Quarantine: a per-row NeverRunDeclinedOutsideGate holder for the probes the floor never plans; english_emit_add and file_hold leave quarantine (they pass)

[gunbai-bot]

Depends on #12603. test.claim.quarantine_probe_disposition_witness_test does not typecheck on main (List vs FreeMonoid) until #12603 lands. The evidence below was taken on #12603's head plus this diff. Land #12603 first.

The latent red. With #12603 in, both live claims (every_quarantine_probe_derives_exactly_one_disposition and every_supplied_population_is_load_bearing_on_the_live_claim) are false. 11 admitted probes derive QuarantineProbeNowPassing, which is the fold's arm for "held by no roster". It is not an executed green.

Measured with claim_batch before choosing a remedy:

• 9 algebra_receiver probes: test.claim.algebra_receiver_callable_witness_test ×6 and test.claim.algebra_receiver_alias_witness_test ×3 all FAIL, which is their declared red. Deleting their rows would delete live discriminating reds (§4b(4)).
• v2.test.manual.english_emit_add english_emit_add_ingest_round_trip_holds: PASS. Its admission row and its transitional_admission_exception entry delete (a climb), and the witness stays as a regression control.
• test.claim.file_hold_plan_refusal_probe_witness_test the_harness_runs_…: PASS on main 785934a. The UnimportedBareProvider RosterStale #filter entry refusal seen on an older base was already retired by Bare-provider gate: read bare references from the full parse; delete the byte scanner #12609; with it gone, the probe greens, which is exactly its row's dissolution (Measured compile: a unit variant is bound through its parent coproduct (std.measure census 147 -> 0) #12132 landed). Its admission row deletes. The 9 algebra_receiver probes were re-measured on the same main and are still red.

Remedy (manager ruling: option B, with three conditions). A fifth holder arm, NeverRunDeclinedOutsideGate { module, trigger }.

1. Never coverage. Its verification standing is WitnessNeverRuns: the arm records a red that nothing runs and nothing enforces. It is never read as held-and-checked or green.
2. One row per probe. The rows live in the new gunbc.quarantine_outside_gate_decline, and each carries its own module and its own next-rung trigger: the module being admitted by required_gate_admits, after which the probe moves to floor_expected_red, or a recorded decision to keep it out. There is no blanket row.
3. Joined on identity against the gate. A row holds only if its module and function equal the subject's and gate_admits(subject.module) is false. In production that is v2.workflow.required_floor required_gate_admits, the floor's own admission decision, not a copy of its prefixes. A row for a module inside the gate derives no holder, so the probe reads NowPassing and reds the witness.

Widening the gate (option A) is a cost decision and is not in this PR.

Evidence (local claim_batch, #12603 head + this diff): all 9 claims in the witness module PASS.

• Both live claims.
• The load-bearing claim, which now also requires that removing the outside-gate population breaks the live claim.
• New discriminating pair an_outside_gate_row_holds_only_while_the_gate_refuses_the_module_and_only_as_never_run: the same row holds as WitnessNeverRuns under a refusing gate, and derives NowPassing under an admitting one.

🤖 Generated with Claude Code

[gunbai-bot]

Floor red on 1479f86 is the declared dependency, not a defect in this diff: touching the module makes the floor compile test.claim.quarantine_probe_disposition_witness_test, which fails to typecheck on main without #12603 (Empty {} at List positions: expected 'Container(List,Primitive(element))', got 'Coproduct(FreeMonoid)', pre-existing lines 255-473). Rewriting those literals to dodge the compiler defect #12603 fixes would be a §5 workaround, so this PR is back in draft until #12603 lands, then it merges main and re-runs. With #12603 applied, all 9 witness claims pass locally (see body).

— sent from crisp-lynx-364

[gunbai-bot]

Both reds from CI run 36656467027 are addressed in 42cbe99.

generated. docs/design-rung-drops.md is regenerated through tools.docs_projection_gate regen. The only change is that english_emit_add leaves the transitional_admission_exception population line.

floor budget (808,294 steps). I re-derived the chain rather than supplying around it, because the cost was not in re-running the route. Measured with claim_batch:

• The corpus census host read costs 10 steps.
• Live subject derivation cost 677,277: module_for_entry folded the whole census once per admission row, a rows × corpus product.
• The disposition fold scanned each roster once per probe.
• The earlier five-fold load-bearing claim added only about 18k on top of one live evaluation, because of memoization.

Both joins are quadratic cost shapes (§6, bare minimum cost), so I keyed them:

• The admission entries are keyed once, and the census is read in one pass over the entries' own parent directories. Those roots are derived from the entries, never authored.
• The two rosters are keyed once per population in quarantine_probe_dispositions.
• The load-bearing claim reads every population's holder off one live evaluation. Under exactly-one holding, "dropping P reds the live claim" is the same statement as "some live probe's single holder is P". The fixture claims keep the mutation half on supplied facts.

Result: both live claims now take 43.6k steps, against the 72,300 new-witness budget. All 9 claims PASS. As a control, emptying the outside-gate roster turns both live claims FAIL.

— sent from crisp-lynx-364