cell list to the verdict and got success: no cells means no unsound cells, so nothing-measured and nothing-wrong reached the same exit. (ii) The VERDICT reproduced it one level up -- an empty or short traversal has an empty unsound-cell list, so the report would have exited success over a matrix it never built. (iii) A WET WITNESS asserted `Filesystem.Read(path).success` to prove the refusing report had written its matrix; A READ OF A ZERO-BYTE FILE SUCCEEDS, so a report that created the file and wrote nothing satisfied the arm whose entire purpose was that the operator GETS the evidence before the line stops. Repairs: a positive denominator on the traversal, and a payload compared against the authoritative renderer over the SAME cells rather than a second rendering. **(iv) WAS IN THE VERIFICATION SCRIPT, WHICH IS WHERE THIS CLASS SURVIVES LONGEST AND IS THE FAIL-OPEN GENERATOR IN ITS PUREST FORM.** A shell identity join of PR-body-named controls against real `test fn` declarations printed `claimed but absent: none` and was nearly accepted as verification. The `tr` in the extraction had errored, so the claimed side was EMPTY and `comm -23` was vacuously clean. It was written MINUTES AFTER the commit message describing (i)-(iii), by the author who had just repaired them. A verification script is the one artifact nobody reviews and whose green nobody re-derives, so a vacuous assertion there is both the likeliest to be written and the longest-lived. IF THE REMEDY WERE `REMEMBER TO GUARD IT`, THAT IS THE MOMENT IT WOULD HAVE WORKED. **THE SHELL INSTANCE IS OUTSIDE THE MODELED GUARANTEE AND MUST NOT BORROW THE .dag RUNG.** Instances (i)-(iii) are `.dag` and are reachable by the positive-denominator capability this row already names as its trigger. Instance (iv) is a shell pipeline where no `.dag` construction can forbid the vacuous state, and `set -o pipefail` does not cover it either -- a `tr` that errors mid-substitution still yields an empty stream to a successful downstream stage. That places it in DESIGN section 4b's ADJACENT COLUMN, outside the modeled guarantee, observed or refused at a DECLARED boundary: in practice the shell instrument asserts its own denominator before it joins, WHICH IS MITIGATION, RUNG 1, and is stated as such. Writing the scope down is the point -- an unwritten scope is read as wider than it is, and the `.dag` wall would otherwise be cited as coverage for a medium it cannot reach. **A NEAR-MISS WORTH MORE THAN THE FIX, RECORDED BECAUSE THE ROSTER CAUGHT IT AND NO REVIEWER DID.** On finding these four, the proposed remedy was to move the guard out of each caller and into a shared JOIN PRIMITIVE that refuses an empty claimed side. This row had already reasoned past that: a guard at one call site is ARTIFACT-GRAINED AND DISCHARGES NOTHING, and a join primitive is exactly that unless it is the ONLY join route -- which it is not, and cannot be made to be while an author can write a bare `comm`. So the proposal was one more guarded site wearing the language of a capability, and it would have WEAKENED this row's existing trigger by sitting underneath it. THE THIRD TIME IN ONE DAY A PROPOSED NEXT-RUNG TRIGGER NAMED LESS THAN THE CAPABILITY IT WAS MEANT TO RESTORE. The check that caught it was reading the roster before writing, not review. **(v) A FIFTH INSTANCE THE SAME DAY, AND THE ONLY ONE WHOSE CONCLUSION WOULD HAVE BEEN TRUE -- WHICH IS WHAT MAKES IT THE WORST OF THE FIVE.** Diagnosing a floor refusal on gunbc#10545 while the run was still executing, the job-log API returned a ONE-LINE FILE reading `run is still in progress`. That file was then grepped for the module under test, matched nothing, and was one step from being reported as `the route-gaps are gone and the module is clean`. THE ROUTE-GAPS WERE IN FACT GONE, so the report would have been CORRECT -- drawn from a REFUSAL MISTAKEN FOR AN ABSENCE. A false conclusion is caught by the next reader who disagrees with it; a correct conclusion obtained by a method that cannot distinguish absence from refusal is NEVER CAUGHT, because nothing downstream ever disagrees. The evidence rots while the claim stays true, and the same procedure run again produces a wrong answer with identical confidence. Instances (i)-(iv) lose an assertion; THIS ONE LOSES THE ABILITY TO EVER LEARN THAT THE ASSERTION WAS LOST. **(v) IS ALSO THE ONE INSTANCE WITH A CONSTRUCTION REPAIR RATHER THAN A GUARD, AND THE CONTRAST IS THE USABLE PART OF THIS ROW.** The artifact-grained fix was available and tempting: check that the captured file is non-empty before grepping it. That is validation, it is the same one-more-guarded-site this row has already refused twice, and it leaves the refusing stream in the procedure. The repair actually taken REMOVES THE EMPTY-CAPTURE STATE FROM THE PROCEDURE INSTEAD OF CHECKING FOR IT: the typed failure causes are read from the run RECEIPT -- `gh run download --name required-ci-measurement-receipt` -- which returns the blockers as structured data ONCE THE RECEIPT IS PUBLISHED -- and the scope of that word is the correction a reviewer had to supply, because the first draft of this receipt said REGARDLESS OF RUN STATE and that is false. `gunbc.witness_floor_workflow` publishes the artifact in a step guarded `if: always() && !cancelled()`, AFTER the measurement step, so before publication the route has nothing to serve and on a CANCELLED run it never publishes at all. What is true, and is what was actually observed, is narrower and still useful: the receipt is available while the RUN is still in progress, because the publishing job's step has already run -- which the log endpoint cannot match, since it is a stream that refuses mid-run. SO THE REMEDY IS SCOPED AND ITS UNAVAILABLE CASE MUST STILL REFUSE: read the published receipt where one exists, and where none exists REFUSE EXPLICITLY rather than falling back to the stream that produced this class. A remedy asserted wider than its availability is the same overstatement one level up. SCOPE, STATED SO IT IS NOT READ WIDER: this removes ONE GENERATOR ON ONE ROUTE. It does not touch instances (i)-(iv), it does not discharge this row's trigger, and every other lane reading a log that can refuse still has the state. **(vi) A SIXTH, FROM A DIFFERENT LANE AND A DIFFERENT SUBSTRATE, WHICH IS WHY IT IS WORTH RECORDING BESIDE FIVE FROM ONE AUTHOR.** quick-heron-85, 2026-09-05: a pool probe reported a confident PASS having emitted ZERO FILES, in 0ms. Every assertion in it ranged over the emitted population, the population was empty because the emit never happened, and each universal held vacuously -- so the probe reported the strongest possible result about a run that did not occur. The 0ms is the tell and it is the same tell as the one-line log file and the 114-of-114 row count: a number that is implausible for the work claimed. IT WAS CAUGHT BY READING THE OUTPUT, not by anything refusing, which is the sixth consecutive instance of this class being caught by an author's attention rather than by a mechanism. **THESE SIX ARE A RECORD AND NOT A REPAIR, and `a_written_row_is_not_a_firing_mechanism` requires that be said rather than left for a reader to work out.** After they land, nothing is harder to type: a universal over a possibly-empty domain is still the shortest thing to write, and the next author attending to their GOAL rather than to the class of their step will write one, exactly as the author of these did minutes after repairing the first three. The one construction repair, in (v), removes a single generator on a single route and is scoped to it. This row's existing trigger -- the positive denominator on every completion or coverage predicate -- is the repair for the rest, and it is NOT DISCHARGED by these specimens. They raise the demand for it; they do not meet it. The class stands UNREMEDIED. **WHAT ACTUALLY CAUGHT FOUR OF THE FIVE WAS A HUMAN NOTICING A NUMBER LOOKED WRONG, AND THAT IS THE ABSENCE OF A MECHANISM RATHER THAN THE PRESENCE OF ONE.** A one-line capture file where a log was expected, a row count of 114 out of 114, a `comm` join reporting `none` on both sides: three implausible NUMBERS, noticed by an author who happened to be attending to the step rather than to the goal. No gate fired, no lens ran, no review found any of them. THREE SAVES IN ONE DAY BY THE SAME FACULTY MUST NOT BE READ AS A PRACTICE -- this row already records that the faculty predictably does not fire when the author is attending to the goal, which is the ordinary case and was the case in the instance that got closest to shipping. If these specimens are ever cited as evidence that authorial attention covers this class, THAT CITATION IS WRONG AND THIS SENTENCE IS THE REFUTATION. A COMPOSITION EDGE: THE FIRST LEG OF THIS ROW'S UPSTREAM-FAILURE GENERATOR HAS ITS OWN ROSTERED OWNER (2026-09-08). The paragraph above already owns the general sequence -- an upstream failure manufactures an empty domain and the downstream universal certifies it -- and an earlier draft of this receipt wrongly claimed that sequence as new, having grepped ONE sentence of this row instead of reading it. What is recorded here is narrower and is a RELATION rather than a class: on a measured incident the two legs are owned by DIFFERENT rostered rows firing in sequence. `git show ` EXITED 128 and yielded empty stdout; the exit status was discarded and the empty bytes were split into an empty sentence set; the universal `every sentence the authority gained appears in the projection` then held vacuously and certified a commit that was never read. [[empty_capture_read_as_clean_result]] owns the FIRST failure -- a refusing read consumed as content. This row owns the SECOND -- the universal over the resulting empty domain returning true. NEITHER CLASS ALONE EXPLAINS THE INCIDENT. The bad SHA is provenance for the specimen and nothing more: it explains why this particular read refused, and it changes no mechanism, recognition rule or repair, since wrong paths, wrong windows and refusing reads are all already covered. WHY LEG ONE IS CITED TO THE SPECIALIZATION AND NOT TO ITS PARENT, and an earlier draft of this paragraph got the reason wrong. It claimed the boundary was WHETHER THE READ SIGNALLED FAILURE, with the parent as the no-error case. THAT IS FALSE AND THE PARENT SAYS SO IN ITS OWN TEXT: [[absent_reads_identically_to_never_looked]] carries arms that are LOUD -- stderr, non-zero exit -- and its sharper statement is that THE SILENCE WAS MANUFACTURED BY THE READER'S FILTER. The false discriminator came from reading three specimen LABELS instead of the row, which is this ledger's own artifact-verification defect committed against its own roster. THE ACTUAL RELATION IS SPECIFICITY, stated by the specialization itself: [[empty_capture_read_as_clean_result]] is a specialization of that parent, narrowed to the mechanism where THE REFUSAL IS WELL-FORMED AND HONEST AND SIMPLY TRAVELS ON A CHANNEL NOBODY KEPT. This specimen matches that narrower mechanism -- exit 128 on a channel the reader discarded -- so it is cited to the specialization because the specialization is more specific, not because any test separates the two classes. THE TWO OBLIGATIONS FOR A COMPOSED CHAIN, AND ONE OF THEM IS CITED RATHER THAN RE-DERIVED. (1) PRESERVE OR REFUSE THE FAILED READ: inspect the exit status so an upstream fault cannot become content. (2) REQUIRE A POSITIVE DENOMINATOR ON THE ACTUAL CHECKED DOMAIN -- not a synthetic control, which proves only that the MATCHER discriminates and says nothing about whether the domain had members. THAT SECOND OBLIGATION IS ALREADY ROSTERED ON THIS ROW and this receipt does not restate it as its own: THIS ROW'S OWN NEXT-RUNG TRIGGER names the positive denominator as the capability -- every completion or coverage predicate requiring one, so a zero-size population refuses as not-yet-started rather than passing as settled. AND IT IS DELIBERATELY NOT CITED TO [[absent_reads_identically_to_never_looked]], which an earlier draft did: that row's denominator-and-control language establishes THAT THE READER REACHED ITS SUBJECT, which is a different fact at a different point in the pipeline from THE NON-EMPTINESS OF THE DOWNSTREAM PREDICATE'S ACTUAL CHECKED DOMAIN. Collapsing the two is how one obligation gets taken for the other and neither gets built. AND THE SPLIT IS ONLY HONEST WITH THIS SAID, because without it a reader takes one: EITHER GUARD ALONE WOULD HAVE PREVENTED THIS EXACT FALSE PASS. The positive denominator would have rejected the zero-sentence domain with the read failure still swallowed, and preserving the read would have refused before any domain existed. Both are required to repair the COMPOSED CHAIN rather than this instance of it -- the first preserves and LOCATES the original fault, the second closes vacuity from every other origin. It is not two guards for two holes; it is one hole closable twice, and a chain that needs both of its ends held. - **a check's subject is narrower than the claim it is cited for** (EVERY DEGREE OF FREEDOM IN A CHECK'S SUBJECT -- which call sites, which spellings, which lexical states, which domain, which files -- is a place its coverage can silently be narrower than the population it is read as covering. INVALID STATE: an executing, reached, green check whose declared subject is a strict superset of the population its implementation actually ranges over. RUNG: outside the ladder, because the gap is invisible from the check's own result -- a wall whose range is too narrow is green for the same reason a wall over a clean corpus is green, and DESIGN section 4b(1) reads a class's rung as the MINIMUM across its in-scope paths, so a check like this INFLATES the rung of everything it is cited for. THE ROUTE IS WHAT MAKES IT INVISIBLE: the narrowing is never a decision, it is the shape of the first implementation -- an author edits one file, so the scanner reads one file; the corpus spells the call one way, so the seed matches one spelling; the fixture has no raw strings, so the projection has no raw-string state; the window is never short, so the universal is never vacuous. Each is locally reasonable and none is written down, which is why the gap survives the review that reads the check's LOGIC and never asks what its INPUT was. SPECIMEN, and the reason this is a class rather than a bug: ONE guard in PR #10033 carried SIX instances -- (1) a body-local grep for the mutator, defeated by moving the call one helper deeper; (2) a seed matching only the fully-qualified path, defeated by `use std::env;`; (3) a lexical projection with no raw-string state, so an unbalanced brace in a fixture silently shifted every containment decision after it; (4) `take(n).all(..)`, vacuously true over a short remainder (rostered as predicate_vacuously_true_on_an_empty_domain); (5) a scan ranging over ONE FILE while the scope declaration claimed every test the required lane runs -- found by review, not by the author; and (6) after widening, cross-file call edges resolved by BARE NAME, which merges every declaration of a shared spelling (18 `main`s in that crate) and bridged one production seed into hundreds of unrelated tests. Four were found by the author, one by review, one by the widening itself, and the sixth is the mirror of the fifth: over-broad and under-broad are the same defect measured in opposite directions, and both are reported as coverage. RECOGNITION RULE: name the check's SUBJECT and the check's RANGE as two separate sentences, then ask what is in the first and not the second. If the answer is anything, the claim is the narrower one until the range is widened. The review-side tell is a scope comment that quantifies (`every test`, `all modules`, `any call site`) beside an implementation that names ONE input. BOUNDED AGAINST TWO NEIGHBOURS. selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population, arriving as the fix for a real objection; here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it. incidental_denominator_as_wall is a guard that holds by an upstream coincidence that genuinely holds; here the guard holds over a population it never read. CEILING 3, structurally guaranteed and decidable, BUT SCOPED TO THIS CLASS'S EXECUTING FORMS AND NOT TO THE CLASS (scope amended when the ninth form landed): a check whose subject is a VALUE it receives rather than a scope its implementation re-derives cannot range over less than it claims, because the claim and the range are then one object. That derivation needs an executing check with an input. Every form above it is one, so the limit was never visible and the ceiling read as belonging to the class when it belongs to a sub-case: where the subject is a WRITTEN SURFACE a human is supposed to read completely, the claim and the range stay TWO objects and cannot inherit this ceiling. The ninth form below is that sub-case and carries no rung of its own. NEXT-RUNG TRIGGER, named as a capability: the guarded population is passed to the check as a constructed value carrying its own extent, sufficient that no check can name a subject its input does not contain. WHAT IS NOT CLAIMED: that widening always wins. Narrowing the DECLARATION to match the range is equally honest and is sometimes correct -- what is forbidden is leaving the two different, and the choice between them is a cost measurement, not a preference. On this specimen widening cost one change of input plus one linear-time rewrite of a quadratic edge builder, and the wider check ran FASTER than the narrow one, which is what settled it.) A SEVENTH FORM, AND THE FIRST WHERE THE NARROWING IS AN AXIS OF THE COMPARISON RATHER THAN A RANGE OF INPUTS (2026-09-03). The six above narrow WHICH INPUTS a check sees; this one narrows WHAT IT COMPARES, so it is invisible even over a complete corpus. `v1_compiler.behavioral_receipt_host` `behavioral_differential` is cited as the executing evidence for DESIGN section 7 behavioural equivalence, and its own doc comment cites section 7 by name. What it RANGES OVER is the seed-Rust versus emitted-Rust axis: `generate_receipt_driver` emits a Rust main that prints each planned call, and the differential runs that ONE driver twice -- against the tree as committed, then after the candidate overwrites its mirror and the crate is rebuilt. Both transcripts come from COMPILED RUST BINARIES, so any property the two realizations SHARE is unobservable to it by construction, however clean the corpus. THE DISCRIMINATING INSTANCE IS NOT THIS ROW'S TO STATE, AND CITING IT RATHER THAN RESTATING IT IS THE POINT (amended 2026-09-03). The interpreter-versus-emitted evaluation divergence has an owner with better evidence than prose: `realization_arms_diverge_on_whether_the_program_refuses`, filed by gunbc#10139, which carries the source reading in both directions AND an EXECUTED red -- `fn guarded_division(n: Int) -> Bool { n != 0 && (100 / n) > 1 }`, run and dated, explicitly not asserted. An earlier draft of this receipt described that divergence in its own words. That would have been a second authority for a fact this ledger already owns, committed inside the row about subjects narrower than their claims, which is the specimen writing itself. WHAT IS THIS ROW'S OWN SUBJECT is the other half and a different fact: THE INSTRUMENT CANNOT SEE IT. Both of `behavioral_differential`'s arms are compiled Rust, so they share the target's evaluation semantics and agree with each other -- wrongly, together -- on exactly the inputs where that cited class occurs. The divergence is #10139's; the blindness of the equivalence instrument to it is this row's. THE REVIEW TELL FOR THIS FORM: ask what the two sides of a comparison SHARE, not what the check ranges over -- a differential between two realizations of one target cannot see a property of that target. The ordinary tell, a green over a population nobody checked, is unavailable here: this instrument is green for a reason no input can change. ONE NEIGHBOUR CHECKED AND EXCLUDED, so the next reader does not re-derive it: `v2.compiler.emit_host` `run_test_claim_emit_vs_eval` IS enrolled on the required floor and DOES pair an executed emitted answer with an interpreted one, with a positive control and a discriminating negative. But it evaluates `expected_eval_root` while host-running the emitted `claim_input_root` -- two different roots -- so it is an ORACLE comparison and the interpreter never evaluates the expression the target runs. Its subject excludes same-expression evaluation divergence structurally, not by coverage. THE AUTHOR'S OWN INSTANCE, recorded because it happened while filing this: the first draft claimed NO required phase pairs an interpreted answer with an emitted-and-executed one, derived by enumerating the closed five-variant `RequiredCiPhase` and then asserting what its members execute without reading them. The population was closed; the claim about its members was never checked -- a real enumeration, divided by nothing. It was refuted by the very rows that refused the pull request being worked on.AN EIGHTH FORM, AND THE FIRST WHERE THE BLIND SPOT IS NOT ARBITRARY BUT CORRELATED WITH RECENCY (2026-09-03, tidy-koi-619 on gunbc#10106, with warm-seal-35 as the finder). Every form above treats the narrowing as ARBITRARY -- 'never a decision, the shape of the first implementation'. When the narrowed axis is a DIRECTION over a time-ordered subject, the narrowing stops being arbitrary and starts tracking recency, which makes it strictly worse than a random miss. THE INSTANCE: a squash-merged branch survives as a divergent-looking branch and auto-opens a pull request that would REVERT main. Diagnosing gunbc#10242 I enumerated what a merge would wrongly RE-ADD -- 47 namespace admissions consumed by their own merge, plus three files deleted on main -- and concluded, in the comment closing it, 'there is no file where this branch carries content main wants'. THAT SENTENCE IS TRUE. Its subject is one direction; its reading is completeness. The 54 differing paths were 43 common-but-differing, 3 branch-only which a merge RE-ADDS, and 8 main-only which a merge DELETES -- and the deletion category, which the sweep never ranged over, contained a witness test that had landed twenty minutes earlier. WHY RECENCY MAKES IT WORSE: the newest work on main is NECESSARILY in the merge-would-delete category, because the more recently something landed the more certain it is to be absent from a superseded branch. So this sweep's blind spot is not spread evenly over the population -- it concentrates on exactly the rows that are newest, least recoverable, and least likely to be noticed missing, since nobody is yet watching for the absence of a thing that landed twenty minutes ago. A check whose miss probability rises with the value of what is missed is a different economic object from one that misses uniformly, and the review tell is different too: it is not 'what population did this range over' but 'is the missed set correlated with anything, and with what'. RECOGNITION RULE FOR THIS FORM: when a check's subject is a COMPARISON between two states, name both directions as separate sentences and range over both -- present-on-A-absent-on-B and present-on-B-absent-on-A are two populations, and a size or presence heuristic run one way answers only one of them. WHY IT IS FILED HERE AND NOT AS ITS OWN CLASS: three instances arrived within one day from three unrelated angles -- a record comparator that could not parse a parameterized constructor and so reported None == None as agreement on the `standing` field; an assert-count-is-1 guard over a citation sweep that held because the PATTERN was narrow rather than because the file was clean; and this one-directional diff sweep. The author's first instinct was to mint a new class around the sentence 'a check that does not state its own denominator cannot be distinguished from a complete one'. That sentence is this row's INVALID STATE restated, so a new row would have been a second authority for a rostered fact -- the DESIGN section 2 failed decomposition, committed inside the ledger that exists to prevent it, which is the same self-demonstration the seventh form records. The class was already here; only the recency observation was new. A NINTH FORM, WHERE THE SUBJECT ITSELF MOVED UNDER THE CHECK (2026-09-05, adjudicated in jolly-dove-86, measured on gunbc#10552). It is numbered ninth because this row already carried an eighth; the brief that commissioned it said eighth, and the row is the authority on its own count. STATEMENT: a repair changes the SUBJECT that the earlier observation described. Completeness and correctness must be established against the FINAL SUBJECT, with the selection boundary explicit; finding the newly inserted wording is not that establishment. THE REASONING UNDER IT: checked revision A, plus edit A to B, does not equal checked revision B, without a preservation argument or a renewed inspection. The escape clause is not decoration -- RENEWED INSPECTION DISCHARGES IT, and reading the final text once IS an adjudication. No impossibility is claimed here: an earlier draft said such a sweep can never close, and that was refuted, because renewed reading is the only mechanism that actually works. RUNG: this form carries NONE. It is the sub-case the amended ceiling above excludes -- the subject is a written surface, so no input can be constructed to carry its extent, and the claim and the range remain two objects. SPECIMEN ONE, three reviews that ranged over less than the row they reviewed: 5120939460, 5121228544 and 5121282475, none of which reached `test.claim.phantom_marker_type_argument_identity_witness` -- the file the row under repair CITES -- where two corrected-away formulations stood verbatim. The enumeration found them; no reviewer did. SPECIMEN TWO, and it is what fixes the UNIT of repair: a repair landed at the QUOTED text, left the FRAMING sentence directly above it standing, and left a dependent two paragraphs BELOW it standing too -- one that never quoted the premise it rested on (`a trigger whose owner has ceased to exist is retired by nothing at all`). That dependent contained none of the repair's search terms precisely because it RESTED on the premise rather than quoting it. So the unit of repair is the ENTAILMENT NEIGHBOURHOOD of the premise -- framing above, dependents below, sibling surfaces -- and it is BIDIRECTIONAL. A phrase-keyed sweep is keyed on quotation, and entailment does not quote. REFUSED TRIGGER, recorded WITH its reason so it is not re-proposed: `enroll the sweep in CI`. Mechanisation moves the INVOCATION, not the SUBJECT -- the same incomplete phrase search would execute reliably over the same incomplete subject, so the trigger would fire while the capability stayed dead, which is exactly the DESIGN section 4b(3) grain mismatch between a loss sentence and its trigger. Rung 2 needs an adequate subject definition, a valid checking relation AND a consumer; automation supplies only the third. THE NEIGHBOUR CHECKED AND EXCLUDED, using that row's own bounding text: selection_view_read_as_population is a set produced by a MEASUREMENT threshold and read as the population. Here nothing is measured and nothing is filtered -- the range was simply never as wide as the sentence beside it, which is this row's invariant, so the form is filed here and not minted. The corroborating receipt from the row's own repair day: a phrase-keyed sweep certified that repair clean and missed four survivors, because the live one read `WHAT ACTUALLY HOLDS THIS CLASS AT 2` and matched none of the guessed patterns. The form applies to writing the form. **THE SAME INVARIANT AT WITNESS GRAIN, WHERE THE DECLARED CLAIM IS AN ANNOTATION AND THE RANGE IS THE EXECUTED SPECIMEN (deep-carp-676, gunbc#10602, 2026-09-05).** A claim's note names the mutation it is aimed at, and that sentence is read by every later author as the class's coverage -- but nothing checks that the specimen REACHES the mutated code. Four instances in one lane, each measured rather than reasoned about: two SCM staging claims named `candidate_inherited_from_base` answering the empty corpus while their specimens left the stage POINTER PRESENT, so they never entered the inheritance path at all and stayed GREEN under exactly that mutation; two others were annotated as covering the v4-predecessor-document and post-checkout routes while constructing the post-normalization envelope by hand, bypassing the decoder and the checkout that define those routes. AND THE SAME SHAPE ONE LEVEL UP, IN THE INSTRUMENT: a sweep certifying seven modules clean had passed `--functions __probe__`, and the tool exits 2 on an unresolvable function name BEFORE resolving anything -- so `no diagnostics reported` was `no resolution was attempted`. The wrapper was repaired to assert three facts separately (exit 0, the resolve phase REACHED, no diagnostics) and was then checked with a must-fail control, because an instrument that cannot go red is not evidence about the subject it is pointed at. THE RECOGNITION RULE TRANSFERS WITHOUT CHANGE and gains one imperative: name the claim's DECLARED subject and its EXECUTED subject as two sentences -- and where the declared subject is a mutation, RUN THE MUTATION. A named mutation that leaves the claim green is not a weak control, it is a false coverage statement, and it is worse than no annotation because the next author reads it as a wall. - **a recurrence ledger scoped below the recurrence it must find** (an instrument counts repetition WITHIN a unit of work and is reset at that unit's boundary, while the repetition that matters happens ACROSS those units. Every unit then reports the same honest answer -- ONE -- and the aggregate nobody computes is the only place the duplication exists. The instrument is not wrong at its own grain and never reads as broken: it runs, it is enabled, it prints, and its output is empty of the thing being looked for, which is indistinguishable from that thing being absent. **The recognition rule is a question about RANGE, not about correctness: name the scope over which the redundancy you are hunting is defined, and check that the ledger's lifetime is at least that scope.** If the ledger is cleared more often than the redundancy recurs, its silence is a property of its reset schedule. **THE KINSHIP THAT MAKES IT LEGIBLE, and it is `censored_estimator_drops_its_own_tail` in a different medium: a cost paid once per unit and attributed to one arbitrary consumer never reaches count>=2 inside that unit, so the ledger that ranks REPETITION cannot observe the population it exists to rank.** The estimator is censored not by a threshold but by a scope. **THE FIELD TELL, and it is the one that identifies this class from the outside before anyone reads the instrument: the repair mechanism ALREADY EXISTS and its coverage is hand-authored, because candidates are discovered when the unrepaired cost causes a failure somewhere unrelated.** A roster that grows one row at a time, each row traceable to an incident on somebody else's change, is a roster whose discovery instrument is blind -- the incidents are doing the ranking, and their cost is paid by whoever was passing. Distinct from `instrument_output_read_as_subject_content`, where a report is complete for the reporter and read past its promise -- here the report IS complete for its declared scope and the CONSUMER'S QUESTION LIVES AT A WIDER ONE -- and distinct from `selection_view_read_as_population`, where a threshold over measured values is mistaken for the class: no selection happens here at all, the population is simply unrepresentable in the ledger's key space. SPECIMEN, WITH THE FULL CAUSAL CHAIN MEASURED (2026-09-02, gunbc#10036 lane). The required floor charges each claim a per-claim CPU ceiling and builds a FRESH EVALUATION FRAME PER CLAIM -- deliberately, so one witness cannot contaminate the next -- so every claim re-derives the pure substrate its import closure reaches. `v1_compiler.v1_interpreter`'s recompute-trace ledger ranks pure calls with count>=2 within ONE `InterpContext`, and `claim_executor` prints and drops it at every claim frame exit; a producer evaluated EXACTLY ONCE per claim, in 3477 claims, has count=1 in every ledger and appears in none. The repair mechanism already existed -- `v2.workflow.floor_pure_producer_share` serves one evaluation of a declared pure producer across frames -- and its roster was six hand-authored rows, because nothing produced its candidates. **SO THE DISCOVERY MECHANISM WAS THE COST: roster coverage was found when a per-claim budget refusal landed on an unrelated lane's pull request, four lanes in one day, every one of those runs reporting failed=0.** THE DISCRIMINATOR THAT PROVED THE CHARGE WAS NOT THE CLAIM'S OWN WORK, and it is reusable: a witness and its DISCRIMINATING RED do materially different work, so when they cost the same to within 2ms while both sit near the ceiling, the cost is not the assertion's -- 296/294, 333/331 and 384/382 on main run 33615659836's `required_floor_claim_cost.tsv`, against a corpus p50 of 2ms; one 34-row module spans 0ms to the ceiling in three bands that track WHICH SHARED PRODUCER a row forces rather than what it asserts. **WHAT THE SPECIMEN REFUTES IS BOTH OF THE OBVIOUS REMEDIES, AND THAT IS WHY THE CLASS IS FILED RATHER THAN THE INSTANCE FIXED.** Raising the ceiling moves a line that the corpus distribution says is correctly placed, to accommodate a charge that is wrong, and it destroys the only signal that anything is slow; quarantining the family converts a cost problem into a coverage problem silently. Both are the absorbing arm DESIGN section 5 forbids, and the second cannot even be reached, because the family is not anomalous -- its own work is among the smallest in the corpus. REPAIR: fold each unit's ledger into a run-scoped census keyed on the DECLARATION identity plus the argument row, so cross-unit demand becomes a run product; the receipt is `v1_compiler.v1_interpreter` `absorb_claim_recompute_demand` and the artifact `gunbc.witness_floor_workflow` `required_floor_cross_claim_demand_path`, whose own discriminating red asserts the per-frame ledger's blindness beside the census's answer so re-scoping it back reds. A SECOND, INDEPENDENT CONSEQUENCE, AND IT RETIRES PART OF A DECLARED DROP RATHER THAN THE DROP: `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` names a missing carrier -- the per-claim cost artifact modeled as data a function can read -- and states that its attention subset is a HAND derivation rather than a run product. That is buildable, so what a cross-unit census plus that modeled fold retires is BLIND CANDIDATE DISCOVERY, INCIDENT-AS-DISCOVERY, AND THE MISSING CARRIER. **WHAT IT DOES NOT RETIRE, AND SAYING OTHERWISE WOULD BE THE RUNG INFLATION THIS LEDGER EXISTS TO CATCH: environment-independent claim-cost qualification.** Naming every shared producer does not make a claim's remaining evaluator work invariant across execution envelopes -- host scheduling, contention and cache state still move it -- so the per-claim line stays an ATTEMPT-SAFETY boundary and that drop keeps standing on its own subject. **THE SAME DISCIPLINE APPLIES TO WHAT THE CENSUS ITSELF EXPLAINS.** A per-unit constant is BY CONSTRUCTION identical on two runs of one tree, so it accounts for the LEVEL and not the VARIANCE; a run-to-run delta is separately measured (byte-identical evaluator steps against 1.31-1.80x cpu over a byte-identical payload). The two COMPOSE into the observed shape -- the constant puts a family AT the line and something run-to-run decides which of its rows cross -- and that composition is why the victim WANDERS rather than repeating -- the prediction this account makes and the rival 'fixed set of expensive rows' account does not. **TWO RECEIPTS, NEITHER A CROSS-RUN COMPARISON.** (i) ZERO MARGIN: two rows of one module measured 502ms and EXACTLY 500ms against the 500ms budget. (ii) ONE ROW OBSERVED CROSSING THE TWO POPULATIONS ON ONE TREE -- run 33620893203 attempt 1 records `an_empty_receipt_series_leaves_the_live_tree_unmeasured_rather_than_held` as INTERRUPTED-BEFORE-VERDICT with `cost=UNMEASURED`, and ATTEMPT 2 OF THE SAME RUN records it as COMPLETED-OVER-COST-REQUIREMENT at cpu_ms=500, reaching its verdict. **THAT PAIR IS A BOUND BESIDE A VALUE, NOT TWO MEASUREMENTS OF ONE QUANTITY, AND THE DIFFERENCE IS THE WHOLE POINT:** the interrupted arm knows only that the cost exceeded the ceiling by an unknown amount, and its reported figure names where the POLL observed the ceiling -- a property of the budget, which its own diagnostic spends three clauses saying. Writing the pair as two costs would say the row got a couple of milliseconds cheaper and crossed a line, which is a story about the row; what actually changed between the attempts is WHAT THE OBSERVER COULD SAY. Those are the two populations the budget cut separated BECAUSE THEY ARE DIFFERENT FACTS WITH DIFFERENT REMEDIES, and at this margin which one a row lands in is decided by whether the poll fired before or after the work finished: a fact about the poll, not about the row. **THE CITATION DISCIPLINE THAT MADE THAT RECOVERABLE IS PART OF THE CLASS, because the evidence was retracted and then restored on it: CITE THE ATTEMPT, NOT THE RUN OR THE JOB.** A bare run id and a bare job id both resolve to the LATEST attempt, so a rerun silently changes what a stable citation serves -- no error, and nothing visible from the citing end, which is why the first retraction looked sound. `/actions/runs//attempts//logs` serves the attempt that was actually read; a figure cited without an attempt should carry `run_attempt` beside it so a reader can tell whether the citation still points at what its author saw. **AND THE STANDING RECOMMENDATION IS UNCHANGED BY EITHER DIRECTION OF THAT CORRECTION: A REMEDY MUST NEVER BE KEYED TO WHICH ROWS TIPPED.** A producer census survived the retraction and the restoration without a word changing in what it reports; a ranking of tipped rows would have been rebuilt twice. Two independent arguments for one conclusion: dispersion shows the charge is not the ASSERTION's, wandering shows it is not the ROW's.) - **a carefully hedged BENEFIT claim leaves the HARM axis wholly unexamined** (INVALID STATE: an actor takes an irreversible or side-effecting action, states a calibrated caution about whether it HELPS, and never asks whether it HARMS. The two are different axes, and no amount of hedging on the first reaches the second. HARM: the hedge is what makes it dangerous rather than merely wrong -- it reads as due diligence, so a reviewer or manager sees the epistemic care and endorses, and the endorsement generalises a single act into practice. Section 5 silent wrongness with an amplifier: the honest-sounding sentence is the vector. **SPECIMEN, and the actor is the reporter** (sunny-gull-270, 2026-09-02). A superseded CI run on a two-commit-stale head was cancelled to return a fleet slot during saturation, reported with the explicit caution `the cancel does not make the current run start, and I have no evidence it helps rather than merely stops waste`. The manager verified the reasoning and endorsed it as `the only lever any of us actually has`, generalising it. Both were wrong, and the authority that settles it was one grep away: gunbc.witness_floor_workflow emits cancel-in-progress false with running NeverSupersedeRunning, because the fleet's builds are bounded by a host-persistent GNU jobserver whose permits are returned COOPERATIVELY -- a cancelled run SIGKILLs cargo mid-build, so every borrowed permit is lost for the daemon's lifetime and the pool decays monotonically toward zero. So the act did not merely fail to help; it is the mechanism that produces the exhaustion symptom it was taken to relieve, and the stale runs it reclaimed are that policy's DECLARED cost rather than waste. **RECOGNITION RULE, and it is mechanical: read the hedge and ask which axis it is on.** A caution of the form `I cannot show this helps`, `this may not be enough`, `no evidence it improves things` is a BENEFIT hedge. If the action has any side effect on shared state -- a cancel, a delete, a force-push, a config write, a retry against a non-idempotent endpoint -- the benefit hedge is not the relevant one and its presence is evidence the harm question was never asked. **THE TELL A REVIEWER CAN USE: an actor who has genuinely examined harm names the mechanism by which harm would occur, and then says why it does not apply here.** An actor who has only hedged benefit names no mechanism at all, because there is none to name. **RUNG FOUND AT: 1, mitigatable, and by nothing structural** -- the harm was caught after the fact by reading an authority nobody was required to read. **CEILING: 2, mechanically preventable, and not higher.** Whether an action's side effects are harmful is not decidable from the action alone; it depends on a governing policy that may live in any authority. What IS decidable is whether the policy governing a class of action was CONSULTED. **NEXT TRIGGER: a typed standing that binds each fleet-affecting operator action to the authority governing it, so taking the action without consulting that authority refuses rather than relying on the actor to grep.** Until that exists this is a review discipline and citing it as coverage is rung inflation.