diff --git a/dag/gunbc/design_ledgers.dag b/dag/gunbc/design_ledgers.dag index 69959d00410..321721c23d8 100644 --- a/dag/gunbc/design_ledgers.dag +++ b/dag/gunbc/design_ledgers.dag @@ -74,7 +74,7 @@ import gunbc.plans.md_helpers { h2, h3, p, li, ul, hr } import extdeps.languages.markdown { serialize_markdown_source } import gunbc.recurring_failure_mode { authored } import gunbc.recurring_failure_mode.roster { recurring_failure_mode_roster } -import gunbc.rung_drop { rung_drop_declaration_message, RungDropStanding, Standing, Retired } +import gunbc.rung_drop { rung_drop_declaration_message, rung_drop_amendment_message, RungDropStanding, Standing, Retired } import gunbc.rung_drop.roster { rung_drop_roster } import v2.workflow.floor_discovery { floor_discovery_tree_identity } import gunbc.self_host_compile_phase_frontier { @@ -125,9 +125,9 @@ fn rung_drop_blocks() -> List { ], flat_map(rung_drop_roster, d => concat(concat([ h3(text: concat(concat(concat(d.subject, " — declared "), d.declared), rung_drop_standing_suffix(standing: d.standing))), - ], rung_drop_standing_blocks(standing: d.standing)), concat([ + ], rung_drop_standing_blocks(standing: d.standing)), concat(concat([ p(text: rung_drop_declaration_message(d: d)), - ], if (d.identity as String) == "measurement_bankruptcy" { + ], map(d.amendments, a => p(text: rung_drop_amendment_message(a: a)))), if (d.identity as String) == "measurement_bankruptcy" { compile_phase_frontier_blocks() } else { [] }))), ], diff --git a/dag/gunbc/rung_drop.dag b/dag/gunbc/rung_drop.dag index 05bb052a222..e94e7b705f8 100644 --- a/dag/gunbc/rung_drop.dag +++ b/dag/gunbc/rung_drop.dag @@ -301,12 +301,53 @@ type RungDropDeclaration } | AuthoredProse { legacy: LegacyProseIdentity, authored: String } +// A LATER RULING MOVED THE WORLD UNDER A STANDING DROP, AND THE DECLARATION HAD NOWHERE TO SAY SO. +// DESIGN section 4b(3) names five fields, all of them about the MOMENT the rung fell: previous, +// temporary, reason, population, trigger. None of them can carry a fact established AFTERWARDS that +// changes how the declaration should be read -- and one such fact was written into +// docs/design-rung-drops.md by hand on 2026-09-20, in a file that module's own note says is +// generated from this roster. It survived one regeneration as unexplained drift on two lanes +// (gunbc#11732 reverted the deletion; gunbc#11786 was left holding nothing but it) and was then +// regenerated away on main by gunbc#11789, which is the silent loss DESIGN section 6 calls manual +// application committed as source: the prose dies and the diff that kills it looks like noise. +// +// THIS IS NOT A COMMENTARY FIELD AND IS DELIBERATELY NOT ONE. A free-text note on a drop would be +// the absorbing fallback with a nicer name -- every sentence nobody could place would land in it. +// An amendment is a specific thing with three parts and no fourth: WHEN the later fact was +// recorded, WHAT it was (cited, so a reader can reach it), and WHAT IT DOES to this declaration. +// The third part is the load-bearing one, because the whole reason to carry an amendment rather +// than edit the row is that the declaration itself did NOT change: the trigger a drop is retired by +// is the trigger it was declared with, and an amendment that silently rewrote it would retire a +// drop by something other than its trigger, which 4b(3) forbids. +// +// WHY NOT AN ANNOTATION. The reasoning below already exists as a source annotation on the row that +// needs it, and that is exactly why the paragraph went missing: DESIGN section 4c states that no +// Accepted program can read an annotation, so the projection could not and did not. A fact a +// generated document must carry is program data, not commentary. +type RungDropAmendment { + amended: String + occasion: NonEmptyStr + consequence: NonEmptyStr +} + +// THE ONE RENDERING, for the reason rung_drop_declaration_message is the one rendering of a +// declaration: a second speller of an amendment would drift from the row it amends. +fn rung_drop_amendment_message(a: RungDropAmendment) -> String { + concat( + concat("AMENDED ", concat(a.amended, ": ")), + concat(a.occasion, concat(" -- ", concat(a.consequence, "."))) + ) +} + +// `amendments` IS ORDINARILY EMPTY AND IS A LIST RATHER THAN AN OPTION because the world can move +// under one declaration more than once, and a second amendment must not overwrite the first. type RungDrop { identity: NonEmptyStr subject: String declared: String standing: RungDropStanding declaration: RungDropDeclaration + amendments: List } // THE ONE RENDERING, so a refusal arm never restates the row beside it. A gate that spelled its diff --git a/dag/gunbc/rung_drop/accumulator_copy_positive_controls_off_every_lane.dag b/dag/gunbc/rung_drop/accumulator_copy_positive_controls_off_every_lane.dag index a07127188af..04d33eeb78a 100644 --- a/dag/gunbc/rung_drop/accumulator_copy_positive_controls_off_every_lane.dag +++ b/dag/gunbc/rung_drop/accumulator_copy_positive_controls_off_every_lane.dag @@ -70,5 +70,7 @@ data accumulator_copy_positive_controls_off_every_lane: RungDrop = RungDrop { "v2.test.long.accumulator_copy_fold_analysis an_inline_step_beside_a_decoy_lambda_is_still_caught", ], restoration_trigger: "an executing lane with a declared ceiling plans an ingest-reaching hermetic witness: either the per-frame front end is paid once per run so these enroll as test fns on ordinary discovery inside the enrolment margin (the restoration trigger of long_module_changed_witness_cpu_observed_only), or a scheduled substrate-long executor is re-added under the operator agreement gunbc#8283 reserved. Observed at retirement, not asserted: the six population identities are test fns planned by a live cadence and reach PASS on a required or scheduled run, and this row retires in the same change. Passing under claim_batch is the declared state, not the trigger." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/builtin_signature_arity_pairing_fabricates.dag b/dag/gunbc/rung_drop/builtin_signature_arity_pairing_fabricates.dag index f3dbbb2f301..6d80d81e22c 100644 --- a/dag/gunbc/rung_drop/builtin_signature_arity_pairing_fabricates.dag +++ b/dag/gunbc/rung_drop/builtin_signature_arity_pairing_fabricates.dag @@ -12,5 +12,7 @@ data builtin_signature_arity_pairing_fabricates: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: BuiltinSignatureArityPairingFabricates, authored: "Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RUNG: none to lower -- this declares that a class created by this change lands below its attainable ceiling rather than at it. v1.compiler.infer_method pairs each row's DECLARED parameter names with the parameter TYPES derived from std.algebra. When the two lists disagree in length, pair_declared_names yields AlgebraTypeVariable { id: \"unpaired_declared_parameter\" } for the unpaired position instead of refusing. That is a value standing where a refusal belongs -- DESIGN section 5's fabricated-plausible-output arm -- and it is declared here rather than left as a marker that reads like a wall. TEMPORARY RUNG: mitigatable. The marker is distinctive, greppable, and reaches src/v1/stage0/src/v1_compiler_infer_method.rs, so a mismatch is DISCOVERABLE by inspection of a generated artifact. It is not mechanically preventable, because NO CONSUMER ASSERTS ITS ABSENCE: an unchecked marker is an inert lens, and DESIGN is explicit that the tier where the machinery exists and nothing gates on it is itself a lie. REASON: builtin_function_registry is a `data` initializer and a .dag data initializer has no refusal channel -- there is nowhere at construction for a typed, located diagnostic to go, so the only arms available were a fabricated value or a silently shorter list, and a marked fabrication is the more honest of the two. POPULATION: bounded and closed at 20 rows -- exactly the registry names that std.algebra also declares and that therefore pair at all (count, to_int, substring, to_string, concat, map_insert, map_merge, with, map_contains_key, map_has, lookup, map_get, map_keys, map_values, get, reverse, list_push, length, starts_with, replace). The other 112 rows author their types directly and cannot reach this arm. Zero occurrences of the marker in the tree today, which is the state this row exists to keep observable. RESTORATION TRIGGER: construction-time refusal available inside a `data` initializer -- SUFFICIENT FOR a declared/derived arity disagreement to stop the line with a typed, located diagnostic at the row that causes it, rather than to produce a marked value that construction accepts. The trigger names that capability and not any artifact that would contribute to one; a witness asserting the marker's absence would raise this to mechanically preventable but would NOT retire the row, because the invalid state would still be writable." } + declaration: AuthoredProse { legacy: BuiltinSignatureArityPairingFabricates, authored: "Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RUNG: none to lower -- this declares that a class created by this change lands below its attainable ceiling rather than at it. v1.compiler.infer_method pairs each row's DECLARED parameter names with the parameter TYPES derived from std.algebra. When the two lists disagree in length, pair_declared_names yields AlgebraTypeVariable { id: \"unpaired_declared_parameter\" } for the unpaired position instead of refusing. That is a value standing where a refusal belongs -- DESIGN section 5's fabricated-plausible-output arm -- and it is declared here rather than left as a marker that reads like a wall. TEMPORARY RUNG: mitigatable. The marker is distinctive, greppable, and reaches src/v1/stage0/src/v1_compiler_infer_method.rs, so a mismatch is DISCOVERABLE by inspection of a generated artifact. It is not mechanically preventable, because NO CONSUMER ASSERTS ITS ABSENCE: an unchecked marker is an inert lens, and DESIGN is explicit that the tier where the machinery exists and nothing gates on it is itself a lie. REASON: builtin_function_registry is a `data` initializer and a .dag data initializer has no refusal channel -- there is nowhere at construction for a typed, located diagnostic to go, so the only arms available were a fabricated value or a silently shorter list, and a marked fabrication is the more honest of the two. POPULATION: bounded and closed at 20 rows -- exactly the registry names that std.algebra also declares and that therefore pair at all (count, to_int, substring, to_string, concat, map_insert, map_merge, with, map_contains_key, map_has, lookup, map_get, map_keys, map_values, get, reverse, list_push, length, starts_with, replace). The other 112 rows author their types directly and cannot reach this arm. Zero occurrences of the marker in the tree today, which is the state this row exists to keep observable. RESTORATION TRIGGER: construction-time refusal available inside a `data` initializer -- SUFFICIENT FOR a declared/derived arity disagreement to stop the line with a typed, located diagnostic at the row that causes it, rather than to produce a marked value that construction accepts. The trigger names that capability and not any artifact that would contribute to one; a witness asserting the marker's absence would raise this to mechanically preventable but would NOT retire the row, because the invalid state would still be writable." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/cited_symbol_census.dag b/dag/gunbc/rung_drop/cited_symbol_census.dag index ff19de52b01..ce8a6f14c43 100644 --- a/dag/gunbc/rung_drop/cited_symbol_census.dag +++ b/dag/gunbc/rung_drop/cited_symbol_census.dag @@ -12,5 +12,7 @@ data cited_symbol_census: RungDrop = RungDrop { standing: Retired { trigger_fired: "2026-08-25" as NonEmptyStr }, - declaration: AuthoredProse { legacy: CitedSymbolCensus, authored: "**THE CITED-SYMBOL CENSUS IS NO LONGER A REQUIRED CHECK, AND THIS ROW DECLARES THE RUNG IT DROPS (2026-08-23).** It sits beside the CI entry above rather than inside it, for the reason the regen row already gives: that paragraph narrates the floor and regen cuts, this is a third drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. WHAT WAS HERE: a second `witnesses.yml` job, `cited-symbol`, running `claim_executor --required-cited-symbol --source-root dag --source-root src/v2` and stopping the line when any authored `DeclarationRef` named a symbol that does not resolve — the executing half of §3's cite-the-symbol-not-the-position rule. **IT IS DELETED** — the job, its command authority (`gunbc.fabric_witness_run` `cited_symbol_run_command`), the job row and capability wiring in `gunbc.witness_floor_workflow`, and the closure witness that covered it. REASON: operator directive, 2026-08-23. This is not a defect finding and the mechanism was not failing; it was executing and green, and the directive is that it does not belong in CI as a separate corpus-wide job. PREVIOUS RUNG: *mechanically preventable* — a real wall, armed on every push, measured green at `checked=390` on run `32664434197` (`f49886339a5`, 2026-08-23T20:26Z). TEMPORARY RUNG: *mitigatable* — the rule survives as review diligence, which is strictly weaker in the exact way §6 already records for the deleted inert-lens census: a newly authored citation naming a symbol that does not exist is writable again, and nothing detects it. MEASURED POPULATION AT THE CUT: 390 authored references, on the last green run of the job. FUTURE EXPOSURE, STATED AS A SECOND FACT BECAUSE JOINING THE TWO IS THE DENOMINATOR ERROR THIS DOCUMENT KEEPS FINDING: unbounded. Nothing counts a citation authored after the cut and nothing refuses one, so §4b(3)'s BOUNDED-POPULATION REQUIREMENT IS NOT SATISFIED HERE, and this row does not pretend otherwise — the drop is an operator-approved exception to that clause rather than an instance of it, and saying so is the whole point of writing the row down. An earlier revision of this row read *the 390 references, plus every citation authored after it* and called that the bounded population; an exact measurement joined to an open future set is not bounded, and calling it so is the same move §5 forbids when a count copied from the current tree is asked to serve as an oracle. The measured half also rots the way §3 says positional citations do: it is the population's size AT THE MOMENT OF THE DROP, never a standing figure. WHAT WAS NOT CLAIMED WHILE THE DROP STOOD: the capability survived at its own entry point — `--required-cited-symbol` was still a flag on `claim_executor` — but a mode no workflow invokes guards nothing, and calling the surviving flag a mitigation would have been exactly the inflation §4b(1) forbids. **THE RESTORATION TRIGGER FIRED ON 2026-08-25 AND THIS ROW IS RETIRED AS A DROP, WITH ITS EXPOSURE CLOSED RATHER THAN RE-DECLARED.** The trigger read: this row retires when the citation wall is re-derived where the operator's own framing puts it — *you would just make them a normal compiler error* — checked at ingestion, on the module whose source carries the citation, from that module's own text, rather than reconstructed corpus-wide by a second job; and it named §6's module-authorship trigger as the same rung, to be landed together rather than each rebuilding a corpus walk. Both landed on one construction, `v1_compiler.declaration_index`, inside the `parse` phase of `claim_executor --required-ci`: the sweep that already parses every authored module now derives one record per module and resolves every authored `DeclarationRef` against it by keyed lookup. `--required-cited-symbol` is DELETED with the same change, so there is one route and not two. RUNG: back to *mechanically preventable*, and STRICTLY WIDER than what was dropped — the enrolled population is every authored citation in a non-fixture module (measured 1441 authored, 161 in fixture carriers, 79 naming namespaces no `.dag` module declares), not the five carriers the deleted lens's population named, and test modules are INDEXED, so the outside-index disposition those exclusions forced is not needed. WHAT THE FIRST EXECUTION FOUND, because a wall that lands green over a corpus nobody checked for two days would be the more suspicious result: 46 sites over 38 distinct targets, every one a citation naming a declaration that does not exist — the exact class this rule names, accumulated in the unguarded window this row declared unbounded. They are NOT repaired here and NOT silently excluded: they are enumerated at identity grain in `PRE_EXISTING_CITATION_DEBT` as a §5 monotone debt contract whose universe is discovered by the index itself and whose rows REFUSE once their citation stops refusing, so the roster can only shrink. WHAT IS STILL OPEN, stated so this retirement is not read as wider than it is: `v2.lens.cited_symbol_resolution` is DELETED as of 2026-08-26, and the disposition was three-way rather than the two this row admitted. The count was stale on arrival — sixteen was the file's size at #7707 and it had grown to 27 `test fn` identities by the time this sentence was written — and \"dead\" was true of the lens and false of a third of its witnesses. Measured against the seven symbols that file imported FROM the lens, only 6 of the 27 touch one; those 6 died with it. Six more call `resolve_declaration_ref`, which lives in `v2.std.decl_ref_resolution` and SURVIVES with four other consumers, so they are the only executing evidence for a live authority's five-arm refusal and §4b(4) rehomed them to `test.claim.long.decl_ref_resolution_witness_test` rather than deleting them with the machinery that climbed. The remaining 15 are population and projection claims about the carriers that PROJECT `DeclarationRef`s and moved to `test.claim.long.carrier_reference_integrity_witness_test`. What the corpus-wide census subsumes is TYPED-LITERAL citations specifically — `DeclarationRef` record literals and the `decl_ref`/`decl_field_ref` constructors — not \"citations\" in general; a prose reference inside a `String` is covered by nothing, before or after. The per-PR witness that survives was renamed `test.claim.doc_graph_reference_partition_witness_test`, because its subject is a bucket partition over `gunbc.doc_graph_roots` and never was resolution, and under the old name it would have been the only cited-symbol-named thing left in the tree — a misreading two readers made independently from exactly that surface; and the wall is host Rust rather than a modeled ingestion operation, declared as seed growth in `gunbc.declaration_index_seed_growth`." } + declaration: AuthoredProse { legacy: CitedSymbolCensus, authored: "**THE CITED-SYMBOL CENSUS IS NO LONGER A REQUIRED CHECK, AND THIS ROW DECLARES THE RUNG IT DROPS (2026-08-23).** It sits beside the CI entry above rather than inside it, for the reason the regen row already gives: that paragraph narrates the floor and regen cuts, this is a third drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. WHAT WAS HERE: a second `witnesses.yml` job, `cited-symbol`, running `claim_executor --required-cited-symbol --source-root dag --source-root src/v2` and stopping the line when any authored `DeclarationRef` named a symbol that does not resolve — the executing half of §3's cite-the-symbol-not-the-position rule. **IT IS DELETED** — the job, its command authority (`gunbc.fabric_witness_run` `cited_symbol_run_command`), the job row and capability wiring in `gunbc.witness_floor_workflow`, and the closure witness that covered it. REASON: operator directive, 2026-08-23. This is not a defect finding and the mechanism was not failing; it was executing and green, and the directive is that it does not belong in CI as a separate corpus-wide job. PREVIOUS RUNG: *mechanically preventable* — a real wall, armed on every push, measured green at `checked=390` on run `32664434197` (`f49886339a5`, 2026-08-23T20:26Z). TEMPORARY RUNG: *mitigatable* — the rule survives as review diligence, which is strictly weaker in the exact way §6 already records for the deleted inert-lens census: a newly authored citation naming a symbol that does not exist is writable again, and nothing detects it. MEASURED POPULATION AT THE CUT: 390 authored references, on the last green run of the job. FUTURE EXPOSURE, STATED AS A SECOND FACT BECAUSE JOINING THE TWO IS THE DENOMINATOR ERROR THIS DOCUMENT KEEPS FINDING: unbounded. Nothing counts a citation authored after the cut and nothing refuses one, so §4b(3)'s BOUNDED-POPULATION REQUIREMENT IS NOT SATISFIED HERE, and this row does not pretend otherwise — the drop is an operator-approved exception to that clause rather than an instance of it, and saying so is the whole point of writing the row down. An earlier revision of this row read *the 390 references, plus every citation authored after it* and called that the bounded population; an exact measurement joined to an open future set is not bounded, and calling it so is the same move §5 forbids when a count copied from the current tree is asked to serve as an oracle. The measured half also rots the way §3 says positional citations do: it is the population's size AT THE MOMENT OF THE DROP, never a standing figure. WHAT WAS NOT CLAIMED WHILE THE DROP STOOD: the capability survived at its own entry point — `--required-cited-symbol` was still a flag on `claim_executor` — but a mode no workflow invokes guards nothing, and calling the surviving flag a mitigation would have been exactly the inflation §4b(1) forbids. **THE RESTORATION TRIGGER FIRED ON 2026-08-25 AND THIS ROW IS RETIRED AS A DROP, WITH ITS EXPOSURE CLOSED RATHER THAN RE-DECLARED.** The trigger read: this row retires when the citation wall is re-derived where the operator's own framing puts it — *you would just make them a normal compiler error* — checked at ingestion, on the module whose source carries the citation, from that module's own text, rather than reconstructed corpus-wide by a second job; and it named §6's module-authorship trigger as the same rung, to be landed together rather than each rebuilding a corpus walk. Both landed on one construction, `v1_compiler.declaration_index`, inside the `parse` phase of `claim_executor --required-ci`: the sweep that already parses every authored module now derives one record per module and resolves every authored `DeclarationRef` against it by keyed lookup. `--required-cited-symbol` is DELETED with the same change, so there is one route and not two. RUNG: back to *mechanically preventable*, and STRICTLY WIDER than what was dropped — the enrolled population is every authored citation in a non-fixture module (measured 1441 authored, 161 in fixture carriers, 79 naming namespaces no `.dag` module declares), not the five carriers the deleted lens's population named, and test modules are INDEXED, so the outside-index disposition those exclusions forced is not needed. WHAT THE FIRST EXECUTION FOUND, because a wall that lands green over a corpus nobody checked for two days would be the more suspicious result: 46 sites over 38 distinct targets, every one a citation naming a declaration that does not exist — the exact class this rule names, accumulated in the unguarded window this row declared unbounded. They are NOT repaired here and NOT silently excluded: they are enumerated at identity grain in `PRE_EXISTING_CITATION_DEBT` as a §5 monotone debt contract whose universe is discovered by the index itself and whose rows REFUSE once their citation stops refusing, so the roster can only shrink. WHAT IS STILL OPEN, stated so this retirement is not read as wider than it is: `v2.lens.cited_symbol_resolution` is DELETED as of 2026-08-26, and the disposition was three-way rather than the two this row admitted. The count was stale on arrival — sixteen was the file's size at #7707 and it had grown to 27 `test fn` identities by the time this sentence was written — and \"dead\" was true of the lens and false of a third of its witnesses. Measured against the seven symbols that file imported FROM the lens, only 6 of the 27 touch one; those 6 died with it. Six more call `resolve_declaration_ref`, which lives in `v2.std.decl_ref_resolution` and SURVIVES with four other consumers, so they are the only executing evidence for a live authority's five-arm refusal and §4b(4) rehomed them to `test.claim.long.decl_ref_resolution_witness_test` rather than deleting them with the machinery that climbed. The remaining 15 are population and projection claims about the carriers that PROJECT `DeclarationRef`s and moved to `test.claim.long.carrier_reference_integrity_witness_test`. What the corpus-wide census subsumes is TYPED-LITERAL citations specifically — `DeclarationRef` record literals and the `decl_ref`/`decl_field_ref` constructors — not \"citations\" in general; a prose reference inside a `String` is covered by nothing, before or after. The per-PR witness that survives was renamed `test.claim.doc_graph_reference_partition_witness_test`, because its subject is a bucket partition over `gunbc.doc_graph_roots` and never was resolution, and under the old name it would have been the only cited-symbol-named thing left in the tree — a misreading two readers made independently from exactly that surface; and the wall is host Rust rather than a modeled ingestion operation, declared as seed growth in `gunbc.declaration_index_seed_growth`." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/concat_binary_signature_exempt_from_arg_binding.dag b/dag/gunbc/rung_drop/concat_binary_signature_exempt_from_arg_binding.dag index 880d39da680..c1f4944ccc8 100644 --- a/dag/gunbc/rung_drop/concat_binary_signature_exempt_from_arg_binding.dag +++ b/dag/gunbc/rung_drop/concat_binary_signature_exempt_from_arg_binding.dag @@ -12,5 +12,7 @@ data concat_binary_signature_exempt_from_arg_binding: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: ConcatBinarySignatureExemptFromArgBinding, authored: "Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RUNG: none to lower -- nothing binds builtin arguments today, so this declares a class that the arm flip would otherwise create. concat's declared signature is BINARY, and it is binary correctly: std.algebra declares param_types [ReceiverSelf, ReceiverSelf], and src/v1/runtime_rust.dag emits `pub fn concat(a: T, b: T) -> T`. The algebra and the emitted runtime agree; only the CORPUS calls concat at other arities. TEMPORARY RUNG: mitigatable. concat is exempted from the direct-call argument-shape judgement when decide_callable_candidates begins answering FuncSigResolved for a BuiltinCallable; every other builtin is judged. REASON: concat(a, b, c) is a FOLD of the binary associative operation, and what licenses folding an n-ary application into nested binary applications is ASSOCIATIVITY, which is not modeled. std.algebra declares Magma as { op: fn(T, T) -> T } and Semigroup as { op: fn(T, T) -> T } -- structurally identical, differing by a blank line where the law would sit. The type whose entire content is the associativity law carries no law, so nothing in the tree can say an operation is associative, and the missing capability is one level below the signature rather than in it. Widening AlgebraTypeTemplate with a variadic arm was refused because variadicity is not a property of a parameter's TYPE -- that vocabulary answers what type a position has, not how many positions there are -- and DESIGN section 4 puts surface arity in the sugar layer that adds no power. Declaring concat's signature absent was refused because the signature is expressible and true; erasing a fact that holds is a different failure from asserting one that does not. POPULATION: measured over dag, src/v1 and src/v2 with a scanner that skips string literals -- 12 free-call sites at arity 1, 8297 at 2, 507 at 3, 200 at 4, 178 at 5, and a tail to 262, across 64 distinct arities, roughly 1200 sites above binary. Closes by re-measurement, not by opinion. RESTORATION TRIGGER: n-ary application of a binary operation DECLARED ASSOCIATIVE folds to nested binary application -- SUFFICIENT FOR accepting concat's 64 measured arities against its unchanged binary declared signature, with no exemption and no widened vocabulary. Its own prerequisite is that associativity be declarable at all, which today it is not; that grounding is a DESIGN section 5 wall-after-grounding rather than a ratchet, since associativity of a declared operation is a modeled fact and not an undecidable one." } + declaration: AuthoredProse { legacy: ConcatBinarySignatureExemptFromArgBinding, authored: "Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RUNG: none to lower -- nothing binds builtin arguments today, so this declares a class that the arm flip would otherwise create. concat's declared signature is BINARY, and it is binary correctly: std.algebra declares param_types [ReceiverSelf, ReceiverSelf], and src/v1/runtime_rust.dag emits `pub fn concat(a: T, b: T) -> T`. The algebra and the emitted runtime agree; only the CORPUS calls concat at other arities. TEMPORARY RUNG: mitigatable. concat is exempted from the direct-call argument-shape judgement when decide_callable_candidates begins answering FuncSigResolved for a BuiltinCallable; every other builtin is judged. REASON: concat(a, b, c) is a FOLD of the binary associative operation, and what licenses folding an n-ary application into nested binary applications is ASSOCIATIVITY, which is not modeled. std.algebra declares Magma as { op: fn(T, T) -> T } and Semigroup as { op: fn(T, T) -> T } -- structurally identical, differing by a blank line where the law would sit. The type whose entire content is the associativity law carries no law, so nothing in the tree can say an operation is associative, and the missing capability is one level below the signature rather than in it. Widening AlgebraTypeTemplate with a variadic arm was refused because variadicity is not a property of a parameter's TYPE -- that vocabulary answers what type a position has, not how many positions there are -- and DESIGN section 4 puts surface arity in the sugar layer that adds no power. Declaring concat's signature absent was refused because the signature is expressible and true; erasing a fact that holds is a different failure from asserting one that does not. POPULATION: measured over dag, src/v1 and src/v2 with a scanner that skips string literals -- 12 free-call sites at arity 1, 8297 at 2, 507 at 3, 200 at 4, 178 at 5, and a tail to 262, across 64 distinct arities, roughly 1200 sites above binary. Closes by re-measurement, not by opinion. RESTORATION TRIGGER: n-ary application of a binary operation DECLARED ASSOCIATIVE folds to nested binary application -- SUFFICIENT FOR accepting concat's 64 measured arities against its unchanged binary declared signature, with no exemption and no widened vocabulary. Its own prerequisite is that associativity be declarable at all, which today it is not; that grounding is a DESIGN section 5 wall-after-grounding rather than a ratchet, since associativity of a declared operation is a modeled fact and not an undecidable one." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/consumed_row_owner_charge_unenforced.dag b/dag/gunbc/rung_drop/consumed_row_owner_charge_unenforced.dag index ace31e0470a..541502a12ab 100644 --- a/dag/gunbc/rung_drop/consumed_row_owner_charge_unenforced.dag +++ b/dag/gunbc/rung_drop/consumed_row_owner_charge_unenforced.dag @@ -44,5 +44,7 @@ data consumed_row_owner_charge_unenforced: RungDrop = RungDrop { "base-consumed transition-admission rows whose owning change authored no deletion_follow_up, on any merge_group composition that does not touch dag/gunbc/namespace/transition_admission/" ], restoration_trigger: "THE CAPABILITY: a required run that adjudicates a consumed transition-admission row WITHOUT depending on base == head or on the roster being touched -- that is, the consumed-row charge evaluated on the composition that actually lands, the way the merge queue now supplies the required verdict. Nothing smaller retires this row. In particular, re-adding a merge_group arm that refuses a BYSTANDER composition does not: that was the arm removed here, it billed a change for a debt its own comment said was not its own, and DESIGN section 5 names that externalization. Nor does authoring follow-up numbers on the rows standing today, which changes the population and not the coverage. The debt itself stays visible meanwhile: used_without_follow_up is still counted in the refusal message, and deletion_follow_up is still carried on every row.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/dashboard_merge_ready_semantic_admissibility.dag b/dag/gunbc/rung_drop/dashboard_merge_ready_semantic_admissibility.dag index dfcb779be8f..5eb5f0618ef 100644 --- a/dag/gunbc/rung_drop/dashboard_merge_ready_semantic_admissibility.dag +++ b/dag/gunbc/rung_drop/dashboard_merge_ready_semantic_admissibility.dag @@ -12,5 +12,7 @@ data dashboard_merge_ready_semantic_admissibility: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: DashboardMergeReadySemanticAdmissibility, authored: "**THE DASHBOARD REPORTS `MergeReady` WITHOUT CONSUMING WHETHER THE CHANGE IS SEMANTICALLY ADMISSIBLE TO ITS REPOSITORY (2026-09-01).** The dashboard's `pr_merge_ready_digest.mjs` `meetsMergeCriteria` constructs the verdict from review-vote tallies, absence of unresolved or request-changes reviews, GitHub's conflict-free `mergeable` observation, and a non-failing check summary. Those are real mechanical facts, but they do not answer the separate repository-semantic question required by the working agreement: whether the diff actually satisfies its request and the repository's authority documents. An approval explicitly means only that its reviewer found no blocking defect; it is not evidence that the requested change was delivered. Calling their join `MergeReady` therefore turns an incomplete projection into an affirmative operational instruction and can page an operator to land a mechanically clean change that misses its request. EXECUTED SPECIMEN, observed 2026-09-01 with gunbc#9932 at `cc1f3ff60` against main at `6bdc9492c2`: `meetsMergeCriteria` emitted `ready=true` while the decision-time instrument `git merge-tree --write-tree origin/main cc1f3ff60` returned `rc=1`. Both are re-derivable at those two pinned subjects: the driver verdict deterministically, and the dashboard verdict by replaying its named predicate over the same head. The review tallies and check summary that fed that verdict are deliberately NOT recorded here — a vote count on a head is a mutable population with no producer that re-derives it, and copying one would be the transcription this document forbids. The generated-artifact driver refuses `GeneratedArtifactConcurrentDivergence` when both sides changed a generated projection since the merge base; GitHub's plain text-merge verdict never invokes that driver, so its merge can succeed with no conflict, marker or signal while yielding bytes that project neither side's authorities. The repository-semantic answer was Refused while every fact the dashboard consumes admitted the PR. Naming both immutable subjects and the producer makes this the gap firing in production, not a conclusion transcribed from a moving PR. PREVIOUS RUNG: mitigatable — the worker or manager had to reread the request and authority documents before declaring readiness, so the missing semantic fact was bounded only by human diligence and was never a mechanical guarantee. TEMPORARY RUNG: below the ladder on the dashboard-verdict path — no `RepositoryMergeAdmissibility` observation enters the constructor, no typed unknown or refusal is carried, and the affirmative verdict is indistinguishable from one whose semantic admission was actually decided. The review, CI and conflict paths retain their own mechanically preventable rungs; this row does not lower or relabel them. REASON: the dashboard automated the mechanical half of the decision and named the projection after the whole decision without first modeling the other half. BOUNDED POPULATION: every `merge_ready` digest entry constructed by `meetsMergeCriteria`, including its stale-entry revalidation through the same predicate; parent and manager notifications are projections of those entries and are not separate instances. OUTSIDE-THE-MODEL BOUNDARY: semantic admissibility may ultimately require judgment, but that does not license fabricating `Admissible`; an undecided judgment is a first-class standing and must block the affirmative verdict. RESTORATION TRIGGER: in `gunb-ai/ctrl`, a typed `RepositoryMergeAdmissibility` input with at least admitted, refused and undecided standings is consumed by the one canonical merge-readiness predicate, and both initial construction and stale revalidation refuse to emit `MergeReady` unless the exact repository-and-head subject is `Admitted`. A boolean inferred from approvals, CI, GitHub `mergeable`, session state, or the absence of a recorded objection does not satisfy the trigger, because each merely renames a mechanical fact already present. The discriminating RED is an otherwise mechanically ready PR whose semantic standing is undecided or refused; the positive control is the same mechanical packet with an exact-head admitted receipt. The repair belongs to `gunb-ai/ctrl`, which owns the dashboard constructor; this repository records the rung honestly and does not mint a second merge-admission authority." } + declaration: AuthoredProse { legacy: DashboardMergeReadySemanticAdmissibility, authored: "**THE DASHBOARD REPORTS `MergeReady` WITHOUT CONSUMING WHETHER THE CHANGE IS SEMANTICALLY ADMISSIBLE TO ITS REPOSITORY (2026-09-01).** The dashboard's `pr_merge_ready_digest.mjs` `meetsMergeCriteria` constructs the verdict from review-vote tallies, absence of unresolved or request-changes reviews, GitHub's conflict-free `mergeable` observation, and a non-failing check summary. Those are real mechanical facts, but they do not answer the separate repository-semantic question required by the working agreement: whether the diff actually satisfies its request and the repository's authority documents. An approval explicitly means only that its reviewer found no blocking defect; it is not evidence that the requested change was delivered. Calling their join `MergeReady` therefore turns an incomplete projection into an affirmative operational instruction and can page an operator to land a mechanically clean change that misses its request. EXECUTED SPECIMEN, observed 2026-09-01 with gunbc#9932 at `cc1f3ff60` against main at `6bdc9492c2`: `meetsMergeCriteria` emitted `ready=true` while the decision-time instrument `git merge-tree --write-tree origin/main cc1f3ff60` returned `rc=1`. Both are re-derivable at those two pinned subjects: the driver verdict deterministically, and the dashboard verdict by replaying its named predicate over the same head. The review tallies and check summary that fed that verdict are deliberately NOT recorded here — a vote count on a head is a mutable population with no producer that re-derives it, and copying one would be the transcription this document forbids. The generated-artifact driver refuses `GeneratedArtifactConcurrentDivergence` when both sides changed a generated projection since the merge base; GitHub's plain text-merge verdict never invokes that driver, so its merge can succeed with no conflict, marker or signal while yielding bytes that project neither side's authorities. The repository-semantic answer was Refused while every fact the dashboard consumes admitted the PR. Naming both immutable subjects and the producer makes this the gap firing in production, not a conclusion transcribed from a moving PR. PREVIOUS RUNG: mitigatable — the worker or manager had to reread the request and authority documents before declaring readiness, so the missing semantic fact was bounded only by human diligence and was never a mechanical guarantee. TEMPORARY RUNG: below the ladder on the dashboard-verdict path — no `RepositoryMergeAdmissibility` observation enters the constructor, no typed unknown or refusal is carried, and the affirmative verdict is indistinguishable from one whose semantic admission was actually decided. The review, CI and conflict paths retain their own mechanically preventable rungs; this row does not lower or relabel them. REASON: the dashboard automated the mechanical half of the decision and named the projection after the whole decision without first modeling the other half. BOUNDED POPULATION: every `merge_ready` digest entry constructed by `meetsMergeCriteria`, including its stale-entry revalidation through the same predicate; parent and manager notifications are projections of those entries and are not separate instances. OUTSIDE-THE-MODEL BOUNDARY: semantic admissibility may ultimately require judgment, but that does not license fabricating `Admissible`; an undecided judgment is a first-class standing and must block the affirmative verdict. RESTORATION TRIGGER: in `gunb-ai/ctrl`, a typed `RepositoryMergeAdmissibility` input with at least admitted, refused and undecided standings is consumed by the one canonical merge-readiness predicate, and both initial construction and stale revalidation refuse to emit `MergeReady` unless the exact repository-and-head subject is `Admitted`. A boolean inferred from approvals, CI, GitHub `mergeable`, session state, or the absence of a recorded objection does not satisfy the trigger, because each merely renames a mechanical fact already present. The discriminating RED is an otherwise mechanically ready PR whose semantic standing is undecided or refused; the positive control is the same mechanical packet with an exact-head admitted receipt. The repair belongs to `gunb-ai/ctrl`, which owns the dashboard constructor; this repository records the rung honestly and does not mint a second merge-admission authority." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/deleted_cadence_reference_drop.dag b/dag/gunbc/rung_drop/deleted_cadence_reference_drop.dag index 8fdcda84025..4a5eef82357 100644 --- a/dag/gunbc/rung_drop/deleted_cadence_reference_drop.dag +++ b/dag/gunbc/rung_drop/deleted_cadence_reference_drop.dag @@ -40,5 +40,7 @@ data deleted_cadence_reference_drop: RungDrop = RungDrop { "v1_compiler.cli_run parse_entry_live_tree_disposition", ], restoration_trigger: "a workflow or scheduled entry point exists that runs a predict-only cold comparison over the corpus, at which point each row above is reclassified from PremiseInvalidated to ReboundToExecutingConsumer with that consumer's receipt. Cadence half is gunbc.rung_drop.shared_capability missing_cadence_category. Waiters whose remaining unsatisfied condition is only that capability retire together. A waiter whose remainder is still unsatisfied is removed from missing_cadence_category.waiter_identities in the SAME change as those retirements (delist, not SplitRetirement) and stays Standing until its own trigger is fully satisfied.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/determinism_transitive_reachability.dag b/dag/gunbc/rung_drop/determinism_transitive_reachability.dag index f07a6456a36..10a93220149 100644 --- a/dag/gunbc/rung_drop/determinism_transitive_reachability.dag +++ b/dag/gunbc/rung_drop/determinism_transitive_reachability.dag @@ -122,5 +122,7 @@ data determinism_transitive_reachability: RungDrop = RungDrop { "v2.lens.affected_set.entry_selection (fn-arrow declarations, deleted)", ], restoration_trigger: "THE TRIGGER, STATED ONCE AND AT CAPABILITY GRAIN: the reachability walk's cost becomes proportional to WHAT IT REACHES rather than to the POOL IT IS HANDED, sufficient for determinism_transitive_holds to reach a verdict within the per-claim line at directory grain WITHOUT NARROWING THE SUBJECT. Nothing else retires this row. Everything after this sentence is the evidence for that trigger and the record of what was tried; none of it is a second trigger, and where a later paragraph names an obligation belonging to another subject it says so explicitly and that obligation is carried by its own row. THE TRIGGER WAS REPLACED RATHER THAN WEAKENED, 2026-09-07. It previously prescribed a specific implementation -- that the callee lookup answer BY INDEX rather than by scanning the candidate pool -- and that prescription is refuted by execution below. A trigger naming a REPAIR that does not work is worse than one naming none, because it is satisfiable while the capability stays dead. This one names the COST SHAPE the capability requires, which is what was actually measured, and is satisfiable only by achieving it. The previously declared capability (the callee lookup answering BY INDEX rather than by scanning the candidate pool) is withdrawn because the mechanism it was derived from is refuted by execution. THE REFUTATION, BY REASONING: v2.std.fn_index.decls_in_modules is a plain-valued call with hashable arguments, and the v1 interpreter's eval-frame call memo is on by default (GUNBC_EVAL_MEMO), keyed by fn identity x argument identity -- so the loop-invariant that trigger asked a lane to hoist had already been hoisted by the interpreter, and the per-lookup rescan named as the cost was not being paid. THE REFUTATION, BY MEASUREMENT: gunbc#10753 built exactly the prescribed index and measured it against the unindexed lookup at directory grain under a verdict rule pre-registered before the numbers existed; that PR carries the method, the pre-registration and the figures, and is the citation for them rather than a copy here. Its verdict is that the index is HARMFUL -- it adds cost and removes none -- and that both arms remain far above the per-claim line, so the prescription was not merely insufficient but wrong. WHAT SURVIVES: the O(reached x pool) FIT, unchanged and still good evidence. WHAT DOES NOT: the causal sentence behind it. ATTRIBUTION SO FAR, AND THE INSTRUMENT IS NOT IN THE TREE -- THAT IS STATED FIRST BECAUSE IT IS THE FACT A READER MUST HAVE BEFORE ANY FINDING BELOW. The six-arm probe that produced these findings was written, run, and DELIBERATELY NOT LANDED, and three placements were tried and refused before that conclusion was reached (gunbc#10757). Under scratch-probe/, outside every source root, the floor refused every arm as declined_changed_witness_outside_discovery: a planned witness it cannot reach is a typed refusal, not a skip. Moved into the long home it was refused again by floor DISCOVERY, which requires a test-marked declaration to live in a *_test.dag file. Renamed to satisfy that, the arms RAN and blocked the lane sixteen ways -- interrupted before verdict, completed over the per-claim cost requirement, and changed-witness-planned-without-terminal-verdict. THE RULE THAT MAKES THIS GENERAL RATHER THAN A BAD CHOICE OF DIRECTORY: the changed-witness selector REPLACES the ordinary disposition, so a long-home decline, a fixture decline and a declared cost-debt withhold are all overridden for any claim whose FILE THE CHANGE TOUCHES. There is therefore NO location in this repository where a multi-second claim can be added, or later edited, without running on the floor of the change that touches it. An instrument of this cost cannot be a claim here at all. HOW TO RE-DERIVE THE FINDINGS: rebuild the arms locally and run them under claim_batch, which charges each arm separately -- one arm per invocation when peak RSS matters, because claim_batch reports VmHWM for the process at exit. The arms are acquisition alone; the closure list alone; the reachability walk alone; the walk plus the determinism fold; and two arms holding the entry and the CLOSURE fixed while enlarging only the candidate POOL so the reached set is unchanged. Frame structure is itself a variable, so name it whenever a ratio is quoted. THIS IS A WEAKER CITATION THAN A LANDED INSTRUMENT AND IS RECORDED AS ONE: nothing in the tree re-derives these findings, so a lane taking up the trigger rebuilds the arms before quoting anything here. That is the honest cost of the constraint above, not a preference. What it establishes: the determinism fold is NOT the cost -- adding determinism_findings over every reached declaration's whole subtree does not rise above run-to-run noise, so a lane optimising it or its concat accumulator will move nothing; and the reachability WALK is pool-sensitive at a fixed reached set, which corroborates the pool term and locates it inside the walk. WHAT REMAINS UNATTRIBUTED, AND IS NOT A SECOND TRIGGER BUT AN OPEN QUESTION UNDER THE ONE ABOVE: WHICH construct inside that walk is pool-proportional, given that the per-lookup rescan is refuted. Naming it would make the repair easier to find; it is not required to retire this row, because the trigger is stated as the shape the cost must reach and a lane that reaches it has retired this drop whether or not it can say which construct was responsible. ONE CANDIDATE WAS PROPOSED HERE AND IS NOW REFUTED BY EXECUTION, RECORDED SO THE NEXT LANE DOES NOT SPEND ITS DISPATCH RE-KILLING IT. The candidate was the eval-frame memo's own keying -- that a probe must derive a key from the pool-sized argument on every call, so removing a pool-sized scan reintroduces a pool-sized cost in the key. Its death condition was written before the arm ran: if the pool sensitivity SURVIVES with GUNBC_EVAL_MEMO=0, keying is not the cost. Run the probe's a/c/e/f arms with the memo off and the sensitivity survives essentially unchanged, so the walk is pool-proportional INTRINSICALLY -- with the memo and without it -- and no repair to keying removes that term. The same arm establishes the opposite of what the candidate assumed: the memo is not a cost here but very nearly the whole performance of this walk, so any later repair in this area must PROTECT it rather than trim it. TWO MECHANISM SENTENCES HAVE NOW DIED ON THIS SUBJECT -- the candidate-pool rescan of gunbc#10744, and this one -- and the fit has survived both, which is why this row states a fit and refuses to state a cause. A third sentence does not go here until an arm supports it. WHAT IS ESTABLISHED IS NOT A MECHANISM BUT A SHAPE, AND THE SHAPE IS THE FINDING: THE WALK'S COST IS PROPORTIONAL TO THE POOL IT IS HANDED RATHER THAN TO WHAT IT REACHES. Three independent measurements, all re-derivable from the named instrument: the reached-set size is pinned EQUAL across a small pool and a pool several times larger, so reach is held constant while cost moves; the walk's cost ratio between those two pools is the same with the eval-frame memo ON as with it OFF. That third one is what makes this a shape rather than an implementation detail -- a cost that tracks the pool identically with a caching tier present and absent is not a property of that tier, of any key, or of any index, but of the WALK, and it is INVARIANT UNDER EVERY MECHANISM PROPOSED AND REFUTED HERE. That invariance is why this row states it as established while stating no cause. A measured cost-shape defect with no carrier is how a defect becomes ownerless, and DESIGN 2's bare-minimum-cost rule prices a PROVEN cost-shape defect as always worth fixing regardless of realized n, without waiting for the cause to be named. Reach-proportional is what this walk should be; pool-proportional is what it measures as. A CONSTRAINT ON ANY FUTURE REPAIR, MEASURED AND RECORDED HERE BECAUSE THE NEXT LANE WILL NOT EXPECT IT: with GUNBC_EVAL_MEMO=0 the same arms run roughly TWO ORDERS OF MAGNITUDE slower. The eval-frame memo is not a cost on this path, it is very nearly the whole performance of it. A later simplification that bypasses or replaces the memo -- which will look clean, because the memo is invisible in the .dag source -- makes this walk about a hundred times slower. Protect it; do not route around it. WHAT THIS ROW DOES NOT CLAIM, having measured it and found otherwise: that the floor claim's own excess over the per-claim line is explained by anything above. Reproduced term by term at the floor's own grain the claim runs at well under half the line, and running it beside deliberately pool-diverse company on one machine does not move it. So the shape defect above is REAL AND IS NOT THE BLOCKER'S EXCESS, and a lane that fixes the shape should expect the intermittency to survive it. AND THE DISPOSITION THAT FOLLOWS IS NOT THE ONE A READER WILL REACH FOR. Learning that the claim's own cost is well under half the line makes a bigger line look reasonable, and it is not: a budget cannot distinguish a claim whose true cost is half the line from one measured AT the line when the environment is separately recorded as swinging by more than a factor of two on BYTE-IDENTICAL evaluator steps. That is a MEASUREMENT TRUSTWORTHINESS defect and not a THRESHOLD defect, and the repair for it is never a bigger number: a number raised to accommodate an unattributed cost stops the refusal firing without stopping the wrongness and destroys the signal that the measurement cannot be trusted, which is the escape hatch DESIGN 5 forbids. A READING, LABELLED AS ONE BECAUSE IT EXPLAINS EVERY ARM AT ONCE AND THAT IS EXACTLY WHEN TO BE CAREFUL: the eval-frame memo is evicted PER WITNESS FRAME, so diversity BETWEEN claims is cleaned up while diversity WITHIN one frame is not. That predicts all three observations without residue -- the floor claim is unmoved when run beside deliberately pool-diverse company, two walks over two pools in ONE frame cost an order of magnitude more than the same two walks in separate frames, and the floor claim is the one-frame one-pool case that never blows up. THE CONSEQUENCE A LATER LANE MUST NOT MISS: that within-frame blowup DOES NOT BEAR ON THIS BLOCKER. Whoever re-derives it will have found something real and will be tempted to call it the cause. Its payer is not retention, refuted by two independent instruments -- an arm holding the walk count fixed while varying the pools retained, and the peak-RSS column, which moves a few percent while the time moves an order of magnitude. Before those two, every arm inferred memory from time, so a timing result and a memory story could not disagree; these can, and do not. A re-deriver must also pin whether each arm re-pays its acquisition or is served from a cross-witness share, which the probe does not settle. AND A RE-DERIVER MUST NOT CARRY ANY FIGURE HERE ONTO THE MACHINE THAT BLOCKS. Every measurement behind this row was taken on remote build executors; the per-claim line is enforced on the required-lane CI runner, which is a different machine population. A distribution measured on the first says nothing about the second, and treating it as though it did is the same error as comparing an isolated figure to a CI figure -- true measurement, wrong subject. THE BLOCKER IS ACCOUNTED FOR, POSITIVELY, ON THE POPULATION WHERE THE LINE IS ENFORCED, AND IT IS NOT THIS SUBJECT. Harvest the retained required-floor claim-cost artifacts from the successful main runs, take this claim's rows, and GROUP THEM BY eval_steps so that work is held constant -- the whole point of the existing pairing authority. AND READ THE ENFORCING POPULATION FROM THE ARTIFACT RATHER THAN FROM A CLOCK: required-floor-claim-cost is published by every completed witnesses run, so this claim's cost on the population that actually enforces it is readable with no push, no lane and no window -- an earlier reading of this row treated a merge freeze as preventing measurement, which confuses producing a new head with reading a receipt from a run that already finished. PARTITION THOSE ROWS BY eval_steps AND BY NOTHING ELSE. eval_steps is deterministic work rather than a clock, so it is immune to runner variance and pool contention, it states the effect of a work-removing repair directly instead of inferring it from a noisy distribution, and it is what makes the partition AUDITABLE: a run classified as pre-repair by its id and date was found to be a post-repair sample only because its eval_steps disagreed with its neighbours. Partitioning by run id, by date or by branch silently mixes the arms and yields a smaller, believable, wrong delta. AND READ THE PRE-REPAIR ARM AS A DISTRIBUTION THAT WORSENS AS IT GROWS, which is the strongest form of the original complaint rather than a restatement of it: as the pre-repair sample grew the top of the range rose and the margin under the 500ms limit fell, with a growing minority of runs landing within 50ms of the line. A shrinking margin under a GROWING sample is not noise -- noise widens a range symmetrically around a stable centre, while this arm's maximum climbs, which is what an intermittent blocker looks like before it becomes a constant one. That is why this class was worth repairing at a realized n that looked survivable. The large majority of recent runs share one step count, and across that group -- at BYTE-IDENTICAL evaluator work, with no change to this claim and none to the tree -- the observed CPU spans a wide factor whose top reaches essentially the whole per-claim ceiling. THE FIGURES ARE NOT WRITTEN HERE ON PURPOSE, and this sentence is the instrument rather than the reading: harvest required-floor-claim-cost from the completed main runs, take this claim's COMPLETED rows, group them by eval_steps, and read the spread and the maximum of the largest group against the limit. A number copied here would be a run-local figure that nothing re-derives, which is the defect this same field names two paragraphs down. A claim whose cost distribution at fixed work already touches its own line does not need a cost defect, a drift, an accounting hole, or any mechanism to refuse intermittently. It needs only to be sampled again. THAT IS THE INTERMITTENCY, and it is why this refuses on changes that touch nothing near it. AND THE ARM IT REFUSES THROUGH IS NOT AN OVERRUN, WHICH MATTERS BECAUSE THE TWO HAVE DIFFERENT DISPOSITIONS AND ONLY ONE OF THEM BLOCKS. Harvest the RED main runs as well as the green ones and this claim's blocking row reads verdict_reached=FALSE with a right-censored cost and a LOWER eval_steps count than any completed run -- fewer steps precisely because it never finished. On red runs where it did finish it came in under budget and those runs were red for other reasons. So the failure mode is INTERRUPTED-BEFORE-VERDICT and not COMPLETED-OVER-BUDGET: the deadline preempts the witness, whether it would have passed is UNKNOWN, and the reported cost is a bound with no upper limit. That is the stronger reason such a row is inadmissible in the distribution above -- not merely that a bound cannot be divided as a cost, but that it is not a sample from that distribution AT ALL, being the cost of a computation that did not happen. AND eval_steps ON A RIGHT-CENSORED ROW IS A TRUNCATION ARTIFACT, NOT A WORKLOAD FIGURE -- one sentence here to save the next harvester an afternoon. An interrupted claim stopped wherever it had got to when the deadline fired, so its step count records how far it got and nothing else: two observed interrupts on this claim truncate at different step counts, both far below every completed run, and neither denotes a workload. The harvest above groups by eval_steps to hold work constant, which is correct ONLY over completed rows. Group the censored ones the same way and they form a third apparent level out of nothing but where the deadline landed -- a bogus population that will look exactly like the drift finding this row already withdrew once. The two arms are the same underlying fact reached differently: a claim whose completed cost distribution touches its ceiling will, on a bad draw, hit the deadline BEFORE finishing, and then it does not report a larger number, it reports no verdict. THE CONSEQUENCE FOR THE REPAIR IS THAT MARGIN IS WORTH MORE THAN IT LOOKS: an overrun is a cost debt on a claim that PASSED, while an interrupt leaves the subject UNDECIDED and is the arm that refuses. Headroom is bought against the second. AND THE REFUSAL BEHAVIOUR OF THAT ARM IS A SEPARATE FILED CLASS, cited here rather than re-derived and deliberately NOT absorbed into this row: gunbc.recurring_failure_mode.non_verdict_disposition_surfaces_as_refusal records that the floor computes the difference between THIS SUBJECT IS WRONG and I DID NOT FINISH LOOKING AT THIS SUBJECT and then discards it at the aggregate boundary, so the red check and the merge gate receive one bit whose only affordance is to run it again. Its specimen is a run refused by interrupted rows in which ZERO claims failed. That is a different defect from this one, it is what makes an interrupt here block an unrelated change, and it is that row's to repair. TWO READINGS WERE PROPOSED AND WITHDRAWN ON THE WAY TO THAT, RECORDED BECAUSE BOTH ARE TEMPTING. A drift -- the claim walking toward the line across a level change -- dissolved once the smaller step-count group was compared against the larger group's actual range rather than against its own mean: the apparent second level sits inside the first population's spread. And a small-sample variance figure understated that spread, which is what made the two groups look separated at all. One error, twice: a sample too small to see its own width. THE REFUSAL IS CORRECT AS A MEASUREMENT AND WRONG AS AN ATTRIBUTION, and the distinction decides the repair. The CPU really was consumed, so the gate is not lying; but that cost is not a property of this claim's code, so charging it to this claim attributes it wrongly. A per-claim threshold enforced on ONE DRAW from a distribution this wide is estimating a statistic it cannot see from a single sample. Raising the ceiling would silence the wrong half and destroy the evidence, which is why no number moves here. THE REPAIR IS MARGIN, AND IT IS THE POOL-PROPORTIONAL SHAPE ALREADY ESTABLISHED ABOVE -- which needs no separate justification, being a DESIGN 2 bare-minimum-cost defect that is fixed regardless of realized n. It was never the blocker and it is still the fix. AND THE ACCEPTANCE TARGET IS DERIVED FROM THE MEASUREMENT RATHER THAN GUESSED: holding the line against a spread of that width requires the MEDIAN to sit below the ceiling divided by the spread, which gives the required reduction directly -- re-derive both the median and the spread from the harvest named above and take the ratio, rather than reading a percentage here. AND THE ACCEPTANCE EVIDENCE IS A DISTRIBUTION, NEVER A GREEN RUN. A claim this near its ceiling under this spread goes green sometimes with nothing repaired, so the first green after any change carries almost no information and is exactly what will be offered as proof. What establishes a repair is a distribution at EQUAL WORK, before and after, on the enforcing population. The before is the harvest described above and it exists today. IF MARGIN CANNOT BE OBTAINED, the remaining honest arm is a further bounded drop naming the shape fix as its trigger at capability grain. Never a bigger ceiling. A RECEIPT FOR THE COST COPRODUCT, RECORDED BECAUSE IT IS A RUNG CLAIM WITH AN EXECUTION BEHIND IT RATHER THAN A DESIGN INTENTION. The observation that opened this investigation was a budget-refused reading -- a lower bound on a cost that never completed, not a cost. It was the most persuasive number available and it was on the correct population, and it is INADMISSIBLE in any ratio. gunbc.floor_cost_distribution refuses it STRUCTURALLY, because its cost reading is a coproduct and a bound has no constructor a cost fits into; no reviewer's judgement had to catch it. That class was filed after a rendered figure just over this same ceiling was read as a completed cost, and it then prevented the identical error in a later lane that knew the story and still reached for the number. AN INSTRUMENT GAP IS DECLARED HERE RATHER THAN PAPERED OVER. The ANALYSIS for the environment-variance question already exists and is not to be re-minted: gunbc.floor_cost_distribution models the cost reading as a coproduct so a censored bound cannot be divided as a cost, and identity_inflation_permille_at_equal_work pairs rows across two runs by identity AND by equal evaluator steps, which is precisely CPU divergence at byte-identical work. What does not exist is an ACTUATOR that runs one claim N times in N processes over one tree and hands the pairs to it, and the actuator that does exist runs only inside CI. So the variance figures recorded elsewhere in the seed were transcribed not because the concept lacked a home but because nothing could RE-RUN it on demand. A NEIGHBOURING CLASS THIS INVESTIGATION SURFACED, FILED IN ITS OWN ROW AND CITED HERE RATHER THAN STORED HERE: gunbc.recurring_failure_mode.inflation_fold_cannot_name_the_environment_it_measures. It is not a trigger of this drop and cannot retire it -- its subject is whether a per-claim cost MEASUREMENT can be trusted, which is a different invalid state with a different harm. It is named here for one reason only: a lane meeting THIS row's trigger must show the cost shape changed, and the evidence for that is a distribution over repeated runs, which is exactly the analysis that class governs. Read it before quoting any such distribution. A repair must be derived from measurement rather than from a plausible mechanism -- that is what the refutations below establish -- but it is the cost SHAPE that must change, not a named construct that must be found first. SUFFICIENT FOR (unchanged, and still the thing being restored): determinism_transitive_holds with pool_roots=['src/v2/lens'] and pool_files=[] reaching a verdict within the per-claim line at directory grain, WITHOUT NARROWING THE SUBJECT -- scoping pool_roots to the modules the walk happens to reach remains the trap and not the repair, because it lowers the number by shrinking the population, leaves the cost shape intact, and re-breaks the moment the subject widens, which is the widening this drop exists to restore. COST SHAPES IN THIS WALK ARE REAL AND ARE EXPLICITLY NOT THE COST, recorded so a later reader does not fix them and believe the defect is gone. THREE OF THEM ARE NOW REPAIRED and are named in the past tense because their symbols no longer resolve: call_reachable_decls_go scanned `reached` linearly per seed through a decl_in_list helper that is deleted, and now answers membership by keyed lookup over a seen map; it appended to `reached` with a copied accumulator and now conses and reverses once at the end; and list_append(rest, callee_decls) copied the worklist every step and is now guarded so an empty callee list does not copy it. REPAIRING THEM DID NOT RETIRE THIS DROP AND WAS NEVER EXPECTED TO: the pool scan in decls_matching_callee is untouched, and this row is retired by the trigger stated at the head of this field -- the cost shape -- and by nothing else. ONE SHAPE IN callees_from_node IS AN ADMITTED, UNRESOLVED OBLIGATION rather than a repair: its duplicate suppression is a linear scan of the accumulated list per callee, which is quadratic in the callees of one declaration and is subject to the same bare-minimum-cost rule. A map-keyed arm was written and measured SLOWER than the list scan at the realized callee counts and was reverted on that measurement; big-O did not grant permission to ship the slower realization, and equally the slower first attempt did not retire the defect it was aimed at. The obligation dissolves when the walk is asked at a grain whose per-declaration callee counts are large enough for the keyed arm to win, and it is recorded here rather than in the source so that it is folded with the rest of this row. THE REMAINING UNREPAIRED SHAPES: determinism_transitive_findings folds with concat(acc, determinism_findings(...)), a copied accumulator that is FREE while the corpus is clean and degrades quadratically exactly when findings appear, so it is invisible in every green run and expensive only when something is already wrong. determinism_live_closure_modules folds list_snoc_item over module_declaration_facts_live(pool_roots: []), a copied accumulator over a list that is empty today. Until the trigger stated at the head of this field is met, determinism over the fn-arrow call graph is unverified. The way out is that trigger and nothing else.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/direct_call_arg_seam_v2_exemption.dag b/dag/gunbc/rung_drop/direct_call_arg_seam_v2_exemption.dag index 8cbfcbde63e..d4575af7b8a 100644 --- a/dag/gunbc/rung_drop/direct_call_arg_seam_v2_exemption.dag +++ b/dag/gunbc/rung_drop/direct_call_arg_seam_v2_exemption.dag @@ -13,5 +13,7 @@ data direct_call_arg_seam_v2_exemption: RungDrop = RungDrop { standing: Retired { trigger_fired: "2026-09-03 -- declaration-bound formal conformance is carried from callee resolution through the direct-call application plan, so the caller-side reconstruction that motivated the v2-wide exemption is gone and the compat judgment now runs in every module. The remaining unbound-generic boundary is narrower, observable, and declared separately." as NonEmptyStr }, declaration: AuthoredProse { legacy: DirectCallArgSeamV2Exemption, authored: "**ONE OF THE TWO DIRECT-CALL ARGUMENT JUDGMENTS IS SWITCHED OFF FOR EVERY `v2.*` MODULE, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** The suppressed arm is `arg_compat_diags`; the inhabitance arm beside it is ungated and still runs there. That split is measured below, not assumed, and the loose reading -- that argument checking is off in `v2.*` -- is what this row exists to stop being repeated. `v1.compiler.infer` `module_skips_direct_call_arg_check` returns true for every module whose declared name begins with `v2.`, so at a direct call inside such a module the argument-position TYPE-COMPAT judgment does not run. It is ONE of two arms and the measurement below says which: the ungated inhabitance arm still runs there, so this is a narrowed judgment, not an absent one. The predicate is not new and its cost is not disputed: `gunbc.doc_graph_roots` already names it as the one in-tree violation of the no-escape-hatch clause, in its own words that the compiler being bootstrapped is authored under weaker checks than ordinary source. What has never existed is this row. PREVIOUS RUNG AT THIS ROW'S OWN SUBJECT GRAIN: NONE STOOD, and saying otherwise would be the cross-path inflation DESIGN 4b(1) forbids (codex review 58154, which caught it here). The subject is the compat arm INSIDE `v2.*`. That arm has never executed there -- the exemption predates this row -- so there is no rung for this row to have lowered and none is claimed. What the fixture establishes is a DIFFERENT path: that the suppressed check operates OUTSIDE the exemption, on the same tree and the same binary, which is what makes the exemption a real loss of an available guarantee rather than a check nobody has. Those two facts must not be averaged: `mechanically preventable outside v2.*` and `never executed inside v2.*` are separate paths, and a class's rung is the MINIMUM across its in-scope paths. This row therefore declares a STANDING ABSENCE at its subject grain rather than a regression, and it is filed as a drop because the obligation 4b(3) attaches -- population, reason, and a trigger that can retire it -- is the obligation an undeclared permanent exemption was escaping. TEMPORARY RUNG for the compat arm inside `v2.*`: mitigatable where the emitted-Rust self-host closure covers the module, because a wrong argument surviving acceptance becomes a rustc type error in the emitted crate -- refused late, in the wrong compiler, in the wrong phase -- and UNGUARDED on the source-acceptance path for every `v2.*` module that closure does not reach. Those are two paths and the row reports the MINIMUM, so the temporary rung for this subject is UNGUARDED, not mitigatable; the mitigated path is named because it bounds where the loss is observable at all, never to raise the reported rung. The ungated inhabitance arm keeps its rung throughout and is NOT part of this drop. REASON: the exemption's stated justification is representation-gap false positives at the argument seam — the same four classes the conformance lane grounds (brand aliases, optionality's two representations, anonymous record literals, expansion depth) — plus an unlocated historical claim of 104 TypeMismatch false positives that two audits have failed to find a receipt for. Its deletion is gunbc#8924, which is COMPLETE and MEASURED and CLOSED, held because its one missing precondition is a resolve-layer seam whose repair was DECLINED at the owning layer on 2026-08-22 with no owner and no schedule. THE POPULATION IS RESTATED HERE AND IT IS NOT THE ONE THE HOLD WAS PRICED AGAINST. The reopening condition recorded on `gunbc.doc_graph_roots` bounds the blast radius at 9 declarations under `src/v2/extdeps/formatters/`. The predicate's actual population is EVERY MODULE WHOSE DECLARED NAME BEGINS WITH `v2.` — the instrument is the predicate itself, re-derivable by matching `^module v2.` against the corpus's module declarations, and the count is deliberately not transcribed here. That population includes the SELF-HOST EMISSION CLOSURE. WHAT THE EXEMPTION ACTUALLY SUPPRESSES, MEASURED AT DIAGNOSTIC IDENTITY RATHER THAN ARGUED FROM THE PREDICATE. The instrument is one fixture authored twice, byte-identical but for its module line and a renaming of every declaration so nothing resolves across the pair, run through a gunbc built from this tree. Three arms each: a local alias parameter (`type Wrapped = FreeMonoid` declared in the calling module), a cross-module declaration-path parameter (`v2.std.text.String`), and an `Int` parameter as control, each receiving a kernel `String` actual. NON-`v2.` MODULE: the local-alias arm is ADMITTED with no diagnostic; the declaration-path arm REFUSES with `value does not inhabit its declared type at the direct call argument`, declared `Node(std.algebra.FreeMonoid)` produced `Primitive(String)`; the control REFUSES TWICE, once with `type mismatch: expected Primitive(Int), got Primitive(String)` and once with the inhabitance message. `v2.*` MODULE: the local-alias arm is ADMITTED; the declaration-path arm REFUSES with the SAME inhabitance message; the control refuses with the inhabitance message ONLY. EXACTLY ONE DIAGNOSTIC IDENTITY DISAPPEARS across the pair -- the `type mismatch` row -- and every other identity is preserved. That is the drop, measured: this exemption suppresses `arg_compat_diags` and NOTHING ELSE. THE SCOPE OF THE LOSS IS THEREFORE NARROWER THAN THE PREDICATE NAME SUGGESTS, and stating it narrowly is the point of measuring it. `v1.compiler.infer` computes `arg_compat_diags` under this gate and calls `direct_call_argument_inhabitance_diags` immediately after with NO gate, both feeding one `concat`, so the INHABITANCE judgment runs inside `v2.*` exactly as it runs everywhere else. A reader who takes the argument judgment to be off in `v2.*` -- as the first draft of this row did -- will misattribute every surviving refusal and every surviving admission. CONSEQUENTLY THIS ROW CLAIMS NO SELF-HOST HARM AND NAMES NONE. The specimen anyone reaches for first is `src/v2/std/integer.dag` calling `v2.std.text` `string_head`, whose emitted Rust rustc refuses; that call is NOT hidden by this exemption, because the surviving inhabitance arm is the one that judges its shape and the fixture shows the compat arm would not have refused it either. That shape belongs to a DIFFERENT and already-standing declaration, `text_boundary_identity_wall`. Citing it here would be an unbacked execution claim. THE CLAIM IS NOT THAT THE BLAST RADIUS NOW EXCEEDS 9. It is that THE SUBJECT CHANGED and the old bound no longer describes what is being bought, which is a reason to re-measure; a declared drop whose population is measured against a subject it no longer covers is the drop lying about its own size. ONE CONSEQUENCE FOR ANY READER OF A GREEN `v2.*` CALL SITE, stated precisely because the loose version of it is the easiest false inference available here and this row asserted the loose version first: a `v2.*` call site accepted WITHOUT a compat diagnostic says nothing, because that arm cannot speak there; a `v2.*` call site accepted with no INHABITANCE diagnostic says exactly what it says everywhere else, because that arm is ungated. A discriminating red for the SUPPRESSED arm is therefore only authorable in a non-`v2.` module -- not because the wall is absent in `v2.*`, but because only one of its two arms is. RESTORATION TRIGGER, named at capability grain: the resolve-layer seam capability that makes `arg_compat_diags` RUNNABLE on `v2.*` modules -- the argument-position conformance relation grounding the representation gaps that motivated the exemption (brand aliases, optionality's two representations, anonymous record literals, expansion depth), so that the compat arm refuses genuinely wrong argument bindings inside `v2.*` without fabricating a refusal against those four grounded classes. That capability is SUFFICIENT only under a two-direction A/B measured the way this row's own population was: the twin fixture re-run, with the `type mismatch` identity PRESENT on both the non-`v2.` and the `v2.*` side, and the corpus's existing `v2.*` call sites still ADMITTED. gunbc#8924 MERGING IS NOT THIS TRIGGER, and neither is any measurement that only re-prices the hold; the trigger is the seam being repaired at its owning layer, which was DECLINED on 2026-08-22 and is UNOWNED as of this declaration -- a trigger nobody is holding is still a trigger, and a reader must be able to see that nobody is holding it." -} +}, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/direct_call_unbound_carried_generic_compat.dag b/dag/gunbc/rung_drop/direct_call_unbound_carried_generic_compat.dag index a8223dd3c90..6e0e0c109ba 100644 --- a/dag/gunbc/rung_drop/direct_call_unbound_carried_generic_compat.dag +++ b/dag/gunbc/rung_drop/direct_call_unbound_carried_generic_compat.dag @@ -12,5 +12,7 @@ data direct_call_unbound_carried_generic_compat: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: DirectCallUnboundCarriedGenericCompat, authored: "**THE MODULE-WIDE `v2.*` EXEMPTION IS RETIRED, AND THIS NARROWER UNBOUND-GENERIC BOUNDARY IS DECLARED IN ITS PLACE (2026-09-03).** PREVIOUS RUNG: the compat arm was absent for every direct call in every `v2.*` module and silent when skipped. TEMPORARY RUNG: mitigatable. `v1.compiler.infer` `direct_call_arg_type_mismatch` judges every resolved direct call, but accepts when the declaration substitution basis or the produced value still carries an unbound `TypeVariable`; the sibling inhabitance judgment emits the typed, located `DeclaredTypeInhabitanceUndecided` diagnostic with reason `UndecidableGenericFormal`. Unlike the old switch, this boundary announces each occurrence and the compile-clean partition counts it as advisory rather than allowing a rendered diagnostic to belong to neither its blocking nor advisory total. REASON: synthesized constructor signatures and higher-order generic callbacks can retain a parent generic after the call substitution pass, so compatibility cannot prove nominal mismatch at that position. POPULATION, RE-DERIVABLE RATHER THAN TRANSCRIBED: run `compile_clean_diagnostic_histogram` over the required-lane closure and select diagnostic class `DeclaredTypeInhabitanceUndecided`, direct-call argument position/name, reason `UndecidableGenericFormal`; that identity set is the population and no copied count is authoritative. RESTORATION TRIGGER, NAMED AT CAPABILITY GRAIN: synthesized constructor signatures and higher-order callback formals expose and bind their parent generic so direct-call generic inference substitutes it before compatibility, making both the carried formal and produced value decidable without an accepting undecidable arm. A manually maintained census, a module exemption, or suppressing the advisory does not satisfy this trigger." } + declaration: AuthoredProse { legacy: DirectCallUnboundCarriedGenericCompat, authored: "**THE MODULE-WIDE `v2.*` EXEMPTION IS RETIRED, AND THIS NARROWER UNBOUND-GENERIC BOUNDARY IS DECLARED IN ITS PLACE (2026-09-03).** PREVIOUS RUNG: the compat arm was absent for every direct call in every `v2.*` module and silent when skipped. TEMPORARY RUNG: mitigatable. `v1.compiler.infer` `direct_call_arg_type_mismatch` judges every resolved direct call, but accepts when the declaration substitution basis or the produced value still carries an unbound `TypeVariable`; the sibling inhabitance judgment emits the typed, located `DeclaredTypeInhabitanceUndecided` diagnostic with reason `UndecidableGenericFormal`. Unlike the old switch, this boundary announces each occurrence and the compile-clean partition counts it as advisory rather than allowing a rendered diagnostic to belong to neither its blocking nor advisory total. REASON: synthesized constructor signatures and higher-order generic callbacks can retain a parent generic after the call substitution pass, so compatibility cannot prove nominal mismatch at that position. POPULATION, RE-DERIVABLE RATHER THAN TRANSCRIBED: run `compile_clean_diagnostic_histogram` over the required-lane closure and select diagnostic class `DeclaredTypeInhabitanceUndecided`, direct-call argument position/name, reason `UndecidableGenericFormal`; that identity set is the population and no copied count is authoritative. RESTORATION TRIGGER, NAMED AT CAPABILITY GRAIN: synthesized constructor signatures and higher-order callback formals expose and bind their parent generic so direct-call generic inference substitutes it before compatibility, making both the carried formal and produced value decidable without an accepting undecidable arm. A manually maintained census, a module exemption, or suppressing the advisory does not satisfy this trigger." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/emit_copy_qualification_without_a_consumer.dag b/dag/gunbc/rung_drop/emit_copy_qualification_without_a_consumer.dag index 81d4de6d7a2..bd10212845d 100644 --- a/dag/gunbc/rung_drop/emit_copy_qualification_without_a_consumer.dag +++ b/dag/gunbc/rung_drop/emit_copy_qualification_without_a_consumer.dag @@ -12,5 +12,7 @@ data emit_copy_qualification_without_a_consumer: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: EmitCopyQualificationWithoutAConsumer, authored: "**THE EMIT-COST-QUAL-0 BATTERY LOSES ITS ONLY SANCTIONED CONSUMER (2026-09-04).** `emit-copy-qualification-battery` shipped with `if_condition: \"false\"` under the ROOT-N division ruling of 2026-08-31, holding one activation token for the #9769 chain. The 2026-09-04 runner-capacity ruling spent that token on DELETION rather than activation: the job is removed from `gunbc.witness_floor_workflow` instead of having its `\"false\"` lifted. PREVIOUS RUNG: none was held — the job never executed, so the honest previous state is the declared standing that it WOULD execute on activation, with its `claim_batch --functions` line named as `gunbc.emit_copy_qualification_wet_battery`'s only sanctioned consumer. TEMPORARY RUNG: outside the modeled guarantee, which is deliberately not a rung — the battery's wet shards and its five instrument-falsifier mutants are now specification without execution in the sense DESIGN §5 names, and no row in `test.claim.emit_copy_qualification_witness_test` establishes anything about a running system. REASON: the job cost a roster slot and a permanently-skipped entry in the emitted workflow while establishing nothing, and under a runner shortage the cheapest honest disposition of a lane that has never run is to delete it rather than to keep holding a slot for it. Note what this did NOT save, because the opposite would be an inflated claim: the job was skipped, so it consumed no runner time and the deletion buys no capacity. What it buys is a roster that means what it says. BOUNDED POPULATION: `gunbc.emit_copy_qualification_wet_battery` — the six wet carrier shards and six calibration rows named in the deleted argv — plus the three workflow-subject rows removed from its witness file. `gunbc.emit_copy_qualification`, `gunbc.emit_copy_qualification_fixture_gen` and `tools.emit_copy_qualification_transport` keep whatever consumers they had; this row does not speak for them. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns. RESTORATION TRIGGER, at capability grain: the battery's assertions EXECUTING on the real acceptance path as floor-enrolled `*_test.dag` witnesses — which is the same conversion the deleted job's own dissolution row demanded and never got, now with nothing else holding the module up. The blocker it named is real and unchanged: `v2.workflow.floor_changed_witness` refuses a changed witness identity with no terminal floor verdict, and these wet transactions route-gap hermetically (`IsExecutable`, `NoMockResponse`), so the trigger is the capability to give a hermetically route-gapped wet transaction a terminal floor verdict. RE-ADDING A JOB DOES NOT SATISFY IT and now requires operator sign-off besides; a battery that can only be executed by a lane nobody will fund is the state this row records, not the repair." } + declaration: AuthoredProse { legacy: EmitCopyQualificationWithoutAConsumer, authored: "**THE EMIT-COST-QUAL-0 BATTERY LOSES ITS ONLY SANCTIONED CONSUMER (2026-09-04).** `emit-copy-qualification-battery` shipped with `if_condition: \"false\"` under the ROOT-N division ruling of 2026-08-31, holding one activation token for the #9769 chain. The 2026-09-04 runner-capacity ruling spent that token on DELETION rather than activation: the job is removed from `gunbc.witness_floor_workflow` instead of having its `\"false\"` lifted. PREVIOUS RUNG: none was held — the job never executed, so the honest previous state is the declared standing that it WOULD execute on activation, with its `claim_batch --functions` line named as `gunbc.emit_copy_qualification_wet_battery`'s only sanctioned consumer. TEMPORARY RUNG: outside the modeled guarantee, which is deliberately not a rung — the battery's wet shards and its five instrument-falsifier mutants are now specification without execution in the sense DESIGN §5 names, and no row in `test.claim.emit_copy_qualification_witness_test` establishes anything about a running system. REASON: the job cost a roster slot and a permanently-skipped entry in the emitted workflow while establishing nothing, and under a runner shortage the cheapest honest disposition of a lane that has never run is to delete it rather than to keep holding a slot for it. Note what this did NOT save, because the opposite would be an inflated claim: the job was skipped, so it consumed no runner time and the deletion buys no capacity. What it buys is a roster that means what it says. BOUNDED POPULATION: `gunbc.emit_copy_qualification_wet_battery` — the six wet carrier shards and six calibration rows named in the deleted argv — plus the three workflow-subject rows removed from its witness file. `gunbc.emit_copy_qualification`, `gunbc.emit_copy_qualification_fixture_gen` and `tools.emit_copy_qualification_transport` keep whatever consumers they had; this row does not speak for them. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns. RESTORATION TRIGGER, at capability grain: the battery's assertions EXECUTING on the real acceptance path as floor-enrolled `*_test.dag` witnesses — which is the same conversion the deleted job's own dissolution row demanded and never got, now with nothing else holding the module up. The blocker it named is real and unchanged: `v2.workflow.floor_changed_witness` refuses a changed witness identity with no terminal floor verdict, and these wet transactions route-gap hermetically (`IsExecutable`, `NoMockResponse`), so the trigger is the capability to give a hermetically route-gapped wet transaction a terminal floor verdict. RE-ADDING A JOB DOES NOT SATISFY IT and now requires operator sign-off besides; a battery that can only be executed by a lane nobody will fund is the state this row records, not the repair." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/emit_stage_blocking.dag b/dag/gunbc/rung_drop/emit_stage_blocking.dag index 902b3350325..9f3a3df1d0a 100644 --- a/dag/gunbc/rung_drop/emit_stage_blocking.dag +++ b/dag/gunbc/rung_drop/emit_stage_blocking.dag @@ -12,5 +12,7 @@ data emit_stage_blocking: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: EmitStageBlocking, authored: "**A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: COUNTED 2026-08-27, STILL UNBOUNDED, AND THE SHAPE OF THAT RESULT IS THE FINDING.** This row read UNCOUNTED AND UNBOUNDED until a whole-root `--target rust` census was taken; the receipt is `gunbc.emit_stage_blocking_population_census` — a receipt and explicitly not an instrument, since no `.dag` entry point produces this measurement and the compiler's own CLI was driven by hand, which is a gap this row records rather than papers over. What the receipt does carry is the invocation as a DERIVATION rather than as prose: `census_run_invocation` renders each run's argv from that run's own fields, so the command is reachable from the fact it produced instead of sitting in a `//` annotation no `Accepted` program can read. The run's exit status and peak residency sit inside the same record as every count it carries, because a SIGKILL prints nothing and a harness reading only stdout reads a fabricated zero. **WHAT THE CENSUS ANSWERS: three, and three is not the population.** `v1.compiler.emit_rust` `emit_rust` returns with no files at its FIRST gate, so the three parameter-default refusals it reports were MASKING eight anonymous-record ones that had been standing all along — the same prefix-of-the-truth shape `gunbc.emit_diagnostic_observation` already records, reproduced on the live corpus. Clearing a gate in the working tree to see past it is a measurement of what the NEXT gate would report, never a measurement of main, and the receipt says so on every row that used one. **AND THE UPPER BOUND IS UNREACHABLE BY THIS ROUTE, FOR A REASON THAT IS NOT ABOUT DIAGNOSTICS AT ALL:** with both gates clear, emit reaches its code-generation body and does not return — stopped at a declared five-hour budget, still computing, no tree written, so it has no exit status to record and no population to read. **SO §4b(3) IS STILL NOT SATISFIED AND THIS ROW DOES NOT CLAIM IT IS.** What moved is the word UNCOUNTED: the observable population is three, the latent population is at least eleven, and the missing upper bound now has a named cause instead of no measurement. The rung does not move, the restoration trigger does not move, and a census is not the required phase that trigger names. Two specimens are named below, escaping by three distinct modes. Anyone who takes the named specimens, or these figures, as the population has made the denominator error this document keeps recording — the second root measured (`src/v2` as primary, its own subject, unioned with nothing) carries twenty hard diagnostics at its emit refusal of which ZERO were produced by emit. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` HAD ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it was an orphan, so no closure reached it and nothing typechecked it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stood on main for a reason that has nothing to do with which phases emit. **THAT SPECIMEN IS REPAIRED AS OF 2026-08-27 AND THE MODE IS NOT**, which is the same split this row already makes for the gcp operation above: the carrier that cited it now IMPORTS it, so an edge reaches it, it enters that carrier's closure, and its own missing edge to `extdeps.shell` is authored. Nothing about the MODE changed -- an orphan module is still typechecked by nothing, and the next one is still invisible for the same reason this one was. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan was NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carried two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module was CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reached it and nothing typechecked it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home did not compile. **THE REPAIR WAS AT THE CITATION AND NOT AT THE MODULE, AND THAT IS THE TRANSFERABLE PART.** The carrier CALLS both cited declarations, so a real dependency existed the whole time and had been authored as inert data beside a string-equality function comparing each row's literal field against the same literal -- a check whose RED was authorable only by editing the row it read, permanently green by construction and named as evidence that the credential flow bound these authorities. The four rows are replaced by import edges, so the binding is carried by the mechanism that typechecks the calls (§5, construction over validation). Repairing the module's own errors WITHOUT that edge would have closed the specimen and left the next regression in it equally invisible, which is why a citation standing where an edge belongs is the defect rather than a description of one. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. EARLY RESTORATION CONDITION, NOW SUPERSEDED: a required phase emits over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not merely when the gcp operation is repaired. That condition fired when emit-compile covered one closure, narrowing the exposure without restoring the plural loss; it is historical context, not this row's restoration trigger. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. RESTORATION TRIGGER: THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim.", } + declaration: AuthoredProse { legacy: EmitStageBlocking, authored: "**A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: COUNTED 2026-08-27, STILL UNBOUNDED, AND THE SHAPE OF THAT RESULT IS THE FINDING.** This row read UNCOUNTED AND UNBOUNDED until a whole-root `--target rust` census was taken; the receipt is `gunbc.emit_stage_blocking_population_census` — a receipt and explicitly not an instrument, since no `.dag` entry point produces this measurement and the compiler's own CLI was driven by hand, which is a gap this row records rather than papers over. What the receipt does carry is the invocation as a DERIVATION rather than as prose: `census_run_invocation` renders each run's argv from that run's own fields, so the command is reachable from the fact it produced instead of sitting in a `//` annotation no `Accepted` program can read. The run's exit status and peak residency sit inside the same record as every count it carries, because a SIGKILL prints nothing and a harness reading only stdout reads a fabricated zero. **WHAT THE CENSUS ANSWERS: three, and three is not the population.** `v1.compiler.emit_rust` `emit_rust` returns with no files at its FIRST gate, so the three parameter-default refusals it reports were MASKING eight anonymous-record ones that had been standing all along — the same prefix-of-the-truth shape `gunbc.emit_diagnostic_observation` already records, reproduced on the live corpus. Clearing a gate in the working tree to see past it is a measurement of what the NEXT gate would report, never a measurement of main, and the receipt says so on every row that used one. **AND THE UPPER BOUND IS UNREACHABLE BY THIS ROUTE, FOR A REASON THAT IS NOT ABOUT DIAGNOSTICS AT ALL:** with both gates clear, emit reaches its code-generation body and does not return — stopped at a declared five-hour budget, still computing, no tree written, so it has no exit status to record and no population to read. **SO §4b(3) IS STILL NOT SATISFIED AND THIS ROW DOES NOT CLAIM IT IS.** What moved is the word UNCOUNTED: the observable population is three, the latent population is at least eleven, and the missing upper bound now has a named cause instead of no measurement. The rung does not move, the restoration trigger does not move, and a census is not the required phase that trigger names. Two specimens are named below, escaping by three distinct modes. Anyone who takes the named specimens, or these figures, as the population has made the denominator error this document keeps recording — the second root measured (`src/v2` as primary, its own subject, unioned with nothing) carries twenty hard diagnostics at its emit refusal of which ZERO were produced by emit. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` HAD ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it was an orphan, so no closure reached it and nothing typechecked it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stood on main for a reason that has nothing to do with which phases emit. **THAT SPECIMEN IS REPAIRED AS OF 2026-08-27 AND THE MODE IS NOT**, which is the same split this row already makes for the gcp operation above: the carrier that cited it now IMPORTS it, so an edge reaches it, it enters that carrier's closure, and its own missing edge to `extdeps.shell` is authored. Nothing about the MODE changed -- an orphan module is still typechecked by nothing, and the next one is still invisible for the same reason this one was. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan was NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carried two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module was CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reached it and nothing typechecked it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home did not compile. **THE REPAIR WAS AT THE CITATION AND NOT AT THE MODULE, AND THAT IS THE TRANSFERABLE PART.** The carrier CALLS both cited declarations, so a real dependency existed the whole time and had been authored as inert data beside a string-equality function comparing each row's literal field against the same literal -- a check whose RED was authorable only by editing the row it read, permanently green by construction and named as evidence that the credential flow bound these authorities. The four rows are replaced by import edges, so the binding is carried by the mechanism that typechecks the calls (§5, construction over validation). Repairing the module's own errors WITHOUT that edge would have closed the specimen and left the next regression in it equally invisible, which is why a citation standing where an edge belongs is the defect rather than a description of one. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. EARLY RESTORATION CONDITION, NOW SUPERSEDED: a required phase emits over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not merely when the gcp operation is repaired. That condition fired when emit-compile covered one closure, narrowing the exposure without restoring the plural loss; it is historical context, not this row's restoration trigger. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. RESTORATION TRIGGER: THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim.", }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/emitted_bytes_witness_required_lane.dag b/dag/gunbc/rung_drop/emitted_bytes_witness_required_lane.dag index 163803f66a5..b4578584698 100644 --- a/dag/gunbc/rung_drop/emitted_bytes_witness_required_lane.dag +++ b/dag/gunbc/rung_drop/emitted_bytes_witness_required_lane.dag @@ -13,5 +13,7 @@ data emitted_bytes_witness_required_lane: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: EmittedBytesWitnessRequiredLane, authored: "UN-RETIRED 2026-09-04. This row was retired on 2026-09-02 by gunbc#10078 because arm (i) of its trigger fired: `rust-unit-tests` was promoted into the required aggregate, so the witness executed on the real acceptance path. The 2026-09-04 runner-capacity ruling DELETED that job -- see `gunbc.rung_drop` `rust_unit_tests_off_the_merge_path` -- so arm (i) has un-fired and arm (ii), a substrate-visible emitted-bytes probe surface, was never built. The class is therefore back below its declared previous rung and the drop stands again. THE RETIREMENT ADJUDICATION IS KEPT VERBATIM BELOW rather than deleted, because it is the record of what was true when it was made and of exactly which fact stopped being true: everything it establishes about the witness being un-ignored and about the runner-fault class being retired by toolchain-home isolation REMAINS CORRECT. What changed is not the evidence quality, it is that no required lane executes the command any more. Retiring this row a second time needs arm (i) restored under a supply the fleet actually has, or arm (ii) built; re-reading the adjudication below is not sufficient. FORMER trigger_fired: 2026-09-02 by gunbc#10078, both conjuncts of arm (i) adjudicated rather than assumed. FIRST CONJUNCT -- PROMOTED: `gunbc.witness_floor_workflow` `required_lanes_roster` carries `rust_unit_tests_job_id` beside the build and floor lanes, so the emitted aggregate reads `needs: [required-witnesses-build, required-witnesses-floor, rust-unit-tests]` AND reads `$UNIT` in both verdict folds -- the second half is what grants blocking authority, a `needs` alone would only have added a wait. The repository ruleset makes `witnesses` the one required context, so this lane now gates every merge transitively. SECOND CONJUNCT -- THE RUNNER-FAULT CLASS IS RETIRED BY CONSTRUCTION, NOT PRICED. The 2026-09-01 measurement's two failures were the shared-runner `$HOME`/cargo-shim class: concurrent runner slots sharing one toolchain home. Every job of the emitted workflow now carries an `Isolate toolchain homes` prelude that wipes and repoints HOME/CARGO_HOME/RUSTUP_HOME under `$RUNNER_TEMP`, so the sharing the class needs does not occur. MEASURED AGAINST THAT CONSTRUCTION RATHER THAN ASSERTED FROM IT, 2026-09-03 over the witnesses workflow's most recent 100 runs: 55 `rust-unit-tests` jobs had concluded -- 52 success, 3 failure, 2 cancelled -- and EVERY ONE of the three failures is about the diff or is a designed refusal (two `clippy, all targets` reds on the same branch's `type_occurrence_binding_census.rs`, one heal-revalidation preflight refusing a run subject that does not name the expected healed SHA). ZERO runner-environment faults, against the ~8 percent this row declared. THE INSTRUMENT IS NAMED AND THE FIGURES ARE NOT THE CLAIM: re-derive with `gh api repos/OWNER/REPO/actions/workflows/witnesses.yml/runs` then `/actions/runs//jobs` selecting the `rust-unit-tests` job, and read each failure's FAILING STEP -- a conclusion count alone cannot separate a fault class from a defect, which is the whole question this conjunct asks. AND THE WITNESS ACTUALLY EXECUTES: `emit_import_lines_follow_resolved_binding_identity` is emitted into `compiler_tests.rs` as a plain `#[test]` with NO `#[ignore]`, so `cargo test --release -p v1-compiler --lib` runs it on the acceptance path. WHAT THIS DOES NOT RETIRE: the REASON clause stays true -- no substrate-visible surface exposes emitted bytes to a `dag/test/claim` witness -- so arm (ii) is unbuilt and the population is held at the required rung by a Rust-hosted test rather than by the floor. That is a standing modeling gap, not a rung drop, and it is not re-declared here. --- **DECLARED AGAIN 2026-09-04; the 2026-09-02 retirement is un-done and is recorded above.** The witness this row was declared about now executes on the real acceptance path, so the emission-follows-resolution class sits at its declared previous rung again and this drop is debt that no longer exists. The adjudication of both trigger conjuncts is carried in `trigger_fired` rather than restated here. The declaration below is kept verbatim because it is the record of what was true when it was made; `standing` carries what is true now. Witness enrollment — **RUNG DROP, DECLARED (2026-09-01, gunbc#9850 witness enrollment).** PREVIOUS RUNG: none to lower — this declares that the mechanically-preventable rung for the emission-follows-resolution class (the 139-row use-line shadow repaired in gunbc#9850) is held by a test OUTSIDE the required aggregate. TEMPORARY RUNG: the discriminating RED and positive controls are enrolled as `emit_import_lines_follow_resolved_binding_identity` in `v1.compiler.compiler_tests_rust`, emitted into `compiler_tests.rs` and executed by `repo_self_test_command` (`cargo test --release -p v1-compiler --lib`) in the `rust-unit-tests` job of `gunbc.witness_floor_workflow` — which runs on every push and pull request but is NOT a `needs` of the required aggregate, so a regression reddens a visible job without blocking the merge. REASON: no substrate-visible surface exposes EMITTED BYTES to a `dag/test/claim` witness (the host census builtin carries diagnostics only), so the assertion is inexpressible in the required floor today; promoting `rust-unit-tests` to required was measured 2026-09-01 at 23/25 recent completions green with both failures runner-environment faults (shared-runner `$HOME`/cargo-shim class) — an ~8% infra-noise rate ruled too high to make 612 tests merge-blocking fleet-wide tonight. POPULATION: the emission-follows-resolution witness matrix (String RED, structural-Bool and non-kernel controls) plus every other `compiler_tests` row asserting on emitted bytes. RESTORATION TRIGGER, named at capability grain: a required-lane capability SUFFICIENT to execute, on the real acceptance path, a fixture assertion that a named `pub use` line is ABSENT from emitted bytes for a sole-exporter structural type resolved to a host-realized kernel scalar, and PRESENT for a structural kernel carrying a connective (Bool = True | False) — via either (i) `rust-unit-tests` promoted into the required aggregate after its runner-fault class is retired or priced, or (ii) a substrate-visible emitted-bytes probe surface admitted under the scaffold doctrine. A surface that can read emitted bytes but cannot discriminate those two cases does NOT satisfy this trigger." } + declaration: AuthoredProse { legacy: EmittedBytesWitnessRequiredLane, authored: "UN-RETIRED 2026-09-04. This row was retired on 2026-09-02 by gunbc#10078 because arm (i) of its trigger fired: `rust-unit-tests` was promoted into the required aggregate, so the witness executed on the real acceptance path. The 2026-09-04 runner-capacity ruling DELETED that job -- see `gunbc.rung_drop` `rust_unit_tests_off_the_merge_path` -- so arm (i) has un-fired and arm (ii), a substrate-visible emitted-bytes probe surface, was never built. The class is therefore back below its declared previous rung and the drop stands again. THE RETIREMENT ADJUDICATION IS KEPT VERBATIM BELOW rather than deleted, because it is the record of what was true when it was made and of exactly which fact stopped being true: everything it establishes about the witness being un-ignored and about the runner-fault class being retired by toolchain-home isolation REMAINS CORRECT. What changed is not the evidence quality, it is that no required lane executes the command any more. Retiring this row a second time needs arm (i) restored under a supply the fleet actually has, or arm (ii) built; re-reading the adjudication below is not sufficient. FORMER trigger_fired: 2026-09-02 by gunbc#10078, both conjuncts of arm (i) adjudicated rather than assumed. FIRST CONJUNCT -- PROMOTED: `gunbc.witness_floor_workflow` `required_lanes_roster` carries `rust_unit_tests_job_id` beside the build and floor lanes, so the emitted aggregate reads `needs: [required-witnesses-build, required-witnesses-floor, rust-unit-tests]` AND reads `$UNIT` in both verdict folds -- the second half is what grants blocking authority, a `needs` alone would only have added a wait. The repository ruleset makes `witnesses` the one required context, so this lane now gates every merge transitively. SECOND CONJUNCT -- THE RUNNER-FAULT CLASS IS RETIRED BY CONSTRUCTION, NOT PRICED. The 2026-09-01 measurement's two failures were the shared-runner `$HOME`/cargo-shim class: concurrent runner slots sharing one toolchain home. Every job of the emitted workflow now carries an `Isolate toolchain homes` prelude that wipes and repoints HOME/CARGO_HOME/RUSTUP_HOME under `$RUNNER_TEMP`, so the sharing the class needs does not occur. MEASURED AGAINST THAT CONSTRUCTION RATHER THAN ASSERTED FROM IT, 2026-09-03 over the witnesses workflow's most recent 100 runs: 55 `rust-unit-tests` jobs had concluded -- 52 success, 3 failure, 2 cancelled -- and EVERY ONE of the three failures is about the diff or is a designed refusal (two `clippy, all targets` reds on the same branch's `type_occurrence_binding_census.rs`, one heal-revalidation preflight refusing a run subject that does not name the expected healed SHA). ZERO runner-environment faults, against the ~8 percent this row declared. THE INSTRUMENT IS NAMED AND THE FIGURES ARE NOT THE CLAIM: re-derive with `gh api repos/OWNER/REPO/actions/workflows/witnesses.yml/runs` then `/actions/runs//jobs` selecting the `rust-unit-tests` job, and read each failure's FAILING STEP -- a conclusion count alone cannot separate a fault class from a defect, which is the whole question this conjunct asks. AND THE WITNESS ACTUALLY EXECUTES: `emit_import_lines_follow_resolved_binding_identity` is emitted into `compiler_tests.rs` as a plain `#[test]` with NO `#[ignore]`, so `cargo test --release -p v1-compiler --lib` runs it on the acceptance path. WHAT THIS DOES NOT RETIRE: the REASON clause stays true -- no substrate-visible surface exposes emitted bytes to a `dag/test/claim` witness -- so arm (ii) is unbuilt and the population is held at the required rung by a Rust-hosted test rather than by the floor. That is a standing modeling gap, not a rung drop, and it is not re-declared here. --- **DECLARED AGAIN 2026-09-04; the 2026-09-02 retirement is un-done and is recorded above.** The witness this row was declared about now executes on the real acceptance path, so the emission-follows-resolution class sits at its declared previous rung again and this drop is debt that no longer exists. The adjudication of both trigger conjuncts is carried in `trigger_fired` rather than restated here. The declaration below is kept verbatim because it is the record of what was true when it was made; `standing` carries what is true now. Witness enrollment — **RUNG DROP, DECLARED (2026-09-01, gunbc#9850 witness enrollment).** PREVIOUS RUNG: none to lower — this declares that the mechanically-preventable rung for the emission-follows-resolution class (the 139-row use-line shadow repaired in gunbc#9850) is held by a test OUTSIDE the required aggregate. TEMPORARY RUNG: the discriminating RED and positive controls are enrolled as `emit_import_lines_follow_resolved_binding_identity` in `v1.compiler.compiler_tests_rust`, emitted into `compiler_tests.rs` and executed by `repo_self_test_command` (`cargo test --release -p v1-compiler --lib`) in the `rust-unit-tests` job of `gunbc.witness_floor_workflow` — which runs on every push and pull request but is NOT a `needs` of the required aggregate, so a regression reddens a visible job without blocking the merge. REASON: no substrate-visible surface exposes EMITTED BYTES to a `dag/test/claim` witness (the host census builtin carries diagnostics only), so the assertion is inexpressible in the required floor today; promoting `rust-unit-tests` to required was measured 2026-09-01 at 23/25 recent completions green with both failures runner-environment faults (shared-runner `$HOME`/cargo-shim class) — an ~8% infra-noise rate ruled too high to make 612 tests merge-blocking fleet-wide tonight. POPULATION: the emission-follows-resolution witness matrix (String RED, structural-Bool and non-kernel controls) plus every other `compiler_tests` row asserting on emitted bytes. RESTORATION TRIGGER, named at capability grain: a required-lane capability SUFFICIENT to execute, on the real acceptance path, a fixture assertion that a named `pub use` line is ABSENT from emitted bytes for a sole-exporter structural type resolved to a host-realized kernel scalar, and PRESENT for a structural kernel carrying a connective (Bool = True | False) — via either (i) `rust-unit-tests` promoted into the required aggregate after its runner-fault class is retired or priced, or (ii) a substrate-visible emitted-bytes probe surface admitted under the scaffold doctrine. A surface that can read emitted bytes but cannot discriminate those two cases does NOT satisfy this trigger." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/fabric_db_append_principal_unrefused.dag b/dag/gunbc/rung_drop/fabric_db_append_principal_unrefused.dag index b0df50fe1b0..922d2c23149 100644 --- a/dag/gunbc/rung_drop/fabric_db_append_principal_unrefused.dag +++ b/dag/gunbc/rung_drop/fabric_db_append_principal_unrefused.dag @@ -36,5 +36,7 @@ data fabric_db_append_principal_unrefused: RungDrop = RungDrop { "gunbc.fabric_event_log fabric_seat_acquire", ], restoration_trigger: "a modeled roster of fabric writer principals, grounded in an observed reading of the identity each fleet writer presents through tailscale serve on srv1 -- SUFFICIENT FOR fabric_db_serve_handle to refuse a put or advance from any identity outside the roster, including an absent identity, with a discriminating RED over the real handler", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/fabric_evidence_gating.dag b/dag/gunbc/rung_drop/fabric_evidence_gating.dag index 0ffda2ced0b..1b82bdb2bc5 100644 --- a/dag/gunbc/rung_drop/fabric_evidence_gating.dag +++ b/dag/gunbc/rung_drop/fabric_evidence_gating.dag @@ -12,5 +12,7 @@ data fabric_evidence_gating: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FabricEvidenceGating, authored: "**AMENDED 2026-09-04: THE LANE NO LONGER EXECUTES EITHER, AND THIS ROW NOW COVERS BOTH LOSSES.** The 2026-09-04 operator ruling on runner capacity deleted the `fabric-evidence` JOB, together with `fabric_ci_evidence_calibration_step`, its two derived bounds, and `tools/fabric_ci_evidence_calibration.sh`. The declaration below was written when only the merge block was withdrawn and the calibration still ran; read every present-tense claim in it about the lane EXECUTING in the past tense. WHAT CHANGES: the temporary rung falls from mitigatable to outside the modeled guarantee — there is no longer a red for a human to read, because there is no run. WHAT DOES NOT: the restoration trigger, which was already stated at capability grain and is unchanged, and the operational consequence, which now binds harder — the FABRIC-CI program (warm-seal-35) agreed to check `fabric-evidence` explicitly on every head rather than inferring it from `witnesses`, and there is now nothing to check, so any conclusion resting on that lane rests on nothing. THE ROW IS AMENDED RATHER THAN SUPERSEDED because the subject is the same lane and the same trigger retires both losses; a second row would have split one subject across two authorities. The countability moved: `w_RED_fabric_evidence_executes_without_gating` asserted the lane still ran and is replaced by `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return`, which reds if the job, the FABRIC_EVIDENCE binding or the calibration argv returns while this row stands. The original declaration follows. **THE FABRIC-CI EVIDENCE LANE STOPS BLOCKING MERGES AND KEEPS EXECUTING (2026-08-31).** #9704 added `fabric-evidence` as a fourth job and, in the same change, made it a `needs` of the aggregating `witnesses` job that the `passing CI` ruleset names as this repository's one required context. PREVIOUS RUNG: mechanically preventable — a defect in the FCI-EVIDENCE-0 run-boundary contract was exposed by an enrolled calibration and blocked the merge. TEMPORARY RUNG: mitigatable — the same calibration still runs on every push and pull request, still refuses loudly, and its log is still the record; what is gone is the block, so a red is now a signal a human must read rather than a wall. REASON, and it is wall clock rather than doubt about the evidence: the required context's wall is the MAX over its three lanes, and on run 33350499023 that max was `fabric-evidence` at 27 minutes against 20 for the floor lane and 10.5 for the build lane, having moved the required wall from ~13 minutes to ~28-40 within a day of #9704 landing. 1469 of those 1620 seconds are the calibration step, and its own logs put all ~18 of the plan's `gunbc run` host processes at 80-90 seconds each. That cost is not the evidence: the instrument's import closure is six modules, and per `cli_run.entry_resolve` an `--entry` run is scoped in what it EMITS but WHOLE-TREE in what it PARSES, so each process re-parses and re-censuses the entire 4414-module corpus to evaluate a handful of rows. The lane is paying eighteen whole-corpus censuses (DESIGN §2 duplicated work) for thirteen assertions. Batching them is NOT the repair and is not what this row defers: the calibration-timeout derivation recorded that distinct host processes ARE the process-edge subject (that row was deleted with the lane on 2026-09-04; its reasoning is preserved in this sentence), so fewer processes would remove the boundary rather than observe it more cheaply. BOUNDED POPULATION: exactly one job, `fabric-evidence`, and exactly one lost edge — its `needs.fabric-evidence.result` binding into the aggregate's closed-vocabulary verdict fold. No other lane, phase, witness or claim changes rung; the build and floor lanes keep every edge they had, and the calibration keeps every assertion it had. The drop is countable from the emitted workflow: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_fabric_evidence_executes_without_gating` reds if the job stops executing, and reds again if either gating spelling returns while this row still stands. ONE OPERATIONAL CONSEQUENCE, recorded here because it is the kind of practice that quietly stops once the person who agreed to it moves on. With the needs edge withdrawn, a `fabric-evidence` failure no longer reaches the aggregate verdict, so any lane that was reading the required context as a proxy for that lane's health is now reading a context that cannot see it. The FABRIC-CI program (warm-seal-35) accepted the drop on that basis and will check `fabric-evidence` EXPLICITLY on every head rather than inferring it from `witnesses`. Anyone else joining on the required context owes the same explicit check for as long as this row stands; that obligation ends when the trigger below is met and not before. RESTORATION TRIGGER: the CAPABILITY of a single fabric evidence process resolving its entry against the source roots at a cost that fits the required wall budget — concretely, the whole-tree parse and name census being paid once per tree state rather than once per host process, so that the 13-row plan executes its full process-edge roster inside the lane's share of a ~10-minute required wall. THIS IS NOT RETIRED BY THE MEMO PR MERGING. It is retired by a measured `fabric-evidence` job wall that leaves the required context at or under its budget with the needs edge and the FABRIC_EVIDENCE binding restored, which is the only thing that makes the block affordable again. Reducing the plan's process count, relaxing what a row asserts, or moving the calibration to a cadence does not satisfy this trigger — the first removes the subject, and the other two are different drops that would need their own rows." } + declaration: AuthoredProse { legacy: FabricEvidenceGating, authored: "**AMENDED 2026-09-04: THE LANE NO LONGER EXECUTES EITHER, AND THIS ROW NOW COVERS BOTH LOSSES.** The 2026-09-04 operator ruling on runner capacity deleted the `fabric-evidence` JOB, together with `fabric_ci_evidence_calibration_step`, its two derived bounds, and `tools/fabric_ci_evidence_calibration.sh`. The declaration below was written when only the merge block was withdrawn and the calibration still ran; read every present-tense claim in it about the lane EXECUTING in the past tense. WHAT CHANGES: the temporary rung falls from mitigatable to outside the modeled guarantee — there is no longer a red for a human to read, because there is no run. WHAT DOES NOT: the restoration trigger, which was already stated at capability grain and is unchanged, and the operational consequence, which now binds harder — the FABRIC-CI program (warm-seal-35) agreed to check `fabric-evidence` explicitly on every head rather than inferring it from `witnesses`, and there is now nothing to check, so any conclusion resting on that lane rests on nothing. THE ROW IS AMENDED RATHER THAN SUPERSEDED because the subject is the same lane and the same trigger retires both losses; a second row would have split one subject across two authorities. The countability moved: `w_RED_fabric_evidence_executes_without_gating` asserted the lane still ran and is replaced by `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return`, which reds if the job, the FABRIC_EVIDENCE binding or the calibration argv returns while this row stands. The original declaration follows. **THE FABRIC-CI EVIDENCE LANE STOPS BLOCKING MERGES AND KEEPS EXECUTING (2026-08-31).** #9704 added `fabric-evidence` as a fourth job and, in the same change, made it a `needs` of the aggregating `witnesses` job that the `passing CI` ruleset names as this repository's one required context. PREVIOUS RUNG: mechanically preventable — a defect in the FCI-EVIDENCE-0 run-boundary contract was exposed by an enrolled calibration and blocked the merge. TEMPORARY RUNG: mitigatable — the same calibration still runs on every push and pull request, still refuses loudly, and its log is still the record; what is gone is the block, so a red is now a signal a human must read rather than a wall. REASON, and it is wall clock rather than doubt about the evidence: the required context's wall is the MAX over its three lanes, and on run 33350499023 that max was `fabric-evidence` at 27 minutes against 20 for the floor lane and 10.5 for the build lane, having moved the required wall from ~13 minutes to ~28-40 within a day of #9704 landing. 1469 of those 1620 seconds are the calibration step, and its own logs put all ~18 of the plan's `gunbc run` host processes at 80-90 seconds each. That cost is not the evidence: the instrument's import closure is six modules, and per `cli_run.entry_resolve` an `--entry` run is scoped in what it EMITS but WHOLE-TREE in what it PARSES, so each process re-parses and re-censuses the entire 4414-module corpus to evaluate a handful of rows. The lane is paying eighteen whole-corpus censuses (DESIGN §2 duplicated work) for thirteen assertions. Batching them is NOT the repair and is not what this row defers: the calibration-timeout derivation recorded that distinct host processes ARE the process-edge subject (that row was deleted with the lane on 2026-09-04; its reasoning is preserved in this sentence), so fewer processes would remove the boundary rather than observe it more cheaply. BOUNDED POPULATION: exactly one job, `fabric-evidence`, and exactly one lost edge — its `needs.fabric-evidence.result` binding into the aggregate's closed-vocabulary verdict fold. No other lane, phase, witness or claim changes rung; the build and floor lanes keep every edge they had, and the calibration keeps every assertion it had. The drop is countable from the emitted workflow: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_fabric_evidence_executes_without_gating` reds if the job stops executing, and reds again if either gating spelling returns while this row still stands. ONE OPERATIONAL CONSEQUENCE, recorded here because it is the kind of practice that quietly stops once the person who agreed to it moves on. With the needs edge withdrawn, a `fabric-evidence` failure no longer reaches the aggregate verdict, so any lane that was reading the required context as a proxy for that lane's health is now reading a context that cannot see it. The FABRIC-CI program (warm-seal-35) accepted the drop on that basis and will check `fabric-evidence` EXPLICITLY on every head rather than inferring it from `witnesses`. Anyone else joining on the required context owes the same explicit check for as long as this row stands; that obligation ends when the trigger below is met and not before. RESTORATION TRIGGER: the CAPABILITY of a single fabric evidence process resolving its entry against the source roots at a cost that fits the required wall budget — concretely, the whole-tree parse and name census being paid once per tree state rather than once per host process, so that the 13-row plan executes its full process-edge roster inside the lane's share of a ~10-minute required wall. THIS IS NOT RETIRED BY THE MEMO PR MERGING. It is retired by a measured `fabric-evidence` job wall that leaves the required context at or under its budget with the needs edge and the FABRIC_EVIDENCE binding restored, which is the only thing that makes the block affordable again. Reducing the plan's process count, relaxing what a row asserts, or moving the calibration to a cadence does not satisfy this trigger — the first removes the subject, and the other two are different drops that would need their own rows." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cost_claim_qualification_unavailable.dag b/dag/gunbc/rung_drop/floor_cost_claim_qualification_unavailable.dag index 39da0b7e2b6..5e3cfce522a 100644 --- a/dag/gunbc/rung_drop/floor_cost_claim_qualification_unavailable.dag +++ b/dag/gunbc/rung_drop/floor_cost_claim_qualification_unavailable.dag @@ -12,5 +12,7 @@ data floor_cost_claim_qualification_unavailable: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCostClaimQualificationUnavailable, authored: "Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. the 500ms CPU line this row was declared over (now `required_floor_per_subject_cpu_line_ms`, which is still CPU milliseconds and still compared to a CPU reading by the enrolment margin, both as the ceiling its budget must sit below and as the line a live Roster (typed cost-debt) ground must clear, `v2.workflow.floor_enrolment_margin` `enrolment_declared_measured_standing`; the claim ceiling's own 500 moved to `required_floor_claim_work_envelope_ms`, a policy in milliseconds of work that no clock is compared to) was a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 219ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR, and a floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. RE-DERIVED 2026-09-03, BY THAT CONDITION AND BY NOTHING ELSE. The floor was 1.777 from a single identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed -- which is ONE PAIR, and one pair is one sample of a between-run quantity and therefore has no spread at all. A LARGER FLOOR IS NOW MEASURED OVER A SAMPLE THAT INDEXES OVER RUNS: 2.280, the worst per-identity max-over-min across TWELVE green `main` runs of `witnesses.yml` on twelve distinct runner registrations across three hosts, restricted to identities present in every run with a verdict, a baseline at or above 50 cpu-ms, and equal `eval_steps` in all twelve. THAT LAST RESTRICTION IS A FILTER AND NOT A FINDING, and the distinction matters here more than anywhere because MISSING ITEM (b) BELOW MEASURED THE SAME COLUMN AND REFUTED ITS INVARIANCE: selecting rows whose steps agree removes tree movement from the sample so the residual is inflation, and it establishes nothing about whether steps are invariant in general -- they are not. 500 over 2.280 floors to the constant above. THE PRODUCER IS NAMED AND THE DIGITS ARE NOT THE AUTHORITY: `gunbc.floor_cost_distribution` `worst_envelope_permille` over `work_invariant_envelopes` of `complete_envelopes`, driven by `tools.floor_cost_distribution_instrument` `floor_cost_envelope_report`, whose sampled runs and their runners are data in `floor_cost_envelope_sampled_runs`. This is the modeled producer the paragraph below says does not exist for the SUBSET; it exists for the CONSTANT'S INPUT and not for the subset, and those are different gaps. ROBUST IN DIRECTION AND NOT ONLY IN VALUE: restricting the same derivation to rows at or above 200 cpu-ms, where whole-millisecond quantisation cannot dominate, gives 1.874 and a constant of 266ms -- still below the superseded 280, so the re-derivation does not rest on the small-baseline tail. STILL A FLOOR: twelve runs on three hosts are a SUBSET of the admitted execution envelopes, so 2.280 can only rise and this constant can only fall. AND THE EXTREMES ARE CONCENTRATED ON PARTICULAR MACHINES, which a median run factor cannot see because a median is robust exactly where the envelope is driven: `run_extreme_census` over the same population reports one run holding the MINIMUM for 367 of 398 rows and one host holding the MAXIMUM for 279 of 398 from three of twelve runs, while per-run median factors span only 0.878 to 1.118. That is this row's own subject measured at host grain. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN, AT THE SUPERSEDED 280ms CONSTANT AND NOT AT THE ONE ABOVE -- the enumeration is kept as the receipt of what was measured and must not be read as today's subset, which is larger at a lower constant (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. That histogram is that run's, at the superseded constant; on the twelve-run sample above, taking each identity's MAX over the twelve, 88 identities reach 280 and 158 reach the constant now standing, and the same doubling holds within a single run rather than only in the union (run 33754393519: 61 then 115; run 33775106554: 73 then 128; run 33766436293: 20 then 72). Lowering the constant roughly doubles the subset, which is the cost of the re-derivation stated rather than left for a reader to discover. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED BY CONSTRUCTION across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE PER-CLAIM MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. THE QUALIFIER IS LOAD-BEARING AND WAS ADDED BY RULING (fierce-lark-661, 2026-09-13, on gunbc#11195) BECAUSE THE UNQUALIFIED SENTENCE FORBADE MORE THAN ITS EVIDENCE SUPPORTS -- DESIGN section 4d's over-prohibition arm, whose cost is the thing nobody does. WHAT IS FORBIDDEN is deriving a claim's budget from the population's own CPU readings: that is the run-varying, position-sensitive quantity, and a budget consuming it inherits the defect AND makes a verdict vary between runs. WHAT IS ADMITTED is a SINGLE CONTROLLED READING pinned as a POLICY CONSTANT -- `v2.workflow.floor_eval_step_calibration` -- taken on a fixture whose work is fixed by source rather than by the corpus. The discriminator is not the unit but the DEPENDENCE: an error in a pinned constant mis-scales BOTH tiers ONCE and UNIFORMLY and cannot make one claim's verdict differ between two runs of the same tree, which is precisely the property the denominator change buys and precisely what the per-claim distribution cannot offer. A RE-PIN RESCALES EVERY BUDGET UNIFORMLY AND NEVER ONE CLAIM, so it is a policy act taken deliberately and never maintenance. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head, and only where the refusal is carried entirely by this row's two arms. THAT RULE WAS MIS-SPELLED AND MIS-EVIDENCED WHEN FIRST WRITTEN, AND BOTH DEFECTS ARE CORRECTED HERE RATHER THAN QUIETLY RESPELLED. It read `one reroll per head per signature`, which parses as a COUNTER KEY -- so many rerolls per distinct signature -- and that reading is self-defeating on this row's own claim: these arms vary across attempts of one unchanged tree, so A CHANGED SIGNATURE IS THE EXPECTED OUTCOME OF A REROLL rather than new information, and every reroll would license the next one for exactly the reason this row exists. The signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget. The budget is ONE, PER HEAD. AND THE ELIGIBILITY TEST MUST NOT BE EVALUATED AGAINST THIS CLASS'S OWN COUNTERS. It said `the run reported failed=0`, which was read off the floor's disposition counters; those enumerate COST dispositions and do not range over other phases, so they cannot report that anything else failed and the test could only ever confirm itself. THE RULE STATED SO IT SURVIVES THE SPELLING: ELIGIBILITY IS A PROPERTY OF THE RUN'S PHASE VERDICT AND IS NEVER READ OFF A CLASS'S OWN DISPOSITION COUNTERS, whatever either is called. The quotation `failed=0` above is preserved as a RECEIPT of what a run actually printed on 2026-09-02 and must not be restated as the current key: at the time, one word `failed` carried FOUR SUBJECTS across four emitters of one binary -- lane phases, required-floor claims, DISCOVERY ROWS, and a package LIST -- which is why an inside-the-subject reading looked like an outside-the-subject one. THE DISCOVERY SUBJECT IS THE ONE THAT MATTERS AND IT IS NOT A NARROWER OR WIDER SPELLING OF THE CLAIM POPULATION: it is a DIFFERENT population that additionally absorbs NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted, so a reader treating the two as the same word silently unions failure classes the other excludes. That fork is being repaired at the producer by a separate lane, into `phases_failed`, `claims_failed`, `discovery_rows_failed` and `packages_failed`, with `FAILED PHASE` unchanged; this row therefore names the phase verdict as the adjudicating SURFACE rather than any counter key. Eligibility is decided by the RUN'S PHASE VERDICT -- `phases_run`, `failed`, and the `FAILED PHASE` lines -- which is evidence from outside the predicate's own subject. The class is `admission_predicate_evidenced_from_inside_its_own_subject`. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). AND ONE FURTHER PAIR, ENTERED MARKED BECAUSE ITS ADMISSION WAS INVALID AND THAT IS PRECISELY WHY IT IS KEPT: gunbc#10077 run 33647114048, floor job 100317014535, head 74719e46dd, both attempts `planned=executed=3487` with no unexpected claim failures -- attempt 1 `interrupted_before_verdict=12` (all `interrupted_cpu_deadline`), `completed_over_cost_requirement=0`; attempt 2 `interrupted_before_verdict=1`, `completed_over_cost_requirement=2`. Refuse then refuse. All twelve of attempt 1's rows sit in `test.claim.self_host_compile_phase_frontier_witness` and `test.claim.self_host_compile_phase_live_gate_witness`, EACH MEASURED 501 TO 506 CPU-MS AGAINST THE 500MS LIMIT -- a one-to-six millisecond miss, which is the sharpest evidence this row has for its own claim: a witness failing at 900ms would be consistent with genuinely costing that much, and one failing at 501 is not. THE ADMISSION WAS FALSE WHEN IT WAS MADE. The run was `phases_run=3 failed=2`, refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas, so the refusal was never carried entirely by this row's two arms; the eligibility test had been evaluated against the floor's own disposition counters, which cannot report that another phase failed. IT IS ENTERED RATHER THAN REPLACED BY A CLEANER RUN, and the reason is structural: a clean run cannot evidence a defective admission predicate, so this is the only receipt that the rule was broken, and dropping it for being untidy would filter the mitigation's record by how the mitigation turned out. WHAT IT DOES NOT ESTABLISH, stated because the counts invite it: attempt 2's single interrupted row was ALSO IN attempt 1's twelve, so the pair is a SUBSET and not a disjoint redraw, and a stable population straddling the threshold explains both attempts without any redraw at all -- one module in this run carries members at 481, 490, 499, 500 and 501 ms. The counts moved; the membership did not leave the prior set. An earlier reading of this pair asserted that a fixed marginal set could not produce those counts; that assertion was withdrawn by its own author on the membership measurement before it was entered here. THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument defect is WIDER THAN WRONG-ATTEMPT, measured 2026-09-02 on gunbc#10077 by diffing both fetches of ONE job: the `gh run view` copy was MISSING THE `FAILED PHASE` LINES ENTIRELY. It does not merely serve the wrong attempt; it can DROP THE LINES CARRYING THE VERDICT, turning a two-phase failure into an apparent one-phase failure -- which is precisely how the admission predicate above was evaluated as true while it was false. An instrument whose omission is invisible is worse than one that is merely stale. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it. RECEIPT, 2026-09-03, gunbc#10192: ONE EPISODE BY RUN ID -- ADMITTED IN PART AND NOT END TO END, WHICH THE ENUMERATION BELOW ADJUDICATES RATHER THAN SMOOTHS -- AND THE FIRST CORPUS-GRAIN MEASUREMENT OF MISSING ITEM (b) -- WHICH IT REFUTES RATHER THAN DISCHARGES. THE EPISODE, run 33716314510 on head b65a0eb5b32, ENUMERATED IN FULL INCLUDING THE ATTEMPTS THAT DO NOT QUALIFY, because the sequence contains a transition this row does NOT authorize and an enumeration that showed only the eligible attempts would present an unadmitted retry as part of an admitted mitigation. ATTEMPT 1 EXECUTED ZERO JOBS -- no required-witnesses-floor job exists for it; the run was created awaiting workflow approval -- so it is not an attempt of this class and counting it as one would inflate the denominator. ATTEMPT 2, job 100543957851: claims_failed=33 with BOTH cost arms at zero. OUTSIDE this row's domain: zero dispositions in either cost arm. THE CAUSE OF THOSE 33 IS NOT ESTABLISHED HERE AND AN EARLIER DRAFT CALLED THEM SEMANTIC, WHICH THE COUNTERS DO NOT SUPPORT -- claims_failed enumerates ordinary claim-failure dispositions and does not say why they failed, and a missing host capability surfacing as a runtime error would land in the same counter as a genuine false assertion. The honest reading is an ORDINARY CLAIM-FAILURE FLOOR REFUSAL, CAUSE UNESTABLISHED. ITS ROLE HERE IS A NEGATIVE ELIGIBILITY CONTROL AND NOT A DENOMINATOR MEMBER, which corrects the reason an earlier draft gave for including it: a mitigation's eligible population is the attempts satisfying its admission predicate, so an attempt outside the class can no more count as a failed use of the mitigation than an ordinary compile error can. It is kept because it PROVES THE PREDICATE EXCLUDES SOMETHING REAL. AND THE TRANSITION OUT OF IT IS UNADJUDICATED, WHICH THIS ROW RECORDS RATHER THAN LAUNDERS: outside this row's budget means attempt 2 SPENT no reroll; it does not mean attempt 2 EARNED one. The re-run that produced attempt 3 was NOT admitted by this row -- attempt 2's refusal was carried by neither cost arm -- and no other authority is named for it. So this sequence is not one admitted mitigation end to end: it is an unadmitted retry of an ordinary red on byte-identical executed input, followed by a cost-only refusal that this row does admit, followed by its one reroll. A clean attempt 4 does not retroactively discharge attempt 2, and with attempt 2's identity artifact absent it cannot even be shown that all 33 failures were offered again. ATTEMPT 3, job 100573179841: presents as the two-arm shape this row admits, AND THE ADJUDICATING SURFACE IS ENROLLED HERE RATHER THAN ASSUMED: the run reports phases_run=3 with phases_failed=1, the ONLY FAILED PHASE being the floor, and unexpected_failures=0 -- the external phase verdict this row names as the current eligibility surface, and what establishes that no other phase failed. Beneath it the cost arms are completed_over_cost_requirement=1 and interrupted_before_verdict=1 all cpu_deadline, one row each. An earlier revision removed the internal proof without putting the external one in its place, leaving a correct qualification unsupported by the very surface this row says must adjudicate it. THE `failed=0` SPELLING IS NOT THE ELIGIBILITY KEY AND IS NOT RESTATED AS ONE HERE, because this row already ruled that test defective: it is read off the floor's own COST disposition counters, which do not range over other phases and so could only ever confirm themselves. The current surface is the RUN'S PHASE VERDICT -- phases_run, failed, and FAILED PHASE lines -- and the counters below are receipt, not the test. The completed-past-limit row is v2.test.emit.produced_decl_two_target.produced_decl_module_folds_declarations_in_order at cpu_ms=515, an EXACT measurement against the 500 line; the interrupted row is its SIBLING IN THE SAME MODULE, produced_decl_two_targets_render_own_order, whose printed 509 is the BUDGET and not a measurement. ATTEMPT 4, job 100606296727: the consumed reroll, clean, failed=0 and both arms zero. A LATER AND DIFFERENT TREE, head 2b9e59206af (run 33746447180, job 100619903740), ran clean with MORE claims (executed 3519 rising to 3539) and spent no reroll -- consistent with this row's redraw reading and NOT evidence for it, since one clean draw discriminates nothing. MISSING ITEM (b) IS NOW MEASURED AND IS REFUTED. (b) asked for an identity join of eval_steps across two attempts of ONE IDENTICAL TREE where the cpu column moves and this one must not. Attempts 3 and 4 are exactly that pair, and the artifacts are required-floor-claim-cost 9885042655 and 9889079822, both executed=3519, the identity join TOTAL at 3519 with zero rows on either side alone. cpu_ms disagrees on 1394 of 3519 rows, max absolute delta 128ms. eval_steps disagrees on 18 of 3519. So the step measure reproduces exactly on 99.49 percent of the corpus against cpu's 60.4 percent -- FAR more stable, AND NOT INVARIANT, and (b) asked for invariance. THE JOB LOG SAYS THE OPPOSITE, AND THAT IS THE TRAP THIS PARAGRAPH EXISTS TO CLOSE: in the printed over-cost list every identity carries an identical eval_steps across all four runs while cpu swings by a third, so (b) reads as satisfied from the log alone. It is not. That list is ranked BY COST and truncated at 25, and 17 of the 18 disagreeing rows are too cheap to appear in it. A SUBSET SELECTED BY THE VARIABLE YOU ARE NOT TESTING CANNOT TEST THE ONE YOU ARE -- the same defect this row already records for the attention subset, reappearing on the new column, and the reason (b) must be joined on the uploaded artifact and never on the run's printed summary. WHAT THE 18 ARE, AND THEY ARE TWO DIFFERENT CLASSES RATHER THAN ONE POPULATION. SEVENTEEN ARE PASS/PASS with tiny deltas -- 3 to 161 steps, absolute relative difference at most 0.43 percent -- and they are CLUSTERED, NOT UNIFORM: sixteen of the seventeen sit in three modules, v2.test.claim.rust_crate_partition_witness (6), v2.test.claim.c_compilation_unit_witness (5) and v2.test.claim.compilation_unit_witness (5), one partition-and-unit witness family, with a single stray in v2.test.claim.emit.trait_derive_supplemental_generic_bound_contract -- out of 3519 claims spanning the corpus. So MODULE-CLUSTERED VARIANCE EXISTS IN THIS A/B. That is the measurement; it does NOT establish the source, and an earlier revision called it a nondeterminism SOURCE, asserting as fact the conjecture the paragraph below correctly labels as one. IT IS EVIDENCE ABOUT THE STEP COUNT AND NOT ABOUT THE REFUSAL POPULATION, and conflating those is the error this row has already had to retract once: it establishes that module-clustered variance EXISTS in the corpus, which is the mechanism a module-clustered redraw would require, and it does not establish that the refused set redraws by module. THE EIGHTEENTH IS A DIFFERENT CLASS AND BEARS DIRECTLY ON MISSING ITEM (a). produced_decl_two_targets_render_own_order carries 196608 steps in the attempt where it was budget_interrupted and 197227 where it passed, so AN INTERRUPTED CLAIM'S eval_steps IS A PARTIAL COUNT AT THE STOP, not the claim's work -- the exact twin, in the step domain, of the already-recorded fact that an interrupted row's printed ms is the budget rather than a measurement. 196608 is 3 times 2 to the 16th exactly, which is suggestive of a step-interval deadline check; that is n=1 and the mechanism is NOT asserted here. THE CONSEQUENCE FOR (a) IS CONCRETE AND IS WHY THIS IS RECORDED BESIDE IT: a step-denominated line would compare against this partial for precisely the rows it exists to judge, so (a) needs a rule for the non-terminal row BEFORE it needs a number. NET EFFECT ON THE TRIGGER, STATED PER ARM BECAUSE (ii) IS A DISJUNCTION: the conjunct reads INVARIANT OR BOUNDED BY CONSTRUCTION and only the first arm has been tested. EXACT-INVARIANCE ARM: measured and REFUTED. BOUNDEDNESS ARM: UNESTABLISHED -- the 556-identity distribution below calls itself a spread and not a bound, reinforcing the distinction rather than resolving it. WHOLE CONJUNCT: REMAINS UNSATISFIED. An earlier revision wrote that (ii) moves to MEASURED AND FAILING, which is too broad for a disjunction whose second arm is untested: unsatisfied and both-alternatives-measured-and-failing are different findings. The trigger is a conjunction of three and (i) and (iii) are untouched, so nothing here retires this row and nothing here proposes raising the ceiling. RE-DERIVE with gh run download rather than by piping the artifact zip through a shell: gh api .../artifacts/ID/zip redirected to a file, and curl -o on the redirect target, BOTH corrupt the bytes in this environment -- a malformed local header and roughly 380 bytes short -- so an auditor who reaches for the obvious command gets an unreadable archive and may conclude the artifacts are gone. Taking the Location header and fetching it UNAUTHENTICATED also works; forwarding the Authorization header to blob storage returns 401. ONE FURTHER MEASUREMENT FROM THE SAME EPISODE, AND IT BEARS ON THIS ROW'S OWN REROLL SIGNATURE RATHER THAN ON ITS COST ARMS: THE PLANNED POPULATION IS NOT A FUNCTION OF THE TREE. On the single head b65a0eb5b32, the three attempts carrying a floor job report planned=executed=3534 (attempt 2, 33 claims failed), 3519 (attempt 3) and 3519 (attempt 4) -- fifteen claims of difference across attempts of ONE head with no change to the source. NO CAUSE IS ASSERTED HERE AND THE OBVIOUS ONE IS NOT VERIFIED: if the plan is computed relative to a moving main rather than to the head under test, this is expected rather than anomalous, and that is the first thing to check before treating it as a defect. WHAT IT DOES ESTABLISH REGARDLESS OF CAUSE is that EXACT HEAD DOES NOT BY ITSELF FIX THE POPULATION A REROLL IS DRAWN FROM, so a changed planned COUNT is RECEIPT AND COMPARABILITY DETAIL, and a potential planning or coverage defect, and NEVER a fresh reroll allowance. An earlier draft left that open as though it were undecided; it was already decided earlier in this same row, and leaving it open invited the budget reading it forbids. IT DOES NOT CONTAMINATE THE (b) JOIN ABOVE: attempts 3 and 4 both planned 3519 and their identity join is total at 3519 with zero rows on either side alone, which is why that measurement stands independently of this one. AND IT CORRECTS A CHARACTERISATION THAT WAS OFFERED FOR ATTEMPT 2 AND IS FALSE: that attempt was not a toolchain or host-tool incident -- its own summary reports host_tool_unresolved=0 beside claims_failed=33, so it is an ordinary red floor and belongs to no runner-incident population. The disposition is unchanged either way, since both cost arms are zero, so THE COST-ARM ADMISSION PREDICATE DOES NOT HOLD -- stated that way because there is no failed=0 precondition to fail, that key having been retired earlier in this same row, and an earlier revision resurrected it here after removing it one paragraph away, but the ground for excluding it from the mitigation is the cost-arm test and NOT a tooling attribution. THE CAUSE NAMED AS LIKELY IN THE PARAGRAPH ABOVE IS NOW CHECKED AND REFUTED, WHICH IS WHY THAT PARAGRAPH SAID TO CHECK IT FIRST. The suggestion was that the plan might be computed relative to a moving main rather than to the head under test, which would make the differing planned counts expected. IT IS NOT THAT. GitHub Actions evaluates a SYNTHETIC MERGE rather than the branch head, and all three attempts checked out THE SAME SYNTHETIC MERGE COMMIT -- each job log carries the identical line naming the merge of b65a0eb5b32 into 3547b3f9028 at one merge SHA -- so the three attempts ran a BYTE-IDENTICAL TREE and the main they were merged against did not move between them. The planned population therefore varies across attempts of a genuinely fixed tree. THE COUNTERS THAT DO NOT VARY NARROW IT FURTHER, and they are the ones a reader would reach for first: known_red_held, route_gap_held and stale_quarantine are IDENTICAL across all three attempts, so this is not a roster, quarantine or route-gap difference selecting a different population. Only planned, executed and terminal move, together, by fifteen. WHAT CANNOT BE SAID, AND THE REASON IS an artifact gap rather than a judgement: WHICH fifteen identities differ is NOT recoverable, because the attempt that planned 3534 uploaded no per-claim cost artifact -- only the two 3519-attempts did -- so the finding is available at COUNT grain and not at IDENTITY grain, which is precisely the weaker form this row elsewhere refuses to accept as a population. It is recorded as a count because that is what was measured. ONE CONJECTURE, LABELLED AS ONE AND CARRYING ITS OWN TEST RATHER THAN A CONCLUSION: the same unpinned iteration order that would explain the module-clustered eval_steps variance recorded above -- sixteen of seventeen disagreements inside one partition-and-unit witness family, which is exactly the shape of a fold over a set with no declared order -- could also change how many claims a generator emits, giving both observations ONE root. NOTHING HERE ESTABLISHES THAT, and the discriminating test is named so the next lane does not have to invent it: recover the fifteen identities by having the planner emit its plan as an artifact on every attempt including a failing one, then join two attempts of one synthetic merge at IDENTITY grain and ask whether the differing rows are generated claims from the same witness families that carry the step variance. Until that artifact exists the two observations are adjacent and unjoined. THE CONSEQUENCE FOR THIS ROW'S REROLL RULE IS UNCHANGED BY THE REFUTATION AND IS STRENGTHENED BY IT: exact head does not fix the drawn population, and it is now known that no appeal to a moving base explains it away. AND IT DOES NOT EXPAND THE REROLL ALLOWANCE, WHICH IS THE READING IT MOST INVITES AND THE ONE THIS SENTENCE EXISTS TO REFUSE: a differing planned cardinality WEAKENS COMPARABILITY between two attempts and lowers confidence that they covered the same claims; it does not license a second draw. The allowance stays at ONE PER EXACT HEAD, consumed on actuation. IT IS NOT PER SIGNATURE, AND SAYING SO WOULD REINTRODUCE A SPELLING THIS ROW ALREADY REFUTED: the signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget key. This finding makes exact head insufficient as a COMPARABILITY IDENTITY; it leaves exact head intact as the deliberately coarse BUDGET KEY, and letting a changed population mint a fresh signature would recreate retry-until-green exactly when the roster becomes unstable. An attempt that falls outside this row's domain spends nothing AND EARNS NOTHING -- it is not a free retry, and treating an ineligible red as though it restored the budget would be retry-until-green reached by a different route than the one this row already forbids. RECEIPT, 2026-09-03, gunbc#10231 -- THE SHARPEST INSTANCE THIS ROW CARRIES, BECAUSE THE VERDICT FLIPPED WHILE THE WORK MEASURE DID NOT MOVE BY ONE STEP. THE SUBJECT MAKES THE POINT BEFORE THE NUMBERS DO: it is a LEDGER-ONLY PROSE PR -- the filing of this row's sibling mechanism class -- touching one authority row and its generated projection, with no code, no types and no gates. A DIFF CATEGORY DOES NOT GRANT COST INNOCENCE BY CONSTRUCTION, and an earlier revision claimed it did: the ledger is ACCEPTED .dag SOURCE here, so altering a large literal can move parsing, resolution, allocation, generated structure or closure work, and shape is not an argument about cost. THE NARROWER CONTROL IS SUFFICIENT AND IS WHAT IS CLAIMED: the diff was IDENTICAL ACROSS BOTH ATTEMPTS, so whatever it costs relative to its base, it cannot explain the attempt-to-attempt flip. Run 33756177727 attempt 1, floor job 100651027559: REFUSED with completed_over_cost_requirement=1 beside claims_failed=0, interrupted_before_verdict=0 and host_tool_unresolved=0 -- one row, wholly inside this row's admitted domain on the two-arm test, with the run's phase verdict carrying no other failed phase. One reroll was actuated and thereby CONSUMED, against a budget of ONE PER EXACT HEAD. Attempt 2, job 100663093895: PASS. THE DISCRIMINATING PAIR, and it is one identity rather than an aggregate: v2.test.emit.rust_produced_decl_emit.rust_produced_decl_name_discriminates measured cpu_ms=523 on the refusing attempt and cpu_ms=404 on the passing one -- a ratio of 1.294 across the 500 line -- WHILE ITS eval_steps IS IDENTICAL AT 169297 ON BOTH. Same head, same tree, same identity, same count of evaluator steps, opposite verdicts. WHAT THAT SUPPORTS, AT THE INSTRUMENT'S REACH AND NOT BEYOND IT: for one fixed identity on one fixed head the cpu-line verdict flipped while the recorded net evaluator-step count stayed exactly identical, so THE CPU VERDICT IS NOT DETERMINED BY eval_steps ALONE -- stronger than showing cpu varies more often than steps, because it exhibits the mismatch at the very identity whose verdict changed. WHAT IT DOES NOT SUPPORT, and an earlier revision asserted it: that the deciding component lies OUTSIDE THE CLAIM'S WORK. Identical eval_steps establishes identical COUNTED EVALUATOR ENTRIES AFTER THIS INSTRUMENT'S NETTING RULE, not identical claim work -- host work, closure work, attribution and cache behaviour are uncounted and remain possible. This row keeps CHARGE-SUBJECT ALIGNMENT open as conjunct (i), so it cannot use this pair to place the varying component outside the claim; that would discharge (i) by assertion. THIS DOES NOT CONTRADICT THE (b) REFUTATION RECORDED ABOVE, and the reconciliation matters because the two readings look opposed: (b) failed because 18 identities of 3519 disagree on eval_steps, NOT because the measure is generally unstable -- 3501 reproduce exactly, and this identity is one of them. A measure can be exact on a given row and still fail an invariance claim asserted over a corpus. A THIRD SAMPLE OF THE SAME IDENTITY EXISTS ON GREEN MAIN, CITED BY RUN AND JOB SO IT IS RE-DERIVABLE RATHER THAN RELAYED: run 33754393519, floor job 100645180812, event push on main head 75873c28978, reports this identity at cpu_ms=406 with eval_steps=169297 -- the SAME step count as both attempts of the episode above, at a third distinct cpu. AND THE ORDERING IS WEAKER THAN AN EARLIER REVISION OF THIS PARAGRAPH CLAIMED, WHICH IS WHY THE CARRIER WAS WORTH DEMANDING. That revision said the identity had been NAMED IN ADVANCE and that a lane had PUBLISHED the crossing arithmetic before the refusal, which made it a prediction. The job timestamps refute that framing: the green-main job ran 12:17:45Z to 12:45:05Z and the refusing attempt ran 12:40:20Z to 13:10:22Z, so THE TWO RUNS OVERLAPPED. The green-main value was therefore observable 25 minutes before the refusal was observed, and it is CORROBORATION AT A THIRD SAMPLE rather than a prediction made before the event. The advance-prediction claim is withdrawn; it was received by relay and no carrier for the publication event was ever produced, which is exactly the transcribed-number failure DESIGN section 6 forbids -- name the producer, never copy its output. A prediction that names the row before it refuses a PR is worth more than a fresh observation of the same event. INDEPENDENT REPLICATION OF THE SPREAD, derived from the per-claim cost artifacts of THIS row's other episode rather than from the reporting lane's run, and it is an INDEPENDENT RUN AND ARTIFACT SAMPLE rather than an independent instrument -- an earlier revision said the two share NO instrument, which is false: they share the required-floor cpu producer, its accounting semantics, the evaluator-step counter and the artifact schema. What they do not share is a run or an artifact, and that is the whole of the independence claimed: over the 556 identities measuring at least 50 cpu-ms in BOTH attempts of one identical tree, the attempt-to-attempt cpu ratio -- DEFINED PER JOINED IDENTITY AS max(cpu_A, cpu_B) / min(cpu_A, cpu_B), so it is direction-free and never below 1.0, stated because an earlier revision published percentiles without the formula and B/A would give materially different numbers -- has median 1.045, p10 1.005, p90 1.219 and MAXIMUM 1.721. THE MEDIAN IS THE UNINTERESTING NUMBER AND THE TAIL IS THE ONE THAT DECIDES VERDICTS -- a corpus whose typical row moves by 4 percent still puts four identities at 94 to 103 percent of budget on a tree that PASSED. WHAT NONE OF THIS ESTABLISHES, stated because this row's trigger asks for exactly the thing it falls short of: A BOUND. Two attempts give a SPREAD, and (ii) requires the basis to be invariant OR BOUNDED BY CONSTRUCTION across the admitted envelopes; a maximum of 1.721 observed over one pair of attempts on one host pair is a FLOOR on the spread, not a bound on it, and the admitted envelope set is wider than the hosts these pairs sampled. THE CONSEQUENCE ON MAIN, MEASURED AT VERDICT GRAIN RATHER THAN AT ROW GRAIN (2026-09-03), because everything above measures ROWS and the thing that costs the fleet its afternoon is the VERDICT. Of the twenty-five most recent `witnesses.yml` runs on `main`, five reported `verdict=FloorRefused` with `claims_failed=0` and `unexpected_failures=0` -- the whole refusal carried by `interrupted_cpu_deadline` and `completed_over_cost_requirement`, so the required floor refused main five times without a single claim disagreeing with the tree. A GATE THAT REFUSES FOR REASONS UNRELATED TO THE CHANGE TEACHES ITS READERS THAT A RED REQUIRED FLOOR IS NOISE, and that is the cost this row had not priced: the sections above price the mis-attribution of a NUMBER to a row, and this one prices the mis-attribution of a VERDICT to a tree. AND THE HOST CORRELATION, STATED AT THE WIDTH THE SAMPLE SUPPORTS AND NOT WIDER. THE DECISIVE MEASUREMENT IS NOT THE HOST TABLE, IT IS A SAME-HEAD CONTROL, and it is stated first because it is established BY CONSTRUCTION rather than by correlation. Run 33806159353 was re-run at the same head: attempt 1 recorded `required-witnesses-floor` FAILURE on runner srv4-14 and attempt 2 recorded SUCCESS on runner srv4-19, both at head 07f81df887a, unchanged between them. ONE TREE, TWO ATTEMPTS, OPPOSITE VERDICTS. Nothing about the subject differed, so the required floor's verdict is demonstrably NOT A PROPERTY OF THE TREE -- which is this row's whole subject, now shown rather than inferred, and shown without needing any closure argument because nothing changed. THE HOST TABLE IS THE WEAKER EVIDENCE AND ITS FAMILY-SHAPED READINGS ARE REFUTED, twice, in the same direction. Eleven `required-witnesses-floor` jobs by runner registration: seven failed (srv1-02, srv1-07, srv1-10, srv1-16, srv1-17, srv4-11, srv4-14) and four passed (srv3-02, srv3-04, srv3-10, srv4-19). A first reading said srv1 is the bad host and srv4-11 refuted it; a second said srv3 is the only host observed clearing the ceiling and srv4-19 refuted that too, since srv4 now does BOTH. BOTH READINGS GENERALISED A HOST FAMILY FROM MACHINE-LEVEL SAMPLES AND THE NEXT SAMPLE CROSSED THE LINE EACH TIME, which is why the surviving statement names no family at all. WHAT THE MEASUREMENTS SUPPORT, AND NOTHING WIDER: the verdict is not a property of the tree; it is not cleanly a property of the host family; THE ACTUAL VARIABLE IS UNIDENTIFIED, with machine-level load or moment and a per-machine difference both consistent with the data, and eleven samples cannot separate them. Naming a cause here would be the looks-principled-and-is-not move this row already refuses on the calibration arm. MISSING ITEM (b) IS NOW DISCHARGED OVER THE MEASURABLE POPULATION AND THE ROW STILL STANDS, and the reason it still stands is the more useful half. THE JOIN (warm-seal-35, over the two attempts above): 338 shared-fill per-claim rows on each side, joined ON IDENTITY with ZERO unmatched rows in either direction, `marginal_eval_steps` and `measured_eval_steps` IDENTICAL for all 338, while measured cpu-ms moved by more than ten percent on 124 of them and spanned 0.627 to 1.217 as an attempt-2-over-attempt-1 ratio. That is (b) as worded -- an exact identity join of the step column across two attempts of ONE IDENTICAL TREE, with the cpu column moving and this one not -- and it is a population rather than a subject, which is what separates it from the single-claim reading above. ITS DENOMINATOR IS NOT THE FLOOR, AND QUOTING IT AS WHOLE-FLOOR COVERAGE WOULD BE THE ERROR THIS ROW EXISTS TO REFUSE: both attempts executed 3585 claims and the shared-fill instrument reports per-claim cost for 338 of them, so the join covers 9.4 percent and is silent about the rest. THE EXCLUSION IS THE FINDING, NOT A CAVEAT ON IT, AND IT IS SHARPER THAN THE CONSTRAINT PREDICTED ABOVE. An interrupted row is unmeasured in steps by construction, so the join can only cover completed rows -- and the rows it therefore excludes are EXACTLY THE ROWS THAT DECIDED THE VERDICT. Attempt 1 recorded passed=3507 with interrupted_before_verdict=2 and completed_over_cost_requirement=1 and refused; attempt 2 recorded passed=3510 with both counters at zero and was clean. 3507 plus 2 plus 1 is 3510: the three rows are precisely the difference between the two attempts, and they are precisely the rows no step measurement can speak about. THE MORE A CLAIM IS AFFECTED, THE LESS MEASURABLE IT BECOMES. So the join establishes that 338 OTHER claims did identical work under a moving envelope -- strong evidence about the envelope, and NO evidence about the three. WHICH IS A CONSTRAINT ON MISSING ITEM (a) AND NOT ONLY ON (b), and it is the first thing this row has been able to say about (a) at all: A STEP-DENOMINATED LINE BUILT ON THIS INSTRUMENT WOULD BE BLIND IN EXACTLY ITS OWN SUBJECT DIRECTION, because the rows that would cross such a line are the rows that carry no step count. Sizing one from the measurable population would produce a threshold that looks principled and is derived from the rows that were never at issue. EVIDENCE GRADES, KEPT SEPARATE AS EVERYWHERE ELSE IN THIS ROW. The two attempt summaries and their arithmetic were read FIRST-HAND from the run at two different times, attempt 1 while it was the only attempt and attempt 2 after the re-run; the 338-row join is taken from its builder with its own disclosed method corrections and was not re-derived here, because the attempt-1 log archive returns a truncated response that will not open. A CITATION TRAP WAS OBSERVED WHILE CHECKING THIS AND IS RECORDED SO THE NEXT READER DOES NOT LOSE AN HOUR TO IT: a bare job id serves the LATEST attempt, so job 100817014187 -- whose own conclusion is failure -- now serves attempt 2 FloorClean summary. An attempt-level citation is the only stable one. AND THE DISPOSITION GETS MORE DEFENSIBLE RATHER THAN LESS: a ceiling whose verdict flips on ONE UNCHANGED TREE between two attempts thirty-six minutes apart is not something a fifth shave of the claim would fix, which is the measured form of the argument that four prior lanes closed on the claim and it fired again. WHAT IS ESTABLISHED PER SAMPLE DIFFERS AND IS NOT FLATTENED: the `claims_failed=0` / `unexpected_failures=0` signature was read from the run logs for six of the seven failures, srv4-11 being the one taken on report rather than read. The distinction is kept because this carrier's own subject is a verdict being attributed to the wrong thing, and a floor job can redden on a phase that is not the floor -- so FAILED and FAILED-WITH-THIS-SIGNATURE are different facts and the row says which it has. A ONE-SUBJECT CROSS-ENVELOPE READING, WHICH BEARS ON MISSING ITEM (b) AND DOES NOT DISCHARGE IT (calm-deer-33, 2026-09-03, verified here rather than relayed). `v2.test.emit.rust_produced_decl_emit.produced_decl_unwired_target_still_refuses` measured 165802 eval_steps at 346 cpu-ms on run 33802603168 and 165802 eval_steps at 514 cpu-ms on run 33806159353 -- the step count IDENTICAL to the digit while cpu moved 1.49x, and the second reading is the one that crossed into completed-over-budget. Log-line controls of 3472 and 3465 rule out an empty capture on either side, which is this repository's standing guard against a zero that reads as a clean sweep. WHY IT IS NOT (b), ON THREE COUNTS, AND THE THIRD IS THE ONE A LATER READER WILL MISS. (i) GRAIN: (b) asks for a join AT CORPUS GRAIN and this is one subject. (ii) SUBJECT: (b) asks for TWO ATTEMPTS OF ONE IDENTICAL TREE, and these are two different trees -- 8b2323f is an ANCESTOR of 07f81df, so the pull request adds commits on top of the main commit it is compared against. (iii) THE WARRANT FOR THE-WORK-DID-NOT-CHANGE CANNOT COME FROM THE STEP COUNT ITSELF: constant steps are read as envelope-independence only if the work is identical on INDEPENDENT grounds, since a measure insensitive to the change produces the same reading. TWO ATTEMPTS OF ONE IDENTICAL TREE supplies that warrant BY CONSTRUCTION, which is why (b) is written that way. ACROSS TWO TREES IT WAS SUPPLIED SEPARATELY AND (iii) IS ANSWERED, by two arguments that do not depend on each other, both re-derived here rather than relayed. FIRST, A SYMBOL-GRAIN JOIN: the whole diff between the compared trees touches three files and adds or removes six declarations -- `absence_classifier_default_bucket`, `green_reported_over_a_population_the_instrument_does_not_own`, `live_03_normalize_data_inits`, `live_03_normalize_facts`, `live_argument_threaded_past_the_arm_that_decides` and `effect_reach_live_03_normalize_witness_derived_host_reading_holds` -- and the module declaring the measured claim, `v2.test.claim.emit.produced_decl_two_target_test`, references none of the six, with a positive control on the same grep finding `tt_emit`, `tt_emits` and `tt_refuses` there. SYMBOL GRAIN RATHER THAN IMPORT CLOSURE IS LOAD-BEARING IN THIS SUBSTRATE: names resolve by global uniqueness rather than by import lists, so a name absent from every import list still resolves and an import-closure argument would exclude modules that can still supply a binding. SECOND, AND INDEPENDENT OF WHETHER THAT JOIN IS EXHAUSTIVE: the diff is NET NEGATIVE, 32 insertions against 60 deletions, and the only witness change DELETES a row, so any corpus-scale work effect would push this claim CHEAPER while the observation is 1.49x MORE EXPENSIVE. The move is in the wrong direction for every work-based explanation. A CONSTRAINT ON HOW (b) CAN EVER BE DISCHARGED, WHICH IS A PROPERTY OF THE COLUMN AND NOT OF TONIGHT. An INTERRUPTED row is unmeasured in `eval_steps` BY CONSTRUCTION -- the poll fires before a count exists -- so a corpus-grain identity join over this column has a STRUCTURALLY EXCLUDED SUBPOPULATION, and the excluded rows are precisely the expensive ones the join most needs to cover. (b) as worded may therefore not be buildable at full coverage at all. A LATER LANE THAT BUILDS IT OVER COMPLETED ROWS AND REPORTS COVERAGE WILL BE REPORTING OVER A POPULATION IT DOES NOT OWN, which is `gunbc.recurring_failure_mode` `green_reported_over_a_population_the_instrument_does_not_own` -- so the honest discharge of (b) must either state the exclusion as part of its result or reach the interrupted rows by a different measure, and a coverage figure over completed rows alone does not retire this row. WHAT IT DOES ESTABLISH is still an advance on what this row had: the invariance reading was previously grounded at FIXTURE grain and nowhere wider, and this extends it to a live corpus subject under real floor pressure. Recorded as that and not as more. IT WAS MEASURED FORWARD, WHICH IS THE ONLY REASON IT IS RECORDED AT ALL: a prediction that srv1-10 would fail and srv3-10 would pass was registered before either returned, and runs 33794985110 and 33796487867 held it. WHAT IT IS NOT IS AN EXPLANATION. A SLOWER HOST is a hypothesis with no mechanism attached, three passes on one host is a thin denominator, and neither this correlation nor a wider one discharges (i), (ii) or (iii) of the trigger below -- a basis that varies with the machine is exactly what (ii) asks to be rid of, so measuring WHICH machines it varies with sharpens the subject and closes none of it. NOT PROPOSED HERE, AND THE DISTINCTION IS THE SAME ONE THIS ROW HAS MADE THROUGHOUT: raising the 500 line would change which rows cross and would not make the crossing a property of the claim, so it does not retire this row and is not requested." } + declaration: AuthoredProse { legacy: FloorCostClaimQualificationUnavailable, authored: "Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. the 500ms CPU line this row was declared over (now `required_floor_per_subject_cpu_line_ms`, which is still CPU milliseconds and still compared to a CPU reading by the enrolment margin, both as the ceiling its budget must sit below and as the line a live Roster (typed cost-debt) ground must clear, `v2.workflow.floor_enrolment_margin` `enrolment_declared_measured_standing`; the claim ceiling's own 500 moved to `required_floor_claim_work_envelope_ms`, a policy in milliseconds of work that no clock is compared to) was a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 219ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR, and a floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. RE-DERIVED 2026-09-03, BY THAT CONDITION AND BY NOTHING ELSE. The floor was 1.777 from a single identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed -- which is ONE PAIR, and one pair is one sample of a between-run quantity and therefore has no spread at all. A LARGER FLOOR IS NOW MEASURED OVER A SAMPLE THAT INDEXES OVER RUNS: 2.280, the worst per-identity max-over-min across TWELVE green `main` runs of `witnesses.yml` on twelve distinct runner registrations across three hosts, restricted to identities present in every run with a verdict, a baseline at or above 50 cpu-ms, and equal `eval_steps` in all twelve. THAT LAST RESTRICTION IS A FILTER AND NOT A FINDING, and the distinction matters here more than anywhere because MISSING ITEM (b) BELOW MEASURED THE SAME COLUMN AND REFUTED ITS INVARIANCE: selecting rows whose steps agree removes tree movement from the sample so the residual is inflation, and it establishes nothing about whether steps are invariant in general -- they are not. 500 over 2.280 floors to the constant above. THE PRODUCER IS NAMED AND THE DIGITS ARE NOT THE AUTHORITY: `gunbc.floor_cost_distribution` `worst_envelope_permille` over `work_invariant_envelopes` of `complete_envelopes`, driven by `tools.floor_cost_distribution_instrument` `floor_cost_envelope_report`, whose sampled runs and their runners are data in `floor_cost_envelope_sampled_runs`. This is the modeled producer the paragraph below says does not exist for the SUBSET; it exists for the CONSTANT'S INPUT and not for the subset, and those are different gaps. ROBUST IN DIRECTION AND NOT ONLY IN VALUE: restricting the same derivation to rows at or above 200 cpu-ms, where whole-millisecond quantisation cannot dominate, gives 1.874 and a constant of 266ms -- still below the superseded 280, so the re-derivation does not rest on the small-baseline tail. STILL A FLOOR: twelve runs on three hosts are a SUBSET of the admitted execution envelopes, so 2.280 can only rise and this constant can only fall. AND THE EXTREMES ARE CONCENTRATED ON PARTICULAR MACHINES, which a median run factor cannot see because a median is robust exactly where the envelope is driven: `run_extreme_census` over the same population reports one run holding the MINIMUM for 367 of 398 rows and one host holding the MAXIMUM for 279 of 398 from three of twelve runs, while per-run median factors span only 0.878 to 1.118. That is this row's own subject measured at host grain. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN, AT THE SUPERSEDED 280ms CONSTANT AND NOT AT THE ONE ABOVE -- the enumeration is kept as the receipt of what was measured and must not be read as today's subset, which is larger at a lower constant (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. That histogram is that run's, at the superseded constant; on the twelve-run sample above, taking each identity's MAX over the twelve, 88 identities reach 280 and 158 reach the constant now standing, and the same doubling holds within a single run rather than only in the union (run 33754393519: 61 then 115; run 33775106554: 73 then 128; run 33766436293: 20 then 72). Lowering the constant roughly doubles the subset, which is the cost of the re-derivation stated rather than left for a reader to discover. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED BY CONSTRUCTION across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE PER-CLAIM MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. THE QUALIFIER IS LOAD-BEARING AND WAS ADDED BY RULING (fierce-lark-661, 2026-09-13, on gunbc#11195) BECAUSE THE UNQUALIFIED SENTENCE FORBADE MORE THAN ITS EVIDENCE SUPPORTS -- DESIGN section 4d's over-prohibition arm, whose cost is the thing nobody does. WHAT IS FORBIDDEN is deriving a claim's budget from the population's own CPU readings: that is the run-varying, position-sensitive quantity, and a budget consuming it inherits the defect AND makes a verdict vary between runs. WHAT IS ADMITTED is a SINGLE CONTROLLED READING pinned as a POLICY CONSTANT -- `v2.workflow.floor_eval_step_calibration` -- taken on a fixture whose work is fixed by source rather than by the corpus. The discriminator is not the unit but the DEPENDENCE: an error in a pinned constant mis-scales BOTH tiers ONCE and UNIFORMLY and cannot make one claim's verdict differ between two runs of the same tree, which is precisely the property the denominator change buys and precisely what the per-claim distribution cannot offer. A RE-PIN RESCALES EVERY BUDGET UNIFORMLY AND NEVER ONE CLAIM, so it is a policy act taken deliberately and never maintenance. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head, and only where the refusal is carried entirely by this row's two arms. THAT RULE WAS MIS-SPELLED AND MIS-EVIDENCED WHEN FIRST WRITTEN, AND BOTH DEFECTS ARE CORRECTED HERE RATHER THAN QUIETLY RESPELLED. It read `one reroll per head per signature`, which parses as a COUNTER KEY -- so many rerolls per distinct signature -- and that reading is self-defeating on this row's own claim: these arms vary across attempts of one unchanged tree, so A CHANGED SIGNATURE IS THE EXPECTED OUTCOME OF A REROLL rather than new information, and every reroll would license the next one for exactly the reason this row exists. The signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget. The budget is ONE, PER HEAD. AND THE ELIGIBILITY TEST MUST NOT BE EVALUATED AGAINST THIS CLASS'S OWN COUNTERS. It said `the run reported failed=0`, which was read off the floor's disposition counters; those enumerate COST dispositions and do not range over other phases, so they cannot report that anything else failed and the test could only ever confirm itself. THE RULE STATED SO IT SURVIVES THE SPELLING: ELIGIBILITY IS A PROPERTY OF THE RUN'S PHASE VERDICT AND IS NEVER READ OFF A CLASS'S OWN DISPOSITION COUNTERS, whatever either is called. The quotation `failed=0` above is preserved as a RECEIPT of what a run actually printed on 2026-09-02 and must not be restated as the current key: at the time, one word `failed` carried FOUR SUBJECTS across four emitters of one binary -- lane phases, required-floor claims, DISCOVERY ROWS, and a package LIST -- which is why an inside-the-subject reading looked like an outside-the-subject one. THE DISCOVERY SUBJECT IS THE ONE THAT MATTERS AND IT IS NOT A NARROWER OR WIDER SPELLING OF THE CLAIM POPULATION: it is a DIFFERENT population that additionally absorbs NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted, so a reader treating the two as the same word silently unions failure classes the other excludes. That fork is being repaired at the producer by a separate lane, into `phases_failed`, `claims_failed`, `discovery_rows_failed` and `packages_failed`, with `FAILED PHASE` unchanged; this row therefore names the phase verdict as the adjudicating SURFACE rather than any counter key. Eligibility is decided by the RUN'S PHASE VERDICT -- `phases_run`, `failed`, and the `FAILED PHASE` lines -- which is evidence from outside the predicate's own subject. The class is `admission_predicate_evidenced_from_inside_its_own_subject`. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). AND ONE FURTHER PAIR, ENTERED MARKED BECAUSE ITS ADMISSION WAS INVALID AND THAT IS PRECISELY WHY IT IS KEPT: gunbc#10077 run 33647114048, floor job 100317014535, head 74719e46dd, both attempts `planned=executed=3487` with no unexpected claim failures -- attempt 1 `interrupted_before_verdict=12` (all `interrupted_cpu_deadline`), `completed_over_cost_requirement=0`; attempt 2 `interrupted_before_verdict=1`, `completed_over_cost_requirement=2`. Refuse then refuse. All twelve of attempt 1's rows sit in `test.claim.self_host_compile_phase_frontier_witness` and `test.claim.self_host_compile_phase_live_gate_witness`, EACH MEASURED 501 TO 506 CPU-MS AGAINST THE 500MS LIMIT -- a one-to-six millisecond miss, which is the sharpest evidence this row has for its own claim: a witness failing at 900ms would be consistent with genuinely costing that much, and one failing at 501 is not. THE ADMISSION WAS FALSE WHEN IT WAS MADE. The run was `phases_run=3 failed=2`, refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas, so the refusal was never carried entirely by this row's two arms; the eligibility test had been evaluated against the floor's own disposition counters, which cannot report that another phase failed. IT IS ENTERED RATHER THAN REPLACED BY A CLEANER RUN, and the reason is structural: a clean run cannot evidence a defective admission predicate, so this is the only receipt that the rule was broken, and dropping it for being untidy would filter the mitigation's record by how the mitigation turned out. WHAT IT DOES NOT ESTABLISH, stated because the counts invite it: attempt 2's single interrupted row was ALSO IN attempt 1's twelve, so the pair is a SUBSET and not a disjoint redraw, and a stable population straddling the threshold explains both attempts without any redraw at all -- one module in this run carries members at 481, 490, 499, 500 and 501 ms. The counts moved; the membership did not leave the prior set. An earlier reading of this pair asserted that a fixed marginal set could not produce those counts; that assertion was withdrawn by its own author on the membership measurement before it was entered here. THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument defect is WIDER THAN WRONG-ATTEMPT, measured 2026-09-02 on gunbc#10077 by diffing both fetches of ONE job: the `gh run view` copy was MISSING THE `FAILED PHASE` LINES ENTIRELY. It does not merely serve the wrong attempt; it can DROP THE LINES CARRYING THE VERDICT, turning a two-phase failure into an apparent one-phase failure -- which is precisely how the admission predicate above was evaluated as true while it was false. An instrument whose omission is invisible is worse than one that is merely stale. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it. RECEIPT, 2026-09-03, gunbc#10192: ONE EPISODE BY RUN ID -- ADMITTED IN PART AND NOT END TO END, WHICH THE ENUMERATION BELOW ADJUDICATES RATHER THAN SMOOTHS -- AND THE FIRST CORPUS-GRAIN MEASUREMENT OF MISSING ITEM (b) -- WHICH IT REFUTES RATHER THAN DISCHARGES. THE EPISODE, run 33716314510 on head b65a0eb5b32, ENUMERATED IN FULL INCLUDING THE ATTEMPTS THAT DO NOT QUALIFY, because the sequence contains a transition this row does NOT authorize and an enumeration that showed only the eligible attempts would present an unadmitted retry as part of an admitted mitigation. ATTEMPT 1 EXECUTED ZERO JOBS -- no required-witnesses-floor job exists for it; the run was created awaiting workflow approval -- so it is not an attempt of this class and counting it as one would inflate the denominator. ATTEMPT 2, job 100543957851: claims_failed=33 with BOTH cost arms at zero. OUTSIDE this row's domain: zero dispositions in either cost arm. THE CAUSE OF THOSE 33 IS NOT ESTABLISHED HERE AND AN EARLIER DRAFT CALLED THEM SEMANTIC, WHICH THE COUNTERS DO NOT SUPPORT -- claims_failed enumerates ordinary claim-failure dispositions and does not say why they failed, and a missing host capability surfacing as a runtime error would land in the same counter as a genuine false assertion. The honest reading is an ORDINARY CLAIM-FAILURE FLOOR REFUSAL, CAUSE UNESTABLISHED. ITS ROLE HERE IS A NEGATIVE ELIGIBILITY CONTROL AND NOT A DENOMINATOR MEMBER, which corrects the reason an earlier draft gave for including it: a mitigation's eligible population is the attempts satisfying its admission predicate, so an attempt outside the class can no more count as a failed use of the mitigation than an ordinary compile error can. It is kept because it PROVES THE PREDICATE EXCLUDES SOMETHING REAL. AND THE TRANSITION OUT OF IT IS UNADJUDICATED, WHICH THIS ROW RECORDS RATHER THAN LAUNDERS: outside this row's budget means attempt 2 SPENT no reroll; it does not mean attempt 2 EARNED one. The re-run that produced attempt 3 was NOT admitted by this row -- attempt 2's refusal was carried by neither cost arm -- and no other authority is named for it. So this sequence is not one admitted mitigation end to end: it is an unadmitted retry of an ordinary red on byte-identical executed input, followed by a cost-only refusal that this row does admit, followed by its one reroll. A clean attempt 4 does not retroactively discharge attempt 2, and with attempt 2's identity artifact absent it cannot even be shown that all 33 failures were offered again. ATTEMPT 3, job 100573179841: presents as the two-arm shape this row admits, AND THE ADJUDICATING SURFACE IS ENROLLED HERE RATHER THAN ASSUMED: the run reports phases_run=3 with phases_failed=1, the ONLY FAILED PHASE being the floor, and unexpected_failures=0 -- the external phase verdict this row names as the current eligibility surface, and what establishes that no other phase failed. Beneath it the cost arms are completed_over_cost_requirement=1 and interrupted_before_verdict=1 all cpu_deadline, one row each. An earlier revision removed the internal proof without putting the external one in its place, leaving a correct qualification unsupported by the very surface this row says must adjudicate it. THE `failed=0` SPELLING IS NOT THE ELIGIBILITY KEY AND IS NOT RESTATED AS ONE HERE, because this row already ruled that test defective: it is read off the floor's own COST disposition counters, which do not range over other phases and so could only ever confirm themselves. The current surface is the RUN'S PHASE VERDICT -- phases_run, failed, and FAILED PHASE lines -- and the counters below are receipt, not the test. The completed-past-limit row is v2.test.emit.produced_decl_two_target.produced_decl_module_folds_declarations_in_order at cpu_ms=515, an EXACT measurement against the 500 line; the interrupted row is its SIBLING IN THE SAME MODULE, produced_decl_two_targets_render_own_order, whose printed 509 is the BUDGET and not a measurement. ATTEMPT 4, job 100606296727: the consumed reroll, clean, failed=0 and both arms zero. A LATER AND DIFFERENT TREE, head 2b9e59206af (run 33746447180, job 100619903740), ran clean with MORE claims (executed 3519 rising to 3539) and spent no reroll -- consistent with this row's redraw reading and NOT evidence for it, since one clean draw discriminates nothing. MISSING ITEM (b) IS NOW MEASURED AND IS REFUTED. (b) asked for an identity join of eval_steps across two attempts of ONE IDENTICAL TREE where the cpu column moves and this one must not. Attempts 3 and 4 are exactly that pair, and the artifacts are required-floor-claim-cost 9885042655 and 9889079822, both executed=3519, the identity join TOTAL at 3519 with zero rows on either side alone. cpu_ms disagrees on 1394 of 3519 rows, max absolute delta 128ms. eval_steps disagrees on 18 of 3519. So the step measure reproduces exactly on 99.49 percent of the corpus against cpu's 60.4 percent -- FAR more stable, AND NOT INVARIANT, and (b) asked for invariance. THE JOB LOG SAYS THE OPPOSITE, AND THAT IS THE TRAP THIS PARAGRAPH EXISTS TO CLOSE: in the printed over-cost list every identity carries an identical eval_steps across all four runs while cpu swings by a third, so (b) reads as satisfied from the log alone. It is not. That list is ranked BY COST and truncated at 25, and 17 of the 18 disagreeing rows are too cheap to appear in it. A SUBSET SELECTED BY THE VARIABLE YOU ARE NOT TESTING CANNOT TEST THE ONE YOU ARE -- the same defect this row already records for the attention subset, reappearing on the new column, and the reason (b) must be joined on the uploaded artifact and never on the run's printed summary. WHAT THE 18 ARE, AND THEY ARE TWO DIFFERENT CLASSES RATHER THAN ONE POPULATION. SEVENTEEN ARE PASS/PASS with tiny deltas -- 3 to 161 steps, absolute relative difference at most 0.43 percent -- and they are CLUSTERED, NOT UNIFORM: sixteen of the seventeen sit in three modules, v2.test.claim.rust_crate_partition_witness (6), v2.test.claim.c_compilation_unit_witness (5) and v2.test.claim.compilation_unit_witness (5), one partition-and-unit witness family, with a single stray in v2.test.claim.emit.trait_derive_supplemental_generic_bound_contract -- out of 3519 claims spanning the corpus. So MODULE-CLUSTERED VARIANCE EXISTS IN THIS A/B. That is the measurement; it does NOT establish the source, and an earlier revision called it a nondeterminism SOURCE, asserting as fact the conjecture the paragraph below correctly labels as one. IT IS EVIDENCE ABOUT THE STEP COUNT AND NOT ABOUT THE REFUSAL POPULATION, and conflating those is the error this row has already had to retract once: it establishes that module-clustered variance EXISTS in the corpus, which is the mechanism a module-clustered redraw would require, and it does not establish that the refused set redraws by module. THE EIGHTEENTH IS A DIFFERENT CLASS AND BEARS DIRECTLY ON MISSING ITEM (a). produced_decl_two_targets_render_own_order carries 196608 steps in the attempt where it was budget_interrupted and 197227 where it passed, so AN INTERRUPTED CLAIM'S eval_steps IS A PARTIAL COUNT AT THE STOP, not the claim's work -- the exact twin, in the step domain, of the already-recorded fact that an interrupted row's printed ms is the budget rather than a measurement. 196608 is 3 times 2 to the 16th exactly, which is suggestive of a step-interval deadline check; that is n=1 and the mechanism is NOT asserted here. THE CONSEQUENCE FOR (a) IS CONCRETE AND IS WHY THIS IS RECORDED BESIDE IT: a step-denominated line would compare against this partial for precisely the rows it exists to judge, so (a) needs a rule for the non-terminal row BEFORE it needs a number. NET EFFECT ON THE TRIGGER, STATED PER ARM BECAUSE (ii) IS A DISJUNCTION: the conjunct reads INVARIANT OR BOUNDED BY CONSTRUCTION and only the first arm has been tested. EXACT-INVARIANCE ARM: measured and REFUTED. BOUNDEDNESS ARM: UNESTABLISHED -- the 556-identity distribution below calls itself a spread and not a bound, reinforcing the distinction rather than resolving it. WHOLE CONJUNCT: REMAINS UNSATISFIED. An earlier revision wrote that (ii) moves to MEASURED AND FAILING, which is too broad for a disjunction whose second arm is untested: unsatisfied and both-alternatives-measured-and-failing are different findings. The trigger is a conjunction of three and (i) and (iii) are untouched, so nothing here retires this row and nothing here proposes raising the ceiling. RE-DERIVE with gh run download rather than by piping the artifact zip through a shell: gh api .../artifacts/ID/zip redirected to a file, and curl -o on the redirect target, BOTH corrupt the bytes in this environment -- a malformed local header and roughly 380 bytes short -- so an auditor who reaches for the obvious command gets an unreadable archive and may conclude the artifacts are gone. Taking the Location header and fetching it UNAUTHENTICATED also works; forwarding the Authorization header to blob storage returns 401. ONE FURTHER MEASUREMENT FROM THE SAME EPISODE, AND IT BEARS ON THIS ROW'S OWN REROLL SIGNATURE RATHER THAN ON ITS COST ARMS: THE PLANNED POPULATION IS NOT A FUNCTION OF THE TREE. On the single head b65a0eb5b32, the three attempts carrying a floor job report planned=executed=3534 (attempt 2, 33 claims failed), 3519 (attempt 3) and 3519 (attempt 4) -- fifteen claims of difference across attempts of ONE head with no change to the source. NO CAUSE IS ASSERTED HERE AND THE OBVIOUS ONE IS NOT VERIFIED: if the plan is computed relative to a moving main rather than to the head under test, this is expected rather than anomalous, and that is the first thing to check before treating it as a defect. WHAT IT DOES ESTABLISH REGARDLESS OF CAUSE is that EXACT HEAD DOES NOT BY ITSELF FIX THE POPULATION A REROLL IS DRAWN FROM, so a changed planned COUNT is RECEIPT AND COMPARABILITY DETAIL, and a potential planning or coverage defect, and NEVER a fresh reroll allowance. An earlier draft left that open as though it were undecided; it was already decided earlier in this same row, and leaving it open invited the budget reading it forbids. IT DOES NOT CONTAMINATE THE (b) JOIN ABOVE: attempts 3 and 4 both planned 3519 and their identity join is total at 3519 with zero rows on either side alone, which is why that measurement stands independently of this one. AND IT CORRECTS A CHARACTERISATION THAT WAS OFFERED FOR ATTEMPT 2 AND IS FALSE: that attempt was not a toolchain or host-tool incident -- its own summary reports host_tool_unresolved=0 beside claims_failed=33, so it is an ordinary red floor and belongs to no runner-incident population. The disposition is unchanged either way, since both cost arms are zero, so THE COST-ARM ADMISSION PREDICATE DOES NOT HOLD -- stated that way because there is no failed=0 precondition to fail, that key having been retired earlier in this same row, and an earlier revision resurrected it here after removing it one paragraph away, but the ground for excluding it from the mitigation is the cost-arm test and NOT a tooling attribution. THE CAUSE NAMED AS LIKELY IN THE PARAGRAPH ABOVE IS NOW CHECKED AND REFUTED, WHICH IS WHY THAT PARAGRAPH SAID TO CHECK IT FIRST. The suggestion was that the plan might be computed relative to a moving main rather than to the head under test, which would make the differing planned counts expected. IT IS NOT THAT. GitHub Actions evaluates a SYNTHETIC MERGE rather than the branch head, and all three attempts checked out THE SAME SYNTHETIC MERGE COMMIT -- each job log carries the identical line naming the merge of b65a0eb5b32 into 3547b3f9028 at one merge SHA -- so the three attempts ran a BYTE-IDENTICAL TREE and the main they were merged against did not move between them. The planned population therefore varies across attempts of a genuinely fixed tree. THE COUNTERS THAT DO NOT VARY NARROW IT FURTHER, and they are the ones a reader would reach for first: known_red_held, route_gap_held and stale_quarantine are IDENTICAL across all three attempts, so this is not a roster, quarantine or route-gap difference selecting a different population. Only planned, executed and terminal move, together, by fifteen. WHAT CANNOT BE SAID, AND THE REASON IS an artifact gap rather than a judgement: WHICH fifteen identities differ is NOT recoverable, because the attempt that planned 3534 uploaded no per-claim cost artifact -- only the two 3519-attempts did -- so the finding is available at COUNT grain and not at IDENTITY grain, which is precisely the weaker form this row elsewhere refuses to accept as a population. It is recorded as a count because that is what was measured. ONE CONJECTURE, LABELLED AS ONE AND CARRYING ITS OWN TEST RATHER THAN A CONCLUSION: the same unpinned iteration order that would explain the module-clustered eval_steps variance recorded above -- sixteen of seventeen disagreements inside one partition-and-unit witness family, which is exactly the shape of a fold over a set with no declared order -- could also change how many claims a generator emits, giving both observations ONE root. NOTHING HERE ESTABLISHES THAT, and the discriminating test is named so the next lane does not have to invent it: recover the fifteen identities by having the planner emit its plan as an artifact on every attempt including a failing one, then join two attempts of one synthetic merge at IDENTITY grain and ask whether the differing rows are generated claims from the same witness families that carry the step variance. Until that artifact exists the two observations are adjacent and unjoined. THE CONSEQUENCE FOR THIS ROW'S REROLL RULE IS UNCHANGED BY THE REFUTATION AND IS STRENGTHENED BY IT: exact head does not fix the drawn population, and it is now known that no appeal to a moving base explains it away. AND IT DOES NOT EXPAND THE REROLL ALLOWANCE, WHICH IS THE READING IT MOST INVITES AND THE ONE THIS SENTENCE EXISTS TO REFUSE: a differing planned cardinality WEAKENS COMPARABILITY between two attempts and lowers confidence that they covered the same claims; it does not license a second draw. The allowance stays at ONE PER EXACT HEAD, consumed on actuation. IT IS NOT PER SIGNATURE, AND SAYING SO WOULD REINTRODUCE A SPELLING THIS ROW ALREADY REFUTED: the signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget key. This finding makes exact head insufficient as a COMPARABILITY IDENTITY; it leaves exact head intact as the deliberately coarse BUDGET KEY, and letting a changed population mint a fresh signature would recreate retry-until-green exactly when the roster becomes unstable. An attempt that falls outside this row's domain spends nothing AND EARNS NOTHING -- it is not a free retry, and treating an ineligible red as though it restored the budget would be retry-until-green reached by a different route than the one this row already forbids. RECEIPT, 2026-09-03, gunbc#10231 -- THE SHARPEST INSTANCE THIS ROW CARRIES, BECAUSE THE VERDICT FLIPPED WHILE THE WORK MEASURE DID NOT MOVE BY ONE STEP. THE SUBJECT MAKES THE POINT BEFORE THE NUMBERS DO: it is a LEDGER-ONLY PROSE PR -- the filing of this row's sibling mechanism class -- touching one authority row and its generated projection, with no code, no types and no gates. A DIFF CATEGORY DOES NOT GRANT COST INNOCENCE BY CONSTRUCTION, and an earlier revision claimed it did: the ledger is ACCEPTED .dag SOURCE here, so altering a large literal can move parsing, resolution, allocation, generated structure or closure work, and shape is not an argument about cost. THE NARROWER CONTROL IS SUFFICIENT AND IS WHAT IS CLAIMED: the diff was IDENTICAL ACROSS BOTH ATTEMPTS, so whatever it costs relative to its base, it cannot explain the attempt-to-attempt flip. Run 33756177727 attempt 1, floor job 100651027559: REFUSED with completed_over_cost_requirement=1 beside claims_failed=0, interrupted_before_verdict=0 and host_tool_unresolved=0 -- one row, wholly inside this row's admitted domain on the two-arm test, with the run's phase verdict carrying no other failed phase. One reroll was actuated and thereby CONSUMED, against a budget of ONE PER EXACT HEAD. Attempt 2, job 100663093895: PASS. THE DISCRIMINATING PAIR, and it is one identity rather than an aggregate: v2.test.emit.rust_produced_decl_emit.rust_produced_decl_name_discriminates measured cpu_ms=523 on the refusing attempt and cpu_ms=404 on the passing one -- a ratio of 1.294 across the 500 line -- WHILE ITS eval_steps IS IDENTICAL AT 169297 ON BOTH. Same head, same tree, same identity, same count of evaluator steps, opposite verdicts. WHAT THAT SUPPORTS, AT THE INSTRUMENT'S REACH AND NOT BEYOND IT: for one fixed identity on one fixed head the cpu-line verdict flipped while the recorded net evaluator-step count stayed exactly identical, so THE CPU VERDICT IS NOT DETERMINED BY eval_steps ALONE -- stronger than showing cpu varies more often than steps, because it exhibits the mismatch at the very identity whose verdict changed. WHAT IT DOES NOT SUPPORT, and an earlier revision asserted it: that the deciding component lies OUTSIDE THE CLAIM'S WORK. Identical eval_steps establishes identical COUNTED EVALUATOR ENTRIES AFTER THIS INSTRUMENT'S NETTING RULE, not identical claim work -- host work, closure work, attribution and cache behaviour are uncounted and remain possible. This row keeps CHARGE-SUBJECT ALIGNMENT open as conjunct (i), so it cannot use this pair to place the varying component outside the claim; that would discharge (i) by assertion. THIS DOES NOT CONTRADICT THE (b) REFUTATION RECORDED ABOVE, and the reconciliation matters because the two readings look opposed: (b) failed because 18 identities of 3519 disagree on eval_steps, NOT because the measure is generally unstable -- 3501 reproduce exactly, and this identity is one of them. A measure can be exact on a given row and still fail an invariance claim asserted over a corpus. A THIRD SAMPLE OF THE SAME IDENTITY EXISTS ON GREEN MAIN, CITED BY RUN AND JOB SO IT IS RE-DERIVABLE RATHER THAN RELAYED: run 33754393519, floor job 100645180812, event push on main head 75873c28978, reports this identity at cpu_ms=406 with eval_steps=169297 -- the SAME step count as both attempts of the episode above, at a third distinct cpu. AND THE ORDERING IS WEAKER THAN AN EARLIER REVISION OF THIS PARAGRAPH CLAIMED, WHICH IS WHY THE CARRIER WAS WORTH DEMANDING. That revision said the identity had been NAMED IN ADVANCE and that a lane had PUBLISHED the crossing arithmetic before the refusal, which made it a prediction. The job timestamps refute that framing: the green-main job ran 12:17:45Z to 12:45:05Z and the refusing attempt ran 12:40:20Z to 13:10:22Z, so THE TWO RUNS OVERLAPPED. The green-main value was therefore observable 25 minutes before the refusal was observed, and it is CORROBORATION AT A THIRD SAMPLE rather than a prediction made before the event. The advance-prediction claim is withdrawn; it was received by relay and no carrier for the publication event was ever produced, which is exactly the transcribed-number failure DESIGN section 6 forbids -- name the producer, never copy its output. A prediction that names the row before it refuses a PR is worth more than a fresh observation of the same event. INDEPENDENT REPLICATION OF THE SPREAD, derived from the per-claim cost artifacts of THIS row's other episode rather than from the reporting lane's run, and it is an INDEPENDENT RUN AND ARTIFACT SAMPLE rather than an independent instrument -- an earlier revision said the two share NO instrument, which is false: they share the required-floor cpu producer, its accounting semantics, the evaluator-step counter and the artifact schema. What they do not share is a run or an artifact, and that is the whole of the independence claimed: over the 556 identities measuring at least 50 cpu-ms in BOTH attempts of one identical tree, the attempt-to-attempt cpu ratio -- DEFINED PER JOINED IDENTITY AS max(cpu_A, cpu_B) / min(cpu_A, cpu_B), so it is direction-free and never below 1.0, stated because an earlier revision published percentiles without the formula and B/A would give materially different numbers -- has median 1.045, p10 1.005, p90 1.219 and MAXIMUM 1.721. THE MEDIAN IS THE UNINTERESTING NUMBER AND THE TAIL IS THE ONE THAT DECIDES VERDICTS -- a corpus whose typical row moves by 4 percent still puts four identities at 94 to 103 percent of budget on a tree that PASSED. WHAT NONE OF THIS ESTABLISHES, stated because this row's trigger asks for exactly the thing it falls short of: A BOUND. Two attempts give a SPREAD, and (ii) requires the basis to be invariant OR BOUNDED BY CONSTRUCTION across the admitted envelopes; a maximum of 1.721 observed over one pair of attempts on one host pair is a FLOOR on the spread, not a bound on it, and the admitted envelope set is wider than the hosts these pairs sampled. THE CONSEQUENCE ON MAIN, MEASURED AT VERDICT GRAIN RATHER THAN AT ROW GRAIN (2026-09-03), because everything above measures ROWS and the thing that costs the fleet its afternoon is the VERDICT. Of the twenty-five most recent `witnesses.yml` runs on `main`, five reported `verdict=FloorRefused` with `claims_failed=0` and `unexpected_failures=0` -- the whole refusal carried by `interrupted_cpu_deadline` and `completed_over_cost_requirement`, so the required floor refused main five times without a single claim disagreeing with the tree. A GATE THAT REFUSES FOR REASONS UNRELATED TO THE CHANGE TEACHES ITS READERS THAT A RED REQUIRED FLOOR IS NOISE, and that is the cost this row had not priced: the sections above price the mis-attribution of a NUMBER to a row, and this one prices the mis-attribution of a VERDICT to a tree. AND THE HOST CORRELATION, STATED AT THE WIDTH THE SAMPLE SUPPORTS AND NOT WIDER. THE DECISIVE MEASUREMENT IS NOT THE HOST TABLE, IT IS A SAME-HEAD CONTROL, and it is stated first because it is established BY CONSTRUCTION rather than by correlation. Run 33806159353 was re-run at the same head: attempt 1 recorded `required-witnesses-floor` FAILURE on runner srv4-14 and attempt 2 recorded SUCCESS on runner srv4-19, both at head 07f81df887a, unchanged between them. ONE TREE, TWO ATTEMPTS, OPPOSITE VERDICTS. Nothing about the subject differed, so the required floor's verdict is demonstrably NOT A PROPERTY OF THE TREE -- which is this row's whole subject, now shown rather than inferred, and shown without needing any closure argument because nothing changed. THE HOST TABLE IS THE WEAKER EVIDENCE AND ITS FAMILY-SHAPED READINGS ARE REFUTED, twice, in the same direction. Eleven `required-witnesses-floor` jobs by runner registration: seven failed (srv1-02, srv1-07, srv1-10, srv1-16, srv1-17, srv4-11, srv4-14) and four passed (srv3-02, srv3-04, srv3-10, srv4-19). A first reading said srv1 is the bad host and srv4-11 refuted it; a second said srv3 is the only host observed clearing the ceiling and srv4-19 refuted that too, since srv4 now does BOTH. BOTH READINGS GENERALISED A HOST FAMILY FROM MACHINE-LEVEL SAMPLES AND THE NEXT SAMPLE CROSSED THE LINE EACH TIME, which is why the surviving statement names no family at all. WHAT THE MEASUREMENTS SUPPORT, AND NOTHING WIDER: the verdict is not a property of the tree; it is not cleanly a property of the host family; THE ACTUAL VARIABLE IS UNIDENTIFIED, with machine-level load or moment and a per-machine difference both consistent with the data, and eleven samples cannot separate them. Naming a cause here would be the looks-principled-and-is-not move this row already refuses on the calibration arm. MISSING ITEM (b) IS NOW DISCHARGED OVER THE MEASURABLE POPULATION AND THE ROW STILL STANDS, and the reason it still stands is the more useful half. THE JOIN (warm-seal-35, over the two attempts above): 338 shared-fill per-claim rows on each side, joined ON IDENTITY with ZERO unmatched rows in either direction, `marginal_eval_steps` and `measured_eval_steps` IDENTICAL for all 338, while measured cpu-ms moved by more than ten percent on 124 of them and spanned 0.627 to 1.217 as an attempt-2-over-attempt-1 ratio. That is (b) as worded -- an exact identity join of the step column across two attempts of ONE IDENTICAL TREE, with the cpu column moving and this one not -- and it is a population rather than a subject, which is what separates it from the single-claim reading above. ITS DENOMINATOR IS NOT THE FLOOR, AND QUOTING IT AS WHOLE-FLOOR COVERAGE WOULD BE THE ERROR THIS ROW EXISTS TO REFUSE: both attempts executed 3585 claims and the shared-fill instrument reports per-claim cost for 338 of them, so the join covers 9.4 percent and is silent about the rest. THE EXCLUSION IS THE FINDING, NOT A CAVEAT ON IT, AND IT IS SHARPER THAN THE CONSTRAINT PREDICTED ABOVE. An interrupted row is unmeasured in steps by construction, so the join can only cover completed rows -- and the rows it therefore excludes are EXACTLY THE ROWS THAT DECIDED THE VERDICT. Attempt 1 recorded passed=3507 with interrupted_before_verdict=2 and completed_over_cost_requirement=1 and refused; attempt 2 recorded passed=3510 with both counters at zero and was clean. 3507 plus 2 plus 1 is 3510: the three rows are precisely the difference between the two attempts, and they are precisely the rows no step measurement can speak about. THE MORE A CLAIM IS AFFECTED, THE LESS MEASURABLE IT BECOMES. So the join establishes that 338 OTHER claims did identical work under a moving envelope -- strong evidence about the envelope, and NO evidence about the three. WHICH IS A CONSTRAINT ON MISSING ITEM (a) AND NOT ONLY ON (b), and it is the first thing this row has been able to say about (a) at all: A STEP-DENOMINATED LINE BUILT ON THIS INSTRUMENT WOULD BE BLIND IN EXACTLY ITS OWN SUBJECT DIRECTION, because the rows that would cross such a line are the rows that carry no step count. Sizing one from the measurable population would produce a threshold that looks principled and is derived from the rows that were never at issue. EVIDENCE GRADES, KEPT SEPARATE AS EVERYWHERE ELSE IN THIS ROW. The two attempt summaries and their arithmetic were read FIRST-HAND from the run at two different times, attempt 1 while it was the only attempt and attempt 2 after the re-run; the 338-row join is taken from its builder with its own disclosed method corrections and was not re-derived here, because the attempt-1 log archive returns a truncated response that will not open. A CITATION TRAP WAS OBSERVED WHILE CHECKING THIS AND IS RECORDED SO THE NEXT READER DOES NOT LOSE AN HOUR TO IT: a bare job id serves the LATEST attempt, so job 100817014187 -- whose own conclusion is failure -- now serves attempt 2 FloorClean summary. An attempt-level citation is the only stable one. AND THE DISPOSITION GETS MORE DEFENSIBLE RATHER THAN LESS: a ceiling whose verdict flips on ONE UNCHANGED TREE between two attempts thirty-six minutes apart is not something a fifth shave of the claim would fix, which is the measured form of the argument that four prior lanes closed on the claim and it fired again. WHAT IS ESTABLISHED PER SAMPLE DIFFERS AND IS NOT FLATTENED: the `claims_failed=0` / `unexpected_failures=0` signature was read from the run logs for six of the seven failures, srv4-11 being the one taken on report rather than read. The distinction is kept because this carrier's own subject is a verdict being attributed to the wrong thing, and a floor job can redden on a phase that is not the floor -- so FAILED and FAILED-WITH-THIS-SIGNATURE are different facts and the row says which it has. A ONE-SUBJECT CROSS-ENVELOPE READING, WHICH BEARS ON MISSING ITEM (b) AND DOES NOT DISCHARGE IT (calm-deer-33, 2026-09-03, verified here rather than relayed). `v2.test.emit.rust_produced_decl_emit.produced_decl_unwired_target_still_refuses` measured 165802 eval_steps at 346 cpu-ms on run 33802603168 and 165802 eval_steps at 514 cpu-ms on run 33806159353 -- the step count IDENTICAL to the digit while cpu moved 1.49x, and the second reading is the one that crossed into completed-over-budget. Log-line controls of 3472 and 3465 rule out an empty capture on either side, which is this repository's standing guard against a zero that reads as a clean sweep. WHY IT IS NOT (b), ON THREE COUNTS, AND THE THIRD IS THE ONE A LATER READER WILL MISS. (i) GRAIN: (b) asks for a join AT CORPUS GRAIN and this is one subject. (ii) SUBJECT: (b) asks for TWO ATTEMPTS OF ONE IDENTICAL TREE, and these are two different trees -- 8b2323f is an ANCESTOR of 07f81df, so the pull request adds commits on top of the main commit it is compared against. (iii) THE WARRANT FOR THE-WORK-DID-NOT-CHANGE CANNOT COME FROM THE STEP COUNT ITSELF: constant steps are read as envelope-independence only if the work is identical on INDEPENDENT grounds, since a measure insensitive to the change produces the same reading. TWO ATTEMPTS OF ONE IDENTICAL TREE supplies that warrant BY CONSTRUCTION, which is why (b) is written that way. ACROSS TWO TREES IT WAS SUPPLIED SEPARATELY AND (iii) IS ANSWERED, by two arguments that do not depend on each other, both re-derived here rather than relayed. FIRST, A SYMBOL-GRAIN JOIN: the whole diff between the compared trees touches three files and adds or removes six declarations -- `absence_classifier_default_bucket`, `green_reported_over_a_population_the_instrument_does_not_own`, `live_03_normalize_data_inits`, `live_03_normalize_facts`, `live_argument_threaded_past_the_arm_that_decides` and `effect_reach_live_03_normalize_witness_derived_host_reading_holds` -- and the module declaring the measured claim, `v2.test.claim.emit.produced_decl_two_target_test`, references none of the six, with a positive control on the same grep finding `tt_emit`, `tt_emits` and `tt_refuses` there. SYMBOL GRAIN RATHER THAN IMPORT CLOSURE IS LOAD-BEARING IN THIS SUBSTRATE: names resolve by global uniqueness rather than by import lists, so a name absent from every import list still resolves and an import-closure argument would exclude modules that can still supply a binding. SECOND, AND INDEPENDENT OF WHETHER THAT JOIN IS EXHAUSTIVE: the diff is NET NEGATIVE, 32 insertions against 60 deletions, and the only witness change DELETES a row, so any corpus-scale work effect would push this claim CHEAPER while the observation is 1.49x MORE EXPENSIVE. The move is in the wrong direction for every work-based explanation. A CONSTRAINT ON HOW (b) CAN EVER BE DISCHARGED, WHICH IS A PROPERTY OF THE COLUMN AND NOT OF TONIGHT. An INTERRUPTED row is unmeasured in `eval_steps` BY CONSTRUCTION -- the poll fires before a count exists -- so a corpus-grain identity join over this column has a STRUCTURALLY EXCLUDED SUBPOPULATION, and the excluded rows are precisely the expensive ones the join most needs to cover. (b) as worded may therefore not be buildable at full coverage at all. A LATER LANE THAT BUILDS IT OVER COMPLETED ROWS AND REPORTS COVERAGE WILL BE REPORTING OVER A POPULATION IT DOES NOT OWN, which is `gunbc.recurring_failure_mode` `green_reported_over_a_population_the_instrument_does_not_own` -- so the honest discharge of (b) must either state the exclusion as part of its result or reach the interrupted rows by a different measure, and a coverage figure over completed rows alone does not retire this row. WHAT IT DOES ESTABLISH is still an advance on what this row had: the invariance reading was previously grounded at FIXTURE grain and nowhere wider, and this extends it to a live corpus subject under real floor pressure. Recorded as that and not as more. IT WAS MEASURED FORWARD, WHICH IS THE ONLY REASON IT IS RECORDED AT ALL: a prediction that srv1-10 would fail and srv3-10 would pass was registered before either returned, and runs 33794985110 and 33796487867 held it. WHAT IT IS NOT IS AN EXPLANATION. A SLOWER HOST is a hypothesis with no mechanism attached, three passes on one host is a thin denominator, and neither this correlation nor a wider one discharges (i), (ii) or (iii) of the trigger below -- a basis that varies with the machine is exactly what (ii) asks to be rid of, so measuring WHICH machines it varies with sharpens the subject and closes none of it. NOT PROPOSED HERE, AND THE DISTINCTION IS THE SAME ONE THIS ROW HAS MADE THROUGHOUT: raising the 500 line would change which rows cross and would not make the crossing a property of the claim, so it does not retire this row and is not requested." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cost_cpu_regression_at_constant_eval_steps.dag b/dag/gunbc/rung_drop/floor_cost_cpu_regression_at_constant_eval_steps.dag index e0ec43dd6cc..bdacb499b2e 100644 --- a/dag/gunbc/rung_drop/floor_cost_cpu_regression_at_constant_eval_steps.dag +++ b/dag/gunbc/rung_drop/floor_cost_cpu_regression_at_constant_eval_steps.dag @@ -59,5 +59,7 @@ data floor_cost_cpu_regression_at_constant_eval_steps: RungDrop = RungDrop { "CONTENTION BILLED AS CPU is inside this dropped population and is a DISTINCT defect that this ceiling does not remedy: refault under memory pressure is charged to whichever claim is running, so the figure is a property of the machine rather than of the claim. bright-boar-435's seven-run series is the receipt -- gate_processes 24-510ms at a constant 2884/2806 eval_steps, includes_meta_self 30-1083ms at a constant 235/214, the two always expensive together or cheap together, wall and cpu monotone with cost. THE CEILING RENDERS THAT CLASS NON-REFUSING AND THAT IS ALL IT DOES: the denominator change is the remedy for the REFUSAL, never for the billing, and this row does not retire whatever addresses the billing. An earlier revision of this sentence attributed the same observations to position-dependent first-touch fill billing on the first claim of a module; cool-lark-439's #11239-versus-#11244 pair was read that way and the seven-run series superseded it. The wording is corrected rather than deleted because a reader who finds only the first reading will re-derive it", ], restoration_trigger: "PER-STEP COST IS GATED BY CONSTRUCTION, not by a threshold over a wall-clock reading. The capability: std.realization_cost_fidelity's report (landed by gunbc#11026) EXECUTING over the floor's primitive population on the acceptance path, with CostFidelity contradiction and quadratic-realization arms REFUSING a run rather than being rendered. WHAT THAT REPORT MUST BE SUFFICIENT FOR, stated because a trigger naming an artifact that contributes to a capability is satisfied while the capability stays dead: it must (i) cover every primitive the floor's claims actually reach, not a hand-chosen subset, with a missing primitive a typed refusal rather than an omission; (ii) decide fidelity from the MODELED cost bound against the REALIZED one, so a realization swapped underneath a modeled operation is caught by the comparison and not by anyone noticing the milliseconds; (iii) refuse on the acceptance path, so a contradiction stops the line rather than appearing in an artifact a reader may or may not open. A report that runs, renders, and gates nothing is the inert lens DESIGN section 4b names, and does NOT retire this row. (iv) HOLD FOR EVERY PER-SUBJECT BUDGET THE FLOOR APPLIES, not for the one ceiling that happened to prompt this row: both tiers of the claim ceiling, the enrolment margin in v2.workflow.floor_enrolment_margin (still CPU-denominated at this writing and therefore still able to refuse a subject on a run-level reading), and the fast lane's own cap if it moves. THE TRIGGER IS AT BUDGET GRAIN AND NOT AT DENOMINATION GRAIN, and this clause exists because an earlier revision was not: it quantified over the PRIMITIVES the report must cover and said nothing about WHICH BUDGETS must stop being vulnerable, so it could have been discharged by denominating one ceiling in eval_steps while another per-subject budget kept charging a run-level cost to an arbitrary claim. NO PER-SUBJECT BUDGET MAY CONSUME A RUN-LEVEL READING is the statement that has to become true; denominating the claim ceiling in eval_steps is one step toward it and is not it. The same narrowing was found and widened on gunbc.recurring_failure_mode admitted_reclaim_charged_by_first_touch, whose trigger read that a first-touch refault cannot inhabit the claim ceiling, and would have been satisfied by repairing first-touch attribution alone while any other run-level attribution kept refusing arbitrary subjects; that row is scheduled to be renamed run_level_cost_inhabits_a_per_subject_budget, so a reader who cannot resolve the citation above should look for the new name. WHY THE CPU LINE IS NOT THE RESTORATION, and this is the half a later author will be tempted by: re-arming a CPU ceiling would restore a wall that refuses on the environment rather than on the claim, which is the defect that caused this drop. The evidence, re-derived rather than transcribed from the ruling: on gunb-ai/gunbc#11173 (branch session/smart-swift-109), three heads that changed no executable source measured the same 3,775-claim floor at summed observed_cpu_ms of 36,718 (run 34692482393), 40,822 (run 34703087198) and 44,721 (run 34706991347), and the single identity v2.test.claim.affected_set_universe.affected_set_universe_gate_process, at an IDENTICAL eval_steps of 2884 in all three, read 34ms, 455ms and 511ms; two further runs on the same branch (34701129407 at 40,269 / 192ms and 34700917652 at 42,522 / 433ms) sit inside the same band. PRODUCER: the required-floor-claim-cost artifact (required_floor_claim_cost.tsv, columns observed_cpu_ms and eval_steps) published by the required-witnesses-floor lane of gunbc.witness_floor_workflow, one per run. THE FIGURES ARE INLINE RATHER THAN CITED BY PRODUCER ALONE, deliberately and against DESIGN section 6's ordinary rule, because that rule assumes the instrument outlives the citation and here it does not: GitHub Actions artifacts on this repository expire 2026-09-26, after which the producer name re-derives nothing and only the numbers remain", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cost_debt_straddling_produced_decl.dag b/dag/gunbc/rung_drop/floor_cost_debt_straddling_produced_decl.dag index 1d5095ff6af..e1b3f7c18c2 100644 --- a/dag/gunbc/rung_drop/floor_cost_debt_straddling_produced_decl.dag +++ b/dag/gunbc/rung_drop/floor_cost_debt_straddling_produced_decl.dag @@ -34,5 +34,7 @@ data floor_cost_debt_straddling_produced_decl: RungDrop = RungDrop { "v2.test.emit.produced_decl_two_target.produced_decl_two_targets_render_own_order", ], restoration_trigger: "EITHER ARM RETIRES THIS ROW, AND NEITHER IS AN ARTIFACT. (a) The produced-decl consumers stop paying to rebuild the rust TargetModel once per claim -- the measured serve-below-recompute ON THOSE CONSUMERS SPECIFICALLY that v2.workflow.floor_pure_producer_share names as its own next trigger, not on their family total, which has already been observed pointing the wrong way -- so these rows sit under the ceiling on their own work rather than on which runner the job landed on. (b) The required floor qualifies a claim's cost on a measure that IS a stable property of the claim, which is the capability gunbc.rung_drop floor_cost_claim_qualification_unavailable is waiting on; the deterministic eval_steps column already published in the floor's [over-cost] line is the candidate, and it is a candidate rather than the answer because no ceiling has been derived against it. WHAT THIS TRIGGER IS SUFFICIENT FOR, stated because 4b(3) requires it: after either arm, both identities execute on every ordinary required floor and are decided by a figure that does not change between two runs of one tree. DELETING THESE TWO LINES FROM v2.workflow.floor_cost_debt, EMPTYING THAT ROSTER, OR SHRINKING THE EMISSION SUBJECT THE WITNESSES ASSERT OVER SATISFIES NEITHER ARM -- the first two return the flapping, and the third would shrink the subject to buy the budget, which is the move that carrier already refuses for the live_deploy apply witnesses.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cost_high_cpu_withheld.dag b/dag/gunbc/rung_drop/floor_cost_high_cpu_withheld.dag index b9755b04961..10b55053e77 100644 --- a/dag/gunbc/rung_drop/floor_cost_high_cpu_withheld.dag +++ b/dag/gunbc/rung_drop/floor_cost_high_cpu_withheld.dag @@ -12,5 +12,7 @@ data floor_cost_high_cpu_withheld: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCostHighCpuWithheld, authored: "**132 REQUIRED WITNESSES AT OR ABOVE 219 CPU-MS LEAVE THE FLOOR TO STOP A COIN-FLIP GATE (2026-09-04).** main was refusing intermittently on cost alone: four DISTINCT identities across three runs at 502, 508, 519 and 568 cpu-ms against the 500ms stop, one of them by 2ms, every run reporting passed=3525 and claims_failed=0. No witness was wrong; which one lost was a coin flip, and a merge block nobody can act on is the uninformative-signal failure `gunbc.witness_floor_workflow` warns about when it says a lane may be promoted only when a red in it DISCRIMINATES. PREVIOUS RUNG: mechanically preventable -- these 132 executed on the required floor and a regression in any of them blocked a merge. TEMPORARY RUNG: mitigatable -- they remain authored, correct and executable, and `floor_cost_debt_roster` withholds them AT BUILD so the identity join still balances; what is gone is their merge-blocking authority. THE THRESHOLD IS DERIVED, NOT CHOSEN, AND THAT IS THE WHOLE OF WHY IT IS 219 AND NOT THE OPERATOR'S PERMISSIVE 100. `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` measures the per-identity inflation floor at 2.280x over twelve green main runs on three hosts, so 500 / 2.280 = 219 cpu-ms is the LOWEST BASELINE THAT CAN REACH THE STOP; it is that row's own attention constant, named here rather than re-derived. The operator authorised anything above 100ms, which is 316 identities. Withdrawing at 219 takes 132 and leaves 184 rows on the floor that cannot trip the line under the measured floor, because withdrawn coverage is safety spent and 184 rows is a large price for no reduction in flapping. A LOWER LINE IS AVAILABLE IF THE FLOOR RISES: 2.280 is a floor and the row says it can only rise, so if a larger inflation is measured this constant falls and the population grows -- that is a re-derivation, not a re-argument. BOUNDED POPULATION: the 132 identities measured `cost_reading=observed` at or above 219 cpu-ms in the green main run 33841933739. 130 of them are enrolled by this row in `v2.workflow.floor_cost_debt` proven chunks 14-20; the remaining TWO -- `produced_decl_module_folds_declarations_in_order` and `produced_decl_two_targets_render_own_order` -- were rostered by gunbc#10389 while this branch was open and are NOT re-enrolled here. The roster totals 421 identities. THAT SPLIT IS RECORDED RATHER THAN TIDIED AWAY BECAUSE IT COST A CI FAILURE: this row's chunks were generated mechanically from the cost TSV, deep-wolf-853 had named those two rows as gunbc#10389's, the reply agreeing to leave them alone was never applied to the artifact, and the duplicate only became reachable when main merged in. `floor_cost_debt_roster` refused it fail-closed -- `duplicate withheld identity` -- before running a single claim, which is the roster behaving correctly and the generation step behaving carelessly. The uniqueness check that would have caught it was run BEFORE the merge, and a merge is exactly the event that can create a duplicate. THREE SUBPOPULATIONS, DISPOSITIONED SEPARATELY BECAUSE THEY END DIFFERENTLY. (1) 37 host-process execution rows (`emit_host`, `rust_emit_host_call`) build and RUN a real host program to assert the executed program agrees with eval; no fixture work moves them, so they are PERMANENT withhold candidates, not pending fixes. (2) 5 live-tree lens rows walk the repository corpus, which is what they assert about, so shrinking their input would delete the check; also permanent. Two of these are the reason cpu and not eval_steps denominates this row at all -- `wall_residue_live` costs 298ms on 28 eval_steps and `test_migration_debt` 288ms on 129, because a corpus walk is host I/O that performs almost no substrate evaluation. (3) The remaining 90 are fixture-optimizable and are being worked: deep-wolf-853's six lanes edit the witness fixtures, and gunbc#10389 owns two of the top three. A row whose baseline drops below 219 leaves this population by re-measurement. WHY eval_steps IS NOT THE DENOMINATOR, recorded because it was proposed and tested rather than dismissed: eval_steps is deterministic where cpu is not, which is a real advantage, and it MATCHES at the 100ms line (Jaccard 0.943, 316 cpu rows against 327 step rows). It DEGRADES at the tail this row is about -- 0.718 at 219ms and 0.294 at 400ms -- because it counts substrate evaluation and cannot see host I/O. The conservative step line covering every at-risk row is steps>=28, which is 3092 of 3602 rows. cpu is the only column that sees both mechanisms. RESTORATION TRIGGER, at capability grain and NOT retired by these rows getting faster: an environment-independent per-claim cost qualification -- a charge readable as a stable property of the claim rather than of the attempt -- so that a cost verdict discriminates a regression from an execution position. That is the same capability `floor_cost_claim_qualification_unavailable` names, and this row is downstream of it: while a claim's charge is not a property of the claim, no threshold anywhere makes this gate discriminate, and moving the line only moves which rows flap. Individual rows returning under 219ms is a POPULATION shrink and retires their own membership, not this row." } + declaration: AuthoredProse { legacy: FloorCostHighCpuWithheld, authored: "**132 REQUIRED WITNESSES AT OR ABOVE 219 CPU-MS LEAVE THE FLOOR TO STOP A COIN-FLIP GATE (2026-09-04).** main was refusing intermittently on cost alone: four DISTINCT identities across three runs at 502, 508, 519 and 568 cpu-ms against the 500ms stop, one of them by 2ms, every run reporting passed=3525 and claims_failed=0. No witness was wrong; which one lost was a coin flip, and a merge block nobody can act on is the uninformative-signal failure `gunbc.witness_floor_workflow` warns about when it says a lane may be promoted only when a red in it DISCRIMINATES. PREVIOUS RUNG: mechanically preventable -- these 132 executed on the required floor and a regression in any of them blocked a merge. TEMPORARY RUNG: mitigatable -- they remain authored, correct and executable, and `floor_cost_debt_roster` withholds them AT BUILD so the identity join still balances; what is gone is their merge-blocking authority. THE THRESHOLD IS DERIVED, NOT CHOSEN, AND THAT IS THE WHOLE OF WHY IT IS 219 AND NOT THE OPERATOR'S PERMISSIVE 100. `gunbc.rung_drop` `floor_cost_claim_qualification_unavailable` measures the per-identity inflation floor at 2.280x over twelve green main runs on three hosts, so 500 / 2.280 = 219 cpu-ms is the LOWEST BASELINE THAT CAN REACH THE STOP; it is that row's own attention constant, named here rather than re-derived. The operator authorised anything above 100ms, which is 316 identities. Withdrawing at 219 takes 132 and leaves 184 rows on the floor that cannot trip the line under the measured floor, because withdrawn coverage is safety spent and 184 rows is a large price for no reduction in flapping. A LOWER LINE IS AVAILABLE IF THE FLOOR RISES: 2.280 is a floor and the row says it can only rise, so if a larger inflation is measured this constant falls and the population grows -- that is a re-derivation, not a re-argument. BOUNDED POPULATION: the 132 identities measured `cost_reading=observed` at or above 219 cpu-ms in the green main run 33841933739. 130 of them are enrolled by this row in `v2.workflow.floor_cost_debt` proven chunks 14-20; the remaining TWO -- `produced_decl_module_folds_declarations_in_order` and `produced_decl_two_targets_render_own_order` -- were rostered by gunbc#10389 while this branch was open and are NOT re-enrolled here. The roster totals 421 identities. THAT SPLIT IS RECORDED RATHER THAN TIDIED AWAY BECAUSE IT COST A CI FAILURE: this row's chunks were generated mechanically from the cost TSV, deep-wolf-853 had named those two rows as gunbc#10389's, the reply agreeing to leave them alone was never applied to the artifact, and the duplicate only became reachable when main merged in. `floor_cost_debt_roster` refused it fail-closed -- `duplicate withheld identity` -- before running a single claim, which is the roster behaving correctly and the generation step behaving carelessly. The uniqueness check that would have caught it was run BEFORE the merge, and a merge is exactly the event that can create a duplicate. THREE SUBPOPULATIONS, DISPOSITIONED SEPARATELY BECAUSE THEY END DIFFERENTLY. (1) 37 host-process execution rows (`emit_host`, `rust_emit_host_call`) build and RUN a real host program to assert the executed program agrees with eval; no fixture work moves them, so they are PERMANENT withhold candidates, not pending fixes. (2) 5 live-tree lens rows walk the repository corpus, which is what they assert about, so shrinking their input would delete the check; also permanent. Two of these are the reason cpu and not eval_steps denominates this row at all -- `wall_residue_live` costs 298ms on 28 eval_steps and `test_migration_debt` 288ms on 129, because a corpus walk is host I/O that performs almost no substrate evaluation. (3) The remaining 90 are fixture-optimizable and are being worked: deep-wolf-853's six lanes edit the witness fixtures, and gunbc#10389 owns two of the top three. A row whose baseline drops below 219 leaves this population by re-measurement. WHY eval_steps IS NOT THE DENOMINATOR, recorded because it was proposed and tested rather than dismissed: eval_steps is deterministic where cpu is not, which is a real advantage, and it MATCHES at the 100ms line (Jaccard 0.943, 316 cpu rows against 327 step rows). It DEGRADES at the tail this row is about -- 0.718 at 219ms and 0.294 at 400ms -- because it counts substrate evaluation and cannot see host I/O. The conservative step line covering every at-risk row is steps>=28, which is 3092 of 3602 rows. cpu is the only column that sees both mechanisms. RESTORATION TRIGGER, at capability grain and NOT retired by these rows getting faster: an environment-independent per-claim cost qualification -- a charge readable as a stable property of the claim rather than of the attempt -- so that a cost verdict discriminates a regression from an execution position. That is the same capability `floor_cost_claim_qualification_unavailable` names, and this row is downstream of it: while a claim's charge is not a property of the claim, no threshold anywhere makes this gate discriminate, and moving the line only moves which rows flap. Individual rows returning under 219ms is a POPULATION shrink and retires their own membership, not this row." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut.dag b/dag/gunbc/rung_drop/floor_cut.dag index 6e08ba07da2..5bc07abaaf5 100644 --- a/dag/gunbc/rung_drop/floor_cut.dag +++ b/dag/gunbc/rung_drop/floor_cut.dag @@ -12,5 +12,7 @@ data floor_cut: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCut, authored: "CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered (the generated-artifact drift gates were on this list until the `generated-artifact` phase described below took them off it): heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER, REPLACED 2026-09-01 BECAUSE THE ORIGINAL NAMED AN OBJECT THAT DOES NOT EXIST: this row's exposure is declared at CAPABILITY GRAIN in EIGHT sibling rows -- `floor_cut_heal`, `floor_cut_effect_gates`, `floor_cut_fmt_gate`, `floor_cut_merge_admission_stamping`, `floor_cut_falsifier_cadence`, `floor_cut_regen_second_generation_agreement`, `floor_cut_behavioural_regression_differential` and `floor_cut_receipt_discriminating_arms` -- and THIS ROW RETIRES WHEN ALL EIGHT RETIRE, BY THAT AND BY NOTHING ELSE. WIDENED FROM FIVE TO EIGHT ON 2026-09-03, AND THE GAP IS THE SAME DEFECT THIS PARAGRAPH WAS ALREADY REWRITTEN ONCE TO FIX. The 2026-09-01 repair replaced a prose-edit trigger with five capability-grain siblings, and enumerated five where the loss sentence above names EIGHT capabilities: this row's own WHAT THAT COSTS clause records that no CI run measures regen DETERMINISM, behavioural equivalence of a changed authority against its committed mirror, or the receipt machinery's own discriminating arms, and not one of the five siblings carried any of those three. That is 4b(3)'s stated review tell -- a plural loss with a trigger that does not span it -- surviving a repair authored against that exact tell. IT WAS NOT HYPOTHETICAL WHEN FOUND: `floor_cut_heal` had ALREADY RETIRED (gunbc#10118), so the trigger was one-fifth discharged while all three uncovered losses stayed dead, and on the four-sibling path that remained this row would have retired and taken three undeclared-dead guarantees with it -- no row standing over them and no trigger left to fire. Found from the floor's own refusal of gunbc#10108 rather than by an audit of this file. Rewriting this paragraph retires nothing; neither does any subset. WHAT THE ORIGINAL SAID AND WHY IT COULD NOT WORK, kept because a trigger replaced silently teaches nobody: it read `this paragraph is rewritten as an ordinary present-tense description -- not amended, rewritten in one pass -- when the re-add queue closes`. That is a PROSE EDIT actuating against a six-capability loss, which is 4b(3)'s grain mismatch in its plainest form -- a plural loss with a singular trigger -- and it is worse than vague: it is a predicate with NO TRUTH CONDITIONS. `the re-add queue` has exactly one referent in this repository, a numbered list under Step 3 of `docs/plans/floor-cut-replacement-plan.md`, which `gunbc.doc_graph_roots` registers as a HandAuthoredDocBind -- a hand-authored document, so no `.dag` authority carries its contents. There is no membership object, no per-item disposition field and no closure predicate anywhere in the tree (searched 2026-09-01 across `.dag`, `.rs` and `.md`). Its own item 8 proposes that the falsifier cadence NEVER RETURNS, and an item that never returns cannot close by returning, so closure would require a per-item disposition nothing records. A row that cannot be retired by its trigger gets retired instead by someone judging the paragraph stale, which is retirement of a live safety regression by editorial judgement. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document already records: the ruleset is not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. **THAT BOUNDARY MOVED, AND THE DECISION IT SUPPORTED DOES NOT.** `gunbc.repo_ruleset` now declares the desired ruleset -- enforcement, target, ref-name condition, the three rules, and the ONE required context, imported from `gunbc.witness_floor_workflow` `witness_floor_workflow_job_id` rather than spelled a second time -- observes the live one through `extdeps.github.rulesets`, reconciles the context roster through `gunbc.membership_reconcile`, applies drift with the whole-ruleset PUT, and READS BACK, claiming convergence only from the second observation and never from the apply's own 200. So the sentence in this bullet stating what the ruleset requires is no longer the only place that fact lives on our side of the boundary: `converge` actuates it and `verify` refuses on any divergence, with a typed reason per way it can diverge. WHAT DID NOT CHANGE, and why the aggregation job stays: convergence is an ACTUATION WITH A READ-BACK, not a wall. Nothing in this repository can constrain what GitHub admits to main, so an in-repo authority still cannot make a required context exist at the moment a merge is attempted -- it can only declare, apply and detect. The first cut's window argument therefore stands on its own terms; what is closed is the invisibility, not the boundary. WHAT IS NOT CLAIMED: NEITHER ENTRY POINT IS ENROLLED IN CI. `verify` is a route somebody runs, and until a required phase invokes it the class sits at *mitigatable* -- a drift is now detectable rather than detected, which is a real climb from unobservable and is not the same as a gate. Its next-rung trigger is that enrolment, which is a separate change under its own operator agreement. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase ` line per phase the lane owns and one `ROUTED to lane ` line per phase it does not, then `lane= phases_run=`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane= phases_run=`, and each job additionally prints a `ROUTED to lane ` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. **A SIXTH PHASE, `generated-artifact`, IS THE FIRST ITEM TAKEN OFF THE UNGUARDED LIST ABOVE RATHER THAN A NEW SUBJECT.** It adjudicates every member of `gunbc.generated_artifact` `committed_generated_artifacts` against what its own authority generates, through the pure per-path projection `gunbc.generated_artifact_emit` `generated_artifact_body_for_path`, hosted by `v1_compiler.cli_run` `run_generated_artifact_boundary` in the build lane. THE PRODUCER WAS NEVER MISSING AND THE CALLER WAS, which is why this is a re-add and not a construction: `main_wet` on `dag/gunbc/instruments/generated_artifact_gate.dag` has always written these files and the projection has always been able to say what each path ought to hold, but from the floor cut until this phase the only route that ASKED it was `claim_executor`'s behavioural-receipt census, which asks only about paths of the form `src/v1/stage0/src/` because its subject is emitted Rust mirrors. So `DESIGN.md` and `ROADMAP.md` -- projections of `gunbc.design_document` and `gunbc.roadmap_authority` -- were computed by nothing and compared by nothing, and were maintained BY HAND in lockstep with their authorities. That is not a hypothetical: gunbc#9392 found the accumulated result the only way an unguarded artifact is ever found, by accident while doing something else, 2198 characters into the drift, and this document's own §4b(3) clause was among the text standing in the artifact with no authority behind it. **AND THE FIRST THING IT FOUND WAS NOT DRIFT, WHICH IS THE REUSABLE HALF.** Two of its four opening reds were ABSENT rather than drifted, and one of those markdown files had been DELETED ON PURPOSE by a295e17415, whose entire subject is the ruling that the .dag carrier is the authority. Regenerating it would have performed exactly what that commit refused, and the gate would then have gone green over the resurrection -- enforcing, permanently, the reverse of a decision already taken. THE GENERAL SHAPE: **a drift gate makes whatever it adjudicates BINDING**, so an absence that was inert before the gate becomes a line-stop after it, and the cheapest way to move the line is to regenerate. A dormant registry mistake is thereby converted into a standing obligation to recreate deleted files, silently, because the green looks identical either way. The stale half is the REGISTRY ROW and not the missing file, so the repair runs the other way: `gunbc.plan` `PlanProjection` makes a plan declare whether its markdown is a committed artifact at all, `PlanIsAuthorityOnly` carries the ruling that removed the projection, and the plan stays rostered, generated and refusable -- only whether its bytes are expected on disk changes. The rule for the next gate: **before a new adjudicator's first red is closed by producing the thing it says is missing, establish that the thing was ever supposed to exist.** WHAT THE PHASE DOES NOT CLAIM: it is READ-ONLY by construction -- there is no write path in it and no flag that opens one, because a gate that can also write its own subject is a gate whose green proves nothing -- and it restores nothing else from the deleted machinery; heal, the seven effect gates, the fmt gate, merge-admission stamping and the falsifier cadence remain their own re-adds. Its roster is ASKED of the authority, so an artifact added to `generated_artifact_registry` is enrolled with no edit to the host, and a rostered member that reaches NO verdict is counted and reported separately from a drifted one and stops the line on its own -- `0 drifted` over a population nothing asked about is the execution-provenance loss this document names, and the two counts are what keep it unrepresentable. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane= phases_run=`, and each job additionally prints a `ROUTED to lane ` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied. This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse." } + declaration: AuthoredProse { legacy: FloorCut, authored: "CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered (the generated-artifact drift gates were on this list until the `generated-artifact` phase described below took them off it): heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER, REPLACED 2026-09-01 BECAUSE THE ORIGINAL NAMED AN OBJECT THAT DOES NOT EXIST: this row's exposure is declared at CAPABILITY GRAIN in EIGHT sibling rows -- `floor_cut_heal`, `floor_cut_effect_gates`, `floor_cut_fmt_gate`, `floor_cut_merge_admission_stamping`, `floor_cut_falsifier_cadence`, `floor_cut_regen_second_generation_agreement`, `floor_cut_behavioural_regression_differential` and `floor_cut_receipt_discriminating_arms` -- and THIS ROW RETIRES WHEN ALL EIGHT RETIRE, BY THAT AND BY NOTHING ELSE. WIDENED FROM FIVE TO EIGHT ON 2026-09-03, AND THE GAP IS THE SAME DEFECT THIS PARAGRAPH WAS ALREADY REWRITTEN ONCE TO FIX. The 2026-09-01 repair replaced a prose-edit trigger with five capability-grain siblings, and enumerated five where the loss sentence above names EIGHT capabilities: this row's own WHAT THAT COSTS clause records that no CI run measures regen DETERMINISM, behavioural equivalence of a changed authority against its committed mirror, or the receipt machinery's own discriminating arms, and not one of the five siblings carried any of those three. That is 4b(3)'s stated review tell -- a plural loss with a trigger that does not span it -- surviving a repair authored against that exact tell. IT WAS NOT HYPOTHETICAL WHEN FOUND: `floor_cut_heal` had ALREADY RETIRED (gunbc#10118), so the trigger was one-fifth discharged while all three uncovered losses stayed dead, and on the four-sibling path that remained this row would have retired and taken three undeclared-dead guarantees with it -- no row standing over them and no trigger left to fire. Found from the floor's own refusal of gunbc#10108 rather than by an audit of this file. Rewriting this paragraph retires nothing; neither does any subset. WHAT THE ORIGINAL SAID AND WHY IT COULD NOT WORK, kept because a trigger replaced silently teaches nobody: it read `this paragraph is rewritten as an ordinary present-tense description -- not amended, rewritten in one pass -- when the re-add queue closes`. That is a PROSE EDIT actuating against a six-capability loss, which is 4b(3)'s grain mismatch in its plainest form -- a plural loss with a singular trigger -- and it is worse than vague: it is a predicate with NO TRUTH CONDITIONS. `the re-add queue` has exactly one referent in this repository, a numbered list under Step 3 of `docs/plans/floor-cut-replacement-plan.md`, which `gunbc.doc_graph_roots` registers as a HandAuthoredDocBind -- a hand-authored document, so no `.dag` authority carries its contents. There is no membership object, no per-item disposition field and no closure predicate anywhere in the tree (searched 2026-09-01 across `.dag`, `.rs` and `.md`). Its own item 8 proposes that the falsifier cadence NEVER RETURNS, and an item that never returns cannot close by returning, so closure would require a per-item disposition nothing records. A row that cannot be retired by its trigger gets retired instead by someone judging the paragraph stale, which is retirement of a live safety regression by editorial judgement. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document already records: the ruleset is not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. **THAT BOUNDARY MOVED, AND THE DECISION IT SUPPORTED DOES NOT.** `gunbc.repo_ruleset` now declares the desired ruleset -- enforcement, target, ref-name condition, the three rules, and the ONE required context, imported from `gunbc.witness_floor_workflow` `witness_floor_workflow_job_id` rather than spelled a second time -- observes the live one through `extdeps.github.rulesets`, reconciles the context roster through `gunbc.membership_reconcile`, applies drift with the whole-ruleset PUT, and READS BACK, claiming convergence only from the second observation and never from the apply's own 200. So the sentence in this bullet stating what the ruleset requires is no longer the only place that fact lives on our side of the boundary: `converge` actuates it and `verify` refuses on any divergence, with a typed reason per way it can diverge. WHAT DID NOT CHANGE, and why the aggregation job stays: convergence is an ACTUATION WITH A READ-BACK, not a wall. Nothing in this repository can constrain what GitHub admits to main, so an in-repo authority still cannot make a required context exist at the moment a merge is attempted -- it can only declare, apply and detect. The first cut's window argument therefore stands on its own terms; what is closed is the invisibility, not the boundary. WHAT IS NOT CLAIMED: NEITHER ENTRY POINT IS ENROLLED IN CI. `verify` is a route somebody runs, and until a required phase invokes it the class sits at *mitigatable* -- a drift is now detectable rather than detected, which is a real climb from unobservable and is not the same as a gate. Its next-rung trigger is that enrolment, which is a separate change under its own operator agreement. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase ` line per phase the lane owns and one `ROUTED to lane ` line per phase it does not, then `lane= phases_run=`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane= phases_run=`, and each job additionally prints a `ROUTED to lane ` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. **A SIXTH PHASE, `generated-artifact`, IS THE FIRST ITEM TAKEN OFF THE UNGUARDED LIST ABOVE RATHER THAN A NEW SUBJECT.** It adjudicates every member of `gunbc.generated_artifact` `committed_generated_artifacts` against what its own authority generates, through the pure per-path projection `gunbc.generated_artifact_emit` `generated_artifact_body_for_path`, hosted by `v1_compiler.cli_run` `run_generated_artifact_boundary` in the build lane. THE PRODUCER WAS NEVER MISSING AND THE CALLER WAS, which is why this is a re-add and not a construction: `main_wet` on `dag/gunbc/instruments/generated_artifact_gate.dag` has always written these files and the projection has always been able to say what each path ought to hold, but from the floor cut until this phase the only route that ASKED it was `claim_executor`'s behavioural-receipt census, which asks only about paths of the form `src/v1/stage0/src/` because its subject is emitted Rust mirrors. So `DESIGN.md` and `ROADMAP.md` -- projections of `gunbc.design_document` and `gunbc.roadmap_authority` -- were computed by nothing and compared by nothing, and were maintained BY HAND in lockstep with their authorities. That is not a hypothetical: gunbc#9392 found the accumulated result the only way an unguarded artifact is ever found, by accident while doing something else, 2198 characters into the drift, and this document's own §4b(3) clause was among the text standing in the artifact with no authority behind it. **AND THE FIRST THING IT FOUND WAS NOT DRIFT, WHICH IS THE REUSABLE HALF.** Two of its four opening reds were ABSENT rather than drifted, and one of those markdown files had been DELETED ON PURPOSE by a295e17415, whose entire subject is the ruling that the .dag carrier is the authority. Regenerating it would have performed exactly what that commit refused, and the gate would then have gone green over the resurrection -- enforcing, permanently, the reverse of a decision already taken. THE GENERAL SHAPE: **a drift gate makes whatever it adjudicates BINDING**, so an absence that was inert before the gate becomes a line-stop after it, and the cheapest way to move the line is to regenerate. A dormant registry mistake is thereby converted into a standing obligation to recreate deleted files, silently, because the green looks identical either way. The stale half is the REGISTRY ROW and not the missing file, so the repair runs the other way: `gunbc.plan` `PlanProjection` makes a plan declare whether its markdown is a committed artifact at all, `PlanIsAuthorityOnly` carries the ruling that removed the projection, and the plan stays rostered, generated and refusable -- only whether its bytes are expected on disk changes. The rule for the next gate: **before a new adjudicator's first red is closed by producing the thing it says is missing, establish that the thing was ever supposed to exist.** WHAT THE PHASE DOES NOT CLAIM: it is READ-ONLY by construction -- there is no write path in it and no flag that opens one, because a gate that can also write its own subject is a gate whose green proves nothing -- and it restores nothing else from the deleted machinery; heal, the seven effect gates, the fmt gate, merge-admission stamping and the falsifier cadence remain their own re-adds. Its roster is ASKED of the authority, so an artifact added to `generated_artifact_registry` is enrolled with no edit to the host, and a rostered member that reaches NO verdict is counted and reported separately from a drifted one and stops the line on its own -- `0 drifted` over a population nothing asked about is the execution-provenance loss this document names, and the two counts are what keep it unrepresentable. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane= phases_run=`, and each job additionally prints a `ROUTED to lane ` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied. This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_behavioural_regression_differential.dag b/dag/gunbc/rung_drop/floor_cut_behavioural_regression_differential.dag index 010431c2210..aa459a9f539 100644 --- a/dag/gunbc/rung_drop/floor_cut_behavioural_regression_differential.dag +++ b/dag/gunbc/rung_drop/floor_cut_behavioural_regression_differential.dag @@ -12,5 +12,7 @@ data floor_cut_behavioural_regression_differential: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutBehaviouralRegressionDifferential, authored: "**NO REQUIRED LANE RUNS A CHANGED TARGET BOTH AS COMMITTED AND AS FRESHLY EMITTED AND COMPARES THE TWO BEHAVIOURS, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, whose loss sentence names this capability and whose five siblings did not carry it. PREVIOUS RUNG: 2 (mechanically preventable) -- the behavioral-differential path was required and could refuse an old-versus-new target divergence. TEMPORARY RUNG: 1 (mitigatable) -- the instrument exists and is careful work: `v1_compiler.behavioral_receipt_host` `behavioral_differential` runs one generated driver against the tree as committed, installs the emitted candidate over its mirror, REBUILDS, runs the same driver again, restores the mirror, and compares transcripts, refusing outright if the mirror is dirty rather than comparing a leftover candidate against itself. WHAT THE INSTRUMENT DOES AND WHAT CI OMITS ARE TWO FACTS, AND AN EARLIER REVISION OF THIS ROW READ THE SECOND AS THE FIRST (corrected 2026-09-03, bright-ram-778 on gunbc#10154). That revision quoted the instrument's own doc comment -- CI proves the committed mirrors equal what the authority emits and that the emit repeats, it never compiles the candidate, let alone runs it -- and carried it as a claim about the MECHANISM. It is not: the sentence describes what the CURRENT REQUIRED COMPOSITION omits, and `behavioral_differential` compiles and runs the candidate by construction. So this row is an ENROLMENT row and nothing else. WHAT THE MERGE PATH ENFORCES INSTEAD is byte agreement plus generation repeatability -- BYTE IDENTITY, which DESIGN section 7 names explicitly as NOT the goal and explains is actively harmful, since a byte-identical fixed point forces v2 to reproduce the seed's warts to match bytes. The enforced property is the disclaimed one; the claimed one has no required consumer. BOUNDED POPULATION: one capability -- refusal, on the merge path, of a behavioural difference between a target as committed and the same target as emitted from the changed authority. RESTORATION TRIGGER, A CAPABILITY: `behavioral_differential` TOGETHER WITH ITS DISCRIMINATING CONTROLS executing in a REQUIRED lane, SUFFICIENT FOR a merge whose candidate target behaves differently from the committed one being refused, demonstrated by a red on a deliberately divergent candidate and by a green on an unchanged one. The controls are half the trigger: a differential that cannot be shown to go red is `floor_cut_receipt_discriminating_arms`'s subject arriving inside this one. WHAT THIS ROW IS NOT: it is the OLD-TARGET-versus-NEW-TARGET relation. Whether the emitted target agrees with the .dag authority that produced it is a different relation on a different pair, filed separately as `gunbc.guarantee_stall` `authority_target_same_expression_equivalence_stall`, and NEITHER implies the other -- see that row for the counterexample in both directions. It is a STALL and not a drop, which is the point of the separate carrier: nothing lowered it, so it has no previous rung to restore. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" } + declaration: AuthoredProse { legacy: FloorCutBehaviouralRegressionDifferential, authored: "**NO REQUIRED LANE RUNS A CHANGED TARGET BOTH AS COMMITTED AND AS FRESHLY EMITTED AND COMPARES THE TWO BEHAVIOURS, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, whose loss sentence names this capability and whose five siblings did not carry it. PREVIOUS RUNG: 2 (mechanically preventable) -- the behavioral-differential path was required and could refuse an old-versus-new target divergence. TEMPORARY RUNG: 1 (mitigatable) -- the instrument exists and is careful work: `v1_compiler.behavioral_receipt_host` `behavioral_differential` runs one generated driver against the tree as committed, installs the emitted candidate over its mirror, REBUILDS, runs the same driver again, restores the mirror, and compares transcripts, refusing outright if the mirror is dirty rather than comparing a leftover candidate against itself. WHAT THE INSTRUMENT DOES AND WHAT CI OMITS ARE TWO FACTS, AND AN EARLIER REVISION OF THIS ROW READ THE SECOND AS THE FIRST (corrected 2026-09-03, bright-ram-778 on gunbc#10154). That revision quoted the instrument's own doc comment -- CI proves the committed mirrors equal what the authority emits and that the emit repeats, it never compiles the candidate, let alone runs it -- and carried it as a claim about the MECHANISM. It is not: the sentence describes what the CURRENT REQUIRED COMPOSITION omits, and `behavioral_differential` compiles and runs the candidate by construction. So this row is an ENROLMENT row and nothing else. WHAT THE MERGE PATH ENFORCES INSTEAD is byte agreement plus generation repeatability -- BYTE IDENTITY, which DESIGN section 7 names explicitly as NOT the goal and explains is actively harmful, since a byte-identical fixed point forces v2 to reproduce the seed's warts to match bytes. The enforced property is the disclaimed one; the claimed one has no required consumer. BOUNDED POPULATION: one capability -- refusal, on the merge path, of a behavioural difference between a target as committed and the same target as emitted from the changed authority. RESTORATION TRIGGER, A CAPABILITY: `behavioral_differential` TOGETHER WITH ITS DISCRIMINATING CONTROLS executing in a REQUIRED lane, SUFFICIENT FOR a merge whose candidate target behaves differently from the committed one being refused, demonstrated by a red on a deliberately divergent candidate and by a green on an unchanged one. The controls are half the trigger: a differential that cannot be shown to go red is `floor_cut_receipt_discriminating_arms`'s subject arriving inside this one. WHAT THIS ROW IS NOT: it is the OLD-TARGET-versus-NEW-TARGET relation. Whether the emitted target agrees with the .dag authority that produced it is a different relation on a different pair, filed separately as `gunbc.guarantee_stall` `authority_target_same_expression_equivalence_stall`, and NEITHER implies the other -- see that row for the counterexample in both directions. It is a STALL and not a drop, which is the point of the separate carrier: nothing lowered it, so it has no previous rung to restore. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_effect_gates.dag b/dag/gunbc/rung_drop/floor_cut_effect_gates.dag index 404999421c3..25dd705a88c 100644 --- a/dag/gunbc/rung_drop/floor_cut_effect_gates.dag +++ b/dag/gunbc/rung_drop/floor_cut_effect_gates.dag @@ -12,5 +12,7 @@ data floor_cut_effect_gates: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutEffectGates, authored: "**SIX OF THE SEVEN EFFECT GATES ARE UNGUARDED AND THE SEVENTH IS BACK, AND THE FRACTION IS STATED BECAUSE SAYING `THE EFFECT GATES` WHERE ONE OF SEVEN IS LIVE IS THE OVERSTATEMENT THIS LEDGER KEEPS PAYING FOR (2026-09-01).** Split out of `floor_cut`. THE SEVEN, from that row's own loss clause: compile-clean, generated-artifact drift, emit-host, extdeps citation, extdeps placement, prose-row, cheap-claim pool. DISCHARGED, 1 of 7: generated-artifact drift, restored by gunbc#9415 as the required `generated-artifact` phase adjudicating every member of `committed_generated_artifacts` through `gunbc.generated_artifact_emit` `generated_artifact_body_for_path`. It is named here as DONE rather than deleted from the list, because a population that shrinks silently cannot be checked. OUTSTANDING, 6 of 7: compile-clean, emit-host, extdeps citation, extdeps placement, prose-row, cheap-claim pool. PREVIOUS RUNG: 2 (mechanically preventable) for each -- a required gate blocked the merge. TEMPORARY RUNG: 0 for the six; not `1`, because these are not mitigated failures but UNOBSERVED ones -- the class is outside the modeled guarantee at the merge boundary until its gate returns. REASON: the 2026-08-15 floor cut deleted the wrapper carrying all seven obligations. BOUNDED POPULATION: the six named gates, enumerated above; the roster is closed and is not `whatever the plan lists`. RESTORATION TRIGGER, PER GATE AND NOT FOR THE SET: this row retires only when EACH of the six has a required-run consumer that refuses a merge on its own violation, each with a discriminating RED executed on the real acceptance path. Six retirements, one row, and the row states its own remaining fraction whenever it is read. WHAT DOES NOT RETIRE THIS ROW: the `generated-artifact` phase being live, which is the one already discharged; a lens that computes any of the six without gating, which is the inert tier DESIGN section 6 names; or a gate landed with no authored RED, which is a wall nobody has seen fire. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." } + declaration: AuthoredProse { legacy: FloorCutEffectGates, authored: "**SIX OF THE SEVEN EFFECT GATES ARE UNGUARDED AND THE SEVENTH IS BACK, AND THE FRACTION IS STATED BECAUSE SAYING `THE EFFECT GATES` WHERE ONE OF SEVEN IS LIVE IS THE OVERSTATEMENT THIS LEDGER KEEPS PAYING FOR (2026-09-01).** Split out of `floor_cut`. THE SEVEN, from that row's own loss clause: compile-clean, generated-artifact drift, emit-host, extdeps citation, extdeps placement, prose-row, cheap-claim pool. DISCHARGED, 1 of 7: generated-artifact drift, restored by gunbc#9415 as the required `generated-artifact` phase adjudicating every member of `committed_generated_artifacts` through `gunbc.generated_artifact_emit` `generated_artifact_body_for_path`. It is named here as DONE rather than deleted from the list, because a population that shrinks silently cannot be checked. OUTSTANDING, 6 of 7: compile-clean, emit-host, extdeps citation, extdeps placement, prose-row, cheap-claim pool. PREVIOUS RUNG: 2 (mechanically preventable) for each -- a required gate blocked the merge. TEMPORARY RUNG: 0 for the six; not `1`, because these are not mitigated failures but UNOBSERVED ones -- the class is outside the modeled guarantee at the merge boundary until its gate returns. REASON: the 2026-08-15 floor cut deleted the wrapper carrying all seven obligations. BOUNDED POPULATION: the six named gates, enumerated above; the roster is closed and is not `whatever the plan lists`. RESTORATION TRIGGER, PER GATE AND NOT FOR THE SET: this row retires only when EACH of the six has a required-run consumer that refuses a merge on its own violation, each with a discriminating RED executed on the real acceptance path. Six retirements, one row, and the row states its own remaining fraction whenever it is read. WHAT DOES NOT RETIRE THIS ROW: the `generated-artifact` phase being live, which is the one already discharged; a lens that computes any of the six without gating, which is the inert tier DESIGN section 6 names; or a gate landed with no authored RED, which is a wall nobody has seen fire. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_falsifier_cadence.dag b/dag/gunbc/rung_drop/floor_cut_falsifier_cadence.dag index 35fbf83a965..46b3bc036d5 100644 --- a/dag/gunbc/rung_drop/floor_cut_falsifier_cadence.dag +++ b/dag/gunbc/rung_drop/floor_cut_falsifier_cadence.dag @@ -12,5 +12,7 @@ data floor_cut_falsifier_cadence: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutFalsifierCadence, authored: "**THE FALSIFIER CADENCE IS GONE AND WHETHER IT SHOULD RETURN IS AN OPEN OPERATOR QUESTION, WHICH IS WHY THIS ROW IS NEITHER A RESTORATION NOR A RETIREMENT (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- a scheduled cadence ran a predict-only cold comparison over the whole corpus, so a wrong affected-set prediction and a lying `SubstrateInputsOnly` disposition surfaced as a counted divergence within one window. TEMPORARY RUNG: 0 -- `falsifier.yml` was deleted by the cut and the repository carries three workflows, none of which runs a cold comparison. `v2.std.live_tree` records the consequence in its own words: two carriers named that cadence as their enforcement, the sentences were true when written and became false when the workflow died, and nothing could notice. BOUNDED POPULATION: one capability -- a scheduled whole-corpus cold control against the selected run. WHY THE DISPOSITION IS OPEN AND STATED AS OPEN. `docs/plans/floor-cut-replacement-plan.md` item 8 says `proposed: never returns`. That is a PROPOSAL in a hand-authored plan, not a ruling, and a capability deliberately not returning is a SCOPE REMOVAL, which is the operator's call and not an author's. Writing this row as a restoration that will wait forever would be a trigger that cannot fire; writing it as retired would be an author retiring an operator's exposure. RESTORATION TRIGGER, TWO ARMS AND NO OTHERS: this row is enrolled on gunbc.rung_drop.shared_capability missing_cadence_category, and both arms keep that enrolled set uniform. FIRST ARM: a scheduled consumer executes a predict-only cold comparison over the whole corpus and reports divergences as a counted, located population -- that is missing_cadence_category firing, and waiters of that capability retire together or not at all. SECOND ARM: an OPERATOR RULES the capability withdrawn -- at which point the row is retired citing that ruling, this identity is removed from missing_cadence_category.waiter_identities in the SAME change (delist, not SplitRetirement), and the carriers that named the cadence as their enforcement must be corrected in the same change, because a withdrawn capability still leaves them asserting a route that does not exist. WHAT DOES NOT RETIRE THIS ROW: an author, a lane or a plan concluding it should never return. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." } + declaration: AuthoredProse { legacy: FloorCutFalsifierCadence, authored: "**THE FALSIFIER CADENCE IS GONE AND WHETHER IT SHOULD RETURN IS AN OPEN OPERATOR QUESTION, WHICH IS WHY THIS ROW IS NEITHER A RESTORATION NOR A RETIREMENT (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- a scheduled cadence ran a predict-only cold comparison over the whole corpus, so a wrong affected-set prediction and a lying `SubstrateInputsOnly` disposition surfaced as a counted divergence within one window. TEMPORARY RUNG: 0 -- `falsifier.yml` was deleted by the cut and the repository carries three workflows, none of which runs a cold comparison. `v2.std.live_tree` records the consequence in its own words: two carriers named that cadence as their enforcement, the sentences were true when written and became false when the workflow died, and nothing could notice. BOUNDED POPULATION: one capability -- a scheduled whole-corpus cold control against the selected run. WHY THE DISPOSITION IS OPEN AND STATED AS OPEN. `docs/plans/floor-cut-replacement-plan.md` item 8 says `proposed: never returns`. That is a PROPOSAL in a hand-authored plan, not a ruling, and a capability deliberately not returning is a SCOPE REMOVAL, which is the operator's call and not an author's. Writing this row as a restoration that will wait forever would be a trigger that cannot fire; writing it as retired would be an author retiring an operator's exposure. RESTORATION TRIGGER, TWO ARMS AND NO OTHERS: this row is enrolled on gunbc.rung_drop.shared_capability missing_cadence_category, and both arms keep that enrolled set uniform. FIRST ARM: a scheduled consumer executes a predict-only cold comparison over the whole corpus and reports divergences as a counted, located population -- that is missing_cadence_category firing, and waiters of that capability retire together or not at all. SECOND ARM: an OPERATOR RULES the capability withdrawn -- at which point the row is retired citing that ruling, this identity is removed from missing_cadence_category.waiter_identities in the SAME change (delist, not SplitRetirement), and the carriers that named the cadence as their enforcement must be corrected in the same change, because a withdrawn capability still leaves them asserting a route that does not exist. WHAT DOES NOT RETIRE THIS ROW: an author, a lane or a plan concluding it should never return. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_fmt_gate.dag b/dag/gunbc/rung_drop/floor_cut_fmt_gate.dag index c45c7422c32..0085a79afc1 100644 --- a/dag/gunbc/rung_drop/floor_cut_fmt_gate.dag +++ b/dag/gunbc/rung_drop/floor_cut_fmt_gate.dag @@ -12,5 +12,7 @@ data floor_cut_fmt_gate: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutFmtGate, authored: "**NO REQUIRED LANE RUNS `cargo fmt`, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- fmt ran as a required CI step on the merge path. TEMPORARY RUNG: 1 (mitigatable) and generously so: what remains is the generated pre-commit hook, which is opt-in per clone (`core.hooksPath`), bypassable with `--no-verify`, and absent in container worktrees. REASON: the 2026-08-15 floor cut deleted the build job that carried the step. BOUNDED POPULATION: one capability -- refusal of unformatted Rust at the merge boundary. MEASURED FROM THE TREE (2026-09-01): the emitted `.github/workflows/witnesses.yml` runs fmt in neither required lane. This is not a new reading -- `gunbc.commit_workflow` already carries it at check grain as an UNCOVERED residual in `check_removal_roster`, and records the sharper fact that the hook's own slimming was argued FROM fmt remaining a required-path CI step, which the cut then falsified. `gunbc.repo_self_build` names the command; nothing required executes it. PRIOR EVIDENCE THE HOOK IS NOT AN AUTHORITY, from that same carrier: gunbc#6658 -- an unformatted `.rs` landed on main and no hook caught it. RESTORATION TRIGGER, A CAPABILITY: `cargo fmt --all --check` executing inside a required lane such that a merge with unformatted Rust is REFUSED, demonstrated by a red on an unformatted fixture. WHAT DOES NOT RETIRE THIS ROW: any strengthening of the pre-commit or pre-push hook -- that surface was proven non-enforcing before this drop was declared, and re-heavying it re-imports the pressure `commit_workflow` records as converting honest reds into workaround greens. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." } + declaration: AuthoredProse { legacy: FloorCutFmtGate, authored: "**NO REQUIRED LANE RUNS `cargo fmt`, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- fmt ran as a required CI step on the merge path. TEMPORARY RUNG: 1 (mitigatable) and generously so: what remains is the generated pre-commit hook, which is opt-in per clone (`core.hooksPath`), bypassable with `--no-verify`, and absent in container worktrees. REASON: the 2026-08-15 floor cut deleted the build job that carried the step. BOUNDED POPULATION: one capability -- refusal of unformatted Rust at the merge boundary. MEASURED FROM THE TREE (2026-09-01): the emitted `.github/workflows/witnesses.yml` runs fmt in neither required lane. This is not a new reading -- `gunbc.commit_workflow` already carries it at check grain as an UNCOVERED residual in `check_removal_roster`, and records the sharper fact that the hook's own slimming was argued FROM fmt remaining a required-path CI step, which the cut then falsified. `gunbc.repo_self_build` names the command; nothing required executes it. PRIOR EVIDENCE THE HOOK IS NOT AN AUTHORITY, from that same carrier: gunbc#6658 -- an unformatted `.rs` landed on main and no hook caught it. RESTORATION TRIGGER, A CAPABILITY: `cargo fmt --all --check` executing inside a required lane such that a merge with unformatted Rust is REFUSED, demonstrated by a red on an unformatted fixture. WHAT DOES NOT RETIRE THIS ROW: any strengthening of the pre-commit or pre-push hook -- that surface was proven non-enforcing before this drop was declared, and re-heavying it re-imports the pressure `commit_workflow` records as converting honest reds into workaround greens. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_heal.dag b/dag/gunbc/rung_drop/floor_cut_heal.dag index 19ccefd218e..418950bba4f 100644 --- a/dag/gunbc/rung_drop/floor_cut_heal.dag +++ b/dag/gunbc/rung_drop/floor_cut_heal.dag @@ -12,5 +12,7 @@ data floor_cut_heal: RungDrop = RungDrop { standing: Retired { trigger_fired: "2026-09-02 -- THE CAPABILITY, OBSERVED, NOT THE EMISSION. gunbc#10118 restored the heal job as a job of gunbc.witness_floor_workflow, and the row is retired on an EXECUTED repair of a REAL divergence rather than on that emission. THE PROBE: commit 330c74f0735364644c6a527a2d61de8da0a37cd8 hand-edited docs/plans/input-envelope-roadmap.md, a generated projection, from 3555 bytes (sha256 4da64e1495ef627c31fa21f3e31e2746ba28c5be447c9f6565d9a004f2c23ead) to 3754 and did not regenerate it. The subject was chosen against the emitted script rather than assumed: it carries a git add line and does NOT appear in the AUTHOR_COMMIT_DRIFT population, so it exercises the PUSH arm; the three workflow projections would have exercised bundle-and-refuse while looking like a heal run. THE RECEIPT, run 33683175090 job 100433326005: HealProduced prior_head=330c74f0735364644c6a527a2d61de8da0a37cd8 healed_head=bc704687540d25796f53f88687226ee1a735743c changed_artifacts=docs/plans/input-envelope-roadmap.md -- exactly one path, no blast radius across the other 32 auto-push rows -- then SupersededByHealedHead and exit 1. The branch head moved, authored gunbc-ci-auto-heal , under the checkout persist-credentials binding gunbc.heal_push_plan resolves the push authority from. IDENTITY CONFIRMED TWO WAYS: the healed file is byte-identical to the pre-drift digest recorded BEFORE the probe, and a clean source-built regeneration on the healed head (whose src/ and dag/ are identical to the tree the binary was built from) changed ZERO files. RESTORED RUNG: 2 (mechanically preventable) -- drift is caught by the required generated-artifact phase and now CORRECTED without an author, which is the previous rung this row lost. NOT RESTORED, and this row does not claim it: revalidation of the head heal creates. CORRECTED 2026-09-03, AND THE ORIGINAL SENTENCE IS QUOTED RATHER THAN DELETED BECAUSE THE RECORD OF WHAT WAS CLAIMED IS THE POINT. This row said: 'An Actions-credential push starts no run, so heal exits nonzero with SupersededByHealedHead rather than reporting a verdict about a head nothing judged.' THE FIRST CLAUSE IS FALSE; EVERYTHING IT WAS OFFERED TO SUPPORT STANDS. Measured over the entire heal-push population since the job was restored -- n=4, healed heads bc704687540d25796f53f88687226ee1a735743c, 695f264c77, 7de8273834 and 958f743f9ec056f73fbd4e4adedf84a65a7bc41b, re-derivable by listing repos/gunb-ai/gunbc/actions/runs filtered to actor.login == github-actions[bot] and reading each run's ATTEMPT 1 rather than its latest attempt -- a pull_request run WAS created for the healed head 4 times out of 4. WHAT GITHUB WITHHOLDS IS EXECUTION, NOT CREATION: 0 of those 4 started a single job on the triggering attempt. Runs 33711005806, 33703032560 and 33705120607 completed action_required with zero jobs; run 33686753487 completed failure with zero jobs. EXACTLY ONE of the four ever executed a job at all: run 33703032560 on attempt 2, after a human acted. The other re-attempt, 33705120607 attempt 2, was cancelled having also started zero jobs, so a second attempt is not itself a verdict either. So the loss this clause names is unchanged -- no EXECUTED verdict exists for the healed head, and heal exits nonzero rather than speaking for a tree it produced -- while the shape of it is not. The judge is CREATED AND HELD, not absent. READ THIS AT ATTEMPT GRAIN OR IT INVERTS, and both obvious proxies fail toward the reassuring answer: GitHub stamps run_started_at equal to created_at on a run that never ran, and a held run still concludes failure or cancelled rather than action_required, so neither a start timestamp nor a conclusion string is an execution receipt. Count JOBS, ON THE ATTEMPT THE CLAIM IS ABOUT -- 'count jobs' alone is not the discriminator, because the default endpoint silently answers for the LATEST attempt. AND THE RUN OBJECT ITSELF MANUFACTURES THE WRONG NUMBER, verified on run 33703032560: its top-level created_at is ATTEMPT 1's creation while its run_started_at is ATTEMPT 2's start, so the object hands back two fields from two different attempts and names neither, and only run_attempt reveals it. Subtracting them yields a start delay that never happened. Reading the latest attempt hides the class outright: on run 33703032560 attempt 1 is action_required with 0 jobs and attempt 2, created 1h47m later after a human acted, runs 6. THREE READERS MADE A VERSION OF THIS ERROR IN ONE NIGHT, EACH LEVEL INVISIBLE FROM THE ONE ABOVE: a run's conclusion read as an execution receipt, then a job count taken on the wrong attempt, then the cross-attempt subtraction above -- recorded because the reader who warned about the second level was standing in the third while writing the warning. There was never a released run here; a human re-ran it. A CONSEQUENCE FOR THIS ROW'S OWN LANGUAGE, and it is why the clause is scoped rather than merely corrected: a held run CAN be released later and judge the head. Of the four, run 33703032560 eventually executed 6 jobs on a head heal had pushed. So 'a head nothing judged' is true AT EXIT TIME and may stop being true afterwards without anyone touching anything. The exit is a statement by the run printing it about the moment it prints, never a standing property of the healed head, and a carrier that states it unscoped is wrong the moment somebody approves. THE HOLD DISCRIMINATES ON THE EVENT, NOT ON THE IDENTITY OR THE TOKEN, and this arm is measured TWO-SIDED with the identity held constant on both sides. Forward: of 500 workflow_dispatch runs sampled, ZERO concluded action_required -- including all 151 actored by github-actions[bot], the same identity and default-token surface whose pull_request runs are held. Reverse control: the entire status=action_required listing is 17 runs and ALL 17 are event=pull_request, zero workflow_dispatch. Re-derive by listing repos/gunb-ai/gunbc/actions/runs with event=workflow_dispatch grouped by actor.login and conclusion, against the status=action_required listing grouped by event. Measured by cool-koi-623 and reproduced independently at the wider sample by fierce-ram-670, which is why the sample sizes here are the larger pair. Two things follow that the refuted premise concealed: releasing the healed head is an approve on that specific gated run (POST /actions/runs//approve) and not a re-run of another run, and a dispatched revalidation is a SECOND run on that head rather than the only one, costing a whole additional run and landing check-runs beside the gated run's on one commit where a name-keyed reader cannot tell them apart. That second cost buys something measured rather than duplicating what would have happened anyway -- by the event discriminator above, a dispatched run is the only route to the healed head that executes without a human. WHAT IS NOT ESTABLISHED AND IS NOT WRITTEN AS IF IT WERE: whether a dispatched run's contexts clear branch protection. repos/gunb-ai/gunbc/branches/main/protection is 403 to this token, and the held run is what protection was waiting on, so closing the REVALIDATION gap is measured and clearing the MERGE gate is not. WHY THE HOLD EXISTS IS LIKEWISE UNDETERMINED BECAUSE UNREADABLE, which is the honest shape and not an unexplained gap: repos/gunb-ai/gunbc/actions/permissions is 403 to these session tokens, so whether a repository setting explains it cannot be read from here. THE RETIREMENT ITSELF STANDS, stated as the output of the question rather than left to be inferred, and this correction does not move the row's rung: the restored capability is automatic repair of drifted generated artifacts, which the receipt above observed, and revalidation was already declared NOT RESTORED here. Its trigger is a workflow_dispatch input on gunbc.witness_floor_workflow carrying the healed sha, which every dispatched run binds its own github.sha and checkout against before any witness counts; tools.ci_heal_dispatch is the modeled half and stays unconsumed until then. That gap is a separate obligation, not this row. `floor_cut` DOES NOT RETIRE ON THIS: its trigger is the conjunction of five siblings and this is one." as NonEmptyStr }, - declaration: AuthoredProse { legacy: FloorCutHeal, authored: "**RETIRED 2026-09-02 BY gunbc#10118; READ THE DECLARATION BELOW IN THE PAST TENSE.** The heal job runs again, as a job of `gunbc.witness_floor_workflow` rather than of the deleted `gunbc.ci_workflow`, and the dangling-citation observation this row recorded is also repaired: `ci_heal_credential` `ci_heal_job_ref` and `ci_heal_workflow_ref` now name the emission that carries the job, and their spent `PRE_EXISTING_CITATION_DEBT` rows are deleted. The opening sentence is kept rather than rewritten because the declaration is the record of what was true when it was made; `standing` carries what is true now. ONE CLAUSE OF THE ORIGINAL LOSS IS NOT RESTORED AND IS NOT SILENTLY DROPPED: revalidation of the head heal creates -- see `trigger_fired` for its own trigger. **HEAL IS GONE AND ITS AUTHORITY MODULE IS GONE WITH IT, AND THIS ROW DECLARED THAT RUNG (2026-09-01).** Split out of `floor_cut`, whose single trigger could not retire it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required job regenerated drifted generated artifacts and pushed the repair onto the branch head, so the class `a committed generated artifact diverges from its authority` was caught and CORRECTED without an author. TEMPORARY RUNG: 1 (mitigatable) -- drift is still CAUGHT, by the `generated-artifact` required phase, but nothing repairs it, so every divergence is now a human round trip. REASON: the 2026-08-15 floor cut deleted the job with the workflow authority that carried it. BOUNDED POPULATION: one capability -- automatic repair of drifted generated artifacts on a branch head. MEASURED FROM THE TREE RATHER THAN FROM THE PARAGRAPH UNDER SUSPICION (2026-09-01): `gunbc.ci_heal_credential` survives in full and still carries `ci_heal_job_ref` and `ci_heal_workflow_ref` as DeclarationRefs to `gunbc.ci_workflow` `ci_heal_generated_artifacts_job` and `gunbc.ci_workflow` `ci_workflow` -- and `gunbc.ci_workflow` DOES NOT EXIST in this tree; the only module of that stem is `gunbc.ci_workflow_expressions`, and the decl name resolves nowhere. So heal's credential model is live and its job and workflow are deleted, which also means a typed citation to a deleted module is sitting unrefused; that second fact is recorded here as an observation and is NOT this row's subject. RESTORATION TRIGGER, A CAPABILITY: a required-run consumer that, on a branch head whose committed generated artifacts diverge from their authorities, WRITES the regenerated bytes back and pushes them under a credential the repository already models -- observed doing so on a real divergence, not merely emitted. WHAT DOES NOT RETIRE THIS ROW: restoring `gunbc.ci_workflow` or re-pointing `ci_heal_credential`'s dangling citations, which repairs the MODEL and heals nothing; nor a job that only reports drift, which is the phase we already have. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." } + declaration: AuthoredProse { legacy: FloorCutHeal, authored: "**RETIRED 2026-09-02 BY gunbc#10118; READ THE DECLARATION BELOW IN THE PAST TENSE.** The heal job runs again, as a job of `gunbc.witness_floor_workflow` rather than of the deleted `gunbc.ci_workflow`, and the dangling-citation observation this row recorded is also repaired: `ci_heal_credential` `ci_heal_job_ref` and `ci_heal_workflow_ref` now name the emission that carries the job, and their spent `PRE_EXISTING_CITATION_DEBT` rows are deleted. The opening sentence is kept rather than rewritten because the declaration is the record of what was true when it was made; `standing` carries what is true now. ONE CLAUSE OF THE ORIGINAL LOSS IS NOT RESTORED AND IS NOT SILENTLY DROPPED: revalidation of the head heal creates -- see `trigger_fired` for its own trigger. **HEAL IS GONE AND ITS AUTHORITY MODULE IS GONE WITH IT, AND THIS ROW DECLARED THAT RUNG (2026-09-01).** Split out of `floor_cut`, whose single trigger could not retire it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required job regenerated drifted generated artifacts and pushed the repair onto the branch head, so the class `a committed generated artifact diverges from its authority` was caught and CORRECTED without an author. TEMPORARY RUNG: 1 (mitigatable) -- drift is still CAUGHT, by the `generated-artifact` required phase, but nothing repairs it, so every divergence is now a human round trip. REASON: the 2026-08-15 floor cut deleted the job with the workflow authority that carried it. BOUNDED POPULATION: one capability -- automatic repair of drifted generated artifacts on a branch head. MEASURED FROM THE TREE RATHER THAN FROM THE PARAGRAPH UNDER SUSPICION (2026-09-01): `gunbc.ci_heal_credential` survives in full and still carries `ci_heal_job_ref` and `ci_heal_workflow_ref` as DeclarationRefs to `gunbc.ci_workflow` `ci_heal_generated_artifacts_job` and `gunbc.ci_workflow` `ci_workflow` -- and `gunbc.ci_workflow` DOES NOT EXIST in this tree; the only module of that stem is `gunbc.ci_workflow_expressions`, and the decl name resolves nowhere. So heal's credential model is live and its job and workflow are deleted, which also means a typed citation to a deleted module is sitting unrefused; that second fact is recorded here as an observation and is NOT this row's subject. RESTORATION TRIGGER, A CAPABILITY: a required-run consumer that, on a branch head whose committed generated artifacts diverge from their authorities, WRITES the regenerated bytes back and pushes them under a credential the repository already models -- observed doing so on a real divergence, not merely emitted. WHAT DOES NOT RETIRE THIS ROW: restoring `gunbc.ci_workflow` or re-pointing `ci_heal_credential`'s dangling citations, which repairs the MODEL and heals nothing; nor a job that only reports drift, which is the phase we already have. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_merge_admission_stamping.dag b/dag/gunbc/rung_drop/floor_cut_merge_admission_stamping.dag index 31723c45f6c..da6fabe7630 100644 --- a/dag/gunbc/rung_drop/floor_cut_merge_admission_stamping.dag +++ b/dag/gunbc/rung_drop/floor_cut_merge_admission_stamping.dag @@ -12,5 +12,7 @@ data floor_cut_merge_admission_stamping: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutMergeAdmissionStamping, authored: "**THE MERGE-ADMISSION RECEIPT HAS A CONSUMER AND NO PRODUCER, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- the floor run STAMPED a receipt and `tools.merge_admission_gate` read it, so admission was a fact a machine produced and a machine checked. TEMPORARY RUNG: 0 -- with no producer the gate cannot answer, so what it once decided is now decided by nobody. A consumer whose input never arrives is not a weakened check; it is an absent one wearing a check's name, which is the `diagnostic_name_mechanism_silent` shape this repository already files. REASON: the 2026-08-15 floor cut deleted `tools.merge_admission_gate.dag` together with the floor plan that stamped its receipt. BOUNDED POPULATION: one capability -- a machine-produced admission receipt joined to the merge decision. MEASURED FROM THE TREE (2026-09-01): `gunbc.commit_workflow` records, in two separate removal dispositions, that this receipt is deleted and on the unguarded list -- and that from 2026-08-15 one of those dispositions justified a removed check by naming two authorities that no longer existed, with nothing able to say so because a citation inside a String resolves against nothing. That is the cost of this gap already realized once. RESTORATION TRIGGER, A CAPABILITY: a required run that PRODUCES an admission receipt bound to the head under judgment, and a consumer that refuses a merge whose head has no such receipt -- both executing, with a red on a head that lacks one. WHAT DOES NOT RETIRE THIS ROW: re-adding a `merge_admission_gate` module that reads a receipt nobody writes, which reproduces exactly today's state with more code; nor a human check-list step, which is not a producer. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." } + declaration: AuthoredProse { legacy: FloorCutMergeAdmissionStamping, authored: "**THE MERGE-ADMISSION RECEIPT HAS A CONSUMER AND NO PRODUCER, AND THIS ROW DECLARES THAT RUNG (2026-09-01).** Split out of `floor_cut`. PREVIOUS RUNG: 2 (mechanically preventable) -- the floor run STAMPED a receipt and `tools.merge_admission_gate` read it, so admission was a fact a machine produced and a machine checked. TEMPORARY RUNG: 0 -- with no producer the gate cannot answer, so what it once decided is now decided by nobody. A consumer whose input never arrives is not a weakened check; it is an absent one wearing a check's name, which is the `diagnostic_name_mechanism_silent` shape this repository already files. REASON: the 2026-08-15 floor cut deleted `tools.merge_admission_gate.dag` together with the floor plan that stamped its receipt. BOUNDED POPULATION: one capability -- a machine-produced admission receipt joined to the merge decision. MEASURED FROM THE TREE (2026-09-01): `gunbc.commit_workflow` records, in two separate removal dispositions, that this receipt is deleted and on the unguarded list -- and that from 2026-08-15 one of those dispositions justified a removed check by naming two authorities that no longer existed, with nothing able to say so because a citation inside a String resolves against nothing. That is the cost of this gap already realized once. RESTORATION TRIGGER, A CAPABILITY: a required run that PRODUCES an admission receipt bound to the head under judgment, and a consumer that refuses a merge whose head has no such receipt -- both executing, with a red on a head that lacks one. WHAT DOES NOT RETIRE THIS ROW: re-adding a `merge_admission_gate` module that reads a receipt nobody writes, which reproduces exactly today's state with more code; nor a human check-list step, which is not a producer. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS**, and this sentence is on every one of the five so the constraint is readable from either end: that row's trigger is the conjunction of these five, so retiring it on a reading of any single sibling -- including this one -- is the reading its own trigger forbids." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_receipt_discriminating_arms.dag b/dag/gunbc/rung_drop/floor_cut_receipt_discriminating_arms.dag index 36001514ccd..dbac0e365f1 100644 --- a/dag/gunbc/rung_drop/floor_cut_receipt_discriminating_arms.dag +++ b/dag/gunbc/rung_drop/floor_cut_receipt_discriminating_arms.dag @@ -12,5 +12,7 @@ data floor_cut_receipt_discriminating_arms: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutReceiptDiscriminatingArms, authored: "**THE RECEIPT MACHINERY'S OWN DISCRIMINATING ARMS HAVE NO EXECUTING CONSUMER, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, third of the three losses its own prose names and its five siblings omit. PREVIOUS RUNG: 2 (mechanically preventable). TEMPORARY RUNG: 1 (mitigatable) -- the selftest and census targets exist (`behavioral-receipt-selftest`, `behavioral-receipt-census`) and `floor_cut` records that no workflow invokes them. WHY THIS IS ITS OWN SUBJECT AND NOT A DETAIL OF THE TWO ABOVE, which is the whole reason it must not be folded into them: a differential's value is entirely in whether it still GOES RED on a real divergence, and that property is established by its discriminating arms and by nothing else. Restoring an equivalence comparison whose own falsification controls never execute yields an instrument that reports EQUIVALENT and cannot be shown to be capable of reporting anything else -- DESIGN section 4b(4) keeps the discriminating RED enrolled precisely so a climb does not dissolve the evidence that the higher rung is real. BOUNDED POPULATION: one capability -- executing evidence that the receipt machinery can still distinguish an equivalent emission from a divergent one. RESTORATION TRIGGER, A CAPABILITY: the receipt machinery's falsification controls executing on the required path, SUFFICIENT FOR a deliberately divergent fixture producing a RED from that machinery in a required lane. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" } + declaration: AuthoredProse { legacy: FloorCutReceiptDiscriminatingArms, authored: "**THE RECEIPT MACHINERY'S OWN DISCRIMINATING ARMS HAVE NO EXECUTING CONSUMER, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, third of the three losses its own prose names and its five siblings omit. PREVIOUS RUNG: 2 (mechanically preventable). TEMPORARY RUNG: 1 (mitigatable) -- the selftest and census targets exist (`behavioral-receipt-selftest`, `behavioral-receipt-census`) and `floor_cut` records that no workflow invokes them. WHY THIS IS ITS OWN SUBJECT AND NOT A DETAIL OF THE TWO ABOVE, which is the whole reason it must not be folded into them: a differential's value is entirely in whether it still GOES RED on a real divergence, and that property is established by its discriminating arms and by nothing else. Restoring an equivalence comparison whose own falsification controls never execute yields an instrument that reports EQUIVALENT and cannot be shown to be capable of reporting anything else -- DESIGN section 4b(4) keeps the discriminating RED enrolled precisely so a climb does not dissolve the evidence that the higher rung is real. BOUNDED POPULATION: one capability -- executing evidence that the receipt machinery can still distinguish an equivalent emission from a divergent one. RESTORATION TRIGGER, A CAPABILITY: the receipt machinery's falsification controls executing on the required path, SUFFICIENT FOR a deliberately divergent fixture producing a RED from that machinery in a required lane. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/floor_cut_regen_second_generation_agreement.dag b/dag/gunbc/rung_drop/floor_cut_regen_second_generation_agreement.dag index b10bd03b515..47b024baa90 100644 --- a/dag/gunbc/rung_drop/floor_cut_regen_second_generation_agreement.dag +++ b/dag/gunbc/rung_drop/floor_cut_regen_second_generation_agreement.dag @@ -12,5 +12,7 @@ data floor_cut_regen_second_generation_agreement: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: FloorCutRegenSecondGenerationAgreement, authored: "**NO REQUIRED LANE COMPARES A SECOND GENERATION AGAINST THE FIRST, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, which named this loss in prose on 2026-08-15 and then enumerated five siblings that do not include it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required run compared a second emit against the first and refused a difference. TEMPORARY RUNG: 1 (mitigatable): the capability survives as `v1_compiler` `--required-regen-fixed-point`, which has an entry point and no required consumer, so a non-deterministic emitter is caught only when a human runs it. REASON: the 2026-08-15 floor cut ended the enrolment of three capabilities at once -- second-generation agreement and the two behavioral-receipt instrument targets -- and `floor_cut` records that no workflow invokes them. The three are counted together and are not one kind: second-generation agreement is NOT itself a behavioral-receipt target, and an earlier revision of this row said it was. WHY IT IS NOT COVERED BY THE REGEN PHASE THAT DOES RUN: `RequiredCiPhase::Regen` adjudicates the committed mirrors against what the authority emits ONCE -- byte agreement between two artifacts -- which is a different question from whether a SECOND generation from the same authority transaction agrees with the referenced first. The receipt model already separates those two as different variants, and this row is scoped to the second. **WHAT THIS PHASE DOES NOT DETECT, CORRECTED 2026-09-03 AND KEPT RATHER THAN QUIETLY DELETED (bright-ram-778 on gunbc#10154).** An earlier revision of this row claimed that an emitter wrong the same way twice satisfies the phase that runs and fails the one that does not. THAT IS FALSE, and it is false in the direction that inflates the missing capability: if both generations produce the same wrong bytes W, the one-shot committed comparison may pass when the committed bytes are W, and the second-generation comparison passes too, because W equals W. A repeatability comparison cannot see deterministic semantic wrongness; the only thing it sees is a GENERATION DISAGREEMENT. Naming the property correctly narrows what this row is owed, which is the point of stating it: the missing capability is agreement between generations, not correctness of either one. BOUNDED POPULATION, WIDENED 2026-09-04 AND ENUMERATED RATHER THAN OBSERVED: one capability -- refusal of a non-deterministic emit on the merge path -- over EVERY REQUIRED PHASE THAT REGENERATES A COMMITTED POPULATION, which is TWO of the five the roster declares. The enumeration is the point and is recorded so a later reader can re-run it rather than trust it: gunbc.required_ci_phase_roster declares parse, namespace-wave-admission, regen, generated-artifact and floor; the discriminator is whether the phase holds a committed artifact population it regenerates, not whether it writes files. REGEN qualifies (src/v1/stage0/src/required_regen_host.rs reaches emitted_population, whose list carries 157 mirror paths). GENERATED-ARTIFACT qualifies (its population is gunbc.generated_artifact committed_generated_artifacts, 38 paths, of which 4 are seed mirrors under src/v1/stage0/src). PARSE and NAMESPACE-WAVE-ADMISSION hold no such population and emit nothing (namespace_wave_admission.rs performs zero file writes). FLOOR DOES WRITE FILES AND IS STILL OUT: they are run receipts, not a regeneration of a committed baseline, and the phase holds no committed artifact population at all -- which is exactly why 'writes files' is the wrong discriminator and 'regenerates a committed population' is the right one. HOW MANY FILES FLOOR WRITES IS DELIBERATELY NOT STATED HERE. Three independent readings disagreed on it within one review -- uploaded artifact names in the emitted workflow, fs::write sites in cli_run/required_floor_runner.rs, and a real run's artifact set -- because they measure three different populations, and the number is not what excludes floor. Transcribing any of them would put a stale count in the one sentence whose whole purpose is that the count does not decide. The instrument is the runner and the emitted workflow; re-derive it there if a count is ever needed. THE EARLIER POPULATION NAMED NEITHER PHASE, and that is the defect this widening repairs rather than a restatement: a lane restoring second-generation agreement for REGEN ALONE would have discharged the trigger while the generated-artifact phase's 38 stayed unguarded -- a trigger naming less than the capability it restores, satisfied while the capability stays dead for part of its subject, which is the failure DESIGN 4b(3) names in terms. RESTORATION TRIGGER, A CAPABILITY AND DELIBERATELY NOT A LIST OF PHASES: a required lane producing a second generation from the same authority transaction and REFUSING a byte difference against the referenced first generation, FOR EVERY PHASE THAT REGENERATES A COMMITTED POPULATION -- stated as the property so that adding a sixth such phase and skipping it does not satisfy this row, which enumerating today's two would have allowed. SUFFICIENT FOR a merge whose emitter disagrees with itself across two generations being refused, demonstrated by a red on a fixture that produces generation_1 != generation_2 UNDER THE EXACT EXECUTION MODEL THE RESTORED PHASE USES -- a fixture that is unstable only under some other harness establishes nothing about this phase. THE BOUND ON WHAT THAT RED ESTABLISHES, stated so the row is not later cited past it: one two-generation experiment shows the phase catches the generation-instability class it deliberately exercises. It does NOT show that every nondeterministic emitter is rejected, and this row must not be read as claiming it. Restoring the flag's invocation without that red does not discharge it: the flag already exists and its existence is what this row records as insufficient. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" } + declaration: AuthoredProse { legacy: FloorCutRegenSecondGenerationAgreement, authored: "**NO REQUIRED LANE COMPARES A SECOND GENERATION AGAINST THE FIRST, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, which named this loss in prose on 2026-08-15 and then enumerated five siblings that do not include it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required run compared a second emit against the first and refused a difference. TEMPORARY RUNG: 1 (mitigatable): the capability survives as `v1_compiler` `--required-regen-fixed-point`, which has an entry point and no required consumer, so a non-deterministic emitter is caught only when a human runs it. REASON: the 2026-08-15 floor cut ended the enrolment of three capabilities at once -- second-generation agreement and the two behavioral-receipt instrument targets -- and `floor_cut` records that no workflow invokes them. The three are counted together and are not one kind: second-generation agreement is NOT itself a behavioral-receipt target, and an earlier revision of this row said it was. WHY IT IS NOT COVERED BY THE REGEN PHASE THAT DOES RUN: `RequiredCiPhase::Regen` adjudicates the committed mirrors against what the authority emits ONCE -- byte agreement between two artifacts -- which is a different question from whether a SECOND generation from the same authority transaction agrees with the referenced first. The receipt model already separates those two as different variants, and this row is scoped to the second. **WHAT THIS PHASE DOES NOT DETECT, CORRECTED 2026-09-03 AND KEPT RATHER THAN QUIETLY DELETED (bright-ram-778 on gunbc#10154).** An earlier revision of this row claimed that an emitter wrong the same way twice satisfies the phase that runs and fails the one that does not. THAT IS FALSE, and it is false in the direction that inflates the missing capability: if both generations produce the same wrong bytes W, the one-shot committed comparison may pass when the committed bytes are W, and the second-generation comparison passes too, because W equals W. A repeatability comparison cannot see deterministic semantic wrongness; the only thing it sees is a GENERATION DISAGREEMENT. Naming the property correctly narrows what this row is owed, which is the point of stating it: the missing capability is agreement between generations, not correctness of either one. BOUNDED POPULATION, WIDENED 2026-09-04 AND ENUMERATED RATHER THAN OBSERVED: one capability -- refusal of a non-deterministic emit on the merge path -- over EVERY REQUIRED PHASE THAT REGENERATES A COMMITTED POPULATION, which is TWO of the five the roster declares. The enumeration is the point and is recorded so a later reader can re-run it rather than trust it: gunbc.required_ci_phase_roster declares parse, namespace-wave-admission, regen, generated-artifact and floor; the discriminator is whether the phase holds a committed artifact population it regenerates, not whether it writes files. REGEN qualifies (src/v1/stage0/src/required_regen_host.rs reaches emitted_population, whose list carries 157 mirror paths). GENERATED-ARTIFACT qualifies (its population is gunbc.generated_artifact committed_generated_artifacts, 38 paths, of which 4 are seed mirrors under src/v1/stage0/src). PARSE and NAMESPACE-WAVE-ADMISSION hold no such population and emit nothing (namespace_wave_admission.rs performs zero file writes). FLOOR DOES WRITE FILES AND IS STILL OUT: they are run receipts, not a regeneration of a committed baseline, and the phase holds no committed artifact population at all -- which is exactly why 'writes files' is the wrong discriminator and 'regenerates a committed population' is the right one. HOW MANY FILES FLOOR WRITES IS DELIBERATELY NOT STATED HERE. Three independent readings disagreed on it within one review -- uploaded artifact names in the emitted workflow, fs::write sites in cli_run/required_floor_runner.rs, and a real run's artifact set -- because they measure three different populations, and the number is not what excludes floor. Transcribing any of them would put a stale count in the one sentence whose whole purpose is that the count does not decide. The instrument is the runner and the emitted workflow; re-derive it there if a count is ever needed. THE EARLIER POPULATION NAMED NEITHER PHASE, and that is the defect this widening repairs rather than a restatement: a lane restoring second-generation agreement for REGEN ALONE would have discharged the trigger while the generated-artifact phase's 38 stayed unguarded -- a trigger naming less than the capability it restores, satisfied while the capability stays dead for part of its subject, which is the failure DESIGN 4b(3) names in terms. RESTORATION TRIGGER, A CAPABILITY AND DELIBERATELY NOT A LIST OF PHASES: a required lane producing a second generation from the same authority transaction and REFUSING a byte difference against the referenced first generation, FOR EVERY PHASE THAT REGENERATES A COMMITTED POPULATION -- stated as the property so that adding a sixth such phase and skipping it does not satisfy this row, which enumerating today's two would have allowed. SUFFICIENT FOR a merge whose emitter disagrees with itself across two generations being refused, demonstrated by a red on a fixture that produces generation_1 != generation_2 UNDER THE EXACT EXECUTION MODEL THE RESTORED PHASE USES -- a fixture that is unstable only under some other harness establishes nothing about this phase. THE BOUND ON WHAT THAT RED ESTABLISHES, stated so the row is not later cited past it: one two-generation experiment shows the phase catches the generation-instability class it deliberately exercises. It does NOT show that every nondeterministic emitter is rejected, and this row must not be read as claiming it. Restoring the flag's invocation without that red does not discharge it: the flag already exists and its existence is what this row records as insufficient. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.**" }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/g0_type_decl_modifier_parse_without_sealing_property.dag b/dag/gunbc/rung_drop/g0_type_decl_modifier_parse_without_sealing_property.dag index 30c31895c06..df0267887c2 100644 --- a/dag/gunbc/rung_drop/g0_type_decl_modifier_parse_without_sealing_property.dag +++ b/dag/gunbc/rung_drop/g0_type_decl_modifier_parse_without_sealing_property.dag @@ -31,5 +31,7 @@ data g0_type_decl_modifier_parse_without_sealing_property: RungDrop = RungDrop { }, population: g0_type_decl_modifier_parse_without_sealing_property_population, restoration_trigger: "v2 parse mints the sole_constructor property from the captured modifier terminal on a type decl, sufficient for the construction wall v1 parsed_sole_constructor_properties enforces. Consuming the token without minting that property does not retire this row. Token consumption of nominal_opaque matches v1 and is not this drop." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/harness_seat_ceiling_by_operator_policy.dag b/dag/gunbc/rung_drop/harness_seat_ceiling_by_operator_policy.dag index a71dcd2b041..7d0cfe4b561 100644 --- a/dag/gunbc/rung_drop/harness_seat_ceiling_by_operator_policy.dag +++ b/dag/gunbc/rung_drop/harness_seat_ceiling_by_operator_policy.dag @@ -78,5 +78,7 @@ data harness_seat_ceiling_by_operator_policy: RungDrop = RungDrop { "gunbc.serving.serving_enrollment serving_group_b_route_turn_ceiling (group B's arm of the same question, a session-attributed allocation of 4 standing where a derivation belongs. It replaced serving_canary_route_ceiling on 2026-09-18, which delegated to the retired exl3 canary's operator bound; it is deliberately NOT the converged arm's --max-num-seqs, which is what the engine schedules rather than what this repository offers)", ], restoration_trigger: "a seat lease is granted only against a resolved KV layout read back from the engine incarnation that will serve the request: the layout receipt names allocator inventory, per-group block sizes, windows and the engine's own startup projections, it is bound to a live incarnation identity so a restart invalidates every prior grant, and the amount leased is the block cost of the admitted sequence envelope computed from the whole group layout rather than any single field. A layout observation that is not incarnation-bound does not discharge this row, because an unbound receipt lets a grant taken against one launch authorize a request against another", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/heal_healed_head_executed_verdict_without_human.dag b/dag/gunbc/rung_drop/heal_healed_head_executed_verdict_without_human.dag index fb83e33508f..e563a6824f9 100644 --- a/dag/gunbc/rung_drop/heal_healed_head_executed_verdict_without_human.dag +++ b/dag/gunbc/rung_drop/heal_healed_head_executed_verdict_without_human.dag @@ -27,5 +27,7 @@ data heal_healed_head_executed_verdict_without_human: RungDrop = RungDrop { "the auto-dispatch splice that stood in gunbc.ci_spec until gunbc#11172 deleted it; the commit-and-push step that carried it is itself deleted by the gunbc#10958 cutover, so neither the splice nor its host resolves any more", ], restoration_trigger: "the gated pull_request run for a bot-pushed healed head starts and completes its required jobs with no human POST /actions/runs//approve and no workflow_dispatch on that SHA, so the name-keyed PR rollup sees those conclusions. SUFFICIENT FOR: HealProduced then statusCheckRollup showing real conclusions on that SHA with zero human approvals of that run and zero workflow_dispatch runs on that SHA. Approving the gated run is the standing remedy and does not restore an executed verdict without a human. Restoring tools.ci_heal_dispatch auto-invoke does not retire this row. THE CAPABILITY THAT WOULD SATISFY THIS TRIGGER HAS LANDED BUT NOT YET EXECUTED (gunbc#10958): heal no longer pushes at all, and gunbc.heal_publisher_workflow publishes the repair from the default branch under an App installation token, whose pushes GitHub does not gate. That changes what the receipt must show WITHOUT changing this trigger: a heal-published head, its statusCheckRollup carrying real conclusions, zero approvals of that run and zero workflow_dispatch runs on that sha. Until one such head exists, this row stays standing -- a mechanism that would produce the receipt is not the receipt", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/lens_enforcement_censuses.dag b/dag/gunbc/rung_drop/lens_enforcement_censuses.dag index a9ea4ef0f61..8578ed50598 100644 --- a/dag/gunbc/rung_drop/lens_enforcement_censuses.dag +++ b/dag/gunbc/rung_drop/lens_enforcement_censuses.dag @@ -12,5 +12,7 @@ data lens_enforcement_censuses: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: LensEnforcementCensuses, authored: "**The corpus-wide backstops that used to police this are DELETED (2026-08-11), and the reason is the rule that replaces them:** the inert-lens reach census and the construction-justification census both ran inside floor witness discovery, so *every* discovery run — on every PR, on regen, in every coordinated worker — had to acquire a whole-corpus module graph in order to answer a question about who authored a lens. That is the §6 cost-shape defect at its purest: the unit of computation was the world, the unit of fact was one module's authorship, and the price was paid by every consumer that wanted a witness roster and nothing else. **Who paid it, split by era, because this document must not assert a superseded population as the present one:** before #8140 the walk was unconditional, so ordinary CI, regen, the falsifier cadence and every coordinated worker all paid; #8140 made it demand-directed, so a discovery-free plan such as regen stopped paying; from #8140 to this deletion the two censuses burdened every remaining discovery-bearing execution. The correction is recorded rather than reworded because a change deleting stale supply-side enforcement must not land a fresh stale assertion in the same diff (review on #8141). Neither census had a consumer that justified the acquisition; the inert-lens half additionally reported through two host builtins whose `.dag` surface was a pair of self-recursive stubs (`fn f() { f() }`) reachable only because the interpreter intercepted them. **What is NOT claimed:** this is a real scope narrowing, not a climb. A newly authored lens with no witness, and a lens recording no `construction_justification`, are both writable again and nothing detects either. The obligation survives as review diligence, which is strictly weaker. **THAT NEXT-RUNG TRIGGER HAS NOW FIRED FOR THE CONSTRUCTION-JUSTIFICATION HALF (2026-08-25), AND ONLY FOR THAT HALF.** The trigger read: an authorship fact belongs on the module's own declaration, checked at ingestion where the module is parsed anyway — one module's facts from one module's source — rather than reconstructed corpus-wide by a consumer that wanted something else. `v1_compiler.declaration_index` is that construction. The `.dag` parse sweep inside `claim_executor --required-ci` already parses every authored module once, on every required run, and discarded the tree; it now derives one record per module from that same parse, and the presence of `construction_justification` on a top-level lens is read off the lens's own declaration list. The class moves from *mitigatable* to *mechanically preventable*: measured at the landing, 71 top-level lens modules, all 71 carrying it, and the RED is authorable — and authored — at the FIXTURE boundary rather than only over the corpus, which is what §4b requires of a check that is green everywhere it can currently run. **THE INERT-LENS HALF DID NOT CLIMB AND IS NOT CLAIMED TO HAVE**, for a reason this clause already stated when it named the trigger: whether a lens has a discovered witness is not a single-module fact, so no ingestion-time reader can answer it from one module's source. That half stays at *mitigatable*, on review diligence, and its own next rung is a different construction. **AND THE HAND-RUST HALF OF THE TRIGGER STAYS OPEN**: the index is host Rust reading the filesystem, not a modeled ingestion operation, so what discharged here is the CORPUS-WALK half — the obligation is declared, enumerated at declaration grain, and carries its dissolution trigger in `gunbc.declaration_index_seed_growth`." } + declaration: AuthoredProse { legacy: LensEnforcementCensuses, authored: "**The corpus-wide backstops that used to police this are DELETED (2026-08-11), and the reason is the rule that replaces them:** the inert-lens reach census and the construction-justification census both ran inside floor witness discovery, so *every* discovery run — on every PR, on regen, in every coordinated worker — had to acquire a whole-corpus module graph in order to answer a question about who authored a lens. That is the §6 cost-shape defect at its purest: the unit of computation was the world, the unit of fact was one module's authorship, and the price was paid by every consumer that wanted a witness roster and nothing else. **Who paid it, split by era, because this document must not assert a superseded population as the present one:** before #8140 the walk was unconditional, so ordinary CI, regen, the falsifier cadence and every coordinated worker all paid; #8140 made it demand-directed, so a discovery-free plan such as regen stopped paying; from #8140 to this deletion the two censuses burdened every remaining discovery-bearing execution. The correction is recorded rather than reworded because a change deleting stale supply-side enforcement must not land a fresh stale assertion in the same diff (review on #8141). Neither census had a consumer that justified the acquisition; the inert-lens half additionally reported through two host builtins whose `.dag` surface was a pair of self-recursive stubs (`fn f() { f() }`) reachable only because the interpreter intercepted them. **What is NOT claimed:** this is a real scope narrowing, not a climb. A newly authored lens with no witness, and a lens recording no `construction_justification`, are both writable again and nothing detects either. The obligation survives as review diligence, which is strictly weaker. **THAT NEXT-RUNG TRIGGER HAS NOW FIRED FOR THE CONSTRUCTION-JUSTIFICATION HALF (2026-08-25), AND ONLY FOR THAT HALF.** The trigger read: an authorship fact belongs on the module's own declaration, checked at ingestion where the module is parsed anyway — one module's facts from one module's source — rather than reconstructed corpus-wide by a consumer that wanted something else. `v1_compiler.declaration_index` is that construction. The `.dag` parse sweep inside `claim_executor --required-ci` already parses every authored module once, on every required run, and discarded the tree; it now derives one record per module from that same parse, and the presence of `construction_justification` on a top-level lens is read off the lens's own declaration list. The class moves from *mitigatable* to *mechanically preventable*: measured at the landing, 71 top-level lens modules, all 71 carrying it, and the RED is authorable — and authored — at the FIXTURE boundary rather than only over the corpus, which is what §4b requires of a check that is green everywhere it can currently run. **THE INERT-LENS HALF DID NOT CLIMB AND IS NOT CLAIMED TO HAVE**, for a reason this clause already stated when it named the trigger: whether a lens has a discovered witness is not a single-module fact, so no ingestion-time reader can answer it from one module's source. That half stays at *mitigatable*, on review diligence, and its own next rung is a different construction. **AND THE HAND-RUST HALF OF THE TRIGGER STAYS OPEN**: the index is host Rust reading the filesystem, not a modeled ingestion operation, so what discharged here is the CORPUS-WALK half — the obligation is declared, enumerated at declaration grain, and carries its dissolution trigger in `gunbc.declaration_index_seed_growth`." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/live_deploy_apply_render_new_witness_eval_step_cost.dag b/dag/gunbc/rung_drop/live_deploy_apply_render_new_witness_eval_step_cost.dag index cf7cffe88a4..39bdaf9b6fb 100644 --- a/dag/gunbc/rung_drop/live_deploy_apply_render_new_witness_eval_step_cost.dag +++ b/dag/gunbc/rung_drop/live_deploy_apply_render_new_witness_eval_step_cost.dag @@ -45,5 +45,7 @@ data live_deploy_apply_render_new_witness_eval_step_cost: RungDrop = RungDrop { }, population: live_deploy_apply_render_new_witness_eval_step_cost_population, restoration_trigger: "THE CAPABILITY, BOTH CLAUSES, NOT EITHER: (i) emission witnesses reach a terminal verdict over the production apply script because that script is a shared fill-netted artifact (the capability v2.workflow.floor_cost_debt already names on this subject: either the script becomes a shared fill-netted artifact or an emission lane declares and enforces its own sufficient ceiling). Seeding a dag/test/claim module into every floor subject is a floor POLICY change and is one way to make the fill resolve; restoring the gunbc#11204 warm rows without that reach is not the capability. WHAT THE FILL MUST BE SUFFICIENT FOR: a required-floor claim over apply_script_stays_within_ci_runner_grants or repository_convergence_is_ordered_after_binary_and_before_readback does not re-pay live_deploy_apply_script_for per claim frame. (ii) AND each of the two identities measured under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives on the acceptance path, still executing, still recording eval_steps, still blocking on a semantic red. Measuring the two under budget without the shared-fill capability does not retire the row; landing a fill that does not cover these two identities does not retire it either. Merely deleting either identity, emptying floor_cost_debt, or replacing production emission with a smaller fixture satisfies neither clause.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/long_home_enrolment_margin_observed_only.dag b/dag/gunbc/rung_drop/long_home_enrolment_margin_observed_only.dag index d126ceb106b..d390f954b28 100644 --- a/dag/gunbc/rung_drop/long_home_enrolment_margin_observed_only.dag +++ b/dag/gunbc/rung_drop/long_home_enrolment_margin_observed_only.dag @@ -62,5 +62,7 @@ data long_home_enrolment_margin_observed_only: RungDrop = RungDrop { "src/v1/stage0/src/cli_run/required_floor_runner.rs enrolment_margin_standing_for (the seed realization of the same arm, keyed on enrolment_expensiveness_declaration long_home_holds)", ], restoration_trigger: "the per-frame front end is paid once per run rather than once per claim, so a newly enrolled long-home identity's measured CPU is its own work: a shared producer whose value SURVIVES CONSUMPTION in the claim frame that reads it. Both halves are required, and they are the same capability `long_module_changed_witness_cpu_observed_only` waits on, named here because a trigger that named only that sibling ROW would fire while this gate stayed stood down. WHAT THIS TRIGGER IS SUFFICIENT FOR: after it, a newly enrolled long-home identity observed over floor_enrolment_margin_budget_ms with a reached verdict is EnrolmentOverMargin again and blocks this gate. A run in which such an identity merely passes under EnrolmentExpensivenessDeclared does not discharge it, because that is the state this row declares", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/long_module_changed_witness_cpu_observed_only.dag b/dag/gunbc/rung_drop/long_module_changed_witness_cpu_observed_only.dag index 9fac48b1f56..e2893adb9cb 100644 --- a/dag/gunbc/rung_drop/long_module_changed_witness_cpu_observed_only.dag +++ b/dag/gunbc/rung_drop/long_module_changed_witness_cpu_observed_only.dag @@ -73,5 +73,7 @@ data long_module_changed_witness_cpu_observed_only: RungDrop = RungDrop { "src/v1/stage0/src/cli_run/required_floor_runner.rs (the seed realization of the same arm, keyed on the long_home prefix match the runner already computes)", ], restoration_trigger: "the per-frame front end is paid once per run rather than once per claim, so a claim's measured CPU is its own work: a shared producer whose value SURVIVES CONSUMPTION in the claim frame that reads it. Both halves are required: netting a producer whose value the consuming claim cannot use would move the cost without removing it, so survival of consumption must be DEMONSTRATED at retirement rather than assumed. The netting half is already demonstrated, and the producer of that fact is the floor's own pure-producer-share-warm phase receipt on the run that enrolled them: three normalized-tree producers reported disposition=Stored at strict preparation, with their fill billed to preparation rather than to any claim. The consumption half is NOT known to fail, and this row previously said it did: it cited every claim reading a served normalized tree erroring with no field 'kind' on type 'NormalizedTree'. That error was a type error in the probe fixture on the measuring branch, which passed a NormalizedTree where ProbeNormalized.root is declared Node; gunbc#11025 repaired it on main and the measuring head did not carry that repair, so both readings of it were of the same authored defect and neither was evidence about the serve boundary. The withdrawal is recorded here rather than dropped silently because the claim is what scoped this row. What remains, and what keeps the row standing, is the measured COST, which none of that touches: the front end is a FIXED per-claim charge with no size term -- it is paid once per claim whatever the claim is -- and the floor's own per-claim cost receipt reports all three claims refused at the line before reaching a verdict. A fixed charge with no size term is precisely a cost the witness does not cause, so until netting is on, the 500ms line is measuring the front end and not the population it is meant to bound. Retirement is observed and not asserted: when the front end is closure-scoped and the three v2.test.long.accumulator_copy_compile_gate witnesses complete under the armed line, this arm and this row retire together. A run in which they merely pass under the OBSERVED-ONLY policy does not discharge it, because that is the state this row declares", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/main_per_commit_floor_verdict.dag b/dag/gunbc/rung_drop/main_per_commit_floor_verdict.dag index d6884d631c8..fd958637367 100644 --- a/dag/gunbc/rung_drop/main_per_commit_floor_verdict.dag +++ b/dag/gunbc/rung_drop/main_per_commit_floor_verdict.dag @@ -42,5 +42,7 @@ data main_per_commit_floor_verdict: RungDrop = RungDrop { "push events on refs/heads/main" ], restoration_trigger: "every superseded pending refs/heads/main SHA receives a terminal adjudication, bound to that SHA, of every required acceptance obligation -- executed and passed, or coverage by a superseding execution proved. SUFFICIENT FOR: per-commit attribution and bisection grain on main, so a SHA GitHub removed while pending is not silent. Fleet cancellation safety (running_supersession_for_fleet_standing restoring pull_request-only running cancel) lives on the running-cancellation axis and does not retire this evidence-grain drop. Re-adding unique run_id to the group string is an artifact and does not discharge the row" - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/measurement_bankruptcy.dag b/dag/gunbc/rung_drop/measurement_bankruptcy.dag index e1fc5170685..683767c2bf0 100644 --- a/dag/gunbc/rung_drop/measurement_bankruptcy.dag +++ b/dag/gunbc/rung_drop/measurement_bankruptcy.dag @@ -12,5 +12,7 @@ data measurement_bankruptcy: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: MeasurementBankruptcy, authored: "**THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left. **THE TRIGGER HAS FIRED, AND THE ROW STAYS AS HISTORICAL EVIDENCE OF THE LOST PER-ENTRY ROUTE.** The restored route is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/emission_entry_instrument.dag --function measure --arg entry= --arg report=`. It emits one entry's closure, assembles it with `cssl_assemble`, compiles the assembled crate under cargo's JSON message format, and returns typed emit-stage and coded rustc diagnostic populations. `EmissionMeasurement` has no spelling in which an unreached stage renders as an empty reached stage, and its decode refuses inconsistent populations. **THE WHOLE-CORPUS PERSISTENCE THAT NOW CITES THIS HISTORY IS SEPARATE:** `gunbc.self_host_compile_phase_frontier` derives the compile-phase board from that instrument's `00_compile` closure observation, persists the linked identity-grain receipt series, and executes the phase/identity ratchet over its latest validated pair. Board standings quoted by the program status and design-ledger projection cite that frontier rather than this historical row. This does not turn the historical per-entry drop into the live board, and every figure copied into prose without naming its producer remains debt." } + declaration: AuthoredProse { legacy: MeasurementBankruptcy, authored: "**THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left. **THE TRIGGER HAS FIRED, AND THE ROW STAYS AS HISTORICAL EVIDENCE OF THE LOST PER-ENTRY ROUTE.** The restored route is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/emission_entry_instrument.dag --function measure --arg entry= --arg report=`. It emits one entry's closure, assembles it with `cssl_assemble`, compiles the assembled crate under cargo's JSON message format, and returns typed emit-stage and coded rustc diagnostic populations. `EmissionMeasurement` has no spelling in which an unreached stage renders as an empty reached stage, and its decode refuses inconsistent populations. **THE WHOLE-CORPUS PERSISTENCE THAT NOW CITES THIS HISTORY IS SEPARATE:** `gunbc.self_host_compile_phase_frontier` derives the compile-phase board from that instrument's `00_compile` closure observation, persists the linked identity-grain receipt series, and executes the phase/identity ratchet over its latest validated pair. Board standings quoted by the program status and design-ledger projection cite that frontier rather than this historical row. This does not turn the historical per-entry drop into the live board, and every figure copied into prose without naming its producer remains debt." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/namespace_admission_consumed_row_deletion.dag b/dag/gunbc/rung_drop/namespace_admission_consumed_row_deletion.dag index 98572550158..935865a2c73 100644 --- a/dag/gunbc/rung_drop/namespace_admission_consumed_row_deletion.dag +++ b/dag/gunbc/rung_drop/namespace_admission_consumed_row_deletion.dag @@ -12,5 +12,7 @@ data namespace_admission_consumed_row_deletion: RungDrop = RungDrop { standing: Retired { trigger_fired: "2026-09-02" as NonEmptyStr }, - declaration: AuthoredProse { legacy: NamespaceAdmissionConsumedRowDeletion, authored: "Namespace wave admission -- **RUNG DROP, DECLARED (2026-09-02).** gunbc#9824 split ConsumedByMerge from UnmatchedAdmission so that a row whose admitted relocation the base already satisfies stops refusing unrelated pull requests, and it carried its own deletion obligation in one arm: consumed rows are due, and refuse, on the first change whose diff touches the roster source file itself. PREVIOUS RUNG: 2, mechanically preventable. Before that split a row past its life reported stale and refused every run, so the obligation was enforced by a mechanism that executed -- at the cost of billing the enforcement to bystanders, which is the externalized degradation #9824 was authorized to remove. TEMPORARY RUNG: 1, mitigatable. A consumed row is now a typed receipt printed by every run and nothing else, and its removal depends on a human reading that receipt. THIS ROW CORRECTS #9824 RATHER THAN RESTATING IT, AND THE CORRECTION IS THE REASON THE DROP IS DECLARED AT ALL. That pull request states its window as wall-clock unbounded, roster-use bounded, bystander-invisible. The first and third conjuncts hold. The second is FALSE IN EXECUTION: v1_compiler.cli_run.namespace_wave_admission.run_required_wave_admission derives roster_touched from the head side produced by diff_sides, whose final act retains only paths satisfying in_sweep_scope, and that predicate opens by requiring a .dag suffix -- while ADMISSION_ROSTER_REL_PATH names a .rs file. A .rs path cannot survive a .dag filter, so roster_touched is false on every production run, consumed_due in claim_executor.report_wave_admission_outcome can never be true, and the roster-use bound does not exist. REASON, and it is not a bug in the filter: in_sweep_scope answers WHICH FILES THE PARSER RE-READS to reconstruct the baseline, a different question asked for a different purpose, and nothing joins it to the deletion obligation it silently decides. That is the mechanism gunbc.recurring_failure_mode carries as incidental_denominator_as_wall, cited here at the polarity where the accident KILLS a declared wall rather than accidentally holding one up. The discriminating fact is already executed in this repository: tests/namespace_wave_admission.rs a_rename_contributes_its_source_to_the_base_side_and_its_destination_to_the_head_side asserts that a src/v1/stage0/src path enters neither side of the diff. POPULATION, bounded and enumerable at every head: the rows of NAMESPACE_TRANSITION_ADMISSIONS for which admission_consumed_at_base holds against that run base. The population is closed by construction, since a row can enter it only by being authored into that const and the const is the single production construction site; at the head declaring this row it is exactly the two RLM-2b rows, consumed since the commit that authored them, which is also the merge of the relocation they admit. The lifetime the population sits in is measurable and is not the roster lifetime: an admission is TRUE of a diff only from its authoring until its own pull request merges, and RESIDENT on main only from that merge until a human deletes it, two disjoint intervals separated by that merge, of which the second can never match a delta and is therefore pure liability. The disjointness carries one honest caveat: a branch that MERGES main in moves its merge base past the relocation, so no delta reappears, while a branch that cherry-picks instead could reopen the first interval -- no cohort in the recorded history did this, and the caveat is stated rather than assumed away. Re-derive the record with git log over src/v1/stage0/src/namespace_wave_admission.rs, reading added and removed label lines per commit. RESTORATION TRIGGER: the consumed-row deletion obligation is observed by a mechanism that EXECUTES on the required path -- SUFFICIENT FOR a consumed row standing on a roster-touching change refusing that change, established by a discriminating RED authored on the acceptance path rather than over a hand-built outcome value. That restores rung 2 and waits on no carrier. It is deliberately not the larger climb: admissions bound to the delta content they admit, adjudicated per run and never resident on main -- SUFFICIENT FOR making a row that is not about this run diff unwritable -- is what retires the roster itself, and this row is not retired by it.RETIRED THE SAME DAY IT WAS DECLARED, BY ITS TRIGGER AND BY NOTHING ELSE (2026-09-02). gunbc#10014 landed at 962d9288ab2: diff_sides now reports what a change touched ONCE and unfiltered, each consumer applies the scope its own question needs at its own point of use, and the verdict moved off the executor onto the wall as wave_admission_refusal. roster_touched is therefore reachable on the required path and the consumed-row deletion obligation is observed by a mechanism that executes, which is the capability this row named. THE WINDOW WAS REAL AND THE ROW IS KEPT AS ITS RECORD rather than deleted: it ran from gunbc#9824 on 2026-08-31, when the obligation was declared over an arm that could not fire, to gunbc#10014 today. ONE EVIDENCE OBLIGATION REMAINS OPEN ON THE RESTORED CAPABILITY AND IS NAMED HERE RATHER THAN LEFT TO BE REDISCOVERED: the obligation is observed by a PAIR of executing probes -- one establishing that the roster path reaches the side roster_touched reads, one establishing that a consumed row on a roster-touching run refuses while a bystander stays admitted -- and not yet by a single probe that walks a real diff through to a refusal. That is evidence owed on a capability that exists, which is a different thing from a capability that does not, so it is recorded as an obligation and is neither a new drop nor a next-rung trigger." } + declaration: AuthoredProse { legacy: NamespaceAdmissionConsumedRowDeletion, authored: "Namespace wave admission -- **RUNG DROP, DECLARED (2026-09-02).** gunbc#9824 split ConsumedByMerge from UnmatchedAdmission so that a row whose admitted relocation the base already satisfies stops refusing unrelated pull requests, and it carried its own deletion obligation in one arm: consumed rows are due, and refuse, on the first change whose diff touches the roster source file itself. PREVIOUS RUNG: 2, mechanically preventable. Before that split a row past its life reported stale and refused every run, so the obligation was enforced by a mechanism that executed -- at the cost of billing the enforcement to bystanders, which is the externalized degradation #9824 was authorized to remove. TEMPORARY RUNG: 1, mitigatable. A consumed row is now a typed receipt printed by every run and nothing else, and its removal depends on a human reading that receipt. THIS ROW CORRECTS #9824 RATHER THAN RESTATING IT, AND THE CORRECTION IS THE REASON THE DROP IS DECLARED AT ALL. That pull request states its window as wall-clock unbounded, roster-use bounded, bystander-invisible. The first and third conjuncts hold. The second is FALSE IN EXECUTION: v1_compiler.cli_run.namespace_wave_admission.run_required_wave_admission derives roster_touched from the head side produced by diff_sides, whose final act retains only paths satisfying in_sweep_scope, and that predicate opens by requiring a .dag suffix -- while ADMISSION_ROSTER_REL_PATH names a .rs file. A .rs path cannot survive a .dag filter, so roster_touched is false on every production run, consumed_due in claim_executor.report_wave_admission_outcome can never be true, and the roster-use bound does not exist. REASON, and it is not a bug in the filter: in_sweep_scope answers WHICH FILES THE PARSER RE-READS to reconstruct the baseline, a different question asked for a different purpose, and nothing joins it to the deletion obligation it silently decides. That is the mechanism gunbc.recurring_failure_mode carries as incidental_denominator_as_wall, cited here at the polarity where the accident KILLS a declared wall rather than accidentally holding one up. The discriminating fact is already executed in this repository: tests/namespace_wave_admission.rs a_rename_contributes_its_source_to_the_base_side_and_its_destination_to_the_head_side asserts that a src/v1/stage0/src path enters neither side of the diff. POPULATION, bounded and enumerable at every head: the rows of NAMESPACE_TRANSITION_ADMISSIONS for which admission_consumed_at_base holds against that run base. The population is closed by construction, since a row can enter it only by being authored into that const and the const is the single production construction site; at the head declaring this row it is exactly the two RLM-2b rows, consumed since the commit that authored them, which is also the merge of the relocation they admit. The lifetime the population sits in is measurable and is not the roster lifetime: an admission is TRUE of a diff only from its authoring until its own pull request merges, and RESIDENT on main only from that merge until a human deletes it, two disjoint intervals separated by that merge, of which the second can never match a delta and is therefore pure liability. The disjointness carries one honest caveat: a branch that MERGES main in moves its merge base past the relocation, so no delta reappears, while a branch that cherry-picks instead could reopen the first interval -- no cohort in the recorded history did this, and the caveat is stated rather than assumed away. Re-derive the record with git log over src/v1/stage0/src/namespace_wave_admission.rs, reading added and removed label lines per commit. RESTORATION TRIGGER: the consumed-row deletion obligation is observed by a mechanism that EXECUTES on the required path -- SUFFICIENT FOR a consumed row standing on a roster-touching change refusing that change, established by a discriminating RED authored on the acceptance path rather than over a hand-built outcome value. That restores rung 2 and waits on no carrier. It is deliberately not the larger climb: admissions bound to the delta content they admit, adjudicated per run and never resident on main -- SUFFICIENT FOR making a row that is not about this run diff unwritable -- is what retires the roster itself, and this row is not retired by it.RETIRED THE SAME DAY IT WAS DECLARED, BY ITS TRIGGER AND BY NOTHING ELSE (2026-09-02). gunbc#10014 landed at 962d9288ab2: diff_sides now reports what a change touched ONCE and unfiltered, each consumer applies the scope its own question needs at its own point of use, and the verdict moved off the executor onto the wall as wave_admission_refusal. roster_touched is therefore reachable on the required path and the consumed-row deletion obligation is observed by a mechanism that executes, which is the capability this row named. THE WINDOW WAS REAL AND THE ROW IS KEPT AS ITS RECORD rather than deleted: it ran from gunbc#9824 on 2026-08-31, when the obligation was declared over an arm that could not fire, to gunbc#10014 today. ONE EVIDENCE OBLIGATION REMAINS OPEN ON THE RESTORED CAPABILITY AND IS NAMED HERE RATHER THAN LEFT TO BE REDISCOVERED: the obligation is observed by a PAIR of executing probes -- one establishing that the roster path reaches the side roster_touched reads, one establishing that a consumed row on a roster-touching run refuses while a bystander stays admitted -- and not yet by a single probe that walks a real diff through to a refusal. That is evidence owed on a capability that exists, which is a different thing from a capability that does not, so it is recorded as an obligation and is neither a new drop nor a next-rung trigger." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/namespace_wave_admission_wall_removed.dag b/dag/gunbc/rung_drop/namespace_wave_admission_wall_removed.dag index c9143077640..1e6d2c620ae 100644 --- a/dag/gunbc/rung_drop/namespace_wave_admission_wall_removed.dag +++ b/dag/gunbc/rung_drop/namespace_wave_admission_wall_removed.dag @@ -1,7 +1,7 @@ module gunbc.rung_drop.namespace_wave_admission_wall_removed import std.types { NonEmptyStr } -import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, DeletedWithoutReplacement } +import gunbc.rung_drop { RungDrop, RungDropAmendment, Standing, TypedDeclaration, DeletedWithoutReplacement } import gunbc.guarantee_rung { MechanicallyPreventable, OutsideTheLadder } // DECLARED 2026-09-19, beside the change that deletes the gate: operator ruling 2026-09-19 removed @@ -30,6 +30,14 @@ import gunbc.guarantee_rung { MechanicallyPreventable, OutsideTheLadder } // there is no run on which any admission-row charge could fire at all, so both siblings' temporary // states collapse into this one. They are not deleted -- they are the record of how the wall was // already narrowed before it fell, and this row's trigger subsumes their triggers. +// +// WHY THE REDESIGN PARAGRAPH ABOVE IS ALSO CARRIED AS AN `amendments` ROW BELOW, WHICH LOOKS LIKE +// TWO AUTHORITIES AND IS NOT. DESIGN section 4c: no Accepted program can read an annotation, so +// this note is invisible to docs/design-rung-drops.md -- the projection of this roster. The fact +// was therefore hand-written into that generated file on 2026-09-20, survived as unexplained drift +// on two lanes (gunbc#11732 reverted the deletion; gunbc#11786 was left holding nothing but it) and +// was regenerated away on main by gunbc#11789. The annotation is the irreducible rationale 4c +// admits; the row is the program data the projection consumes. Neither restates the other's job. data namespace_wave_admission_wall_removed: RungDrop = RungDrop { identity: "namespace_wave_admission_wall_removed" as NonEmptyStr, @@ -53,5 +61,13 @@ data namespace_wave_admission_wall_removed: RungDrop = RungDrop { "the parse-environment-agreement tripwire on the merge path (a base revision read under its own grammar before adjudication): survives only inside the floor's own planning reconstruction (v1_compiler.cli_run.namespace_baseline), which is not a gate over namespace deltas", ], restoration_trigger: "THE CAPABILITY, BOTH HALVES AND NO SMALLER SET. (1) A debt-collection design for transition admissions that never charges bystanders: a row's consumption and deletion debt is adjudicated on the composition of the change that OWNS the row, and a merge_group run over bystanders cannot refuse on a row it did not touch -- the 2026-09-16 arm removals (gunbc#11481) and this deletion are the two measured costs of getting that billing wrong in either direction. (2) A landing-time enforcement run: the adjudication executes on the composition that actually lands (or on the push to the default branch), so a base-consumed row is observed then and not whenever the roster happens to be touched next. Both halves executing with a discriminating RED each, on the real acceptance path, re-enrol the phase and retire this row; the program interlock's NamespaceWaveAdmissionEnrolled milestone and ACT-0's release gate read this row's standing meanwhile, so the waves cannot be released while it stands. Re-adding the deleted arms verbatim does NOT retire this row: that is the loop the operator priced out.", - } + }, + + amendments: [ + RungDropAmendment { + amended: "2026-09-20", + occasion: "main landed the carrier redesign (gunbc#11704 -- admissions carried in the change's own commit messages, never the tree, so no bystander is ever billed) hours before this deletion" as NonEmptyStr, + consequence: "the ruling prices the gate itself, not only its billing, and removes the redesigned wall with the old one; the restoration trigger stands whole" as NonEmptyStr, + }, + ], } diff --git a/dag/gunbc/rung_drop/native_lane_closure_walk_unkeyed_membership.dag b/dag/gunbc/rung_drop/native_lane_closure_walk_unkeyed_membership.dag index 8a977b51846..0a507e10f24 100644 --- a/dag/gunbc/rung_drop/native_lane_closure_walk_unkeyed_membership.dag +++ b/dag/gunbc/rung_drop/native_lane_closure_walk_unkeyed_membership.dag @@ -52,5 +52,7 @@ data native_lane_closure_walk_unkeyed_membership: RungDrop = RungDrop { reason: ReplacementStaged { replacement: "a keyed membership set backed by a primitive map_insert / map_lookup realization" }, population: native_lane_closure_walk_unkeyed_membership_population, restoration_trigger: "A realization DELEGATES to std.primitives map_insert_contract so a keyed membership set is writable in v2, and the frontier walk answers membership by key lookup rather than by folding the fact list. That capability is gunbc#11121; the change that lands it is this row's toucher and retires it. The existence of v2.std.collection map_insert_host_binding does NOT satisfy this trigger -- the binding is already present and nothing delegates to it, so a trigger keyed on the binding would fire while the walk stayed quadratic." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/native_lane_second_textual_production_reading.dag b/dag/gunbc/rung_drop/native_lane_second_textual_production_reading.dag index 25c7c739135..61b6a40ac15 100644 --- a/dag/gunbc/rung_drop/native_lane_second_textual_production_reading.dag +++ b/dag/gunbc/rung_drop/native_lane_second_textual_production_reading.dag @@ -51,5 +51,7 @@ data native_lane_second_textual_production_reading: RungDrop = RungDrop { reason: ReplacementStaged { replacement: "the closure computed from the front end's own import edges after a cheap parse of the seed set" }, population: native_lane_second_textual_production_reading_population, restoration_trigger: "The route derives the universe's import closure from the FRONT END'S OWN IMPORT EDGES, after a parse of the seed set that yields those edges WITHOUT preparing each module. That capability must be sufficient for the whole derivation -- module identity and import identity both -- so that native_lane_declared_module_name and native_lane_declared_imports are DELETED rather than retained beside the grammar. A parse that yields edges only after preparation does not retire this row: preparation is the cost the scans exist to avoid, so satisfying the sentence that way would leave the second reading standing." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/owner_deletion_follow_up_charge_removed.dag b/dag/gunbc/rung_drop/owner_deletion_follow_up_charge_removed.dag index 04f12bb9845..de038a54b38 100644 --- a/dag/gunbc/rung_drop/owner_deletion_follow_up_charge_removed.dag +++ b/dag/gunbc/rung_drop/owner_deletion_follow_up_charge_removed.dag @@ -51,5 +51,7 @@ data owner_deletion_follow_up_charge_removed: RungDrop = RungDrop { "used transition-admission rows whose owning change authored no deletion_follow_up, on that owning change's own merge_group composition -- EMPTY since gunbc#11704, which deleted the field" ], restoration_trigger: "THE CAPABILITY: a required run that adjudicates a deletion_follow_up against WHAT IT NAMES -- resolving the authored number to a pull request that exists and is open or deleting the row -- rather than against the fact that digits were typed. Nothing smaller retires this row, AND IN PARTICULAR RE-ADDING THE REMOVED ARM DOES NOT. That arm's admitting side was satisfied by any digits, so restoring it would restore an advance commitment nobody can check while charging every owner for it, which is the cost the operator ruling priced out; the coverage that is missing is not the refusal but the referent behind it. Nor does authoring follow-up numbers on the rows standing today, which changes the population and not the coverage. What remained from 2026-09-16 was a RECORD and not a refusal -- deletion_follow_up carried on every row and used_without_follow_up counted in the refusal message. SINCE gunbc#11704 (2026-09-19) NEITHER EXISTS: transition admissions are carried in the commit messages of the change that needs them, TransitionAdmission has no deletion_follow_up field, and WaveAdmissionReport has no used_without_follow_up, so this drop's population is EMPTY and no record of it remains. The drop stays Standing because the trigger above has not fired; it is inert, not retired.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/persisted_resolved_graph_disk_probe_unqualified_format.dag b/dag/gunbc/rung_drop/persisted_resolved_graph_disk_probe_unqualified_format.dag index 74278a0d8ec..f8889d5455d 100644 --- a/dag/gunbc/rung_drop/persisted_resolved_graph_disk_probe_unqualified_format.dag +++ b/dag/gunbc/rung_drop/persisted_resolved_graph_disk_probe_unqualified_format.dag @@ -47,5 +47,7 @@ data persisted_resolved_graph_disk_probe_unqualified_format: RungDrop = RungDrop }, population: persisted_resolved_graph_disk_probe_unqualified_format_population, restoration_trigger: persisted_resolved_graph_disk_probe_restoration(), - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag b/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag index 8d8f1516f1a..10a85c32091 100644 --- a/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag +++ b/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag @@ -158,5 +158,7 @@ data provider_path_jurisdiction_unread_admits: RungDrop = RungDrop { reason: DeletedWithoutReplacement, population: [], restoration_trigger: "product.fabric.provider_route ProviderPathStanding carries a jurisdiction standing SUFFICIENT FOR a located path to declare its jurisdiction unread without the whole path becoming unread -- so that a consumer matching the located arm can see which of its three components were established -- and gunbc.spark.first_party_serving's telemetry path states the fact in its arm. Reading who operates the usage-stats service does NOT discharge this row: it fills one slot on one route and leaves every other located path with an undocumented counterparty in the same unexpressible position", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/regen_producer.dag b/dag/gunbc/rung_drop/regen_producer.dag index 431282fe1d5..0530a352575 100644 --- a/dag/gunbc/rung_drop/regen_producer.dag +++ b/dag/gunbc/rung_drop/regen_producer.dag @@ -12,5 +12,7 @@ data regen_producer: RungDrop = RungDrop { standing: Retired { trigger_fired: "2026-09-01" as NonEmptyStr }, - declaration: AuthoredProse { legacy: RegenProducer, authored: "**THE REGEN CUT DELETED A PRODUCER ALONG WITH ITS BINARY, DECLARED NOTHING, AND THIS ROW IS THAT DECLARATION (2026-08-20).** It sits beside the CI entry above rather than inside it, because the two are different facts on different clocks — that paragraph narrates what the floor and regen cuts removed, this row declares one capability the regen cut removed in silence — and because a declaration wedged into the repository's most-edited paragraph collides with every unrelated edit to it (three merge conflicts in two hours, each one re-resolving prose neither side had touched). The regen cut re-derived the deleted binary's VERIFIER half — `claim_executor --required-regen`, which compares the committed stage0 mirror against a fresh emit — and did not re-derive its PRODUCER half: writing the emitted tree to disk unconditionally, whatever the comparison then says about it. `run_required_regen` did write a candidate tree, but only on the path where the emitted and committed populations already agreed; every refusal arm returned ahead of the write. The one population asymmetry an author can actually cause is adding a module to the v1 seed closure — its mirror is emitted-not-committed by construction on the first commit that introduces it — so from the cut until this entry, that change refused while naming a file no sanctioned route in the repository produced, and its only reachable green was a hand-authored mirror. That is the same laundering the fixed-point repair above closed one gate over, arrived at from the other direction: there, the gate's only closing move was forbidden; here, the gate's only closing move did not exist. WHAT THE RUNG DROP IS, stated at the honest grain: the class is not a compiler guarantee that fell a rung, it is an OPERATION that lost its only route, so it sat outside the ladder entirely — nothing to mitigate, because nothing could be attempted. Naming it as a declared drop rather than a defect is the point of the entry: the regen cut owed one under §4b(3) and filed none, and a capability deleted in silence is exactly what §3's delete-first doctrine says the census is supposed to surface loudly. It did not surface because no dependent could refuse — the author who needed the producer was outside the tree. **THE ROW'S RESTORATION CONDITION, QUOTED VERBATIM: “production now precedes adjudication.” IT FIRED ON 2026-09-01, WITH EACH CLAUSE RECEIPTED.** *Production now precedes adjudication, refused arm:* run `33498757658`, job `99826921457`, head `e0af6cba5f52e82e1436c6a0a746a716a514ca80` logged `planned=149 executed=149 adjudicated=149`, then `first_generation_equal=false candidate=target/stage0-regen-candidate`, then refused `generated surface drift: v1_std_core.rs`. *Production now precedes adjudication, admitted arm:* run `33500467935`, job `99832373188`, head `04b8fbf3669af0148b278fb3a7be9a44a868a81e` logged `regen.mirror_write`, `regen.candidate_verify`, `regen.adjudicate`, `regen.hand_verify`, and `regen.digest`, then `planned=149 executed=149 adjudicated=149`, `first_generation_equal=true candidate=target/stage0-regen-candidate`; the required build lane passed. The clean arm establishes that production is unconditional rather than activated by drift. The clean head's tree and the pre-drift tree are byte-identical at OID `6beb63bc5bcea490e449371d55822238e0635daa`, so no probe residue contributes to that receipt. `v2.workflow.required_regen` `required_regen_run` is the authority, and it holds the ordering by construction rather than by check — every arm that reports a verdict carries the `CandidateTree` the verdict was computed against, so refused-with-no-tree has no spelling once emit succeeded, and the one tree-less arm is reachable only where emit produced nothing at all (*structurally guaranteed*, §4b). The host `v1_compiler.required_regen_host` `run_required_regen` mirrors that ordering by hand and is therefore only *mitigatable*; that below-ceiling fact is now the independent `required_regen_host_derivation_stall` in `gunbc.guarantee_stall`, rather than a new obligation squatting on this retired drop. The gate did not weaken: it refuses the same populations with the same typed causes, and the refusal now names the directory holding the first mirror the author must install.", } + declaration: AuthoredProse { legacy: RegenProducer, authored: "**THE REGEN CUT DELETED A PRODUCER ALONG WITH ITS BINARY, DECLARED NOTHING, AND THIS ROW IS THAT DECLARATION (2026-08-20).** It sits beside the CI entry above rather than inside it, because the two are different facts on different clocks — that paragraph narrates what the floor and regen cuts removed, this row declares one capability the regen cut removed in silence — and because a declaration wedged into the repository's most-edited paragraph collides with every unrelated edit to it (three merge conflicts in two hours, each one re-resolving prose neither side had touched). The regen cut re-derived the deleted binary's VERIFIER half — `claim_executor --required-regen`, which compares the committed stage0 mirror against a fresh emit — and did not re-derive its PRODUCER half: writing the emitted tree to disk unconditionally, whatever the comparison then says about it. `run_required_regen` did write a candidate tree, but only on the path where the emitted and committed populations already agreed; every refusal arm returned ahead of the write. The one population asymmetry an author can actually cause is adding a module to the v1 seed closure — its mirror is emitted-not-committed by construction on the first commit that introduces it — so from the cut until this entry, that change refused while naming a file no sanctioned route in the repository produced, and its only reachable green was a hand-authored mirror. That is the same laundering the fixed-point repair above closed one gate over, arrived at from the other direction: there, the gate's only closing move was forbidden; here, the gate's only closing move did not exist. WHAT THE RUNG DROP IS, stated at the honest grain: the class is not a compiler guarantee that fell a rung, it is an OPERATION that lost its only route, so it sat outside the ladder entirely — nothing to mitigate, because nothing could be attempted. Naming it as a declared drop rather than a defect is the point of the entry: the regen cut owed one under §4b(3) and filed none, and a capability deleted in silence is exactly what §3's delete-first doctrine says the census is supposed to surface loudly. It did not surface because no dependent could refuse — the author who needed the producer was outside the tree. **THE ROW'S RESTORATION CONDITION, QUOTED VERBATIM: “production now precedes adjudication.” IT FIRED ON 2026-09-01, WITH EACH CLAUSE RECEIPTED.** *Production now precedes adjudication, refused arm:* run `33498757658`, job `99826921457`, head `e0af6cba5f52e82e1436c6a0a746a716a514ca80` logged `planned=149 executed=149 adjudicated=149`, then `first_generation_equal=false candidate=target/stage0-regen-candidate`, then refused `generated surface drift: v1_std_core.rs`. *Production now precedes adjudication, admitted arm:* run `33500467935`, job `99832373188`, head `04b8fbf3669af0148b278fb3a7be9a44a868a81e` logged `regen.mirror_write`, `regen.candidate_verify`, `regen.adjudicate`, `regen.hand_verify`, and `regen.digest`, then `planned=149 executed=149 adjudicated=149`, `first_generation_equal=true candidate=target/stage0-regen-candidate`; the required build lane passed. The clean arm establishes that production is unconditional rather than activated by drift. The clean head's tree and the pre-drift tree are byte-identical at OID `6beb63bc5bcea490e449371d55822238e0635daa`, so no probe residue contributes to that receipt. `v2.workflow.required_regen` `required_regen_run` is the authority, and it holds the ordering by construction rather than by check — every arm that reports a verdict carries the `CandidateTree` the verdict was computed against, so refused-with-no-tree has no spelling once emit succeeded, and the one tree-less arm is reachable only where emit produced nothing at all (*structurally guaranteed*, §4b). The host `v1_compiler.required_regen_host` `run_required_regen` mirrors that ordering by hand and is therefore only *mitigatable*; that below-ceiling fact is now the independent `required_regen_host_derivation_stall` in `gunbc.guarantee_stall`, rather than a new obligation squatting on this retired drop. The gate did not weaken: it refuses the same populations with the same typed causes, and the refusal now names the directory holding the first mirror the author must install.", }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/required_gate_bankruptcy.dag b/dag/gunbc/rung_drop/required_gate_bankruptcy.dag index b58b487e8ac..b7d9c68d00b 100644 --- a/dag/gunbc/rung_drop/required_gate_bankruptcy.dag +++ b/dag/gunbc/rung_drop/required_gate_bankruptcy.dag @@ -21,5 +21,7 @@ data required_gate_bankruptcy: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: RequiredGateBankruptcy, authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`; and -- CORRECTED 2026-08-31, re-verified against main AFTER the generated-artifact partial climb below, because a drop whose stated mitigation cannot be executed is not mitigated but a rung-honesty defect in the drop row itself, and one cited as coverage -- NOT `--required-partition-crates`, which is ABSENT from claim_executor's argument parser: that build is projected by `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. `--required-generated-artifact` is absent from that parser too, and the climb below restores the CHECK without restoring that spelling, so the generated-artifact projection is regenerated through the .dag entry point `tools.generated_artifact_gate` `main_wet_one`, invoked per artifact path via `gunbc run` on a gunbc BUILT FROM SOURCE -- the installed binary predates the section 4c annotation channel and cannot parse the corpus. Both flag spellings went with this cut's deleted phases and the prose naming them was not updated, so this sentence recited two remedies nobody could run) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; AND -- POPULATION AMENDED 2026-09-02, because this row was cited as coverage for a member it did not name -- every module OUTSIDE THE REQUIRED FLOOR GATE CLOSURE, which no required phase compiles at all: the floor prepares the import closure of `required_gate_prefixes`, not the corpus, so a module that no rostered prefix transitively imports is never checked by any required run, and a green required run has therefore never entailed that the corpus holds the floor. That member is a FOURTH thing the original population sentence did not name -- not a witness outside the roster, not a deleted phase, not an ignored lib test -- while the RESTORATION TRIGGER below already covers it verbatim (the whole corpus as its universe). The omission was a rung-honesty defect in THIS ROW rather than a missing class, so it is amended here instead of filed as a second row: two rows behind one trigger is the same single-authority fork this project rejects in every other subject, and the more dangerous form when the row is quoted as evidence of what CI checks. the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once. INCIDENT RECEIPT (2026-09-02), recorded on the same principle as the one above -- a population that has demonstrably fired ranks differently for restoration than one that never has: a whole-corpus compile over dag plus src/v2 found 11 NON-EXHAUSTIVE MATCH SITES STANDING ON GREEN MAIN, closed variants that do not eliminate exhaustively, which is the ordinary compiler floor this document names first; every one of them sits in a module the gate closure never compiles, so no required run has ever been able to see them. Measured as the BASELINE arm of the nested-pattern exhaustiveness checker in gunbc#10028 (whose own change additionally exposes a larger population of ordinary floor defects that the OLD checker could not see -- that population is counted by that PR and its repair program, deliberately NOT transcribed here, because a number copied into this row rots the moment the instrument that produced it is re-run; it is not evidence about this gate in any case, since those sites were invisible to the CHECKER rather than to CI, and only the 11 that main already carries under today's checker measure what the gate does not compile). Those 11 are the first number anyone has put on the gap between main is green and the corpus holds the floor, and they are exactly the population this amendment names." } + declaration: AuthoredProse { legacy: RequiredGateBankruptcy, authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`; and -- CORRECTED 2026-08-31, re-verified against main AFTER the generated-artifact partial climb below, because a drop whose stated mitigation cannot be executed is not mitigated but a rung-honesty defect in the drop row itself, and one cited as coverage -- NOT `--required-partition-crates`, which is ABSENT from claim_executor's argument parser: that build is projected by `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. `--required-generated-artifact` is absent from that parser too, and the climb below restores the CHECK without restoring that spelling, so the generated-artifact projection is regenerated through the .dag entry point `tools.generated_artifact_gate` `main_wet_one`, invoked per artifact path via `gunbc run` on a gunbc BUILT FROM SOURCE -- the installed binary predates the section 4c annotation channel and cannot parse the corpus. Both flag spellings went with this cut's deleted phases and the prose naming them was not updated, so this sentence recited two remedies nobody could run) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; AND -- POPULATION AMENDED 2026-09-02, because this row was cited as coverage for a member it did not name -- every module OUTSIDE THE REQUIRED FLOOR GATE CLOSURE, which no required phase compiles at all: the floor prepares the import closure of `required_gate_prefixes`, not the corpus, so a module that no rostered prefix transitively imports is never checked by any required run, and a green required run has therefore never entailed that the corpus holds the floor. That member is a FOURTH thing the original population sentence did not name -- not a witness outside the roster, not a deleted phase, not an ignored lib test -- while the RESTORATION TRIGGER below already covers it verbatim (the whole corpus as its universe). The omission was a rung-honesty defect in THIS ROW rather than a missing class, so it is amended here instead of filed as a second row: two rows behind one trigger is the same single-authority fork this project rejects in every other subject, and the more dangerous form when the row is quoted as evidence of what CI checks. the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once. INCIDENT RECEIPT (2026-09-02), recorded on the same principle as the one above -- a population that has demonstrably fired ranks differently for restoration than one that never has: a whole-corpus compile over dag plus src/v2 found 11 NON-EXHAUSTIVE MATCH SITES STANDING ON GREEN MAIN, closed variants that do not eliminate exhaustively, which is the ordinary compiler floor this document names first; every one of them sits in a module the gate closure never compiles, so no required run has ever been able to see them. Measured as the BASELINE arm of the nested-pattern exhaustiveness checker in gunbc#10028 (whose own change additionally exposes a larger population of ordinary floor defects that the OLD checker could not see -- that population is counted by that PR and its repair program, deliberately NOT transcribed here, because a number copied into this row rots the moment the instrument that produced it is re-run; it is not evidence about this gate in any case, since those sites were invisible to the CHECKER rather than to CI, and only the 11 that main already carries under today's checker measure what the gate does not compile). Those 11 are the first number anyone has put on the gap between main is green and the corpus holds the floor, and they are exactly the population this amendment names." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/roadmap_live_projection_new_witness_eval_step_cost.dag b/dag/gunbc/rung_drop/roadmap_live_projection_new_witness_eval_step_cost.dag index 4d25bd9fb02..27ac3883593 100644 --- a/dag/gunbc/rung_drop/roadmap_live_projection_new_witness_eval_step_cost.dag +++ b/dag/gunbc/rung_drop/roadmap_live_projection_new_witness_eval_step_cost.dag @@ -61,5 +61,7 @@ data roadmap_live_projection_new_witness_eval_step_cost: RungDrop = RungDrop { }, population: roadmap_live_projection_new_witness_eval_step_cost_population, restoration_trigger: "THE CAPABILITY, BOTH CLAUSES, NOT EITHER: (i) loaded roadmap history consumed as a prepared effect input (dashboard work item adhoc-5ecec982-c23; gentle-ram-506's lane) so no per-claim projection is paid; WHAT adhoc-5ecec982-c23 MUST BE SUFFICIENT FOR: a required-floor claim does not re-pay the live roadmap projection per claim because that history is already a prepared effect input. (ii) AND each of the four identities measured under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives on the acceptance path, still executing, still recording eval_steps, still blocking on a semantic red. Measuring the four under budget without the prepared-input capability does not retire the row; landing the capability without those four under that derived budget on the acceptance path does not retire it either. THE BUDGET IS NAMED, NOT PINNED, AND IS NOT RAISED TO RETIRE THIS ROW: clause (ii) is read against claim_ceiling_eval_step_budget at NewWitnessTier, never against a transcribed figure. A literal would go stale the moment the rate is re-pinned -- and a fail-closed re-pin TIGHTENS the live budget, so a pinned number could be satisfied while the identities are still over the gate this drop lowered. That is the same reason the budget witnesses assert the products rather than the numbers", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/runner_host_file_apply_route_hermetic.dag b/dag/gunbc/rung_drop/runner_host_file_apply_route_hermetic.dag index 1c98c15e854..d8d611c68c2 100644 --- a/dag/gunbc/rung_drop/runner_host_file_apply_route_hermetic.dag +++ b/dag/gunbc/rung_drop/runner_host_file_apply_route_hermetic.dag @@ -21,5 +21,7 @@ data runner_host_file_apply_route_hermetic: RungDrop = RungDrop { "test.claim.runner_host_file_converge_witness_test the_apply_route_refuses_what_the_host_did_not_report (deleted; observe_reports_what_apply_refuses and the file/slot classifiers remain)", ], restoration_trigger: "shell.PosixCommandV.Check carries mock_response coverage sufficient for a hermetic discovery member that calls run_runner_host_files to reach a terminal verdict rather than a Check route gap. Authoring that mock_response is the capability; restoring the witness without it does not retire this row, because the floor already classified that call as never reaching its subject", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/rust_unit_tests_off_the_merge_path.dag b/dag/gunbc/rung_drop/rust_unit_tests_off_the_merge_path.dag index 4259b3f9b69..235286e9f23 100644 --- a/dag/gunbc/rung_drop/rust_unit_tests_off_the_merge_path.dag +++ b/dag/gunbc/rung_drop/rust_unit_tests_off_the_merge_path.dag @@ -12,5 +12,7 @@ data rust_unit_tests_off_the_merge_path: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: RustUnitTestsOffTheMergePath, authored: "**THE RUST UNIT TESTS LEAVE CI ENTIRELY; THE ALL-TARGETS LINT DOES NOT (2026-09-04).** gunbc#10078 promoted `rust-unit-tests` into `required_lanes_roster`, making `cargo test --release -p v1-compiler --lib` and `cargo clippy --all-targets -- -D warnings` merge-blocking. The 2026-09-04 operator ruling on runner capacity deletes the JOB. The two commands are separated rather than dropped together, and that separation is the whole of this row. PREVIOUS RUNG: mechanically preventable — a regression in any of the 774 `#[test]`s under src/v1/stage0 was exposed by an enrolled test and blocked the merge through the aggregate's `$UNIT` verdict fold. TEMPORARY RUNG: mitigatable, and only barely — the tests still exist, still refuse loudly, and `cargo test --release -p v1-compiler --lib` still runs them, but NO CI STEP EXECUTES THEM, so they run when a human chooses to and not otherwise. This is the exact state gunbc#9663 was created to end, and #9886's two failing tests landing on main with every required check green is the measured harm of it; that harm is re-admitted knowingly here, not rediscovered. WHAT IS NOT DROPPED, and a reader must not infer it from the job's absence: `repo_self_clippy_command` moved to `required-witnesses-build` as `rust_clippy_all_targets_step`, keeping its step id, its verdict and its position on a REQUIRED lane. That command is the only one on any CI path that compiles the integration-test and example targets — twelve of them sat red on main (2026-08-30) behind a green required run — so dropping it would have been a below-baseline floor regression under DESIGN §4b rather than a declared drop, and the ruling did not ask for it. REASON, and it is runner supply rather than doubt about the tests: the witnesses workflow carried seven jobs against a fleet that could not serve seven, each paying its own checkout, toolchain install and release build of one tree. The required context's wall is the MAX over its lanes, so contention among jobs that could have been steps was displacing the lanes that gate. The unit tests were cut rather than folded into an existing lane because the ruling asked for the Rust test population to leave CI, not to be relocated; folding them would have preserved the cost this row exists to remove. BOUNDED POPULATION: every `#[test]` in the v1-compiler crate reached by `--lib`, and every witness whose enrollment routed through that command — including `emit_import_lines_follow_resolved_binding_identity`, whose own drop row `emitted_bytes_witness_required_lane` was RETIRED on the strength of this lane being required and is un-retired in the same motion. No other lane, phase or claim changes rung; the build and floor lanes keep every edge they had. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns while this row stands, and `test.claim.required_lane_claim_agreement_witness_test` `w_the_live_roster_is_read_and_carries_both_lanes` asserts its absence from the roster at identity grain. RESTORATION TRIGGER, named at capability grain and not as an artifact: RUNNER SUPPLY SUFFICIENT to execute the v1-compiler `--lib` test population on the real acceptance path within the required context's wall budget, concurrently with the build and floor lanes and without displacing either — concretely, a fleet that admits a third required lane at the observed unit-test wall without raising the max over lanes. THIS IS NOT RETIRED BY SOMEONE RE-ADDING THE JOB, which the roster comment in `gunbc.witness_floor_workflow` now requires operator sign-off for; a job re-added into the same shortage reproduces the contention that caused the cut. Nor is it retired by running the tests somewhere unmeasured, or on a cadence — a cadence is a different drop and would need its own row. ENROLMENT 2026-09-08 (gunbc#10822): this change adds `v1_compiler.cli_run.rostered_row_join` `file_roster_join_tests` to that `--lib` population. The restoration trigger is unchanged and covers them: they are `--lib` tests, so runner supply sufficient to execute that population restores them with the rest." } + declaration: AuthoredProse { legacy: RustUnitTestsOffTheMergePath, authored: "**THE RUST UNIT TESTS LEAVE CI ENTIRELY; THE ALL-TARGETS LINT DOES NOT (2026-09-04).** gunbc#10078 promoted `rust-unit-tests` into `required_lanes_roster`, making `cargo test --release -p v1-compiler --lib` and `cargo clippy --all-targets -- -D warnings` merge-blocking. The 2026-09-04 operator ruling on runner capacity deletes the JOB. The two commands are separated rather than dropped together, and that separation is the whole of this row. PREVIOUS RUNG: mechanically preventable — a regression in any of the 774 `#[test]`s under src/v1/stage0 was exposed by an enrolled test and blocked the merge through the aggregate's `$UNIT` verdict fold. TEMPORARY RUNG: mitigatable, and only barely — the tests still exist, still refuse loudly, and `cargo test --release -p v1-compiler --lib` still runs them, but NO CI STEP EXECUTES THEM, so they run when a human chooses to and not otherwise. This is the exact state gunbc#9663 was created to end, and #9886's two failing tests landing on main with every required check green is the measured harm of it; that harm is re-admitted knowingly here, not rediscovered. WHAT IS NOT DROPPED, and a reader must not infer it from the job's absence: `repo_self_clippy_command` moved to `required-witnesses-build` as `rust_clippy_all_targets_step`, keeping its step id, its verdict and its position on a REQUIRED lane. That command is the only one on any CI path that compiles the integration-test and example targets — twelve of them sat red on main (2026-08-30) behind a green required run — so dropping it would have been a below-baseline floor regression under DESIGN §4b rather than a declared drop, and the ruling did not ask for it. REASON, and it is runner supply rather than doubt about the tests: the witnesses workflow carried seven jobs against a fleet that could not serve seven, each paying its own checkout, toolchain install and release build of one tree. The required context's wall is the MAX over its lanes, so contention among jobs that could have been steps was displacing the lanes that gate. The unit tests were cut rather than folded into an existing lane because the ruling asked for the Rust test population to leave CI, not to be relocated; folding them would have preserved the cost this row exists to remove. BOUNDED POPULATION: every `#[test]` in the v1-compiler crate reached by `--lib`, and every witness whose enrollment routed through that command — including `emit_import_lines_follow_resolved_binding_identity`, whose own drop row `emitted_bytes_witness_required_lane` was RETIRED on the strength of this lane being required and is un-retired in the same motion. No other lane, phase or claim changes rung; the build and floor lanes keep every edge they had. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns while this row stands, and `test.claim.required_lane_claim_agreement_witness_test` `w_the_live_roster_is_read_and_carries_both_lanes` asserts its absence from the roster at identity grain. RESTORATION TRIGGER, named at capability grain and not as an artifact: RUNNER SUPPLY SUFFICIENT to execute the v1-compiler `--lib` test population on the real acceptance path within the required context's wall budget, concurrently with the build and floor lanes and without displacing either — concretely, a fleet that admits a third required lane at the observed unit-test wall without raising the max over lanes. THIS IS NOT RETIRED BY SOMEONE RE-ADDING THE JOB, which the roster comment in `gunbc.witness_floor_workflow` now requires operator sign-off for; a job re-added into the same shortage reproduces the contention that caused the cut. Nor is it retired by running the tests somewhere unmeasured, or on a cadence — a cadence is a different drop and would need its own row. ENROLMENT 2026-09-08 (gunbc#10822): this change adds `v1_compiler.cli_run.rostered_row_join` `file_roster_join_tests` to that `--lib` population. The restoration trigger is unchanged and covers them: they are `--lib` tests, so runner supply sufficient to execute that population restores them with the rest." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/seam_monolith_control_unmeasured_derived_root.dag b/dag/gunbc/rung_drop/seam_monolith_control_unmeasured_derived_root.dag index 2db23246331..0dedc3cbfb6 100644 --- a/dag/gunbc/rung_drop/seam_monolith_control_unmeasured_derived_root.dag +++ b/dag/gunbc/rung_drop/seam_monolith_control_unmeasured_derived_root.dag @@ -39,5 +39,7 @@ data seam_monolith_control_unmeasured_derived_root: RungDrop = RungDrop { reason: DeletedWithoutReplacement, population: seam_monolith_control_unmeasured_derived_root_population, restoration_trigger: "THE MONOLITH CONTROL EXECUTES AGAIN ON ITS SUBJECT: either M is re-expressed at --entry grain against the seam it actually tests, so that an unsharded compile of the importer's closure over the mutated tree reds naming the seam class; or a measured-demand row for derived roots is recorded per base, keyed on the derived root's identity at that base and measured once with its receipt, so that whole-root admission admits M on a row. Never by a per-source or per-byte coefficient, and never by a bigger budget or a placement that skips admission", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/seed_whole_corpus_demand_population_blind.dag b/dag/gunbc/rung_drop/seed_whole_corpus_demand_population_blind.dag index 96d86bf6c01..81e24814d6f 100644 --- a/dag/gunbc/rung_drop/seed_whole_corpus_demand_population_blind.dag +++ b/dag/gunbc/rung_drop/seed_whole_corpus_demand_population_blind.dag @@ -44,5 +44,7 @@ data seed_whole_corpus_demand_population_blind: RungDrop = RungDrop { }, population: seed_whole_corpus_demand_population_blind_population, restoration_trigger: "THE SEED ADMITS ON THE ROOT'S OWN ROW: for every whole-root compile v1_compiler.cli_run compile_emission resolves the invocation's root identity (declared repository, primary root, ordered dependency pools) against that repository's measured rows, refuses a root with no MeasuredForRoot row with the recipe-naming UnmeasuredRoot refusal before indexing, and compares the budget only to that root's own peak -- executed by a discriminating red (an unmeasured root refused at a budget above the public peak) beside the positive control (the public root admitted at its peak and refused one byte below); and an EXECUTING CHECK pins what the seed admits on to the authority row, so the seed cannot drift from the row silently. A seed change that renames the constant, or mirrors a row without performing the join, does not satisfy it", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag b/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag index c64c8e21771..c510b47e2a3 100644 --- a/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag +++ b/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag @@ -70,5 +70,7 @@ data self_host_emit_derisk_claim_unobserved: RungDrop = RungDrop { "v2.test.long.self_host_module_emit_derisk self_host_frontier_emit_two_user_types_accepts", ], restoration_trigger: "an executing required or scheduled lane observes an isolated assemble-or-emit-from-ingest claim of a standalone one-module fixture: these two identities are planned by a live cadence, either as ordinary hold-claims that reach PASS on that run or as known-red controls whose red is read by that run. Observed at retirement, not asserted. A claim_batch invocation of the same entry is the declared unobserved state, not the trigger. Relocating the file onto per-PR discovery while the claims return false, or re-adding falsifier.yml in its 2026-08 shape, does not retire this row." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/serving_cost_axes_asserted_unmeasured.dag b/dag/gunbc/rung_drop/serving_cost_axes_asserted_unmeasured.dag index c872c8f2034..fa5ff70ae63 100644 --- a/dag/gunbc/rung_drop/serving_cost_axes_asserted_unmeasured.dag +++ b/dag/gunbc/rung_drop/serving_cost_axes_asserted_unmeasured.dag @@ -65,5 +65,7 @@ data serving_cost_axes_asserted_unmeasured: RungDrop = RungDrop { "gunbc.serving.turn_admission serving_opportunity_cost (returns NoFeasibleAlternativeUse from gauges that establish no running turn and cannot enumerate competing fabric demands; the fail-closed arm AlternativeUseUnread is reachable and refuses)", ], restoration_trigger: "a selection policy instantiation exists that decides an admission-only placement from what such a placement knows -- fungibility, admission, quality-seat availability and the equal-cost tie policy -- and refuses to require any economic axis its caller did not observe, so that serving placement no longer routes through the priced selector's cost axes and these two functions have no question left to answer. A measured operating cost for a serving group does NOT discharge this row on its own: it leaves the opportunity axis asserted, and it leaves an admission-only placement answering a pricing question it has no standing to answer", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/serving_offer_identity_is_the_exporter_process.dag b/dag/gunbc/rung_drop/serving_offer_identity_is_the_exporter_process.dag index ff162e6925c..daa65828b62 100644 --- a/dag/gunbc/rung_drop/serving_offer_identity_is_the_exporter_process.dag +++ b/dag/gunbc/rung_drop/serving_offer_identity_is_the_exporter_process.dag @@ -55,5 +55,7 @@ data serving_offer_identity_is_the_exporter_process: RungDrop = RungDrop { "gunbc.harness.harness_seat harness_fence_grant (the post-acquisition re-read, which compares the exporter's launch and therefore cannot see an engine replacement beneath it)", ], restoration_trigger: "a launch receipt read from the running engine joins the metrics-exporting process to the engine-core incarnation and its rank population, so that the offer identity and the post-acquisition fence both name the incarnation that will execute the turn. An observation of the exporting process alone does NOT discharge this row: that is what stands today, and it is what lets a seat taken against one engine authorize a request against its replacement", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag b/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag index b9c6fd7b76b..39eff0871ee 100644 --- a/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag +++ b/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag @@ -68,4 +68,6 @@ data slot_row_pinned_below_demonstrated_demand_unrefused: RungDrop = RungDrop { ], restoration_trigger: "BOTH: (i) the per-slot MemoryHigh rises above gunbc.floor_demand gunbc_floor_cgroup_charge_ceiling, or the floor's demand falls below the current line and a later uncensored receipt at this row supersedes the pin -- an operator ruling cited on the moving change; AND (ii) gunbc_runner_slot_allocation_wall_holds gains a conjunct under which a throttle-pin receipt whose armed line equals the current memory_high refuses on the required path, with its red executed on a fixture pin. Retiring the pin receipt or narrowing the charge-ceiling fold satisfies neither clause", }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/source_root_ingest_gate_rung_drop.dag b/dag/gunbc/rung_drop/source_root_ingest_gate_rung_drop.dag index 772eb96d2d8..699ad57145c 100644 --- a/dag/gunbc/rung_drop/source_root_ingest_gate_rung_drop.dag +++ b/dag/gunbc/rung_drop/source_root_ingest_gate_rung_drop.dag @@ -63,5 +63,7 @@ data source_root_ingest_gate_rung_drop: RungDrop = RungDrop { "src/v2/test/claim/self_host/crate_layout_witness_test.dag" ], restoration_trigger: "a live workflow reaches v2.workflow.source_root_ingest_gate and the gunbc.ci_layer_roots exclusion rows above name a consumer that executes. Cadence half is gunbc.rung_drop.shared_capability missing_cadence_category. Waiters whose remaining unsatisfied condition is only that capability retire together. A waiter whose remainder is still unsatisfied is removed from missing_cadence_category.waiter_identities in the SAME change as those retirements (delist, not SplitRetirement) and stays Standing until its own trigger is fully satisfied." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/spark_role_scoped_retirement_production_root.dag b/dag/gunbc/rung_drop/spark_role_scoped_retirement_production_root.dag index 48c8c7ad3d6..f662398e2eb 100644 --- a/dag/gunbc/rung_drop/spark_role_scoped_retirement_production_root.dag +++ b/dag/gunbc/rung_drop/spark_role_scoped_retirement_production_root.dag @@ -12,5 +12,7 @@ data spark_role_scoped_retirement_production_root: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: SparkRoleScopedRetirementProductionRoot, authored: "**AN OPERATOR DECISION REMOVED A BEHAVIOUR'S ONLY SUBJECT, AND THIS ROW IS THAT DECLARATION (2026-09-02).** `gunbc.spark.cell_role` assigned srv6 to `SparkTrainingCell`, and the operator withdrew that dedication as premature -- 'i wouldn't dedicate a whole node for any task - just have it converge and serve whatever task we converge it to' -- so the production roster now holds ZERO training cells. Three claims in `test.claim.spark.spark_cell_role_retirement_witness_test` entered through `fleet_converge_plan_artifact`, the root the converge actuator itself walks, and each needed a production host holding that role to have a subject at all: `w_the_production_artifact_plans_four_retirements_for_the_training_cell`, `w_the_production_artifact_plans_no_rows_for_the_converged_serving_cell`, and `w_the_production_retirement_touches_no_baseline_address`. They are DELETED rather than left silently red, because a claim whose subject no longer exists is not a failing test, and leaving it to fail would have made an operator's decision look like a regression. **PREVIOUS RUNG: mechanically preventable** -- the training arm's four retirement rows and the serving arm's zero rows were both exercised through the production root, so a planner regression that pointed `spark_serving_full_membership_plan` back at the unscoped desired members went red there. **TEMPORARY RUNG: mitigatable** -- both arms are still exercised, but only at `spark_serving_role_scoped_desired_members_in` over an authored fixture roster (`w_the_planner_scopes_desired_state_by_role`), which is a real production function and is NOT the path the converge actuator calls; the same PR added `spark_cell_role_in` and that `_in` planner variant precisely so an arm's evidence stops depending on which machines are currently assigned what. **REASON:** operator decision, recorded with its basis at `gunbc.spark.cell_role` `spark_cell_role_assignment_basis`; role is converged desired state rather than a node dedication. **POPULATION, BOUNDED:** the training arm of Spark serving role scoping and the retirement rows it produces, AS REACHED THROUGH `fleet_converge_plan_artifact`. The serving arm, the no-role refusal, the reconcile, the freeze and the apply are unaffected and their production-root claims remain enrolled. **RESTORATION TRIGGER, NAMING THE CAPABILITY:** a roster-parameterized plan artifact -- the assignment roster threaded from `fleet_converge_plan_artifact` down to `spark_serving_role_scoped_desired_members_in` -- SUFFICIENT FOR a witness to drive the production root over an authored roster and read back the four retirement rows with no production host holding `SparkTrainingCell`. Half that capability exists today: both `_in` functions take the roster; what is missing is the threading through the generic artifact entry point. **RESTORING A TRAINING CELL TO THE PRODUCTION ROSTER DOES NOT RETIRE THIS DROP** -- that would re-create the coupling between an arm's evidence and the current assignment, which is the defect this row exists to record, and it is exactly the trigger-names-less-than-the-capability failure §4b(3) warns about." } + declaration: AuthoredProse { legacy: SparkRoleScopedRetirementProductionRoot, authored: "**AN OPERATOR DECISION REMOVED A BEHAVIOUR'S ONLY SUBJECT, AND THIS ROW IS THAT DECLARATION (2026-09-02).** `gunbc.spark.cell_role` assigned srv6 to `SparkTrainingCell`, and the operator withdrew that dedication as premature -- 'i wouldn't dedicate a whole node for any task - just have it converge and serve whatever task we converge it to' -- so the production roster now holds ZERO training cells. Three claims in `test.claim.spark.spark_cell_role_retirement_witness_test` entered through `fleet_converge_plan_artifact`, the root the converge actuator itself walks, and each needed a production host holding that role to have a subject at all: `w_the_production_artifact_plans_four_retirements_for_the_training_cell`, `w_the_production_artifact_plans_no_rows_for_the_converged_serving_cell`, and `w_the_production_retirement_touches_no_baseline_address`. They are DELETED rather than left silently red, because a claim whose subject no longer exists is not a failing test, and leaving it to fail would have made an operator's decision look like a regression. **PREVIOUS RUNG: mechanically preventable** -- the training arm's four retirement rows and the serving arm's zero rows were both exercised through the production root, so a planner regression that pointed `spark_serving_full_membership_plan` back at the unscoped desired members went red there. **TEMPORARY RUNG: mitigatable** -- both arms are still exercised, but only at `spark_serving_role_scoped_desired_members_in` over an authored fixture roster (`w_the_planner_scopes_desired_state_by_role`), which is a real production function and is NOT the path the converge actuator calls; the same PR added `spark_cell_role_in` and that `_in` planner variant precisely so an arm's evidence stops depending on which machines are currently assigned what. **REASON:** operator decision, recorded with its basis at `gunbc.spark.cell_role` `spark_cell_role_assignment_basis`; role is converged desired state rather than a node dedication. **POPULATION, BOUNDED:** the training arm of Spark serving role scoping and the retirement rows it produces, AS REACHED THROUGH `fleet_converge_plan_artifact`. The serving arm, the no-role refusal, the reconcile, the freeze and the apply are unaffected and their production-root claims remain enrolled. **RESTORATION TRIGGER, NAMING THE CAPABILITY:** a roster-parameterized plan artifact -- the assignment roster threaded from `fleet_converge_plan_artifact` down to `spark_serving_role_scoped_desired_members_in` -- SUFFICIENT FOR a witness to drive the production root over an authored roster and read back the four retirement rows with no production host holding `SparkTrainingCell`. Half that capability exists today: both `_in` functions take the roster; what is missing is the threading through the generic artifact entry point. **RESTORING A TRAINING CELL TO THE PRODUCTION ROSTER DOES NOT RETIRE THIS DROP** -- that would re-create the coupling between an arm's evidence and the current assignment, which is the defect this row exists to record, and it is exactly the trigger-names-less-than-the-capability failure §4b(3) warns about." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/spark_serving_fleet_global_configuration_drop.dag b/dag/gunbc/rung_drop/spark_serving_fleet_global_configuration_drop.dag index a331736a2b1..fde65ababa8 100644 --- a/dag/gunbc/rung_drop/spark_serving_fleet_global_configuration_drop.dag +++ b/dag/gunbc/rung_drop/spark_serving_fleet_global_configuration_drop.dag @@ -45,5 +45,7 @@ data spark_serving_fleet_global_configuration_drop: RungDrop = RungDrop { "gunbc.spark.pair_serving_desired spark_pair_serving_seq_capacity_for (the count 32 measured on the first pair and carried to every group; RE-ANCHORED 2026-09-06 when the Ollama-era serving_desired rows this drop was declared over were deleted with their tree -- the defect survived the migration unchanged: one measurement, every realization. CLOSED 2026-09-07 by the GLM-5.3-Flash migration: both rows now answer SeqCapacityUnmeasured and the unit refuses naming max-num-seqs, so the inherited count is gone by construction rather than by remembering not to inherit. The ROW STAYS OPEN because this population had a second half -- an unobserved realization must refuse rather than inherit A FLEET-GLOBAL DEFAULT -- and closing one inheritance path does not establish that no other confers admission; the restoration trigger below is unchanged and undischarged)", ], restoration_trigger: "no realization can be served at a configuration it has not been observed at: a per-realization runner-memory observation exists for every model the cell loads, at the configuration selected for it, AND the fleet-global default no longer confers an unmeasured realization automatic admission -- an unobserved realization must refuse rather than inherit. An observation table alone does not discharge this row, because inheritance is the half that makes an unmeasured model's admission silent", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/spark_serving_local_artifact_not_reproducible.dag b/dag/gunbc/rung_drop/spark_serving_local_artifact_not_reproducible.dag index e088d447ab8..2080c11dca7 100644 --- a/dag/gunbc/rung_drop/spark_serving_local_artifact_not_reproducible.dag +++ b/dag/gunbc/rung_drop/spark_serving_local_artifact_not_reproducible.dag @@ -12,5 +12,7 @@ data spark_serving_local_artifact_not_reproducible: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: SparkServingLocalArtifactNotReproducible, authored: "Spark serving model materialization — **RUNG DROP, DECLARED (2026-09-02).** SUBJECT: the ability to reconstruct a serving cell's model artifact from desired state alone. WHAT WAS HELD: while `gunbc.spark.serving_desired` `spark_serving_desired_manifest` selected an upstream library tag, `gunbc.spark.serving_converge_realize` `spark_serving_materialize_model_artifact_steps` emitted a complete fetch-and-verify install plan — manifest fetched by reference, checked against the frozen resolved digest, every blob in the closure fetched by digest, staged, verified and only then published. A cell with an empty model store could be converged into a serving one. WHAT IS LOST: desired state now selects `deepseek-v4-gguf:no-h3-stop`, which was produced by `POST /api/create` ON THE CELLS THEMSELVES and has no registry anywhere. The materializer REFUSES for it, so convergence can verify and serve the artifact but cannot rebuild it: a cell that lost its model store cannot be restored by this plan. WHY THE REFUSAL IS NOT ITSELF THE DEFECT: the alternative was emitting `curl` against a registry path that never existed, which fails at apply time on a real host with a transport error that reads as a network fault rather than as the category error it is; and the OTHER alternative — silently degrading to a verify-only plan — is the absorbing fallback, actuating as 'nothing to do' against a host with nothing installed. The line stops, typed and located, naming the producer. WHAT REMAINS: the upstream arm is untouched and still executes its full sequence, and stays enrolled as executing evidence via `test.claim.spark_serving_model_materialization_witness`, which now names `gpt_oss_120b_manifest` explicitly rather than reading desired state — precisely so this arm does not become green-by-vacuity while unselected. PREVIOUS RUNG: mechanically preventable. TEMPORARY RUNG: mitigatable — the gap is refused rather than silent, but the artifact's existence on the cells is an external fact this repository observes and cannot reproduce. RESTORATION TRIGGER — THE CAPABILITY, NOT AN ARTIFACT: a locally materialized manifest can be CONSTRUCTED by the convergence plan from facts this repository owns — the parent artifact's identity and blob closure, and the transformation applied to it — such that a cell with an empty model store converges to the byte-identical resolved identity without a human running `ollama create`. Modeling the Modelfile alone does NOT discharge this row: the plan must construct the artifact and the resulting identity must be checkable against the frozen resolution, or the same unreproducible state persists behind a row that reads as covered. RE-ANCHORED 2026-09-06: the Ollama-era tree this was declared over was deleted; the population is now the vLLM group model's weight snapshot (gunbc.spark.pair_serving_realization binds the HF hub cache read-only at /weights), which group B received by a hand-run copy over the fabric rail on 2026-09-05 and no desired row materializes. The restoration trigger is unchanged: a desired row that materializes the artifact by digest on a host that lacks it. PARTIALLY ADVANCED 2026-09-07, AND THE TRIGGER IS STILL NOT DISCHARGED -- which is the point of recording it here rather than closing the row. `gunbc.spark.model_snapshot_acquisition` now carries a desired row per model, pinned to a resolved upstream commit (DeepSeek at 60d8d707..., GLM-5.3-Flash at eb9eb208..., the latter resolved from the Hub model API on 2026-09-07), and `gunbc.artifact_acquisition` is the subject-agnostic upsert that brings one to a host it is missing from. So a host with an empty model store is no longer unreachable from desired state, and the hand-run rail copy of 2026-09-05 has a modelled replacement. WHAT IS STILL MISSING IS EXACTLY THE WORD `by digest`: the acquisition is keyed on `UpstreamRevision`, not on a content digest this repository holds, so integrity is DELEGATED to the transport (`hf cache verify` checks the cached files against the Hub own checksums, which is a real per-file check but is upstream answering at verification time rather than an oracle frozen here). `gunbc.artifact_acquisition acquisition_key_is_locally_verifiable` answers false for that key, so the weakening is a declared property a consumer can branch on rather than an implication. The remaining step is named and reachable: `extdeps.huggingface.hub hub_repo_tree_api_url` is the observation that yields a per-file sha256 manifest, at which point every shard becomes its own ContentDigestSha256 subject over the same combinator and nothing changes shape. It is not built because a manifest of that size is an observation and hand-authoring one is the fabrication this repository refuses. SEPARATELY UNRESOLVED, and not a modeling gap: which transport moves the bytes. The 2026-09-05 copy went over the fabric rail rather than the management LAN, and nothing has decided which the modelled acquisition should use." } + declaration: AuthoredProse { legacy: SparkServingLocalArtifactNotReproducible, authored: "Spark serving model materialization — **RUNG DROP, DECLARED (2026-09-02).** SUBJECT: the ability to reconstruct a serving cell's model artifact from desired state alone. WHAT WAS HELD: while `gunbc.spark.serving_desired` `spark_serving_desired_manifest` selected an upstream library tag, `gunbc.spark.serving_converge_realize` `spark_serving_materialize_model_artifact_steps` emitted a complete fetch-and-verify install plan — manifest fetched by reference, checked against the frozen resolved digest, every blob in the closure fetched by digest, staged, verified and only then published. A cell with an empty model store could be converged into a serving one. WHAT IS LOST: desired state now selects `deepseek-v4-gguf:no-h3-stop`, which was produced by `POST /api/create` ON THE CELLS THEMSELVES and has no registry anywhere. The materializer REFUSES for it, so convergence can verify and serve the artifact but cannot rebuild it: a cell that lost its model store cannot be restored by this plan. WHY THE REFUSAL IS NOT ITSELF THE DEFECT: the alternative was emitting `curl` against a registry path that never existed, which fails at apply time on a real host with a transport error that reads as a network fault rather than as the category error it is; and the OTHER alternative — silently degrading to a verify-only plan — is the absorbing fallback, actuating as 'nothing to do' against a host with nothing installed. The line stops, typed and located, naming the producer. WHAT REMAINS: the upstream arm is untouched and still executes its full sequence, and stays enrolled as executing evidence via `test.claim.spark_serving_model_materialization_witness`, which now names `gpt_oss_120b_manifest` explicitly rather than reading desired state — precisely so this arm does not become green-by-vacuity while unselected. PREVIOUS RUNG: mechanically preventable. TEMPORARY RUNG: mitigatable — the gap is refused rather than silent, but the artifact's existence on the cells is an external fact this repository observes and cannot reproduce. RESTORATION TRIGGER — THE CAPABILITY, NOT AN ARTIFACT: a locally materialized manifest can be CONSTRUCTED by the convergence plan from facts this repository owns — the parent artifact's identity and blob closure, and the transformation applied to it — such that a cell with an empty model store converges to the byte-identical resolved identity without a human running `ollama create`. Modeling the Modelfile alone does NOT discharge this row: the plan must construct the artifact and the resulting identity must be checkable against the frozen resolution, or the same unreproducible state persists behind a row that reads as covered. RE-ANCHORED 2026-09-06: the Ollama-era tree this was declared over was deleted; the population is now the vLLM group model's weight snapshot (gunbc.spark.pair_serving_realization binds the HF hub cache read-only at /weights), which group B received by a hand-run copy over the fabric rail on 2026-09-05 and no desired row materializes. The restoration trigger is unchanged: a desired row that materializes the artifact by digest on a host that lacks it. PARTIALLY ADVANCED 2026-09-07, AND THE TRIGGER IS STILL NOT DISCHARGED -- which is the point of recording it here rather than closing the row. `gunbc.spark.model_snapshot_acquisition` now carries a desired row per model, pinned to a resolved upstream commit (DeepSeek at 60d8d707..., GLM-5.3-Flash at eb9eb208..., the latter resolved from the Hub model API on 2026-09-07), and `gunbc.artifact_acquisition` is the subject-agnostic upsert that brings one to a host it is missing from. So a host with an empty model store is no longer unreachable from desired state, and the hand-run rail copy of 2026-09-05 has a modelled replacement. WHAT IS STILL MISSING IS EXACTLY THE WORD `by digest`: the acquisition is keyed on `UpstreamRevision`, not on a content digest this repository holds, so integrity is DELEGATED to the transport (`hf cache verify` checks the cached files against the Hub own checksums, which is a real per-file check but is upstream answering at verification time rather than an oracle frozen here). `gunbc.artifact_acquisition acquisition_key_is_locally_verifiable` answers false for that key, so the weakening is a declared property a consumer can branch on rather than an implication. The remaining step is named and reachable: `extdeps.huggingface.hub hub_repo_tree_api_url` is the observation that yields a per-file sha256 manifest, at which point every shard becomes its own ContentDigestSha256 subject over the same combinator and nothing changes shape. It is not built because a manifest of that size is an observation and hand-authoring one is the fabrication this repository refuses. SEPARATELY UNRESOLVED, and not a modeling gap: which transport moves the bytes. The 2026-09-05 copy went over the fabric rail rather than the management LAN, and nothing has decided which the modelled acquisition should use." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/text_boundary_identity_wall.dag b/dag/gunbc/rung_drop/text_boundary_identity_wall.dag index fdf9db1a464..2b59e118079 100644 --- a/dag/gunbc/rung_drop/text_boundary_identity_wall.dag +++ b/dag/gunbc/rung_drop/text_boundary_identity_wall.dag @@ -12,5 +12,7 @@ data text_boundary_identity_wall: RungDrop = RungDrop { standing: Standing, - declaration: AuthoredProse { legacy: TextBoundaryIdentityWall, authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's." } + declaration: AuthoredProse { legacy: TextBoundaryIdentityWall, authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's." }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/transitional_admission_exception.dag b/dag/gunbc/rung_drop/transitional_admission_exception.dag index 9efc531edba..a9519af00b0 100644 --- a/dag/gunbc/rung_drop/transitional_admission_exception.dag +++ b/dag/gunbc/rung_drop/transitional_admission_exception.dag @@ -56,6 +56,8 @@ fn transitional_admission_exception() -> RungDrop { reason: LostAsPassenger { carrier: ".github/workflows/falsifier.yml, deleted at 611fd02770 (#8283)" }, population: transitional_admission_exception_identities, restoration_trigger: "each named identity carries a cadence with a live scheduled route, at which point each row above is removed from transitional_admission_exception_identities and the identity's exception in explicit_witness_admission.dag is deleted (the gate consumes the list, so removing from the list retires the exception). The cadence category those routes need is gunbc.rung_drop.shared_capability missing_cadence_category; the remainder is the per-identity migration onto a live route. Waiters whose remaining unsatisfied condition is only that capability retire together. When the category fires and any named identity still lacks a live scheduled route, this identity is removed from missing_cadence_category.waiter_identities in the SAME change as those retirements (delist, not SplitRetirement) and this row stays Standing until every named identity has that route. If every named identity already has a live scheduled route when the category fires, retire with the enrolled set.", - } + }, + + amendments: [], } } diff --git a/dag/gunbc/rung_drop/type_reference_location_fallback_keys_production_realization.dag b/dag/gunbc/rung_drop/type_reference_location_fallback_keys_production_realization.dag index 820561ace66..297681454cb 100644 --- a/dag/gunbc/rung_drop/type_reference_location_fallback_keys_production_realization.dag +++ b/dag/gunbc/rung_drop/type_reference_location_fallback_keys_production_realization.dag @@ -55,5 +55,7 @@ data type_reference_location_fallback_keys_production_realization: RungDrop = Ru "applied type references whose Resolved node v1.compiler.infer_resolve builds on the reference's own span (split cause ResolvedNodeIsNotADeclaration)", ], restoration_trigger: "every production reader of a type reference's declaration identity -- v1.compiler.coercion type_reference_realization, the v1.compiler.infer native-numeric sites and the v1.compiler.emit_rust readers of type_reference_provenance -- asks type_reference_identity or a declaration-node or env-binding keyed authority and gives its refusal arm typed behaviour, so the own-span fallback arm of type_reference_provenance is deleted", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/typescript_same_language_round_trip_leaves_off_required_floor.dag b/dag/gunbc/rung_drop/typescript_same_language_round_trip_leaves_off_required_floor.dag index 5e500a6963e..4eb76c998b7 100644 --- a/dag/gunbc/rung_drop/typescript_same_language_round_trip_leaves_off_required_floor.dag +++ b/dag/gunbc/rung_drop/typescript_same_language_round_trip_leaves_off_required_floor.dag @@ -31,5 +31,7 @@ data typescript_same_language_round_trip_leaves_off_required_floor: RungDrop = R "v2.test.execution.emit_ingest_typescript_same_language_round_trip.typescript_same_language_discriminates_on_real_tree", ], restoration_trigger: "THE CAPABILITY, not a re-add of the identities: a required-floor claim can inhabit TypeScript parse_tree_to_target_model_bridge and same-language cross_language_compile on the acceptance path UNDER the NewWitnessTier eval-step budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives, without grandfathering and without expected-red enrolment of a passing identity. Observed at retirement: those two identities (and the discriminator if it is a test fn) are planned test fns, reach a verdict on a required run, and measure at or under that derived budget. Re-adding them over budget, or adding them to floor_grandfathered_roster, does not retire this row.", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/v1_consumer_census_live_population_off_the_merge_path.dag b/dag/gunbc/rung_drop/v1_consumer_census_live_population_off_the_merge_path.dag index 5ea79b160c7..6ab09f838e3 100644 --- a/dag/gunbc/rung_drop/v1_consumer_census_live_population_off_the_merge_path.dag +++ b/dag/gunbc/rung_drop/v1_consumer_census_live_population_off_the_merge_path.dag @@ -47,6 +47,8 @@ fn v1_consumer_census_live_population_off_the_merge_path() -> RungDrop { reason: ReplacementStaged { replacement: "gunbc.rust_item_host_observation head_rust_sources folded by observe_rust_references, consumed by gunbc.v1_consumer_census v1_consumer_population: the Rust medium of the census is a produced observation of HEAD rather than a hand list, and a produced observation reaches git, which the hermetic per-PR envelope refuses" }, population: v1_consumer_census_live_population_identities, restoration_trigger: "a merge-blocking step that executes a witness reading v1_consumer_population() against the live tree -- either mock_response coverage for git.Inspect.HeadCommit, git.Inspect.ListTreePathsAtRevision, git.Inspect.ShowTree and git.Core.Show sufficient for head_rust_sources and observe_rust_references to answer under the hermetic envelope with the assertions re-checked under that mock, or a wet lane on the required path that executes a witness reading v1_consumer_population(). NOT retired by the hermetic planted-source witnesses in self_host_v1_consumer_census_witness_test.dag, which exercise the fold and not the tree; not retired by the operator instrument, which executes when a human chooses to; not retired by re-authoring the named assertions in any witness file, which the floor refuses as a changed witness without a terminal verdict.", - } + }, + + amendments: [], } } diff --git a/dag/gunbc/rung_drop/v2_native_route_off_the_merge_path.dag b/dag/gunbc/rung_drop/v2_native_route_off_the_merge_path.dag index a1091c01e1e..0123f119bbc 100644 --- a/dag/gunbc/rung_drop/v2_native_route_off_the_merge_path.dag +++ b/dag/gunbc/rung_drop/v2_native_route_off_the_merge_path.dag @@ -50,5 +50,7 @@ data v2_native_route_off_the_merge_path: RungDrop = RungDrop { reason: DeletedWithoutReplacement, population: v2_native_route_off_the_merge_path_population, restoration_trigger: "A REQUIRED NATIVE-ROUTE JOB WHOSE WALL FITS THE ACCEPTANCE PATH, designed from the ground up against an operator-agreed contract and not re-added into the same envelope: the job must conclude on every merge candidate inside its declared timeout on the real runner class (a measured wall, not a cited one), a newer head of the same subject must supersede the older run so no head holds more than one native claimant, and its red must still discriminate every clause of native_route_admission — universe join, positive population, classified refusals, per-identity agreement with the floor reference, and all four controls. Whether that is reached by affected-set admission that runs only the universe a change touches, by a native run cheap enough to fit whole, or by a job that runs on a different cadence with its own row, is the design decision this drop waits on; the first two retire this row, the third replaces it with a differently-named drop. Re-adding `required-v2-native` with its 2026-09-10 shape does not retire this row and is refused by test.claim.witness_floor_workflow_consolidation_witness_test w_RED_the_deleted_lanes_do_not_return", - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/witness_deferral_freeze_forward_rule_rung_drop.dag b/dag/gunbc/rung_drop/witness_deferral_freeze_forward_rule_rung_drop.dag index 9e0540aad29..c874d0767d7 100644 --- a/dag/gunbc/rung_drop/witness_deferral_freeze_forward_rule_rung_drop.dag +++ b/dag/gunbc/rung_drop/witness_deferral_freeze_forward_rule_rung_drop.dag @@ -27,5 +27,7 @@ data witness_deferral_freeze_forward_rule_rung_drop: RungDrop = RungDrop { "v1_compiler.cli_run run_discovery_corpus_with_options_inner" ], restoration_trigger: "BOTH halves, and the row retires only when both are satisfied: (a) a cadence that actually executes offline-homed witnesses exists, so a green witness under such a path has a truthful admission row to write; AND (b) a required run enters the discovery-corpus path, so refuse_unexecuted_deferred_witnesses can fire when it does not. Half (a) is gunbc.rung_drop.shared_capability missing_cadence_category. Waiters whose remaining unsatisfied condition is only that capability retire together. Half (b) is not that capability. When (a) fires and (b) is still unsatisfied, this identity is removed from missing_cadence_category.waiter_identities in the SAME change as those retirements (delist, not SplitRetirement) and this row stays Standing until (b) fires. If (b) is already satisfied when (a) fires, retire with the enrolled set. (b) firing first does not delist: the row stays enrolled until (a)." - } + }, + + amendments: [], } diff --git a/dag/gunbc/rung_drop/witness_floor_off_the_required_gate.dag b/dag/gunbc/rung_drop/witness_floor_off_the_required_gate.dag index fef4344f8d6..07aafae13fc 100644 --- a/dag/gunbc/rung_drop/witness_floor_off_the_required_gate.dag +++ b/dag/gunbc/rung_drop/witness_floor_off_the_required_gate.dag @@ -42,4 +42,6 @@ data witness_floor_off_the_required_gate: RungDrop = RungDrop { ], restoration_trigger: "THE CAPABILITY: the required gate again plans and executes the enrolled witness population on the revision that lands, at a cost the fleet can carry. gunbc.compiler_gate_workflow's header names the construction expected to get there -- the fold's preparation cost cut, by reusing resolved-module and reach-probe results across runs or by scoping preparation to a diff's closure -- and the MEASUREMENT that makes this the right target is that the claims were never the cost: on run 35462055101 the 4185 claims executed in 53 seconds while strict-preparation of 3197 modules took 14.3 minutes, reach probes 11 minutes, and parse, admission and bookkeeping the rest. WHAT DOES NOT RETIRE THIS ROW, stated because each is the likely mistake: re-emitting witnesses.yml from gunbc.witness_floor_workflow without the preparation repair, which restores the cost that caused the cut; a faster floor that still does not run on the merge path; and deleting gunbc.compiler_gate_workflow, which removes the stopgap rather than restoring the gate. The row retires on an OBSERVED required run that planned and executed the population on a landing revision, not on an emission", }, + + amendments: [], } diff --git a/dag/test/claim/compiler_frontend_program_status_witness_test.dag b/dag/test/claim/compiler_frontend_program_status_witness_test.dag index 68089046e15..b715f990ae8 100644 --- a/dag/test/claim/compiler_frontend_program_status_witness_test.dag +++ b/dag/test/claim/compiler_frontend_program_status_witness_test.dag @@ -344,6 +344,8 @@ test fn the_native_route_fold_answers_both_ways() -> Bool { population: ["fixture"], restoration_trigger: "fixture", }, + + amendments: [], } let standing = RungDrop { identity: retired.identity, @@ -351,6 +353,8 @@ test fn the_native_route_fold_answers_both_ways() -> Bool { declared: retired.declared, standing: Standing, declaration: retired.declaration, + + amendments: [], } let open = standing_rung_drop_outstanding(drop: standing) count(standing_rung_drop_outstanding(drop: retired)) == 0 diff --git a/dag/test/claim/rung_drop_declaration_witness_test.dag b/dag/test/claim/rung_drop_declaration_witness_test.dag index 797b00de935..86512c490dc 100644 --- a/dag/test/claim/rung_drop_declaration_witness_test.dag +++ b/dag/test/claim/rung_drop_declaration_witness_test.dag @@ -5,10 +5,13 @@ import gunbc.guarantee_rung { OutsideTheLadder, Mitigatable, MechanicallyPreventable, guarantee_rung_label, } import gunbc.rung_drop { - RungDrop, TypedDeclaration, DeletedWithoutReplacement, Standing, - rung_drop_declaration_message, rung_drop_off_ladder_judgment, + RungDrop, RungDropAmendment, TypedDeclaration, DeletedWithoutReplacement, Standing, + rung_drop_declaration_message, rung_drop_amendment_message, rung_drop_off_ladder_judgment, OffLadder, OnLadderAt, NotJudgeableFromProse, } +import gunbc.rung_drop.namespace_wave_admission_wall_removed { + namespace_wave_admission_wall_removed, +} import gunbc.rung_drop.source_root_ingest_gate_rung_drop { source_root_ingest_gate_rung_drop } import gunbc.rung_drop.floor_cut_heal { floor_cut_heal } @@ -26,7 +29,9 @@ data control_rung_drop: RungDrop = RungDrop { reason: DeletedWithoutReplacement, population: ["control.population.one"], restoration_trigger: "control restoration trigger" - } + }, + + amendments: [], } // Local one-liner over the builtin rather than an import: three test files already declare their @@ -93,3 +98,43 @@ test fn rung_drop_message_discriminates_between_rows() -> Bool { && !contains_text(haystack: ctl, needle: "v2.workflow.source_root_ingest_gate") && contains_text(haystack: ctl, needle: "deleted without replacement") } + +// AN AMENDMENT RENDERS ITS OWN THREE FIELDS AND NOTHING ELSE. The amendment is a separate record +// from the declaration on purpose -- a later fact does not rewrite a trigger -- so the assertion +// that would go red if the two were ever fused is that the amendment's text does NOT appear in the +// declaration's message and the declaration's does not appear in the amendment's. +test fn an_amendment_renders_separately_from_its_declaration() -> Bool { + let a = rung_drop_amendment_message(a: control_amendment) + let d = rung_drop_declaration_message(d: control_rung_drop) + contains_text(haystack: a, needle: "AMENDED 2026-01-02: ") + && contains_text(haystack: a, needle: "control.occasion") + && contains_text(haystack: a, needle: "control.consequence") + && !contains_text(haystack: a, needle: "control restoration trigger") + && !contains_text(haystack: d, needle: "control.occasion") +} + +// THE LIVE ROW CARRIES THE AMENDMENT, AND THE CONTROL DOES NOT. This is the discriminating pair +// for the field itself: a projection that dropped `amendments`, or a row whose amendment was +// deleted, reds here rather than silently regenerating the paragraph away -- which is exactly what +// happened when the same text lived as hand-edited bytes in docs/design-rung-drops.md. +test fn the_namespace_wave_admission_row_is_amended_and_the_control_is_not() -> Bool { + length(xs: namespace_wave_admission_wall_removed.amendments) == 1 + && length(xs: control_rung_drop.amendments) == 0 + && fold( + namespace_wave_admission_wall_removed.amendments, + init: false, + f: fn(acc, a) { + acc || contains_text(haystack: rung_drop_amendment_message(a: a), needle: "gunbc#11704") + } + ) +} + +// THE CONTROL AMENDMENT, differing from the live one in every field for the same reason the control +// drop does: a renderer that ignored its argument would agree with both. +data control_amendment: RungDropAmendment = RungDropAmendment { + amended: "2026-01-02", + + occasion: "control.occasion" as NonEmptyStr, + + consequence: "control.consequence" as NonEmptyStr, +} diff --git a/dag/test/claim/rung_drop_shared_capability_witness_test.dag b/dag/test/claim/rung_drop_shared_capability_witness_test.dag index b624358f708..5d5c5461d94 100644 --- a/dag/test/claim/rung_drop_shared_capability_witness_test.dag +++ b/dag/test/claim/rung_drop_shared_capability_witness_test.dag @@ -27,7 +27,9 @@ fn fixture_drop(id: String, standing: RungDropStanding, trigger: String) -> Rung reason: DeletedWithoutReplacement, population: ["fixture.population"], restoration_trigger: trigger - } + }, + + amendments: [], } } @@ -171,7 +173,9 @@ fn fixture_prose_drop(id: String, authored: String) -> RungDrop { subject: id, declared: "2026-01-01", standing: Standing, - declaration: AuthoredProse { legacy: FloorCutFalsifierCadence, authored: authored } + declaration: AuthoredProse { legacy: FloorCutFalsifierCadence, authored: authored }, + + amendments: [], } } diff --git a/docs/design-rung-drops.md b/docs/design-rung-drops.md index a0f7ecc3618..62c5efb0016 100644 --- a/docs/design-rung-drops.md +++ b/docs/design-rung-drops.md @@ -319,3 +319,5 @@ an append to the fabric event log by a principal that is not a fleet writer: RUN ### the required namespace-wave-admission phase: merge-path adjudication of closure, subject-membership and occurrence-binding deltas between merge base and head — declared 2026-09-19 the required namespace-wave-admission phase: merge-path adjudication of closure, subject-membership and occurrence-binding deltas between merge base and head: RUNG DROP, mechanically preventable -> outside the ladder (deleted without replacement). Population: unadjudicated subject-membership deltas between merge base and head: no required run computes or refuses them, unadjudicated occurrence-binding deltas (a spelling already authored on both sides changing which declarations it admits): no required run computes or refuses them, the TargetChanged arm's mis-shaped-wave detection: a wave that both requalifies and repoints a reference to a different declaration is no longer caught anywhere on the merge path, closure deltas, which the wall measured and attributed to their membership generators as blast radius: not computed, the transition-admission roster's stale/consumed bookkeeping and its deletion-follow-up debt record: moot, because no executing consumer reads the roster -- the roster directory dag/gunbc/namespace/transition_admission/ is deleted with the wall, the parse-environment-agreement tripwire on the merge path (a base revision read under its own grammar before adjudication): survives only inside the floor's own planning reconstruction (v1_compiler.cli_run.namespace_baseline), which is not a gate over namespace deltas. Restored when: THE CAPABILITY, BOTH HALVES AND NO SMALLER SET. (1) A debt-collection design for transition admissions that never charges bystanders: a row's consumption and deletion debt is adjudicated on the composition of the change that OWNS the row, and a merge_group run over bystanders cannot refuse on a row it did not touch -- the 2026-09-16 arm removals (gunbc#11481) and this deletion are the two measured costs of getting that billing wrong in either direction. (2) A landing-time enforcement run: the adjudication executes on the composition that actually lands (or on the push to the default branch), so a base-consumed row is observed then and not whenever the roster happens to be touched next. Both halves executing with a discriminating RED each, on the real acceptance path, re-enrol the phase and retire this row; the program interlock's NamespaceWaveAdmissionEnrolled milestone and ACT-0's release gate read this row's standing meanwhile, so the waves cannot be released while it stands. Re-adding the deleted arms verbatim does NOT retire this row: that is the loop the operator priced out.. + +AMENDED 2026-09-20: main landed the carrier redesign (gunbc#11704 -- admissions carried in the change's own commit messages, never the tree, so no bystander is ever billed) hours before this deletion -- the ruling prices the gate itself, not only its billing, and removes the redesigned wall with the old one; the restoration trigger stands whole.