main is red: import mutation_status_is_commit_ambiguous from the module that declares it

dag/gunbc/cloudflare/r2_token_mint_run.dag

@@ -5,7 +5,10 @@ import std.resources { Network }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import std.human_intervention { HumanIntervention, ProvisioningHumanBurden }
 import extdeps.cloud.gcp.secret_ref { SecretRef, secret_ref_version_resource }
-import extdeps.transports.rest { RestOk, RestStatusRefused, RestTransportRefused, RestBodyUndecodable }
+import extdeps.transports.rest {
+  RestOk, RestStatusRefused, RestTransportRefused, RestBodyUndecodable,
+  mutation_status_is_commit_ambiguous,
+}
 import extdeps.cloudflare.account_api_tokens
 import extdeps.cloudflare.account_api_tokens {
   CreateAccountTokenRequest,
@@ -66,7 +69,6 @@ import gunbc.secret_provision_actuator {
   add_initial_version, VersionAddedAndVerified, VersionAdditionRefused, VersionAdditionOutcomeUnknown,
   VersionAddedButUnverified,
   verified_exact_ref,
-  mutation_status_is_commit_ambiguous,
 }
 
 // THE EXECUTING CONSUMER OF THE R2 MINT, AND THE ORDER OF ITS CHECKS IS THE WHOLE DESIGN.

src/v1/stage0/src/namespace_wave_admission.rs

@@ -1678,7 +1678,52 @@ pub struct TransitionAdmission {
 /// #10818 CpuBoundStanding rehome consumed: required floor on this PR's previous head
 /// (34440928699) reported both `TargetChanged` rows already satisfied at the base. This file is
 /// the roster, so this touch deletes them. Empty is the resting state; empty is not permissive.
-pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[];
+/// mutation_status_is_commit_ambiguous stranded caller (2026-09-10, gunbc#10945). main was RED on
+/// the declarations check: `gunbc.cloudflare.r2_token_mint_run` imported that spelling from
+/// `gunbc.secret_provision_actuator`, which declares no such name, so the base bound it to NOTHING.
+/// NEITHER CONTRIBUTING CHANGE IS WRONG IN ISOLATION and the row says so because a wrong attribution
+/// here would outlive the defect: #10925 wrote that import line at 23598caecca when the fn WAS
+/// declared in `secret_provision_actuator`, and #10923 then deleted the fn at 4024a3a5bdb, rehoming
+/// it to `extdeps.transports.rest` (rest.dag:111) and leaving one edge pointing at the old address.
+/// The defect exists only in their composition — a stranded caller. #10923's floor concluded
+/// 09:50:11Z, four hours before #10925 landed at 13:48:36Z, so the verdict that would have caught the
+/// stranding was computed against a base that did not yet contain the importer it was about to
+/// strand. Not a race: a concluded verdict, correct about the world it measured, and that world no
+/// longer existed at merge time.
+///
+/// The repair points the import at the one module that declares the name, which this module already
+/// imported. Required floor run 34497494076 measured parse 0 and declarations 0 — the break is gone —
+/// and refused adjudication on exactly this one binding delta, `base {} -> head
+/// {extdeps.transports.rest}`, classified `NewPoolCoincidenceResolution`.
+///
+/// THE CLASSIFICATION IS WRONG AND THIS ROW ADMITS IT ANYWAY. By the 2026-08-27 operator ruling in
+/// `gunbc.compiler_frontend_program_interlock`, an author writing the import that resolves a name the
+/// module was ALREADY SPELLING is `AuthoredReferenceResolution`, which auto-admits; that ruling was
+/// made after the wall refused gunbc#9485, a one-line import repair. This is that case exactly. It
+/// lands in the coincidence arm because `locally_authored_claim_added` decides authorship with
+/// `names_leaf`, which reads `c.members` and never `c.target`: base names the leaf (wrong module),
+/// head names it (right module), so `names_leaf(head) && !names_leaf(base)` is false. The predicate
+/// sees a name appearing where it was ABSENT, never a name whose SOURCE changed. The incentive
+/// inversion is what makes this a defect rather than a rough edge: a REDUNDANT blanket import would
+/// have tripped the `blanket_targets` branch and auto-admitted, so the wall is easier to satisfy by
+/// writing worse code. Escalated rather than worked around; admit was ruled, with the predicate fix
+/// to land separately against a green main — repairing a wall in the same motion that asks it for an
+/// exception would make the exception look bought by the fix.
+///
+/// TRIGGER: this row goes when #10945 merges. The base then binds the spelling to
+/// `extdeps.transports.rest` inside `mint_r2_object_read_token`, the delta stops being producible,
+/// and CONSUMED comes due on the roster's next touch — adjudicated by the declaring-module join, not
+/// by this sentence.
+pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[TransitionAdmission {
+    label: "gunbc#10945 mutation_status_is_commit_ambiguous stranded-caller repair",
+    subject: AdmissionSubject::Binding {
+        module: "gunbc.cloudflare.r2_token_mint_run",
+        in_declaration: "mint_r2_object_read_token",
+        spelling: "mutation_status_is_commit_ambiguous",
+        target: "extdeps.transports.rest",
+    },
+    disposition: NamespaceDeltaDisposition::NewPoolCoincidenceResolution,
+}];
 
 /// The denominators a green must name (DESIGN §5): a run that cannot say what it covered is an
 /// instrument failure wearing coverage's clothes.