Confirming the string is not confirming whose fact it is

[gunbai-bot]

A verbatim citation is a string with a scope — the element that authored it and the heading
that governs it. Rendering to text keeps the string and destroys both, so a reader working from a
rendering can confirm the wording perfectly and still be wrong about the owner.

Two specimens from the colo census, opposite directions, one mechanism:

• Fusion. A spec strip authored as two sibling <li> cells captured as one comma'd sentence
  that appears nowhere in the bytes. Four independent instances on four facilities of one operator,
  three different readers — which is what makes it a property of the page template rather than of a
  reader.
• Locality. 12 kW of 2x 208V/50A A+B redundant power in a 42U configuration reproduced in the
  bytes exactly, on the right operator's page, under a block headed
  Limited Time: Chicago-Area Facility.

The second defeats the repair the first motivates, which is why the row exists. Closing fusion
with "confirm the wording occurs in the raw bytes" passes cleanly on the Chicago figure — a
string-occurrence test cannot fail on correct text attached to the wrong subject. A verification
sound for one member of a class and silent for another does not partially repair it; it certifies
the residue.

The repair is at markup grain and only there: element boundaries settle fusion (one <li> is an
authored cell, two joined by a comma is invention) and byte order settles locality (the nearest
preceding heading is the figure's scope). Tag-stripped text cannot express the first, so the
intuitive fix destroys the evidence — and raw bytes cannot answer the wording question at all once
the numeral is emphasized. Two questions, two artefacts.

Measured cost of not having the row: verbatim auditing reduced the readable-density population
rather than growing it — one metro 4 rows to 2, one corridor 2 to 1 of 28 — and every withdrawal
had passed a plausibility read.

Bounded against positional_citation (right owner, decaying position),
stable_citation_mutable_referent (referent moved after a correct read) and
type_name_field_carries_rendered_value (a rendering in what the corpus carries, not what it was
checked against).

Row file only — the roster is derived and gitignored. Compiles clean in the
gunbc.design_ledgers closure; the 3 blocking errors in that closure are pre-existing on main
(extdeps.gunbc shell-transport emission) and unrelated.

🤖 Generated with Claude Code

https://claude.ai/code/session_01998xs4ojJKWGptxcuxVWHN

[gunbai-bot]

Review 62774 accepted and fixed at ecf2e56. The finding was right and it was load-bearing rather
than ceremonial, for the reason the review gave: the receipts already prescribe a repair, and a
named repair with no capability that ends it is exactly the untracked stall §4b(2) forbids.

RUNG FOUND AT: mitigatable — and the mitigation was a human re-reading page bytes, which is the
weakest form the rung has. Worth stating the harsher half: while the Chicago row stood it was
silent wrongness, below the ladder rather than on it, because no consumer could distinguish the
wrong figure from a right one. It is filed at mitigatable because the containment is real and
entirely retrospective.

CEILING: structurally impossible, both halves. The invalid states are a wording spanning two
elements and a wording scoped by a heading naming another subject. Element containment is a tree
question, enclosing-heading is a byte-order question — decidable, no predicate lifted to proof — and
neither has a constructor once the wording is minted as a projection of one captured element and its
heading path. The residual is deliberately not a rung: whether the captured bytes are that page
today is upstream reality, observed at a declared boundary and never fabricated. So the ceiling is
impossibility of misattribution within a capture, not of a stale capture.

NEXT-RUNG TRIGGER, naming the capability: a captured-source carrier whose mint takes bytes plus
an element identity and yields the wording, so claim_wording cannot be inhabited by a hand-typed
String at all, carrying the enclosing heading path and joining it against the facility the row is
about. Sufficient for: no author can write a wording spanning two elements, and none whose enclosing
heading names a different facility, promotion or metro.

I took the roster_is_its_own_denominator correction the review pointed at seriously rather than
just matching its format. A carrier that merely stores the bytes beside the wording does not
discharge this — both stay writable and one author satisfies both in one edit, which is the
artifact-shaped trigger. And the intermediate rung is recorded so it cannot later be cited as the
ceiling: a lens over stored captures reaches mechanically preventable and stops there, because
safety then depends on that lens staying enrolled.

On the review's other observations — filename-is-membership, evidence: [] matching the standing
documented reason, single-line receipts preserving the merge geometry, and the sibling boundaries —
I checked each and they stand; no change needed. On the 43-of-189 rows omitting a ceiling: agreed
that is debt and not precedent, and I have not used it as one.

Compiles clean in the gunbc.design_ledgers closure; the 3 blocking errors there are pre-existing
on main (extdeps.gunbc shell-transport emission) and unchanged by this commit.

— sent from quiet-cat-23