diff --git a/dag/gunbc/instrument_targets.dag b/dag/gunbc/instrument_targets.dag
index f596042c669..8f9003e12fd 100644
--- a/dag/gunbc/instrument_targets.dag
+++ b/dag/gunbc/instrument_targets.dag
@@ -333,6 +333,25 @@ fn dag_emit_real_grammar_round_trips_entry() -> String {
   "dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag"
 }
 
+// THE MATERIALIZATION STORE CLOSURE, EMITTED, BUILT UNDER CARGO AND RUN: the NativeClaimDriver
+// program gunbc.instruments.native_materialization_store_closure, whose closure contains
+// extdeps.realization.materialization_store_local. Its cargo compilation discriminates two emitter
+// classes of accepted source that emitted Rust rustc refused -- item bounds missing from
+// hand-written impl and fn headers (class A), and an optional-returning lambda unwrapped inside its
+// own body (class C) -- so for those two the BUILD is a verdict, not only the cases. The cases over
+// the five representation-local simplifications (class B, specimens of gunbc.rung_drop
+// text_boundary_identity_wall) are behavioral controls of the simplified functions: restoring an
+// unnecessary identified crossing may unfold or refuse at source acceptance and is not guaranteed
+// to fail this build. Run by name, not a merge gate.
+// `gunbc test //gunbc/instruments:native-materialization-store-closure`.
+fn native_materialization_store_closure_label() -> Label {
+  Label { package: instruments_package() target: TargetName { name: "native-materialization-store-closure" } }
+}
+
+fn native_materialization_store_closure_entry() -> String {
+  "dag/gunbc/instruments/native_materialization_store_closure.dag"
+}
+
 // THE NATIVE EMISSION CONTROLS: one carrier per Rust-emitter rule, emitted, built and run by the
 // NativeClaimDriver program gunbc.instruments.native_emission_controls. It is the executing evidence
 // that a rule's emission is a compilable program with the right answers -- the half a textual
@@ -528,6 +547,10 @@ fn dag_emit_real_grammar_round_trips_binding() -> TargetBinding {
   TargetBinding { target: dag_emit_real_grammar_round_trips_label() producer: NativeClaimProgramProducer { entry: dag_emit_real_grammar_round_trips_entry() } }
 }
 
+fn native_materialization_store_closure_binding() -> TargetBinding {
+  TargetBinding { target: native_materialization_store_closure_label() producer: NativeClaimProgramProducer { entry: native_materialization_store_closure_entry() } }
+}
+
 fn type_declaration_use_census_binding() -> TargetBinding {
   TargetBinding { target: type_declaration_use_census_label() producer: V2NativeCensusProducer { reading: TypeDeclarationUseReading } }
 }
@@ -684,6 +707,7 @@ fn instrument_targets() -> List<Label> {
     self_host_behavioral_equivalence_label(), dependency_demand_census_label(),
     emitted_crate_workspace_label(),
     native_crypto_vectors_label(), native_app_attest_label(), dag_emit_real_grammar_round_trips_label(),
+    native_materialization_store_closure_label(),
     native_emission_controls_label()
   ]
 }
@@ -700,6 +724,7 @@ fn instrument_bindings() -> List<TargetBinding> {
     self_host_behavioral_equivalence_binding(), dependency_demand_census_binding(),
     emitted_crate_workspace_binding(),
     native_crypto_vectors_binding(), native_app_attest_binding(), dag_emit_real_grammar_round_trips_binding(),
+    native_materialization_store_closure_binding(),
     native_emission_controls_binding()
   ]
 }
diff --git a/dag/gunbc/instruments/native_materialization_store_closure.dag b/dag/gunbc/instruments/native_materialization_store_closure.dag
new file mode 100644
index 00000000000..6392cbb40b6
--- /dev/null
+++ b/dag/gunbc/instruments/native_materialization_store_closure.dag
@@ -0,0 +1,193 @@
+module gunbc.instruments.native_materialization_store_closure
+
+import std.types { List, String, Bool }
+import std.compiler_entry { CompilerEntryDriver, NativeClaimDriver, NativeClaimReport, NativeClaimTerminal, NativeClaimHeld, NativeClaimNotHeld }
+import std.authorization_profile { UniversalAudience, EnumeratedAudience, audience_subset, audience_join }
+import std.effect_grant { namespace_tree_of_label, namespace_tree_label }
+import std.materialization_object { store_object_line, store_object_line_malformed_text }
+import extdeps.realization.materialization_store_local { store_path }
+import v2.compiler.self_host.generation {
+  SourceClosureMember, SourceClosureRoster, source_closure_axis_digest,
+  SourceClosureAxisDigest, SourceClosureAxisRefused,
+  RosterCanonicallyOrdered, RosterNotAscending, RosterDuplicateMember, RosterMemberIdentityEmpty,
+}
+import v2.std.node { symbol_identity_digest }
+
+// THE MATERIALIZATION STORE CLOSURE, EMITTED, BUILT AND RUN. `gunbc test
+// //gunbc/instruments:native-materialization-store-closure` emits the closure this entry reaches --
+// which contains extdeps.realization.materialization_store_local and everything it imports -- builds
+// the emitted crate under cargo, and runs it. The build is the first half of the evidence and the
+// reason this is a program rather than a string witness. Its DISCRIMINATING claim is narrow: it
+// discriminates the two EMITTER defect classes this change repaired -- impl and fn headers that
+// omitted their item's bounds (class A) and an optional-returning lambda unwrapped inside a closure
+// body (class C) -- each ACCEPTED source that emitted Rust rustc refused, and both had sat under a
+// compile_dag_rust_emit_check row that was green the whole time, one asserting the ill-formed text
+// verbatim. A substring oracle cannot refuse Rust that does not compile; cargo can. The five text
+// sites (class B) are NOT discriminated by the build: after gunbc#12512 an identified crossing of
+// that shape unfolds or refuses at source acceptance, so their cases below are BEHAVIORAL controls of
+// the simplified functions, not reds the build would catch.
+//
+// The cases are the second half: one natively executed case per changed site, each on the exact
+// function changed, each with a RED beside it.
+//   audience_*          std.authorization_profile audience_subset / audience_join -- generic fns
+//                       over a Set element, which emitted `P: Clone` and no `P: Ord`, beside
+//                       hand-written Debug/PartialEq impls whose headers omitted the item header's
+//                       own Clone bound.
+//   tree_label_*        std.effect_grant namespace_tree_of_label -- the four kernel-String values
+//                       that were passed to v2.std.algebra length (gunbc.rung_drop
+//                       text_boundary_identity_wall, specimens of 2026-10-03). The prefix-only
+//                       label is the RED for that exact comparison.
+//   roster_*            v2.compiler.self_host.generation roster_scan_step -- the fifth specimen,
+//                       where emptiness is now tested on the kernel value the member holds.
+//   malformed_text_*    std.materialization_object store_object_line_malformed_text -- an
+//                       optional-returning lambda passed to a `fn(..) -> T` parameter, which the
+//                       emitter unwrapped inside the closure body.
+//   store_path_*        extdeps.realization.materialization_store_local itself, so the store module
+//                       is in the closure by a reference this program executes rather than by an
+//                       import nothing calls.
+//
+// WHAT THIS DOES NOT ESTABLISH. It runs no filesystem operation: a NativeClaimDriver main reads no
+// file (std.compiler_entry), so the store's effectful half -- open, lookup, commit -- is built here
+// and executed elsewhere. And it is run by name; it is not a merge gate.
+data compiler_pipeline_entry: CompilerEntryDriver = NativeClaimDriver
+
+type StoreClosureCase {
+  identity: String
+  held: Bool
+  observed: String
+}
+
+fn bool_text(b: Bool) -> String {
+  if b { "true" } else { "false" }
+}
+
+fn held_as(identity: String, observed: String, expected: String) -> StoreClosureCase {
+  StoreClosureCase { identity: identity, held: observed == expected, observed: observed }
+}
+
+fn string_set(a: String, b: String) -> Set<String> {
+  set_insert(set_insert(empty_set(), a), b)
+}
+
+fn audience_cases() -> List<StoreClosureCase> {
+  let narrow = EnumeratedAudience { members: set_insert(empty_set(), "alice") }
+  let wide = EnumeratedAudience { members: string_set(a: "alice", b: "bob") }
+  let other = EnumeratedAudience { members: string_set(a: "bob", b: "carol") }
+  let joined = match audience_join(left: wide, right: other) {
+    EnumeratedAudience { members: members } => members == set_insert(string_set(a: "alice", b: "bob"), "carol")
+    UniversalAudience => false
+  }
+  [
+    held_as(identity: "audience_subset_admits_a_contained_set", observed: bool_text(b: audience_subset(left: narrow, right: wide)), expected: "true"),
+    held_as(identity: "audience_subset_red_a_wider_set_is_not_contained", observed: bool_text(b: audience_subset(left: wide, right: narrow)), expected: "false"),
+    held_as(identity: "audience_subset_red_overlapping_sets_are_incomparable", observed: bool_text(b: audience_subset(left: wide, right: other)), expected: "false"),
+    held_as(identity: "audience_join_is_the_union", observed: bool_text(b: joined), expected: "true")
+  ]
+}
+
+fn tree_label_round_trip(label: String) -> String {
+  match namespace_tree_of_label(label: label) {
+    Present { value: tree } => namespace_tree_label(tree: tree)
+    Absent => "refused"
+  }
+}
+
+fn tree_label_cases() -> List<StoreClosureCase> {
+  [
+    held_as(identity: "tree_label_service_round_trips", observed: tree_label_round_trip(label: "service:fs"), expected: "service:fs"),
+    held_as(identity: "tree_label_red_service_prefix_naming_no_service_refuses", observed: tree_label_round_trip(label: "service:"), expected: "refused"),
+    held_as(identity: "tree_label_parameterless_tree_round_trips", observed: tree_label_round_trip(label: "filesystem"), expected: "filesystem")
+  ]
+}
+
+fn roster_member(identity: String) -> SourceClosureMember {
+  SourceClosureMember { identity: identity, content: symbol_identity_digest(sym: "content") }
+}
+
+fn roster_verdict_text(roster: SourceClosureRoster) -> String {
+  match source_closure_axis_digest(roster: roster) {
+    SourceClosureAxisDigest { digest: _ } => "digest"
+    SourceClosureAxisRefused { verdict: v } =>
+      match v {
+        RosterMemberIdentityEmpty => "identity_empty"
+        RosterCanonicallyOrdered => "ordered"
+        RosterNotAscending { at_member: _ } => "not_ascending"
+        RosterDuplicateMember { at_member: _ } => "duplicate"
+      }
+  }
+}
+
+fn roster_cases() -> List<StoreClosureCase> {
+  [
+    held_as(identity: "roster_ascending_members_fold_to_a_digest", observed: roster_verdict_text(roster: SourceClosureRoster { members: [roster_member(identity: "a_module"), roster_member(identity: "b_module")] }), expected: "digest"),
+    held_as(identity: "roster_red_an_empty_member_identity_refuses", observed: roster_verdict_text(roster: SourceClosureRoster { members: [roster_member(identity: "")] }), expected: "identity_empty")
+  ]
+}
+
+fn malformed_text(line: String) -> String {
+  match store_object_line_malformed_text(l: store_object_line(line: line)) {
+    Present { value: text } => concat("malformed:", text)
+    Absent => "well_formed"
+  }
+}
+
+fn malformed_text_cases() -> List<StoreClosureCase> {
+  [
+    held_as(identity: "malformed_text_carries_the_malformed_line", observed: malformed_text(line: "neither a part nor a payload"), expected: "malformed:neither a part nor a payload"),
+    held_as(identity: "malformed_text_red_a_well_formed_line_carries_none", observed: malformed_text(line: "end"), expected: "well_formed")
+  ]
+}
+
+fn store_path_cases() -> List<StoreClosureCase> {
+  [
+    held_as(identity: "store_path_joins_root_and_name", observed: store_path(root_path: "/store", name: "object"), expected: "/store/object"),
+    held_as(identity: "store_path_does_not_double_a_trailing_separator", observed: store_path(root_path: "/store/", name: "object"), expected: "/store/object")
+  ]
+}
+
+fn store_closure_cases() -> List<StoreClosureCase> {
+  concat(
+    concat(audience_cases(), tree_label_cases()),
+    concat(concat(roster_cases(), malformed_text_cases()), store_path_cases())
+  )
+}
+
+fn case_row(c: StoreClosureCase) -> String {
+  concat("case ", concat(c.identity, concat(if c.held { " held" } else { " not_held" }, concat(" observed=", concat(c.observed, "\n")))))
+}
+
+// THE EXPECTED IDENTITIES, DECLARED RATHER THAN DERIVED FROM THE CASES, on the rule
+// gunbc.instruments.native_crypto_vectors states: the reader joins the printed rows against this
+// roster, so a case function deleted or filtered away leaves its identity here with no row and the
+// run is NO OBSERVATION rather than a smaller green.
+data store_closure_expected_identities: List<String> = [
+  "audience_subset_admits_a_contained_set",
+  "audience_subset_red_a_wider_set_is_not_contained",
+  "audience_subset_red_overlapping_sets_are_incomparable",
+  "audience_join_is_the_union",
+  "tree_label_service_round_trips",
+  "tree_label_red_service_prefix_naming_no_service_refuses",
+  "tree_label_parameterless_tree_round_trips",
+  "roster_ascending_members_fold_to_a_digest",
+  "roster_red_an_empty_member_identity_refuses",
+  "malformed_text_carries_the_malformed_line",
+  "malformed_text_red_a_well_formed_line_carries_none",
+  "store_path_joins_root_and_name",
+  "store_path_does_not_double_a_trailing_separator"
+]
+
+fn native_claim_report() -> NativeClaimReport {
+  let cases = store_closure_cases()
+  let roster = concat("roster ", concat(store_closure_expected_identities |> join(separator: ","), "\n"))
+  let failed = cases |> filter(c => !c.held) |> map(c => c.identity)
+  let terminal = if (failed |> count) == 0 { held_terminal() } else { not_held_terminal(reason: concat("not held: ", failed |> join(separator: ","))) }
+  NativeClaimReport { stdout: concat(roster, cases |> map(c => case_row(c: c)) |> join(separator: "")), terminal: terminal }
+}
+
+fn held_terminal() -> NativeClaimTerminal {
+  NativeClaimHeld
+}
+
+fn not_held_terminal(reason: String) -> NativeClaimTerminal {
+  NativeClaimNotHeld { reason: reason }
+}
diff --git a/dag/gunbc/recurring_failure_mode/accepted_source_emits_uncompilable_target.dag b/dag/gunbc/recurring_failure_mode/accepted_source_emits_uncompilable_target.dag
index 1ceb775446e..c4aa37c082a 100644
--- a/dag/gunbc/recurring_failure_mode/accepted_source_emits_uncompilable_target.dag
+++ b/dag/gunbc/recurring_failure_mode/accepted_source_emits_uncompilable_target.dag
@@ -300,7 +300,8 @@ data accepted_source_emits_uncompilable_target: RecurringFailureMode = Recurring
     "OCCURRENCE, 2026-09-24 (lively-koi-275, gunbc#12208 MQ-1): A FIELD BOUND UNDER A NESTED VARIANT PATTERN KEEPS ITS BOX. The `diagnostics` field of `v2.std.diagnostic` `Outcome` is a recursive Optional, so `v1.compiler.emit_rust` `needs_box_wrapping` boxes it. At a SINGLE-LEVEL arm `Accepted { value: v, diagnostics: d } =>` the emitter binds the field by `ref` and unboxes it (`let d = diagnostics.as_ref()`). Under a NESTED arm `Present { value: Accepted { value: facts, diagnostics: d } } =>` it bound the Box itself, and passing `d` to `v2.std.diagnostic` `diagnostics_merge` failed rustc with E0308 (expected `Option<Rc<NonEmptyDiagnostics>>`, found `Box<Option<..>>`) in the emitted `v2.compiler.infer`. The `.dag` was accepted with zero diagnostics, and only the non-required emit-build lane (`//gunbc/instruments:self-host`) saw it. The author-side repair split the match into two single-level arms, which the rest of the corpus already does by habit. That habit is an unstated workaround: it explains why the population is small and is not evidence that it is zero. The existing trigger of this row covers it: the emitted carrier comes from the declaration, and nested-pattern binders must go through the same unboxing join as single-level arms.",
     "THE std.string_type COMPONENT IS DISCHARGED, 2026-09-28 (royal-newt-820, XL-0T ruling B): it now REFUSES AT CHECK in the shape it had, and its eight E0308 are gone because the shape no longer exists in the corpus. The link that was unjustified was neither of the two this row called justified -- it was the compatibility relation, which matched `String` against `String` by leaf spelling across two representations. The repair is text representation decided by declaration identity (v1.compiler.infer_env text_representation_by_identity), read by the checker (corpus relation, call arguments, declared returns and data initializers, and builtin arguments, which had been admitted untyped). The Rust renderer keeps its provenance-keyed answer until its render paths carry the env, and is measured byte-identical to base on the self-host crate. So a local `type String = FreeMonoid<Char>` (or a renamed `type Text = FreeMonoid<Char>`) handed to string_length/char_at/substring is a located refusal: test.claim.text_boundary_identity_wall_witness_test r_local_string_alias_into_kernel_primitive_refuses and r_renamed_text_alias_into_kernel_primitive_refuses. std.string_type's two functions are deleted (their eight callers use host String `<`, which is the same code-point order), and its `type String = FreeMonoid<Char>` stays as a declared frontier with no importer pending the seed kernel-names ruling; its 71 importers were nicknaming host text as that declaration and their imports are deleted, including src/v2/compiler/discovery_enumeration.dag, whose emitted closure no longer reaches std.string_type. THE TWO OPEN SHAPES THE ENTRY ABOVE ROUTED FOR A RULING were decided as B (two carriers, a declared crossing): a host value at a code-point-sequence call argument takes the Unicode scalar unfold as a typed node keyed to the existing literal_homomorphism_rows row, and every other crossing refuses. The residue and its trigger are carried by gunbc.rung_drop text_boundary_identity_wall, not restated here.",
     "OCCURRENCE, 2026-09-28 (warm-wolf-234, precursor to the Bool de-fork): THE ARMS OF A NATIVELY REALIZED COPRODUCT. std.types Bool = True | False is bound to Rust `bool` by gunbc.rust_source_type_bindings, and `match a { True => b  False => False }` over it was accepted at zero blocking diagnostics and emitted `Bool::True` / `Bool::False` against a `bool` -- rustc E0308. The type binding said which carrier Bool realizes as and nothing said which of its values each arm is, so the emitter spelled the arm by its SOURCE name, the one spelling the carrier cannot express. It went unexercised because v2.std.logic's structural Bool answered every True/False in the corpus; retiring that declaration exposed it. REPAIRED AT THE OWNING LINK, not at the two sites that tripped it: std.target_representation SourceVariantTargetValue rows keyed on the parent's identity -- a DeclarationRef, or the kernel type name for the kernel mint every module's `Bool` resolves to, admitted by std.types is_kernel_type (the values themselves are target facts in extdeps.languages.rust.representation) -- that identity read once at inference and carried as VariantParentIdentity on VariantPattern and VariantValueBinding, and the emitter spelling the row's value or refusing located (compile_error!) where the identity is not recovered for an arm some row binds -- never falling back to the spelling. Standing controls: fixtures/fixture_closure_rustc/native_bool_variant_probe.dag (rustc, red before, green after), fixtures/fixture_closure_rustc/local_true_false_coproduct_probe.dag (a module-local coproduct whose arms are spelled True/False keeps its own enum, so the rows are identity-keyed), and test.claim.native_variant_realization_witness_test on the emitted bytes.",
-    "OCCURRENCE, 2026-09-28 (warm-wolf-234, found while choosing the control above; NOT repaired): A MODULE-LOCAL COPRODUCT SPELLED WITH A KERNEL TYPE NAME. `type Bool = True | False` declared in an ordinary module is accepted at zero blocking diagnostics, but kernel names are never overridden in type position, so every signature renders the kernel `bool` while the arms render the local `enum Bool` -- rustc E0308 on the specimen fixtures/fixture_closure_rustc/local_bool_coproduct_probe.dag, measured on origin/main by `gunbc compile --entry` plus cargo check. Two referents for one spelling in one module is the defect; the earlier boundary is the checker, which should refuse a declaration that shadows a kernel name (or the emitter should keep one referent). Rostered here with its specimen so it is not lost; the variant-realization change deliberately does not touch it."
+    "OCCURRENCE, 2026-09-28 (warm-wolf-234, found while choosing the control above; NOT repaired): A MODULE-LOCAL COPRODUCT SPELLED WITH A KERNEL TYPE NAME. `type Bool = True | False` declared in an ordinary module is accepted at zero blocking diagnostics, but kernel names are never overridden in type position, so every signature renders the kernel `bool` while the arms render the local `enum Bool` -- rustc E0308 on the specimen fixtures/fixture_closure_rustc/local_bool_coproduct_probe.dag, measured on origin/main by `gunbc compile --entry` plus cargo check. Two referents for one spelling in one module is the defect; the earlier boundary is the checker, which should refuse a declaration that shadows a kernel name (or the emitter should keep one referent). Rostered here with its specimen so it is not lost; the variant-realization change deliberately does not touch it.",
+    "OCCURRENCES, 2026-10-03 (neat-bat-562), THREE PRODUCERS ON ONE CLOSURE, measured by `gunbc compile --entry dag/extdeps/realization/materialization_store_local.dag --target rust` plus cargo build of the emitted crate: 84 rustc errors at zero blocking diagnostics. (1) AN ITEM'S DECLARED BOUND IS ONE DECISION RENDERED AT EVERY HEADER THAT NAMES THE ITEM'S GENERICS, AND TWO RENDERERS DID NOT READ IT. The hand-written Debug and PartialEq impls for a FreeMonoid- or Set-carrying item printed the carrier's supplemental bound and the structural trait and omitted the item header's own Clone bound, so `struct PublicationContext<C: Clone, P>` was followed by `impl<C: std::fmt::Debug, ..>` (E0277 at every such impl, and E0369 where the missing Clone was also what im::Vector's PartialEq is conditional on); and a generic fn over a Set element carried Clone and never Ord, though every im::OrdSet bridge and its PartialEq are conditional on it (std.authorization_profile audience_subset and audience_join). Repaired in v1.compiler.trait_derive_emit by one header renderer fed the bound record the item header prints, and by a signature-read set-element row beside the keyed-map one. (2) A LAMBDA ARGUMENT'S BODY TYPE WAS READ AS THE ARGUMENT'S OWN: a typed lambda node carries its body's type, so a lambda returning an optional, passed to a parameter declared `fn(X) -> T`, earned the fail-closed unwrap, which Rust parses into the closure body, so the closure returned the payload where the instantiation demands the Option (E0308, std.materialization_object). Repaired at the guard in v1.compiler.emit_rust. (3) FIVE KERNEL-STRING VALUES AT STRUCTURAL-TEXT PARAMETERS, which is not an emitter defect: each site was a representation-local simplification removing a crossing the computation never needed, recorded on gunbc.rung_drop text_boundary_identity_wall as that drop's specimens. THE RECOGNITION RULE THIS OCCURRENCE ADDS: test.claim.generic_item_ord_bound_witness asserted the ill-formed impl header VERBATIM in its must-contain list and was green for as long as the defect stood. A substring oracle over emitted text cannot refuse text that does not compile, so a row of that kind is evidence about spelling and never about the class in this file; the executing control is `gunbc test //gunbc/instruments:native-materialization-store-closure`, whose emitted-crate build is the verdict for shapes (1) and (2); its cases over (3) are behavioral controls, since restoring an unnecessary identified crossing may unfold or refuse at source acceptance rather than fail the build."
   ],
 
 
diff --git a/dag/gunbc/rung_drop/text_boundary_identity_wall.dag b/dag/gunbc/rung_drop/text_boundary_identity_wall.dag
index 0efd759e9a6..989448b8b5c 100644
--- a/dag/gunbc/rung_drop/text_boundary_identity_wall.dag
+++ b/dag/gunbc/rung_drop/text_boundary_identity_wall.dag
@@ -12,5 +12,5 @@ data text_boundary_identity_wall: RungDrop = RungDrop {
 
   standing: Standing,
 
-  declaration: AuthoredProse { legacy: TextBoundaryIdentityWall, authored: "**CURRENT STANDING (2026-09-29, after the CLIMB below): a text crossing between two IDENTIFIED sides is structurally guaranteed -- a non-literal kernel-String value at an identified code-point-sequence boundary unfolds through the declared row or refuses, located. This row stands for exactly two remaining populations, each with its own trigger stated below: (1) CALLABLE-SIGNATURE crossings -- a callable whose parameters are code-point sequences passed where a callable over host text is expected, which callable-signature agreement does not yet judge by the text classifier; (2) the UNIDENTIFIED population -- a boundary where one side has no readable declaration identity, which the wall declines to judge (STANDING RESTATED, at the end). The Rust renderer's separate text-carrier answer is its own row, gunbc.guarantee_stall text_carrier_render_not_keyed_on_identity_stall.**\n\nHISTORY, AS DECLARED 2026-08-30 (the structural-text landing), superseded by the CLIMB below -- kept as history, not as standing: **A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DID NOT REFUSE.** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINED ADMITTED at that boundary (until the CLIMB) and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String<Product(Char)>) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid<Char> identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid<Char> per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid<Product(Char)>), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid<Char>, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid<Char>, a call to its own fn taking s: String refuses with expected Node(String<Product(Char)>), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's.\n\nCLIMB, 2026-09-28 (royal-newt-820, XL-0T ruling B relayed by neat-boar-16 msg_c69ec34e: one type, two representations, every crossing through the Unicode scalar unfold or a refusal). WHAT CLIMBED, BY EXECUTION: the value-at-boundary subject of this row. Compatibility no longer keys on the leaf spelling: text representation is decided by DECLARATION IDENTITY (v1.compiler.infer_env text_representation_by_identity; std.coercion TextRepresentation = HostText | CodePointSequence | NotText | TextRepresentationUnidentified, review 72252). HostText is the kernel String mint. CodePointSequence is the declaration std.algebra FreeMonoid applied to the declaration std.types Char, directly or through transparent aliases. A where-refinement has its base's representation, which is why std.types NonEmptyStr is host text. Identity is read only by declaring span, by qualified name, or, inside a declaration's body, by that declaration's own module, and never by re-resolving a spelling in the comparing site's scope. It is read by the corpus relation (v1.compiler.infer_types node_type_equals_core and node_type_compatible, which now carry the TypeEnv), by the call-argument judgment (v1.compiler.infer direct_call_arg_mismatch_diags), by declared-return and data-initializer conformance (declared_type_conformance_diags), and by the builtin argument check (builtin_text_argument_crossing_diags -- builtins were admitted with UNTYPED arguments, which is how std.string_type's string_length/char_at/substring passed). The Rust renderer (v1.compiler.emit_rust is_host_text_carrier_type) is NOT this authority: it keeps a provenance-keyed answer, a second authority for the same fact, declared as its own typed stall row gunbc.guarantee_stall text_carrier_render_not_keyed_on_identity_stall with its population and trigger. A host value at a code-point-sequence call argument is UNFOLDED as a typed-tree node -- the scalar-string algebra method chars, typed as the destination, gated on the existing gunbc.structural_realization_bindings literal_homomorphism_rows UnicodeScalarSequenceUnfold row (v1.compiler.infer destination_declares_scalar_sequence_unfold); every other crossing refuses, located. THE CALLER-RE-RESOLUTION ESCAPE IS CLOSED, and that is this row's trigger clause discharged: a call argument's expected type was param_node_type_expr re-resolved in the CALLER's scope, so v2.std.text's bare-String parameters read as host text at every foreign call site; it is now the declaration-bound formal (declaration_bound_conformance, then substitution_basis, then declared_type -- the first that is a code-point sequence, formal_code_point_view), so a foreign kernel value unfolds and a foreign literal takes the scalar image. THE ALIASING ESCAPE: a structure-identical local alias (type Wrapped = FreeMonoid<Char>, and the renamed type Text) and the local-String alias std.string_type had are refused; a local alias OF THE QUALIFIED declaration (type LocalText = v2.std.text.String) is classified through its qualified target. EVIDENCE: test.claim.text_boundary_identity_wall_witness_test (r_ refusal rows, u_ unfold rows asserting the emitted .chars() route, c_ controls including the roadmap_page script_src_attr join through the real std.markup Attribute), and test.claim.self_host_structural_text_witness_test w_nonliteral_kernel_string_at_text_return_boundary_refuses, the planted restoration probe FLIPPED to a refusal control. POPULATION, MEASURED AND DISPOSITIONED (producer: gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc, base seed vs head seed over the same tree): the wall first raised 87 refusals, every one host text handed to v2.std.text (string_eq 56, string_all_chars_in 15, string_any_char_in 6, string_contains_char 4, other 6). Disposition: string_eq on two host operands rewritten to == in five src/v2/lens modules (the repair this class's RFM row already named); the alphabet-membership and single-string calls unfold at the argument; extdeps.tools.jq's string_join over two host strings rewritten to kernel concat. Final head-vs-base: 0 new blocking rows, 4 removed. THE ROADMAP_PAGE JOIN IS ADMITTED WITH NO EXEMPTION because the crossing no longer exists: 71 modules imported std.string_type { String } -- a structural declaration -- while treating every value as host text, which is a nickname (DESIGN section 3), and std.markup was one of them. All 71 imports are deleted (the kernel String binds; imports never override it). std.string_type's two lexicographic functions, whose bodies were kernel host-text primitives over its structural String, are deleted and their eight callers use host String `<`, which is code-point order (test.claim.emitter_string_order_present_binding_witness_test host_string_order_is_code_point_order_in_the_interpreter; the emitted Rust compares String by the same order). Its `type String = FreeMonoid<Char>` STAYS as a declared frontier with no importer (DESIGN section 3c): the open seed kernel-names de-fork ruling retires or promotes it (neat-boar-16's ruling for this change). ONE SEED RULE STATED WITH IT: v1.compiler.infer_env global_bare_lookup never resolves a kernel spelling through the global bare fallback. For String that outcome held only because two modules declared the name, so the entry was ambiguous and nearest-ancestor containment answered nothing; measured on this branch while the duplicate was briefly deleted, a single candidate bound every service-output field spelled String to v2.std.text from anywhere. STANDING STAYS Standing, NARROWED (and restated at the end of this row for the unidentified population), because one crossing is still unguarded: a CALLABLE VALUE whose parameters are code-point sequences passed where a callable over host text is expected (eq: string_eq into a generic contains / dedupe over a List of host strings) -- callable-signature agreement does not consult the text classifier. Lower bound of candidate sites by name: 35 `eq: string_eq` arguments in 20 files, not yet split into host and structural lists. RESTORATION TRIGGER, RESTATED: callable-signature agreement (v1.compiler.infer_types callable_signatures_agree and the generic callable unification feeding it) refuses a code-point-sequence parameter against a host-text one and admits the matching pair, SUFFICIENT FOR every one of those sites to be either admitted as structural-on-structural or refused located; nothing else retires this row. ONE PATH THIS CLIMB DOES NOT REACH, and it is another row's: inside `v2.*` modules the call-argument compat arm does not run (gunbc.rung_drop direct_call_arg_seam_v2_exemption), so a code-point sequence handed to a host-text USER-FUNCTION parameter there is judged only by the inhabitance arm; the unfold of a host value at a code-point parameter is inference and runs everywhere, and the builtin argument check is ungated. A SPELLING COLLISION IS STILL SILENT WRONGNESS, measured 2026-09-28 with compile_dag_diagnostic_census on binaries built at fd0b879 (base) and 314e576 (head). A module declaring its own `type Char { c: Int }` and `type FreeMonoid<T> { items: List<T> }` and handing a host String VALUE to `xs: FreeMonoid<Char>` is ADMITTED on both base and head. The container-template machinery recognizes the user record named FreeMonoid by its spelling (v1.compiler.infer_types canonical_template_name over the std.types container-alias rows), so no text judgment runs at all. The text classifier keyed on declaration identity does NOT close this on its own. The capability that does: container-template recognition keyed by the resolved declaration (std.algebra FreeMonoid), SUFFICIENT FOR a user declaration that merely shares the spelling to be judged as the record it is. In the same measurement the classifier this row describes also fabricates: a user `type Char` makes `xs: List<Char>` read as a code-point sequence, and a host String value or literal there is unfolded and ADMITTED where base refused. That is why the classifier is being re-keyed on declaration identity before this row's climb lands. OUT OF THIS ROW, recorded where it was found: a local alias of a qualified reference resolves to an unresolved leaf, so `fn a() -> LocalText { 1 }` returns an Int unjudged -- that is not text-specific and belongs to the declared-conformance frontier (declared_type_conformance_note), not here.\n\nSTANDING RESTATED, 2026-09-28 (royal-newt-820; ruling by neat-boar-16 via wise-dove-693). PREVIOUS RUNG for the unidentified population: UNGUARDED -- leaf-name compatibility admitted any value whose spelling matched. TEMPORARY RUNG: IDENTIFIED text crossings are STRUCTURALLY GUARANTEED on the source-acceptance path (refused, located, or unfolded through the declared row). A boundary where one side is identified text and the other has NO readable declaration identity is UNJUDGED: the text wall adds no verdict, and base type compatibility decides exactly as before, never an admission base would not make. Each such site emits the non-blocking diagnostic TextRepresentationUnidentifiedAtBoundary, located. REASON: measured, most v1 type references are unresolved references that carry no declaration identity; refusing them refused 3632 correct sites whole-corpus. POPULATION, BOUNDED BY IDENTITY, PRODUCER NAMED: the rows of diagnostic class TextRepresentationUnidentifiedAtBoundary emitted by `gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc --measured-root-demands tools/whole_corpus_compile_measured_root_demands.json` (dag closure) and by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag --target rust` (self-host closure), each row carrying its file:line:col and position. The identity each row reports as unread is v1's ONE type-reference derivation, `v1.compiler.infer_env` `type_reference_declaration_reading` (its `TypeReferenceUnidentified` arm), the same read `v1.tests.claim.carrier_realization_census` records per authored reference position; the census is NOT this population's producer, because it enumerates authored type-reference positions inside declarations, while this population is checker comparisons at use sites whose value side is usually an inferred type with no authored position. RESTORATION TRIGGER, the capability verbatim: the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures. STAGED REPLACEMENT: node://adhoc-207dd6ac-6d2 (resolver: declaration identity on every type reference), coordinating with #12540 and deep-bee-18's declaration-reference work. That item is the staged work, not the trigger; the trigger is the capability above. A SECOND GAP NAMED BESIDE C: a user `type Char` record list passed to a host-text builtin (string_length) is admitted on base and head. With identity the list is correctly not text, and the admission is the builtin registry typing its arguments by nothing. The capability that closes it is builtin arguments judged against their declared BuiltinParam types in general, not only for text." }
+  declaration: AuthoredProse { legacy: TextBoundaryIdentityWall, authored: "**CURRENT STANDING (2026-09-29, after the CLIMB below): a text crossing between two IDENTIFIED sides is structurally guaranteed -- a non-literal kernel-String value at an identified code-point-sequence boundary unfolds through the declared row or refuses, located. This row stands for exactly two remaining populations, each with its own trigger stated below: (1) CALLABLE-SIGNATURE crossings -- a callable whose parameters are code-point sequences passed where a callable over host text is expected, which callable-signature agreement does not yet judge by the text classifier; (2) the UNIDENTIFIED population -- a boundary where one side has no readable declaration identity, which the wall declines to judge (STANDING RESTATED, at the end). The Rust renderer's separate text-carrier answer is its own row, gunbc.guarantee_stall text_carrier_render_not_keyed_on_identity_stall.**\n\nHISTORY, AS DECLARED 2026-08-30 (the structural-text landing), superseded by the CLIMB below -- kept as history, not as standing: **A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DID NOT REFUSE.** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINED ADMITTED at that boundary (until the CLIMB) and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String<Product(Char)>) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid<Char> identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid<Char> per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid<Product(Char)>), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid<Char>, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid<Char>, a call to its own fn taking s: String refuses with expected Node(String<Product(Char)>), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's.\n\nCLIMB, 2026-09-28 (royal-newt-820, XL-0T ruling B relayed by neat-boar-16 msg_c69ec34e: one type, two representations, every crossing through the Unicode scalar unfold or a refusal). WHAT CLIMBED, BY EXECUTION: the value-at-boundary subject of this row. Compatibility no longer keys on the leaf spelling: text representation is decided by DECLARATION IDENTITY (v1.compiler.infer_env text_representation_by_identity; std.coercion TextRepresentation = HostText | CodePointSequence | NotText | TextRepresentationUnidentified, review 72252). HostText is the kernel String mint. CodePointSequence is the declaration std.algebra FreeMonoid applied to the declaration std.types Char, directly or through transparent aliases. A where-refinement has its base's representation, which is why std.types NonEmptyStr is host text. Identity is read only by declaring span, by qualified name, or, inside a declaration's body, by that declaration's own module, and never by re-resolving a spelling in the comparing site's scope. It is read by the corpus relation (v1.compiler.infer_types node_type_equals_core and node_type_compatible, which now carry the TypeEnv), by the call-argument judgment (v1.compiler.infer direct_call_arg_mismatch_diags), by declared-return and data-initializer conformance (declared_type_conformance_diags), and by the builtin argument check (builtin_text_argument_crossing_diags -- builtins were admitted with UNTYPED arguments, which is how std.string_type's string_length/char_at/substring passed). The Rust renderer (v1.compiler.emit_rust is_host_text_carrier_type) is NOT this authority: it keeps a provenance-keyed answer, a second authority for the same fact, declared as its own typed stall row gunbc.guarantee_stall text_carrier_render_not_keyed_on_identity_stall with its population and trigger. A host value at a code-point-sequence call argument is UNFOLDED as a typed-tree node -- the scalar-string algebra method chars, typed as the destination, gated on the existing gunbc.structural_realization_bindings literal_homomorphism_rows UnicodeScalarSequenceUnfold row (v1.compiler.infer destination_declares_scalar_sequence_unfold); every other crossing refuses, located. THE CALLER-RE-RESOLUTION ESCAPE IS CLOSED, and that is this row's trigger clause discharged: a call argument's expected type was param_node_type_expr re-resolved in the CALLER's scope, so v2.std.text's bare-String parameters read as host text at every foreign call site; it is now the declaration-bound formal (declaration_bound_conformance, then substitution_basis, then declared_type -- the first that is a code-point sequence, formal_code_point_view), so a foreign kernel value unfolds and a foreign literal takes the scalar image. THE ALIASING ESCAPE: a structure-identical local alias (type Wrapped = FreeMonoid<Char>, and the renamed type Text) and the local-String alias std.string_type had are refused; a local alias OF THE QUALIFIED declaration (type LocalText = v2.std.text.String) is classified through its qualified target. EVIDENCE: test.claim.text_boundary_identity_wall_witness_test (r_ refusal rows, u_ unfold rows asserting the emitted .chars() route, c_ controls including the roadmap_page script_src_attr join through the real std.markup Attribute), and test.claim.self_host_structural_text_witness_test w_nonliteral_kernel_string_at_text_return_boundary_refuses, the planted restoration probe FLIPPED to a refusal control. POPULATION, MEASURED AND DISPOSITIONED (producer: gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc, base seed vs head seed over the same tree): the wall first raised 87 refusals, every one host text handed to v2.std.text (string_eq 56, string_all_chars_in 15, string_any_char_in 6, string_contains_char 4, other 6). Disposition: string_eq on two host operands rewritten to == in five src/v2/lens modules (the repair this class's RFM row already named); the alphabet-membership and single-string calls unfold at the argument; extdeps.tools.jq's string_join over two host strings rewritten to kernel concat. Final head-vs-base: 0 new blocking rows, 4 removed. THE ROADMAP_PAGE JOIN IS ADMITTED WITH NO EXEMPTION because the crossing no longer exists: 71 modules imported std.string_type { String } -- a structural declaration -- while treating every value as host text, which is a nickname (DESIGN section 3), and std.markup was one of them. All 71 imports are deleted (the kernel String binds; imports never override it). std.string_type's two lexicographic functions, whose bodies were kernel host-text primitives over its structural String, are deleted and their eight callers use host String `<`, which is code-point order (test.claim.emitter_string_order_present_binding_witness_test host_string_order_is_code_point_order_in_the_interpreter; the emitted Rust compares String by the same order). Its `type String = FreeMonoid<Char>` STAYS as a declared frontier with no importer (DESIGN section 3c): the open seed kernel-names de-fork ruling retires or promotes it (neat-boar-16's ruling for this change). ONE SEED RULE STATED WITH IT: v1.compiler.infer_env global_bare_lookup never resolves a kernel spelling through the global bare fallback. For String that outcome held only because two modules declared the name, so the entry was ambiguous and nearest-ancestor containment answered nothing; measured on this branch while the duplicate was briefly deleted, a single candidate bound every service-output field spelled String to v2.std.text from anywhere. STANDING STAYS Standing, NARROWED (and restated at the end of this row for the unidentified population), because one crossing is still unguarded: a CALLABLE VALUE whose parameters are code-point sequences passed where a callable over host text is expected (eq: string_eq into a generic contains / dedupe over a List of host strings) -- callable-signature agreement does not consult the text classifier. Lower bound of candidate sites by name: 35 `eq: string_eq` arguments in 20 files, not yet split into host and structural lists. RESTORATION TRIGGER, RESTATED: callable-signature agreement (v1.compiler.infer_types callable_signatures_agree and the generic callable unification feeding it) refuses a code-point-sequence parameter against a host-text one and admits the matching pair, SUFFICIENT FOR every one of those sites to be either admitted as structural-on-structural or refused located; nothing else retires this row. ONE PATH THIS CLIMB DOES NOT REACH, and it is another row's: inside `v2.*` modules the call-argument compat arm does not run (gunbc.rung_drop direct_call_arg_seam_v2_exemption), so a code-point sequence handed to a host-text USER-FUNCTION parameter there is judged only by the inhabitance arm; the unfold of a host value at a code-point parameter is inference and runs everywhere, and the builtin argument check is ungated. A SPELLING COLLISION IS STILL SILENT WRONGNESS, measured 2026-09-28 with compile_dag_diagnostic_census on binaries built at fd0b879 (base) and 314e576 (head). A module declaring its own `type Char { c: Int }` and `type FreeMonoid<T> { items: List<T> }` and handing a host String VALUE to `xs: FreeMonoid<Char>` is ADMITTED on both base and head. The container-template machinery recognizes the user record named FreeMonoid by its spelling (v1.compiler.infer_types canonical_template_name over the std.types container-alias rows), so no text judgment runs at all. The text classifier keyed on declaration identity does NOT close this on its own. The capability that does: container-template recognition keyed by the resolved declaration (std.algebra FreeMonoid), SUFFICIENT FOR a user declaration that merely shares the spelling to be judged as the record it is. In the same measurement the classifier this row describes also fabricates: a user `type Char` makes `xs: List<Char>` read as a code-point sequence, and a host String value or literal there is unfolded and ADMITTED where base refused. That is why the classifier is being re-keyed on declaration identity before this row's climb lands. OUT OF THIS ROW, recorded where it was found: a local alias of a qualified reference resolves to an unresolved leaf, so `fn a() -> LocalText { 1 }` returns an Int unjudged -- that is not text-specific and belongs to the declared-conformance frontier (declared_type_conformance_note), not here.\n\nSTANDING RESTATED, 2026-09-28 (royal-newt-820; ruling by neat-boar-16 via wise-dove-693). PREVIOUS RUNG for the unidentified population: UNGUARDED -- leaf-name compatibility admitted any value whose spelling matched. TEMPORARY RUNG: IDENTIFIED text crossings are STRUCTURALLY GUARANTEED on the source-acceptance path (refused, located, or unfolded through the declared row). A boundary where one side is identified text and the other has NO readable declaration identity is UNJUDGED: the text wall adds no verdict, and base type compatibility decides exactly as before, never an admission base would not make. Each such site emits the non-blocking diagnostic TextRepresentationUnidentifiedAtBoundary, located. REASON: measured, most v1 type references are unresolved references that carry no declaration identity; refusing them refused 3632 correct sites whole-corpus. POPULATION, BOUNDED BY IDENTITY, PRODUCER NAMED: the rows of diagnostic class TextRepresentationUnidentifiedAtBoundary emitted by `gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc --measured-root-demands tools/whole_corpus_compile_measured_root_demands.json` (dag closure) and by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag --target rust` (self-host closure), each row carrying its file:line:col and position. The identity each row reports as unread is v1's ONE type-reference derivation, `v1.compiler.infer_env` `type_reference_declaration_reading` (its `TypeReferenceUnidentified` arm), the same read `v1.tests.claim.carrier_realization_census` records per authored reference position; the census is NOT this population's producer, because it enumerates authored type-reference positions inside declarations, while this population is checker comparisons at use sites whose value side is usually an inferred type with no authored position. RESTORATION TRIGGER, the capability verbatim: the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures. STAGED REPLACEMENT: node://adhoc-207dd6ac-6d2 (resolver: declaration identity on every type reference), coordinating with #12540 and deep-bee-18's declaration-reference work. That item is the staged work, not the trigger; the trigger is the capability above. A SECOND GAP NAMED BESIDE C: a user `type Char` record list passed to a host-text builtin (string_length) is admitted on base and head. With identity the list is correctly not text, and the admission is the builtin registry typing its arguments by nothing. The capability that closes it is builtin arguments judged against their declared BuiltinParam types in general, not only for text.\n\nMEASURED SPECIMENS, 2026-10-03, FIVE ROWS, EACH A REPRESENTATION-LOCAL SIMPLIFICATION. Producer: the emitted-Rust path -- `gunbc compile --source-root dag --source-root src/v2 --entry dag/extdeps/realization/materialization_store_local.dag --target rust` followed by cargo build of the emitted crate -- measured at 6b1161c948, a tree that did NOT yet contain the CLIMB above (gunbc#12512). Rows one to four: std.effect_grant namespace_tree_of_label called v2.std.algebra length (parameter FreeMonoid<T>) on label twice and on service_tree_label_prefix twice, both kernel Strings. Row five: v2.compiler.self_host.generation roster_scan_step called v2.std.text string_is_empty on member.identity, a kernel-String value passed to a parameter declared over v2.std.text String -- the IDENTIFIED foreign-formal shape (control: u_kernel_value_at_foreign_bare_structural_parameter_unfolds), not the unidentified population. DISPOSITION, the same for all five: each site was rewritten to operate on the representation it already held (string_length for rows one to four, equality with the empty literal for row five), which removes a crossing the computation never needed; nothing converts at emission and no leaf name is coerced. THE RULE THESE ROWS SIT UNDER, after the CLIMB: an identified host-text value passed as a call argument to a code-point-sequence parameter unfolds through the declared row (UnicodeScalarSequenceUnfold), and every other identified crossing without that route refuses, located -- so a NEW identified site of this shape now unfolds or refuses at source acceptance; it is not admitted as these five were at 6b1161c948. These rows are behavioral controls for that rule and neither narrow nor retire this drop's two remaining populations (callable-signature crossings and the unidentified population); the drop stays Standing." }
 }
diff --git a/dag/std/effect_grant.dag b/dag/std/effect_grant.dag
index 9143d8c8315..eb92b5af24f 100644
--- a/dag/std/effect_grant.dag
+++ b/dag/std/effect_grant.dag
@@ -1,7 +1,7 @@
 module std.effect_grant
 
 import std.types { Bool, String, List }
-import v2.std.algebra { length, filter }
+import v2.std.algebra { filter }
 import std.effects { EffectShape, ReadEffect, UpsertEffect, DeleteEffect, CreateEffect, AppendEffect, ExecuteEffect }
 import std.materialization_ladder { Frame }
 import std.access {
@@ -263,8 +263,8 @@ fn namespace_tree_of_label(label: String) -> NamespaceTree? {
   match (filter(namespace_trees_without_parameters, t => namespace_tree_label(tree: t) == label)).first() {
     Present { value: t } => Present { value: t }
     Absent =>
-      if starts_with(s: label, prefix: service_tree_label_prefix) && length(label) > length(service_tree_label_prefix) {
-        Present { value: ServiceOpTree { service: substring(s: label, start: length(service_tree_label_prefix), end: length(label)) } }
+      if starts_with(s: label, prefix: service_tree_label_prefix) && string_length(s: label) > string_length(s: service_tree_label_prefix) {
+        Present { value: ServiceOpTree { service: substring(s: label, start: string_length(s: service_tree_label_prefix), end: string_length(s: label)) } }
       } else { none }
   }
 }
diff --git a/dag/test/claim/generic_item_ord_bound_witness_test.dag b/dag/test/claim/generic_item_ord_bound_witness_test.dag
index cd862e01293..2588d2d7d59 100644
--- a/dag/test/claim/generic_item_ord_bound_witness_test.dag
+++ b/dag/test/claim/generic_item_ord_bound_witness_test.dag
@@ -76,17 +76,33 @@ fn w_struct_propagates_ord_through_declared_coproduct_field() -> Bool {
     [
       "enum AudienceSet<P>",
       "struct PublicationContext<C: Clone, P>",
-      "impl<C: std::fmt::Debug, P: Ord + std::fmt::Debug> std::fmt::Debug for PublicationContext<C, P>",
-      "impl<C: PartialEq, P: Ord + PartialEq> PartialEq for PublicationContext<C, P>"
+      "impl<C: Clone + std::fmt::Debug, P: Ord + std::fmt::Debug> std::fmt::Debug for PublicationContext<C, P>",
+      "impl<C: Clone + PartialEq, P: Ord + PartialEq> PartialEq for PublicationContext<C, P>"
     ],
     [
       "enum AudienceSet<P: Ord>",
       "struct PublicationContext<C: Ord, P: Ord>",
-      "struct PublicationContext<C, P: Ord>"
+      "struct PublicationContext<C, P: Ord>",
+      "impl<C: std::fmt::Debug, P",
+      "impl<C: PartialEq, P"
     ]
   )
 }
 
+// A FN GENERIC OVER A SET ELEMENT CARRIES Ord, read from the signature through both reaches the
+// item path recognises: the declared-coproduct hop (`subset`, the std.authorization_profile
+// audience_subset shape, whose body unions and compares the sets) and a direct Set<P> parameter
+// (`direct`). `unrelated` is the negative control in the same module -- a generic that reaches no
+// Set stays free of Ord, so a rule that bounded every generic in a Set-using module reds here.
+fn w_fn_generic_over_set_element_carries_ord() -> Bool {
+  compile_dag_rust_emit_check(
+    "module generic_item_ord_witness.fn_bound\nimport std.types { Bool }\n\ntype AudienceSet<P>\n  = UniversalAudience\n  | EnumeratedAudience { members: Set<P> }\n\nfn subset<P>(left: AudienceSet<P>, right: AudienceSet<P>) -> Bool {\n  match left {\n    UniversalAudience => false\n    EnumeratedAudience { members: l } => match right {\n      UniversalAudience => true\n      EnumeratedAudience { members: r } => set_union(l, r) == r\n    }\n  }\n}\n\nfn direct<P>(a: Set<P>, b: Set<P>) -> Set<P> { set_union(a, b) }\n\nfn unrelated<Q>(x: Q) -> Q { x }\n",
+    "src/generic_item_ord_witness_fn_bound.rs",
+    ["pub fn subset<P: Clone + Ord>", "pub fn direct<P: Clone + Ord>"],
+    ["pub fn subset<P: Clone>", "pub fn direct<P: Clone>", "Q: Ord", "Q: Clone + Ord"]
+  )
+}
+
 fn w_propagation_is_one_hop_only() -> Bool {
   compile_dag_rust_emit_check(
     "module generic_item_ord_witness.two_hop\n\ntype AudienceSet<P>\n  = UniversalAudience\n  | EnumeratedAudience { members: Set<P> }\n\ntype PublicationContext<C, P> {\n  audience: AudienceSet<P>\n  context: C\n}\n\ntype Wrapper<C, P> {\n  inner: PublicationContext<C, P>\n}\n",
@@ -129,6 +145,10 @@ test fn struct_propagation_positive() -> Bool {
   w_struct_propagates_ord_through_declared_coproduct_field()
 }
 
+test fn fn_generic_over_set_element_carries_ord() -> Bool {
+  w_fn_generic_over_set_element_carries_ord()
+}
+
 test fn propagation_one_hop_only_negative_control() -> Bool {
   w_propagation_is_one_hop_only()
 }
diff --git a/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag b/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
index c13e6be0942..ac54e27d924 100644
--- a/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
+++ b/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
@@ -758,6 +758,22 @@ test fn w_optional_carrier_parameter_takes_the_optional_argument_without_an_unwr
   )
 }
 
+// A FUNCTION VALUE IS NOT AN OPTIONAL ARGUMENT. A typed lambda node carries its BODY's type, so a
+// lambda returning `String?` passed to `fn(String) -> T` read as an optional flowing into a
+// required parameter and earned the unwrap -- appended to the lambda, where Rust parses it into
+// the closure body, turning a closure that must return Option<String> into one returning String
+// (E0308 at std.materialization_object store_object_line_malformed_text and store_lookup_payload).
+// The `end: none` argument is the positive control in the same call: a bare type-variable
+// parameter was already declined, so the row reds only on the callable arm.
+test fn w_optional_returning_lambda_argument_is_not_unwrapped_as_an_optional_value() -> Bool {
+  compile_dag_rust_emit_check(
+    "module test.claim.optional_lambda_probe\nimport std.types { String, Bool }\nfn pick<T>(flag: Bool, hit: fn(String) -> T, miss: T) -> T { if flag { hit(\"x\") } else { miss } }\nfn probe(flag: Bool) -> String? { pick(flag: flag, hit: t => Present { value: t }, miss: none) }\n",
+    "src/test_claim_optional_lambda_probe.rs",
+    ["|t| Some(t.clone())"],
+    [".expect(\"fail-closed: an optional value flowed into non-optional parameter"]
+  )
+}
+
 // The shared-field accessor returns T by value from &self; without T: Clone on its impl rustc
 // clones the reference.
 test fn w_generic_coproduct_shared_accessor_impl_carries_the_clone_bound() -> Bool {
diff --git a/docs/design-rung-drops.md b/docs/design-rung-drops.md
index f042a8d6abf..a96e334d436 100644
--- a/docs/design-rung-drops.md
+++ b/docs/design-rung-drops.md
@@ -134,6 +134,8 @@ CLIMB, 2026-09-28 (royal-newt-820, XL-0T ruling B relayed by neat-boar-16 msg_c6
 
 STANDING RESTATED, 2026-09-28 (royal-newt-820; ruling by neat-boar-16 via wise-dove-693). PREVIOUS RUNG for the unidentified population: UNGUARDED -- leaf-name compatibility admitted any value whose spelling matched. TEMPORARY RUNG: IDENTIFIED text crossings are STRUCTURALLY GUARANTEED on the source-acceptance path (refused, located, or unfolded through the declared row). A boundary where one side is identified text and the other has NO readable declaration identity is UNJUDGED: the text wall adds no verdict, and base type compatibility decides exactly as before, never an admission base would not make. Each such site emits the non-blocking diagnostic TextRepresentationUnidentifiedAtBoundary, located. REASON: measured, most v1 type references are unresolved references that carry no declaration identity; refusing them refused 3632 correct sites whole-corpus. POPULATION, BOUNDED BY IDENTITY, PRODUCER NAMED: the rows of diagnostic class TextRepresentationUnidentifiedAtBoundary emitted by `gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc --measured-root-demands tools/whole_corpus_compile_measured_root_demands.json` (dag closure) and by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag --target rust` (self-host closure), each row carrying its file:line:col and position. The identity each row reports as unread is v1's ONE type-reference derivation, `v1.compiler.infer_env` `type_reference_declaration_reading` (its `TypeReferenceUnidentified` arm), the same read `v1.tests.claim.carrier_realization_census` records per authored reference position; the census is NOT this population's producer, because it enumerates authored type-reference positions inside declarations, while this population is checker comparisons at use sites whose value side is usually an inferred type with no authored position. RESTORATION TRIGGER, the capability verbatim: the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures. STAGED REPLACEMENT: node://adhoc-207dd6ac-6d2 (resolver: declaration identity on every type reference), coordinating with #12540 and deep-bee-18's declaration-reference work. That item is the staged work, not the trigger; the trigger is the capability above. A SECOND GAP NAMED BESIDE C: a user `type Char` record list passed to a host-text builtin (string_length) is admitted on base and head. With identity the list is correctly not text, and the admission is the builtin registry typing its arguments by nothing. The capability that closes it is builtin arguments judged against their declared BuiltinParam types in general, not only for text.
 
+MEASURED SPECIMENS, 2026-10-03, FIVE ROWS, EACH A REPRESENTATION-LOCAL SIMPLIFICATION. Producer: the emitted-Rust path -- `gunbc compile --source-root dag --source-root src/v2 --entry dag/extdeps/realization/materialization_store_local.dag --target rust` followed by cargo build of the emitted crate -- measured at 6b1161c948, a tree that did NOT yet contain the CLIMB above (gunbc#12512). Rows one to four: std.effect_grant namespace_tree_of_label called v2.std.algebra length (parameter FreeMonoid<T>) on label twice and on service_tree_label_prefix twice, both kernel Strings. Row five: v2.compiler.self_host.generation roster_scan_step called v2.std.text string_is_empty on member.identity, a kernel-String value passed to a parameter declared over v2.std.text String -- the IDENTIFIED foreign-formal shape (control: u_kernel_value_at_foreign_bare_structural_parameter_unfolds), not the unidentified population. DISPOSITION, the same for all five: each site was rewritten to operate on the representation it already held (string_length for rows one to four, equality with the empty literal for row five), which removes a crossing the computation never needed; nothing converts at emission and no leaf name is coerced. THE RULE THESE ROWS SIT UNDER, after the CLIMB: an identified host-text value passed as a call argument to a code-point-sequence parameter unfolds through the declared row (UnicodeScalarSequenceUnfold), and every other identified crossing without that route refuses, located -- so a NEW identified site of this shape now unfolds or refuses at source acceptance; it is not admitted as these five were at 6b1161c948. These rows are behavioral controls for that rule and neither narrow nor retire this drop's two remaining populations (callable-signature crossings and the unidentified population); the drop stays Standing.
+
 ### Fabric CI evidence lane as a required merge block, and then as a lane at all — declared 2026-08-31
 
 **CORRECTED 2026-09-28: THE CALIBRATION SCRIPT WAS DELETED AND THEN RESTORED, AND THE LANE WAS NOT.** The amendment below said the 2026-09-04 ruling deleted `tools/fabric_ci_evidence_calibration.sh`. #10390 did delete it on 2026-09-04. #10270 (FCI-1) re-added it on 2026-09-05, and it is live: `tools/fabric_ci_fci1_live_instrument.sh` runs it against the exact binary before any srv3 observation. The original sentence is QUOTED, not deleted, because the record of what was claimed is the point: 'together with fabric_ci_evidence_calibration_step, its two derived bounds, and tools/fabric_ci_evidence_calibration.sh'. WHAT THE CORRECTION CHANGES: only the script clause. The script now runs only when an operator invokes the FCI-1 live instrument by hand, on no CI trigger. WHAT IT DOES NOT CHANGE: the `fabric-evidence` job, the calibration step and the FABRIC_EVIDENCE binding are still absent from every emitted workflow. `w_RED_the_deleted_lanes_do_not_return` still guards that absence. A red from a hand-invoked run is still not a merge wall, so the temporary rung (outside the modeled guarantee for merges), the population and the restoration trigger all stand unchanged. The script is its own scaffold with its own dissolution condition in its header; this row does not govern it. **AMENDED 2026-09-04: THE LANE NO LONGER EXECUTES EITHER, AND THIS ROW NOW COVERS BOTH LOSSES.** The 2026-09-04 operator ruling on runner capacity deleted the `fabric-evidence` JOB, together with `fabric_ci_evidence_calibration_step`, its two derived bounds, and `tools/fabric_ci_evidence_calibration.sh`. The declaration below was written when only the merge block was withdrawn and the calibration still ran; read every present-tense claim in it about the lane EXECUTING in the past tense. WHAT CHANGES: the temporary rung falls from mitigatable to outside the modeled guarantee — there is no longer a red for a human to read, because there is no run. WHAT DOES NOT: the restoration trigger, which was already stated at capability grain and is unchanged, and the operational consequence, which now binds harder — the FABRIC-CI program (warm-seal-35) agreed to check `fabric-evidence` explicitly on every head rather than inferring it from `witnesses`, and there is now nothing to check, so any conclusion resting on that lane rests on nothing. THE ROW IS AMENDED RATHER THAN SUPERSEDED because the subject is the same lane and the same trigger retires both losses; a second row would have split one subject across two authorities. The countability moved: `w_RED_fabric_evidence_executes_without_gating` asserted the lane still ran and is replaced by `test.claim.deleted_lanes_countable_witness_test` `w_RED_the_deleted_lanes_do_not_return`, which reds if the job, the FABRIC_EVIDENCE binding or the calibration argv returns while this row stands. The original declaration follows. **THE FABRIC-CI EVIDENCE LANE STOPS BLOCKING MERGES AND KEEPS EXECUTING (2026-08-31).** #9704 added `fabric-evidence` as a fourth job and, in the same change, made it a `needs` of the aggregating `witnesses` job that the `passing CI` ruleset names as this repository's one required context. PREVIOUS RUNG: mechanically preventable — a defect in the FCI-EVIDENCE-0 run-boundary contract was exposed by an enrolled calibration and blocked the merge. TEMPORARY RUNG: mitigatable — the same calibration still runs on every push and pull request, still refuses loudly, and its log is still the record; what is gone is the block, so a red is now a signal a human must read rather than a wall. REASON, and it is wall clock rather than doubt about the evidence: the required context's wall is the MAX over its three lanes, and on run 33350499023 that max was `fabric-evidence` at 27 minutes against 20 for the floor lane and 10.5 for the build lane, having moved the required wall from ~13 minutes to ~28-40 within a day of #9704 landing. 1469 of those 1620 seconds are the calibration step, and its own logs put all ~18 of the plan's `gunbc run` host processes at 80-90 seconds each. That cost is not the evidence: the instrument's import closure is six modules, and per `cli_run.entry_resolve` an `--entry` run is scoped in what it EMITS but WHOLE-TREE in what it PARSES, so each process re-parses and re-censuses the entire 4414-module corpus to evaluate a handful of rows. The lane is paying eighteen whole-corpus censuses (DESIGN §2 duplicated work) for thirteen assertions. Batching them is NOT the repair and is not what this row defers: the calibration-timeout derivation recorded that distinct host processes ARE the process-edge subject (that row was deleted with the lane on 2026-09-04; its reasoning is preserved in this sentence), so fewer processes would remove the boundary rather than observe it more cheaply. BOUNDED POPULATION: exactly one job, `fabric-evidence`, and exactly one lost edge — its `needs.fabric-evidence.result` binding into the aggregate's closed-vocabulary verdict fold. No other lane, phase, witness or claim changes rung; the build and floor lanes keep every edge they had, and the calibration keeps every assertion it had. The drop is countable from the emitted workflow: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_fabric_evidence_executes_without_gating` reds if the job stops executing, and reds again if either gating spelling returns while this row still stands. ONE OPERATIONAL CONSEQUENCE, recorded here because it is the kind of practice that quietly stops once the person who agreed to it moves on. With the needs edge withdrawn, a `fabric-evidence` failure no longer reaches the aggregate verdict, so any lane that was reading the required context as a proxy for that lane's health is now reading a context that cannot see it. The FABRIC-CI program (warm-seal-35) accepted the drop on that basis and will check `fabric-evidence` EXPLICITLY on every head rather than inferring it from `witnesses`. Anyone else joining on the required context owes the same explicit check for as long as this row stands; that obligation ends when the trigger below is met and not before. RESTORATION TRIGGER: the CAPABILITY of a single fabric evidence process resolving its entry against the source roots at a cost that fits the required wall budget — concretely, the whole-tree parse and name census being paid once per tree state rather than once per host process, so that the 13-row plan executes its full process-edge roster inside the lane's share of a ~10-minute required wall. THIS IS NOT RETIRED BY THE MEMO PR MERGING. It is retired by a measured `fabric-evidence` job wall that leaves the required context at or under its budget with the needs edge and the FABRIC_EVIDENCE binding restored, which is the only thing that makes the block affordable again. Reducing the plan's process count, relaxing what a row asserts, or moving the calibration to a cadence does not satisfy this trigger — the first removes the subject, and the other two are different drops that would need their own rows.
diff --git a/src/v1/05_emit_rust.dag b/src/v1/05_emit_rust.dag
index 1ea1ac37481..52cb88057ff 100644
--- a/src/v1/05_emit_rust.dag
+++ b/src/v1/05_emit_rust.dag
@@ -161,6 +161,7 @@ import v1.compiler.dag_collect_support { connective_name }
 import v1.compiler.trait_derive_emit {
   v1_emit_enum_derives,
   v1_emit_struct_from_capability_table, v1_emit_enum_supplemental_impls,
+  v1_fn_signature_set_element_param_names, v1_set_element_bound_spellings,
   v1_generic_params_needing_clone_bound,
   v1_emit_type_params_with_clone_bounds, v1_emit_type_params_with_bounds,
   v1_clone_bounded_type_params, v1_item_clone_bounded_param_names, v1_item_clone_undecided_head,
@@ -8551,6 +8552,7 @@ fn v1_fn_bounds_by_param(
   clone_param_names: List<String>,
   eq_param_names: List<String>,
   map_key_param_names: List<String>,
+  set_element_param_names: List<String>,
   static_param_names: List<String>
 ) -> Map<String, List<String>> {
   let with_clone = clone_param_names |> fold(init: empty_map(), f: (m, n) => map_insert(m, n, ["Clone"]))
@@ -8566,7 +8568,13 @@ fn v1_fn_bounds_by_param(
       Absent => map_insert(m, n, rust_map_key_bound_traits())
     }
   )
-  static_param_names |> fold(init: with_key, f: (m, n) =>
+  let with_set = set_element_param_names |> fold(init: with_key, f: (m, n) =>
+    match map_get(m, n) {
+      Present { value: traits } => map_insert(m, n, unique_strings(items: concat(traits, v1_set_element_bound_spellings())))
+      Absent => map_insert(m, n, v1_set_element_bound_spellings())
+    }
+  )
+  static_param_names |> fold(init: with_set, f: (m, n) =>
     match map_get(m, n) {
       Present { value: traits } => map_insert(m, n, concat(traits, ["'static"]))
       Absent => map_insert(m, n, ["'static"])
@@ -9214,6 +9222,12 @@ fn emit_fn_def(name: String, params: List<Node>, inferred: Node, body: Node, reg
     generic_param_names: generic_param_names,
     source_indices: si
   )
+  let set_element_param_names = v1_fn_signature_set_element_param_names(
+    signature_type_exprs: list_push(value_params |> map(p => param_node_type_expr(n: p)), inferred),
+    generic_param_names: generic_param_names,
+    type_decl_items: emit_info.type_decl_items,
+    source_indices: si
+  )
   let returns_fn_field_record = type_has_fn_fields(name: rust_fn_sig_leaf_name(source_indices: si, n: inferred), emit_info: emit_info)
   let returns_arrow_or_fn_field_record = (inferred.params |> count) > 0 || returns_fn_field_record
   let call_forwarded_static_param_names = v1_call_forwarding_static_bound_param_names(
@@ -9233,9 +9247,10 @@ fn emit_fn_def(name: String, params: List<Node>, inferred: Node, body: Node, reg
     clone_param_names: clone_param_names,
     eq_param_names: eq_param_names,
     map_key_param_names: map_key_param_names,
+    set_element_param_names: set_element_param_names,
     static_param_names: static_param_names
   )
-  let needs_bound = (clone_param_names |> count) > 0 || (eq_param_names |> count) > 0 || (map_key_param_names |> count) > 0 || (static_param_names |> count) > 0
+  let needs_bound = (clone_param_names |> count) > 0 || (eq_param_names |> count) > 0 || (map_key_param_names |> count) > 0 || (set_element_param_names |> count) > 0 || (static_param_names |> count) > 0
   let type_params_str = if needs_bound {
     v1_emit_type_params_with_bounds(params: type_params, bounds_by_param: bounds_by_param, source_indices: si)
   } else {
@@ -11901,6 +11916,26 @@ fn rust_param_type_is_type_variable(param_type: Node, source_indices: Map<String
   }
 }
 
+// A FUNCTION VALUE IS NEVER ITSELF AN EMPTY OPTIONAL. A typed LAMBDA node carries its BODY's type
+// as its own inferred type (v1.compiler.infer_types, the ExprLambda arm: `inferred:
+// body_typed.inferred`), so a lambda returning `String?` read here as "an optional argument", and
+// against a parameter declared `fn(X) -> T` -- an arrow, neither `?` nor a bare type variable,
+// hence "required" -- the guard appended `.expect(..)` to the lambda. Rust parses that suffix into
+// the closure BODY, so the closure then returned the unwrapped payload:
+// `store_object_line_fold(.., malformed: t => Present { value: t })` instantiated at T = String?
+// emitted `|t| Some(t.clone()).expect(..)`, a closure returning String where the instantiation
+// demands Option<String> (E0308, two sites in std.materialization_object), and at runtime it would
+// have panicked on every `none` arm the fold exists to return. The argument's SHAPE is the fact
+// asked: a lambda expression, or a value whose type is an arrow, is a callable and is passed as
+// written. Whether a callable's return type inhabits the parameter's declared return is the
+// inhabitance judgment's question at inference, never an unwrap decided here.
+fn rust_call_arg_is_function_value(arg: Node) -> Bool {
+  match arg.expr_data {
+    ExprLambda => true
+    _ => resolved_type(n: arg).connective == Arrow
+  }
+}
+
 fn rust_call_arg_fail_closed_unwrap(arg_str: String, arg: Node, callee: ItemInfo?, idx: Int, func: String, source_indices: Map<String, NewlineIndex>) -> String {
   match callee {
     Present { value: info } =>
@@ -11908,7 +11943,7 @@ fn rust_call_arg_fail_closed_unwrap(arg_str: String, arg: Node, callee: ItemInfo
         Present { value: param } =>
           let param_type = param_node_type_expr(n: param)
           let param_required = param_type.return_cardinality != CardOptional && !is_host_optional_carrier_type(n: param_type, source_indices: source_indices) && !rust_param_type_is_type_variable(param_type: param_type, source_indices: source_indices)
-          let arg_optional = resolved_type(n: arg).return_cardinality == CardOptional
+          let arg_optional = resolved_type(n: arg).return_cardinality == CardOptional && !rust_call_arg_is_function_value(arg: arg)
           if param_required && arg_optional {
             concat(arg_str, ".expect(\"fail-closed: an optional value flowed into non-optional parameter ", to_string(value: idx), " of ", func, " (empty Optional at runtime)\")")
           } else {
diff --git a/src/v1/stage0/src/target_invocation_host.rs b/src/v1/stage0/src/target_invocation_host.rs
index 995c01a60e1..3e7addfff73 100644
--- a/src/v1/stage0/src/target_invocation_host.rs
+++ b/src/v1/stage0/src/target_invocation_host.rs
@@ -380,6 +380,12 @@ fn instrument_registry() -> Vec<(Label, TargetProducer)> {
                 entry: "dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag",
             },
         ),
+        (
+            instrument_label("native-materialization-store-closure"),
+            TargetProducer::NativeClaimProgram {
+                entry: "dag/gunbc/instruments/native_materialization_store_closure.dag",
+            },
+        ),
         (
             instrument_label("native-emission-controls"),
             TargetProducer::NativeClaimProgram {
diff --git a/src/v1/stage0/src/v1_compiler_emit_rust.rs b/src/v1/stage0/src/v1_compiler_emit_rust.rs
index 8c556a25a7c..60541e60230 100644
--- a/src/v1/stage0/src/v1_compiler_emit_rust.rs
+++ b/src/v1/stage0/src/v1_compiler_emit_rust.rs
@@ -275,10 +275,12 @@ pub use crate::v1_compiler_trait_derive_emit::{
     trait_derive_emit_fn_clone_bound_keyed_carrier_module, v1_clone_bounded_type_params,
     v1_clone_impl_required_type_params, v1_emit_enum_derives, v1_emit_enum_supplemental_impls,
     v1_emit_struct_from_capability_table, v1_emit_type_params_with_bounds,
-    v1_emit_type_params_with_clone_bounds, v1_generic_params_needing_clone_bound,
-    v1_item_clone_bounded_param_names, v1_item_clone_undecided_head, v1_item_field_type_exprs,
+    v1_emit_type_params_with_clone_bounds, v1_fn_signature_set_element_param_names,
+    v1_generic_params_needing_clone_bound, v1_item_clone_bounded_param_names,
+    v1_item_clone_undecided_head, v1_item_field_type_exprs,
     v1_item_wf_propagated_clone_bounded_param_names, v1_map_key_head_names_in_type_expr,
-    v1_map_key_required_type_names, v1_trait_derive_refuse, v1_with_map_key_requirement,
+    v1_map_key_required_type_names, v1_set_element_bound_spellings, v1_trait_derive_refuse,
+    v1_with_map_key_requirement,
 };
 use crate::v1_rt;
 use crate::v1_rt::{VecCompat, VecJoin};
@@ -18396,6 +18398,7 @@ pub fn v1_fn_bounds_by_param(
     clone_param_names: Rc<Vec<String>>,
     eq_param_names: Rc<Vec<String>>,
     map_key_param_names: Rc<Vec<String>>,
+    set_element_param_names: Rc<Vec<String>>,
     static_param_names: Rc<Vec<String>>,
 ) -> Rc<HashMap<String, Rc<Vec<String>>>> {
     {
@@ -18435,9 +18438,28 @@ pub fn v1_fn_bounds_by_param(
                 }
             },
         );
-        static_param_names.iter().cloned().fold(
+        let with_set = set_element_param_names.iter().cloned().fold(
             with_key.clone(),
             |m: Rc<HashMap<String, Rc<Vec<String>>>>, n: String| match v1_rt::map_get(&m, n.clone())
+            {
+                Some(traits) => v1_rt::rc_map_insert(
+                    m.clone(),
+                    n.clone(),
+                    crate::v1_compiler_emit_core_support::unique_strings(v1_rt::concat(
+                        traits.clone(),
+                        crate::v1_compiler_trait_derive_emit::v1_set_element_bound_spellings(),
+                    )),
+                ),
+                std::option::Option::None => v1_rt::rc_map_insert(
+                    m.clone(),
+                    n.clone(),
+                    crate::v1_compiler_trait_derive_emit::v1_set_element_bound_spellings(),
+                ),
+            },
+        );
+        static_param_names.iter().cloned().fold(
+            with_set.clone(),
+            |m: Rc<HashMap<String, Rc<Vec<String>>>>, n: String| match v1_rt::map_get(&m, n.clone())
             {
                 Some(traits) => v1_rt::rc_map_insert(
                     m.clone(),
@@ -19103,6 +19125,22 @@ pub fn emit_fn_def(
             generic_param_names.clone(),
             si.clone(),
         );
+        let set_element_param_names =
+            crate::v1_compiler_trait_derive_emit::v1_fn_signature_set_element_param_names(
+                v1_rt::rc_list_push(
+                    Rc::new({
+                        let mut __result = Vec::new();
+                        for p in value_params.iter().cloned() {
+                            __result.push(crate::v1_std_core::param_node_type_expr(p.clone()));
+                        }
+                        __result
+                    }),
+                    inferred.clone(),
+                ),
+                generic_param_names.clone(),
+                emit_info.type_decl_items.clone(),
+                si.clone(),
+            );
         let returns_fn_field_record = type_has_fn_fields(
             rust_fn_sig_leaf_name(si.clone(), inferred.clone()),
             emit_info.clone(),
@@ -19126,11 +19164,13 @@ pub fn emit_fn_def(
             clone_param_names.clone(),
             eq_param_names.clone(),
             map_key_param_names.clone(),
+            set_element_param_names.clone(),
             static_param_names.clone(),
         );
-        let needs_bound = (((((clone_param_names.clone().len() as i64) > 0)
+        let needs_bound = ((((((clone_param_names.clone().len() as i64) > 0)
             || ((eq_param_names.clone().len() as i64) > 0))
             || ((map_key_param_names.clone().len() as i64) > 0))
+            || ((set_element_param_names.clone().len() as i64) > 0))
             || ((static_param_names.clone().len() as i64) > 0));
         let type_params_str = if needs_bound.clone() {
             crate::v1_compiler_trait_derive_emit::v1_emit_type_params_with_bounds(
@@ -25347,6 +25387,18 @@ pub fn rust_param_type_is_type_variable(
     }
 }
 
+pub fn rust_call_arg_is_function_value(arg: Rc<Node>) -> bool {
+    match (*arg.expr_data.clone()).clone() {
+        ExprData::ExprLambda => true,
+        _ => {
+            (crate::v1_compiler_infer_types::resolved_type(arg.clone())
+                .connective
+                .clone()
+                == Connective::Arrow)
+        }
+    }
+}
+
 pub fn rust_call_arg_fail_closed_unwrap(
     arg_str: String,
     arg: Rc<Node>,
@@ -25371,10 +25423,11 @@ pub fn rust_call_arg_fail_closed_unwrap(
                         param_type.clone(),
                         source_indices.clone(),
                     ));
-                let arg_optional = (crate::v1_compiler_infer_types::resolved_type(arg.clone())
+                let arg_optional = ((crate::v1_compiler_infer_types::resolved_type(arg.clone())
                     .return_cardinality
                     .clone()
-                    == Cardinality::CardOptional);
+                    == Cardinality::CardOptional)
+                    && !rust_call_arg_is_function_value(arg.clone()));
                 if (param_required.clone() && arg_optional.clone()) {
                     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(arg_str.clone(), ".expect(\"fail-closed: an optional value flowed into non-optional parameter ".to_string()), crate::v1_compiler_emit_core_support::to_string(idx.clone())), " of ".to_string()), func.clone()), " (empty Optional at runtime)\")".to_string())
                 } else {
diff --git a/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs b/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
index 3ed09d08298..281355a6dae 100644
--- a/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
+++ b/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
@@ -2080,6 +2080,71 @@ pub fn v1_item_ord_propagated_param_names(
     })
 }
 
+pub fn v1_set_element_bound_spellings() -> Rc<Vec<String>> {
+    crate::v1_compiler_emit_core_support::unique_strings(Rc::new({
+        let mut __result = Vec::new();
+        for row in rust_btree_set_supplemental_generic_bound_rows()
+            .iter()
+            .cloned()
+        {
+            __result.push(
+                crate::extdeps_languages_rust_emit::rust_trait_derive_spelling(
+                    row.required.clone(),
+                ),
+            );
+        }
+        __result
+    }))
+}
+
+pub fn v1_fn_signature_set_element_param_names(
+    signature_type_exprs: Rc<Vec<Rc<Node>>>,
+    generic_param_names: Rc<Vec<String>>,
+    type_decl_items: Rc<HashMap<String, Rc<Node>>>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<Vec<String>> {
+    {
+        let direct = v1_set_element_params(
+            generic_param_names.clone(),
+            signature_type_exprs.clone(),
+            source_indices.clone(),
+        );
+        let propagated = v1_item_ord_propagated_param_names(
+            generic_param_names.clone(),
+            signature_type_exprs.clone(),
+            type_decl_items.clone(),
+            source_indices.clone(),
+        );
+        Rc::new({
+            let mut __result = Vec::new();
+            for g in generic_param_names.iter().cloned() {
+                if ({
+                    let mut __found = false;
+                    for d in direct.iter().cloned() {
+                        if (d.clone() == g.clone()) {
+                            __found = true;
+                            break;
+                        }
+                    }
+                    __found
+                } || {
+                    let mut __found = false;
+                    for d in propagated.iter().cloned() {
+                        if (d.clone() == g.clone()) {
+                            __found = true;
+                            break;
+                        }
+                    }
+                    __found
+                }) {
+                    __result.push(g);
+                }
+            }
+            __result
+        })
+    }
+}
+
 pub fn v1_set_struct_debug_impl(
     name: String,
     generic_param_names: Rc<Vec<String>>,
diff --git a/src/v1/trait_derive_emit.dag b/src/v1/trait_derive_emit.dag
index d892ffde1ac..ff5a52617f6 100644
--- a/src/v1/trait_derive_emit.dag
+++ b/src/v1/trait_derive_emit.dag
@@ -1016,6 +1016,31 @@ fn v1_item_ord_propagated_param_names(
   )
 }
 
+// A FN GENERIC IN ELEMENT POSITION OF A SET CARRIES THE SET ROWS' REQUIREMENTS, read from the
+// SIGNATURE exactly as the keyed-map rule reads a key generic (v1_fn_signature_map_key_param_names
+// in v1.compiler.emit_rust): Set<P> realizes as im::OrdSet<P>, whose every bridge
+// (v1_rt::rc_set_union, rc_set_insert) and whose own PartialEq are conditional on `P: Ord`, so a
+// fn over the element that emitted only `P: Clone` refused at each of them -- E0277 `P: Ord` and
+// E0369 on `==` at std.authorization_profile audience_subset / audience_join. Both reaches the
+// item path already recognises are asked, and nothing wider: a parameter or return type that IS
+// Set<P> (v1_set_element_params), and one that names a declared type whose slot is Set-affected
+// (v1_item_ord_propagated_param_names, the one hop AudienceSet<P> takes). The traits are the rows'
+// own (rust_btree_set_supplemental_generic_bound_rows), never a literal list here.
+fn v1_set_element_bound_spellings() -> List<String> {
+  unique_strings(items: rust_btree_set_supplemental_generic_bound_rows |> map(row => rust_trait_derive_spelling(row.required)))
+}
+
+fn v1_fn_signature_set_element_param_names(
+  signature_type_exprs: List<Node>,
+  generic_param_names: List<String>,
+  type_decl_items: Map<String, Node>,
+  source_indices: Map<String, NewlineIndex>
+) -> List<String> {
+  let direct = v1_set_element_params(generic_param_names: generic_param_names, field_type_exprs: signature_type_exprs, source_indices: source_indices)
+  let propagated = v1_item_ord_propagated_param_names(generic_param_names: generic_param_names, field_type_exprs: signature_type_exprs, type_decl_items: type_decl_items, source_indices: source_indices)
+  generic_param_names |> filter(g => direct |> any(d => d == g) || propagated |> any(d => d == g))
+}
+
 fn v1_set_struct_debug_impl(
   name: String,
   generic_param_names: List<String>,
diff --git a/src/v2/compiler/self_host/generation.dag b/src/v2/compiler/self_host/generation.dag
index ce15f7a50e4..d2da84bb125 100644
--- a/src/v2/compiler/self_host/generation.dag
+++ b/src/v2/compiler/self_host/generation.dag
@@ -11,7 +11,7 @@ import v2.std.diagnostic {
   invariant_port_locus
 }
 import v2.std.node { combine_hash, Hash, Symbol, symbol_identity_digest }
-import v2.std.text { String, string_is_empty }
+import v2.std.text { String }
 import std.content_hash { Sha512Digest, content_hash_eq_sha512 }
 
 // Generation identity is INDEPENDENT AXES, never one scalar. A single opaque
@@ -241,7 +241,7 @@ type RosterScanAcc {
 fn roster_scan_step(acc: RosterScanAcc, member: SourceClosureMember) -> RosterScanAcc {
   match acc.verdict {
     RosterCanonicallyOrdered =>
-      if string_is_empty(s: member.identity) {
+      if member.identity == "" {
         RosterScanAcc {
           verdict: RosterMemberIdentityEmpty,
           previous: member.identity,