Record #10933 x #10934 as the next stale-green instance in gunbc.plans.ci_merge_freshness

dag/gunbc/plans/ci_merge_freshness.dag

@@ -63,6 +63,20 @@ fn ci_merge_freshness_body() -> List<MarkdownBlock> {
       li(text: "**(b) cap-recovery has reclaimed session slots (IN-FLIGHT: #5650 + operator oomd).** Green-on-main re-runs *increase* floor memory load during exactly the contention window this lockdown is containing; enforcing before the host has slack worsens the OOM pressure the verdict is meant to triage."),
     ]),
     p(text: "Until both clear, the verdict is a loaded mechanism left unwired on purpose: a future worker must **not** flip it to enforcing early. The trigger is decidable (both consumers either exist on `main` or do not), so this is a wall-after-grounding, not a forever-ratchet."),
+    h2(text: "7. Next instance — #10933 × #10934 (2026-09-10): a deletion crossing a new consumer"),
+    p(text: "Same mechanism as §1, one variation in what crossed. In §1 a newly-landed **gate** crossed a module; here a newly-landed **consumer** crossed a **deletion**, and the check that fired (the declarations phase) was on `main` throughout. What is the same is the part §2 names: two overlapping PRs, each green on its own head, never jointly validated, and the second merged on a green that described a tree without the first. The two touched different files, so the text merge saw no conflict. Both were individually correct and both were approved."),
+    ul(items: [
+      li(text: "#10933 adds `dag/test/claim/fabric_m0_publication_witness_test.dag`, written against the `ReadSource` carrier: it imports `DurableOriginRead` and `DisposableCacheRead` from `gunbc.fabric_m0_commit`."),
+      li(text: "#10934 deletes `ReadSource`, `DurableOriginRead` and `DisposableCacheRead` from `gunbc.fabric_m0_commit` (head `df47e1d7670`). Its witnesses run 34520652774 starts **@ 19:28:58Z** against a base without #10933 and concludes **SUCCESS @ 20:49:25Z**."),
+      li(text: "#10933 merges **@ 20:07:51Z** (`0db47c51374`) — while #10934's run is still in flight, so that run never saw it."),
+      li(text: "#10934 merges **@ 21:23:51Z** (`a4b21cb8e47`) on the **same head**, **never re-run against current main**. Its head does not contain #10933's merge commit."),
+      li(text: "`main` at `a4b21cb8e47`, witnesses run 34531957010, `required-witnesses-floor`: the declarations phase FAILS with **exactly 2** IMPORT-MEMBER-ABSENT findings attributable to this pair — the publication witness importing `DurableOriginRead` and `DisposableCacheRead`, which `gunbc.fabric_m0_commit` no longer declares. The same run carries a **third** IMPORT-MEMBER-ABSENT from an unrelated crossing (`test.claim.colo_nj_central_south_census` importing `grain_admits_single_cabinet`, repaired separately by #10968); it is not this pair's and is not counted here."),
+      li(text: "This pair's red opened with #10934's own merge **@ 21:23:51Z** — it could not open earlier, the missing names being #10934's deletions — and lasted until #10977 repaired `main` **@ 23:35:17Z** (`38fde6682a8`); #10968, #10973, #10959 and #10921 landed inside it."),
+    ]),
+    p(text: "**Established independently, NOT a finding of that run.** The same witness also still constructed `ReadbackConfirmed` with an `observed_digest` field (and `ManifestRead` with `observed_digest` and `source`), where #10934 had made `ReadbackConfirmed` carry a `reading`. So restoring the two imports alone would not have repaired the tree. The declarations run stopped on the two missing imports and never reached those constructions; this is read from the source at `a4b21cb8e47`, not emitted by any run."),
+    p(text: "**Contributing factor, the avoidable part.** Both PRs came from lanes one manager (`keen-dove-322`) was managing and tracking together. That manager flagged the **textual** conflict risk between them and never compiled the merged pair. So the exposure was known to the one party placed to see it, and that party still had no instrument that would have shown it: every check available validated each head against its own base, which is exactly the hole §2 describes. Holding both lanes did not substitute for validating the composed tree."),
+    p(text: "**Where it sits.** This instance adds no mechanism. It sits under this record's existing retirement condition — the §3 merge-time freshness requirement in force as a witnessed property — which would have re-validated #10934 against a `main` containing #10933 before it could merge."),
+    p(text: "**Why this deferral is not a §4b(3) rung drop, and that is deliberate.** A drop in `gunbc.rung_drop` records a regression from a rung the class HELD: its row names a previous rung, and every `RungDropReason` presupposes something that existed and stopped existing. Merge-time freshness has never been in force, and an unbuilt capability is not a lost one. So this deferral's home is this Plan's retirement condition, and the next reader who notices the class has no rung finds the reason here instead of re-deriving it."),
   ]
 }